July 2007 - Darwin-dev - lists.apple.com

Re: Kernel Recursive mutexes 10.4.9 ++
by Erez Kaplan 19 Jul '07

19 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Recursive mutexes 10.4.9 ++
by Terry Lambert 19 Jul '07

19 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi, 10.4.9+ 10.5 How do I obtain a Kernel Recursive mutexe? The available api does not support this. lck_mtx_alloc_init(gmutex_grp_m, LCK_ATTR_NULL) some function(object) lock mutex atomic increment reference count unlock mutex ... long duration operation ... lock mutex atomic decrement reference count unlock mutex ... destroy(object) lock mutex again: /* Don't destroy the object while someone is using it */ if reference count msleep(mutex, object) goto again /* avoid race */ /* last reference gone, OK to kill it */ destroy object unlock mutex -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Jul 18, 2007, at 8:54 PM, Erez Kaplan wrote: On Jul 18, 2007, at 10:00 PM, Terry Lambert wrote: On Jul 18, 2007, at 2:37 AM, Erez Kaplan wrote: You don't; this is what reference and use counts are for. Can you explain a bit more or give reference to an example. For example, all thread reentrant FSs will take an I/O reference on a vnode, and use that reference to prevent the FS from being unmounted out from under an operation in progress, rather than holding a lock over the complete operation (thus unnecessarily serializing all other I/O to the vnode). Here is a simplified design pattern: /* wake up destroy routine; destroy routine may fail acquisition race */ if !reference count wakeup(object) This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Recursive mutexes 10.4.9 ++
by Erez Kaplan 19 Jul '07

19 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Panic while trying to access the datastructure parameter in ioctl call.
by Terry Lambert 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: Darwin-dev(a)lists.apple.com if (!ctl) { return -1; } - Pointers interior to the ioctl structure are your responsibility. So what could have gone wrong? if ((ctl->dptr) ) { Per the above, the most likely fix is to: (1) use allocated memory instead of a 2K stack buffer (2) check you length argument to ensure that it is > 0 and < 2k -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Jul 18, 2007, at 11:40 AM, JanakiRam wrote: The problem is the kernel panic is comming up when i try to access the data in kernel function. int ioctl_functionpointer(dev_t dev, u_long cmd, caddr_t arg,int fflag, struct proc *p) { IOCTL_Struct_t*ctl = (PF_Ctl_t*)arg; char data[2048]; if ((ctl->dptr) ) { int res = copyin((void *)ctl->dptr, (void *)data, ctl->bytes); if (res != 0) printf ("error in copyin"); } return 0; } If i comment the line copyin function call , then its working fine. Then the problem is one of you declaring the ioctl argument incorrectly, or alignment/packing, or your pointer is bogus, or your length is bogus, or that your copyin() call is happening in a process context different from the process context in which the original ioctl structure was supplied. The way ioctl works is by allocating memory at the BSD layer, and copying in the argument structure (if any; you must specify either _IOW or _IOWR for the copyin to take place) into that allocated region in kernel space, and then passing the address of that around. It knows the length of this structure by virtue of the declaration of the ioctl; there is a bit field breakdown of the ioctl's numberic namespace that is used for this, which is declared in <sys/ioccom.h>, which everyone who declares an ioctl themselves must use. When the call completes, if the call was successful (no error), AND _IOR or _IOWR was specified, then the contents of that structure are copied back out to user space, and the ioctl returns. (1) If you declared the ioctl argument incorrectly, then the copied in data could be short or incomplete. The fact that the: didn't panic on its own only means that the allocated memory area was either (a) large enough, or (b) that it was allocated adjacent to an already allocated region, so the pointer dereference didn't end up failing. You could still have failed to include 'W' in the _IO declaration, which means the data never made it in from user space, and the only thing in the buffer is stack garbage. (2) If you structure alignment or packing is different in kernel space than in user space (which it could be, because you didn't explicitly use a #pragma or __attribute__ to pack your structure), then the structure you are dereferencing may not have it's fields aligned with the structure that user space filled out. So the field you think you are getting may be overlaid with some other field(s) in the structure, and you are getting garbage. (3) If you fill out a bogus pointer in the structure in user space, then the area you are attempting to copy in may in fact be garbage or not in the user address space; this should not result in a panic, however, and what should happen is EFAULT (or in the case of copyinstr, perhaps ENAMETOOLONG, if there is no NULL termination. (4) The most likely cause is that your length is bogus; I notice that your buffer "data" (which should not be a stack buffer, it should be allocated!) is 2K in size, but you don't do anything to ensure that your count "bytes" is > 0 and less than 2K, so you could easily be overflowing the buffer. Another possibility is that, since 2K is a heck of a lot of data in kernel terms (1/8th of your entire available stack!!!), you could be trashing the kernel stack, resulting in the panic (this is less likely than simply having a bogus length and smashing your own stack, but it's a possibility). (5) Finally, if you are using a worker thread to do the work instead of doing it in the context of the process making the call (you should know whether or not you are using one - in fact, you should have told us this when you asked the question...), then it's trying to copy in from kernel_process, which is the wrong process to copy in from. Basically, all copies in or out MUST occur in the context of the process requesting the copy. I've tried to use the copyinstr instead of copyin , then also its showing panic screen. Please help me to solve this. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Symbol Clarification
by Terry Lambert 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi Duane, On Jul 18, 2007, at 8:43 AM, Duane Murphy wrote: Not sure what you mean by "interact", but I'll take a stab at answering the question I think you're asking. The kernel is one big monolithic namespace. All symbols in KEXTs must be unique across the system as they are linked into that one namespace. If a KEXT defines a symbol that already exists, the KEXT will not load. Are you really sure about this? I thought the relocations were done by kextload in userspace, and the only namespaces that are shared are those of your kext and what it depends on. If there is truely a master list of all loaded symbols and their locations, can it be accessed for debugging purposes rather than using kextload -s and add-symbol-file? No, your initial assumption is correct. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Jul 18, 2007, at 11:35 AM, Andrew Gallatin wrote: Garth Cummings writes: I wanted to make sure I understood how symbols interact in kext's. If I use a generally available library and another kext also uses that library, will those symbols interact with each other when the kext are loaded? That is it possible that my kext will accidentally link to the symbols in the other kext using a the same library? The problem Duane is attempting to address is best addressed by putting the library information into a KEXT, and then causing all the KEXTs that need the library to depend on the "library" KEXT. Everyone needs to stop thinking in terms of shared libraries when it comes to KEXTs; KEXTs are PIC (Position Independent Code) which are loaded into a specific (available) kernel virtual address space location by kextload. The symbolic information for KEXTs is available to the kernel in the KEXTcache symbol information on first load, but this is discarded from the kernel address space very early on after boot to save on wired memory, after which the kernel itself is no longer capable of loading KEXTs, and must rely on user space to do the work for it. That means it's also not available for debugging (we can't even keep a mapping for it, since if it came from the cache from a netboot, there is no vnode handle from which to page in the data, even if we were to free up the physical pages -- besides which, a mapping would also eat kernel virtual address space). For Duane and everyone else, I believe Amit covers everything anyone wanted to know about KEXT loading in his book... This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Recursive mutexes 10.4.9 ++
by Terry Lambert 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Hi, 10.4.9+ 10.5 How do I obtain a Kernel Recursive mutexe? The available api does not support this. lck_mtx_alloc_init(gmutex_grp_m, LCK_ATTR_NULL) You don't; this is what reference and use counts are for. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On Jul 18, 2007, at 2:37 AM, Erez Kaplan wrote: This email sent to site_archiver(a)lists.apple.com

