October 2010 - Darwin-dev - lists.apple.com

ASL: log as a circular buffer
by Joel Reymont 13 Oct '10

13 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:content-type :content-transfer-encoding:subject:date:message-id:to:mime-version :x-mailer; bh=RRHvwj5ETiJHEfMjz0eBuJvWTwR+8A/9pOThIvXYveM=; b=VwFT+8uYLh1KS5OG+Z38OD1itghdruKh3Y75zENAoJ9efvz+vC5QIucwB0jn2l+wYP bT8vFuTLMX3WuWOuvZMGn0LzxmYXkjWb/do0LqF9N0dOhM0T9sSh2satKxru8KxWvarc PlajU+HXh0+4K+edtSfvEo4Xi9orDpBbA851I= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:content-type:content-transfer-encoding:subject:date:message-id :to:mime-version:x-mailer; b=BvIVlAlPMUECfVWn1ArvgacWGKcobU1HB4jYDy7ioAuv+p/urFXYU5jtmHHX7A8mET iOusYePuS6EgaV2F3+fPDZFMzXnqV3wAxMfrNmFawcuQ2B1TZ4cEtMyWXZe712VwoucL cTprgH9etjZuv2BsitopWssORIk3A9oOE81Ss= Any suggestions then on how to read just the last N-thousand entries to avoid the log from growing indefinitely and filling up the disk? I add another descriptor now and redirect to a file but I have no way of controlling the growth of that. This is intended for a production facility that runs non-stop. The user-space USB driver fails sometimes and I need to see why. I used to just print to stdout but using the console app only gives me the last 4K messages from all sorts of applications. I'd rather have the last 100K messages from mine, for example, or have the log be a circular buffer of 1-2gb. Thanks, Joel --- http://twitter.com/wagerlabs _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

asl: unsetting keys not working
by Joel Reymont 13 Oct '10

13 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:content-type :content-transfer-encoding:subject:date:message-id:to:mime-version :x-mailer; bh=57d8j7S6V0Tg2iB3Voie3hQJRAWooAyVXBh7pcHcJd4=; b=ilJ51pvgQqGjH1X+GPnpFngQKLqO5En59FX3lqCbUZXVxga3fRgKRVjwAz1XEqQUBJ /M/MrZHRRXe/EjsWVTxhpd1fShr2CLfy6xhk/5YWwL4eZe2V57oNdhXN6ZJDZfBxrUGV DtRrLWgtAx79NYNA9GdsK8fyKVHnt8yBZVZHY= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:content-type:content-transfer-encoding:subject:date:message-id :to:mime-version:x-mailer; b=IFswB1tHWbEWEhAtkqILeJSh86OEoytAoa+ACIC6RZqHGeBHF9HCQkn+K1SuS2WsBe or6KZOun85q0UxydZN0pRcUWYtvf7ouZaIr0vGnWXHm2gY/sZZPooNCkVBbN7aJYpvAg HX0dfeGgtF88Q8cErIc3WNF0t6EyEh7KxE20c= Folks, I'm testing a simple program that uses ASL. I would like to -not- print the host name, program name and level of the message. I thought I'm doing everything by the book but the keys I'm unsetting are still being printed. I want to see this Thu Oct 14 00:08:37 [12688]: Boom! but instead get without log_client: Thu Oct 14 00:08:37 biggie a.out[12688] <Debug>: Boom! and with log_client: Thu Oct 14 00:07:37 biggie foo[12672] <Debug>: Boom! What am I doing wrong? Thanks, Joel --- #include <unistd.h> #include <string.h> #include <asl.h> int main(int argc, char* argv[]) { char logtemp[32]; strcpy(logtemp, "/tmp/foo-XXXXXX.log"); // aslclient log_client = asl_open("foo", NULL, ASL_OPT_NO_DELAY); int fd = mkstemps(logtemp, 4); asl_add_log_file(NULL, fd); aslmsg log_msg = asl_new(ASL_TYPE_MSG); asl_unset(log_msg, ASL_KEY_HOST); asl_unset(log_msg, ASL_KEY_LEVEL); asl_unset(log_msg, ASL_KEY_SENDER); asl_unset(log_msg, ASL_KEY_FACILITY); asl_unset(log_msg, ASL_KEY_PID); asl_unset(log_msg, ASL_KEY_UID); asl_unset(log_msg, ASL_KEY_GID); asl_log(NULL, log_msg, ASL_LEVEL_DEBUG, "Boom!"); return 0; } --- http://twitter.com/wagerlabs _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Is it possible to load 64-bit EFI in Mac Pro
by David Elliott 13 Oct '10

13 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Kiran, On Oct 11, 2010, at 9:28 PM, kiran kumar wrote: > Hi All, > > We have a Mac Pro Dual Core Intel Xeon 2,66Ghz machine (Model Number: MacPro1,1) > This model cannot boot the 64-bit kernel and the hardware design only allowed use of a 32-bit kernel. > some Macs with 64-bit processors won’t be able to load the 64-bit kernel because they have a 32-bit EFI. > > Is it possible to load 64-bit EFI in my machine , if it's possible can any one explain it . http://support.apple.com/kb/HT3773 Does holding the 6 and 4 keys from the Apple chime until you see the spinner boot you in to 64-bit mode or does the bootloader simply ignore this? Or perhaps add arch=x86_64 to your NVRAM boot flags? Although according to Amit Singh, neither of those will work with EFI32: http://www.osxbook.com/blog/2009/08/31/is-your-machine-good-enough-for-snow… If that doesn't work I would suggest you contact Apple DTS to see if they have something official. A two-minute e-mail may (or may not) save you a few hours playing with alternative bootloaders. >From a technical perspective the only trick to booting K64 on EFI32 is to zero out the pointer in the system table to the runtime services table. K64 is coded to accept this as a hack to indicate that runtime services will not be available. The actual kernel and drivers are loaded exactly the same except the bootloader loads the x86-64 executable rather than the x86 executable from the fat binaries. As Andrew pointed out open source bootloaders are perfectly happy to do this and you can run them on a genuine Apple machine using the "Boot Camp" BIOS. If you do go that route you can actually make the graphics work with a little hack. You simply need to boot normally and dump the master device-properties key out of the IORegistry and feed that to the bootloader so it will feed it to the kernel. That will make graphics work correctly. Other than losing EFI runtime services (i.e. the ability to get and set firmware variables) and the gathering of device properties from EFI boot-time drivers there is really no huge difference in the end result. You are still booted to OS X and you'll still be using a genuine Apple computer. You are simply booting it in a very unsupported configuration. Anyway, you can find source (I don't do binaries) in my public SVN tree: https://tgwbd.org/svn/Darwin/boot/branches/public/ Scattered around there are a bunch of comments. With a little work you can actually manage all sorts of fun combinations like having GRUB boot it or having it boot GRUB or having it boot NTLDR or BOOTMGR (Microsoft) or having them boot it, and so on and so forth. If you don't mind making it your primary BIOS bootloader (i.e. it will load before Windows but you will be able to select Windows from it) then I would suggest using gpt0 in the MBR, boot1fat32 as the boot record of the EFI System Partition, and DRWNLDR as the bootloader. There are, however, many many more possibilities depending on how you wish to put things together and how much effort you want to put in. Finally, I don't default to x86_64 but I did implement the arch=x86_64 command-line flag so you have to type that in at the prompt or put it in your boot plist per Amit's article. Hope that helps get you started. -Dave _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Is it possible to load 64-bit EFI in Mac Pro
by Andrew Gallatin 12 Oct '10

12 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=simple/simple; d=cs.duke.edu; s=mail; t=1286887396; bh=EQYKp9W0raHejVofgOPa+Te3yNyGK4rUneZlgVy9gNI=; h=Message-ID:Date:From:MIME-Version:To:CC:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=hPry5BynmXcukO9acvt0p+9y5Gr8zVESUqNVLA05dHVkIuC0ZLwj0XMFcmxnjhugQ TYdozXmgygNWuY9UDRh6vf6vH2DDo5lNLo087kvoqqJqIRrolt/qLi0nNGiplAzdqj V/4LRzXW9LkOS7pEj2vQVjlibCysjQ9oL3pzlcKI= User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.9) Gecko/20100920 Thunderbird/3.1.4 Hi All, We have a Mac Pro Dual Core Intel Xeon 2,66Ghz machine (Model Number: MacPro1,1) This model cannot boot the 64-bit kernel and the hardware design only allowed use of a 32-bit kernel. It has nothing to do with hardware design. Those machines run 64-bit kernels just fine. It is just due to Apple deciding it wasn't worth the effort to backport 64-bit EFI support to a machine they no longer sell or support. some Macs with 64-bit processors won’t be able to load the 64-bit kernel because they have a 32-bit EFI. Is it possible to load 64-bit EFI in my machine , if it's possible can any one explain it . Yes, but not in any Apple supported way. What I did to test my PCIe driver on a 64-bit kernel was to use the hackintosh "pc-efi-v10" bootloader. I use grub on a linux partition to launch the bootloader. Its all very Rube-Goldberg-ish, and it has all the disadvantages of a a "hackintosh" (no decent video support, etc). But for what I need (testing 64-bit driver) it works well enough. I did it quite a long time ago (when Snow Leopard was first released), so I'm fuzzy on all the details. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… On 10/12/10 00:28, kiran kumar wrote: This email sent to site_archiver(a)lists.apple.com