1 0

Kernel Panic while trying to access the datastructure parameter in ioctl call.
by JanakiRam 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: Darwin-dev(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type; b=PypIIw7iNHOcNzrUskxRmErStP6NN5U8S+YhEX+FpS2s8xFBIVTa2YaGHItQXp4cd9+8fbsBU68UaR29hgM26Mwq/SxzO1D5utfHvMcT+G67lw/bm62fE2vFVYlNsyYsDIbq2u9zpKSC2KUx088N27zcM5d8GBXd62ok0RevwBU= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type; b=qNgYAMLaJZrWLI9q6ZPAuLEEGbFjOf11kSGGBGgZVa2RCoYo83Z/SkIdyzqVv36dVzlM4TrNazQz+gH6PqrzXYP41zyPCHKBgm7k2UKH0xLA2A4usbzrqpqSedHGj06UbKnuB6Veg3n/+9Z530t/ZXDqvT4nJ/mbJSj2+qRjKUc= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Symbol Clarification
by Andrew Gallatin 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Garth Cummings writes: > Hi Duane, > > On Jul 18, 2007, at 8:43 AM, Duane Murphy wrote: > > > I wanted to make sure I understood how symbols interact in kext's. > > If I > > use a generally available library and another kext also uses that > > library, will those symbols interact with each other when the kext are > > loaded? That is it possible that my kext will accidentally link to the > > symbols in the other kext using a the same library? > > Not sure what you mean by "interact", but I'll take a stab at > answering the question I think you're asking. > > The kernel is one big monolithic namespace. All symbols in KEXTs must > be unique across the system as they are linked into that one > namespace. If a KEXT defines a symbol that already exists, the KEXT > will not load. > Are you really sure about this? I thought the relocations were done by kextload in userspace, and the only namespaces that are shared are those of your kext and what it depends on. If there is truely a master list of all loaded symbols and their locations, can it be accessed for debugging purposes rather than using kextload -s and add-symbol-file? Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Symbol Clarification
by Duane Murphy 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com --- At Wed, 18 Jul 2007 10:23:15 -0700, Garth Cummings wrote: >Hi Duane, > >On Jul 18, 2007, at 8:43 AM, Duane Murphy wrote: > >I wanted to make sure I understood how symbols interact in kext's. If I >use a generally available library and another kext also uses that >library, will those symbols interact with each other when the kext are >loaded? That is it possible that my kext will accidentally link to the >symbols in the other kext using a the same library? > >Not sure what you mean by "interact", but I'll take a stab at answering >the question I think you're asking. > >The kernel is one big monolithic namespace. All symbols in KEXTs must be >unique across the system as they are linked into that one namespace. If >a KEXT defines a symbol that already exists, the KEXT will not load. > >That's why we strongly recommend using reverse-DNS naming for KEXT symbols. > >Is that what you meant? Thanks Garth, I think this is close. I'll explain in more detail where I am confused and maybe that will help for me to better understand. In my mind I am wondering about static linking, if that is the right word. If I create function called foo() and that function is used in my kext and created by my kext, and linked into my kext, that function foo is not need outside of my kext, why would that symbol collide with any other symbol foo? Aren't all references to foo within my kext already satisfied and the symbol foo is not really a public symbol at all? Is there a way to control which symbols in my kext are public and which are only within my kext and linked at link time rather than load time? I'm figuring the answer has to do with how mach-o shared libraries ('cause that's what kexts are) are linked. Thanks for your help, ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Symbol Clarification
by Garth Cummings 18 Jul '07

18 Jul '07

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0