1 0

Is it possible to load 64-bit EFI in Mac Pro
by kiran kumar 12 Oct '10

12 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:date:message-id :subject:from:to:content-type; bh=j7Fl5WuvV+p+6RTdeWPmRJP3rN71Xc8Dg6Qscnmo/r8=; b=L8vD7gWPYZYgsN9Xgg0kP4o3RcADwCls/f+VuWMgAEGYgWEVvGlt/XQHRvAdYmjjOV KDT9dfnyM2A97e9GOmo7j2Jd3m0bvZEBj/Cp6jd4xJjtDk4832+tW0sVLn+zK2z6f7qe aVmDNLdyOoqdpauNKj7qdqsjq3WUPiiYq8RFo= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=o0pCZK21keceoSywe5SoxB2yUReMhE7DR+/2Kj0dEaf7zbIseYzejOkkBfIpc9d0kD 6Vp+vRTIbR7CpVuM1ED0NRs4ClqZzQxk7Sq4FonCHrpPJOFh+SZbMdpfYDtPaVBkI5fz 1p27ZysUn3hvVKEOA2d1uE5zeXrPn83wcyf8w= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Breakpoint Implementation
by Terry Lambert 08 Oct '10

08 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 8, 2010, at 12:22 AM, Ed Wynne wrote: > On Oct 8, 2010, at 2:42 AM, Terry Lambert wrote: > >> Ideally, you'd want an API, a defined ordering, and a means of sharing instrumentation points among an arbitrary number of observing programs. > > And what are the chances of anything like that ever coming from Apple? Ed: It depends on whether it's requested by a developer, or of it's just some kernel engineer at Apple who thinks it'd be a good idea, but can't convince a customer to file a bug report requesting it, and so can't justify to his/her management expending the engineering effort be placed toward the work, instead of some place else where there's an actual customer demand for something... ;^) -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Breakpoint Implementation
by Ed Wynne 08 Oct '10

08 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 8, 2010, at 2:42 AM, Terry Lambert wrote: > Ideally, you'd want an API, a defined ordering, and a means of sharing instrumentation points among an arbitrary number of observing programs. And what are the chances of anything like that ever coming from Apple? -Ed _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Breakpoint Implementation
by Terry Lambert 08 Oct '10

08 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com On Oct 7, 2010, at 10:26 PM, Derek Darwin Lists wrote: > thread_suspend() does not return until the target thread has been suspended, i.e. the target thread is in a state where it longer executes instructions in user space until it is resumed. See > http://web.mit.edu/darwin/src/modules/xnu/osfmk/man/thread_suspend.html The point is that the thread continues executing in kernel space until it reaches the system return code. If the system trap it was executing within was for the creation of another thread, the newly created thread will not be suspended by the thread_suspend() on the creating thread. In order for this race to be avoided, it's necessary to perform a task_suspend() rather than a thread suspend. This sets the task suspend count and the thread suspend count for the extant threads at the time of the suspend under the task_lock() and thread_lock(), and newly created threads will get an inherited suspend count from the task. This is why I specifically stated: >> Typically, this is done after a task_suspend(), which iterates over the threads in the task and sets suspend counts on all of them. Eventually they drain out of the scheduler run queues to an actually suspended state. [ ... ] >> This is somewhat problematic: >> >> (1) Security features will often prevent a page from being both writeable and executable, and may prevent a page from moving to executable if it has once been writable. The only exception to this would be operations in protected mode in the kernel to change these mappings (e.g. this is how dtrace emulates instructions when it replaces function preambles for FBT - Function Boundary Tracing). You can see this sort of thing in AntiVirus software or in copy protection, etc.. >> > > Given that the poster is referring to Apple intel systems, he can use mprotect() on the heap to confer execute protection and turn off read permission (to account for any future W^X enforcement; 10.6 Intel does not enforce W^X see below). dtrace and antivirus are not relevant. > void *range = mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANON|MAP_PRIVATE, 0, 0); > void (*funcptr) (void) = NULL; > perror("mmap"); > memset(range, 0xCC, 4096); > funcptr = range; > (funcptr)(); I wanted to be crystal clear, since this list is archived, and the information posted here could be used as a reference by someone who didn't want to read the source code, and couldn't obtain the information anywhere else. Not everyone will read back in the thread to obtain the context that this is a hobby project, or that this is Intel-specific and limited current Apple manufactured Intel systems. This is not a good assumption for Darwin in general. > (2) Your code signature for the modified page will no longer be valid. If it gets checked after you modify it, depending on your signing flags, your program may be immediately killed. > > The poster is proposing to generate code on the heap on an Apple Intel system (where there is no concept of "code signatures" for the heap), and repoint a thread's PC to the generated trampoline, not modify pages backed by code signatures on disk. Several companies on this list have implemented "code signing" KEXTs in the past, utilizing kauth callbacks as verification point, as part of security products. It's conceivable and reasonable that one might generate a code signature on the fly for any page that gets marked executable; for example, for use in a JIT, and that that signature would (and should) be checked if the page is paged out to swap and back in. One could also reasonably consider checking the pages either periodically at random, to eventually catch the case of modification while in core in the absence of swapping, and/or at the time the mapping privilege is explicitly changed, prior to allowing the VM system to mark the page executable in the first place. [ ... ] > dtrace will refuse to instrument locations already populated by INT3s, see fasttrap_tracepoint_init() and > http://blogs.sun.com/ahl/entry/dtrace_is_open > Presumably Dave Keck's debugger can also atomically check and decline to break on pre-existing INT3s, or break on the prior instruction and instruction single step etc. Careful... without a specific API being published by Apple for this sort of code modification operation, there's no guarantee here. The assumption that a multibyte instruction will always be replaced using the same technique and ordering of operations in the code, e.g. replacing a 2 byte instruction with NOP,INT3 rather than INT3,NOP, is not warranted. Without knowing that the location previously contained a multibyte instruction, and how many bytes were actually consumed by the instruction, the previous contents are not available to the instrumenting program to allow it to make correct assumptions in any case. You could also consider only replacing the first byte of the instruction rather than NOP'ing the remainder. If so, subsequent instrumentation by another program could fall within the same original instruction, unknowingly. Ideally, you'd want an API, a defined ordering, and a means of sharing instrumentation points among an arbitrary number of observing programs. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Breakpoint Implementation
by Derek Darwin Lists 08 Oct '10

08 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=/NhVaE86zZJzMQ7ymCRNEaWlFTYQT4I3qvVmGv8T0DY=; b=Zwcg3jppBe/k7htqb7se+GnvIjcqr8H6EK07DTR+NAtrss2zNy7QLSb16S4BqDkxm4 TiNmN40oqUVoiVTVphbad31MHrvBSyJ6bkzya60BarGx7d5aIkd56O/T0Sv8NzV4dbgs nE6PCQysFF/SnyPzudoe6UeqRh9YCxDQZXcCk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=E6Y9YwWcA9p45Gi+7n0Rw+A1lmYqJCzj9lg0HptvkXDdqCWK89FUTZ6FGfX567DFFs fATJ+nq//ahWkCd1trK6Tn1RJ9tWY9o3K2p8nDbWmQishSSxCeYgB9vEtdYwX5cd7Iid ofsOdR7VMdq4X7HWbtt1838TrORN19sBYjFUY= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Breakpoint Implementation
by Derek Darwin Lists 08 Oct '10

08 Oct '10

site_archiver(a)lists.apple.com Delivered-To: darwin-dev(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=opLh7E/aR3SyrHUadf4JMtjI3exTzIl17sK/mQdAwjI=; b=AJVN/DsEDXXDFOfDXkqdhHyFnuH6lyA12aRHfwdyHlRiFDTekb5GAHLzc3gZU8ao9B by2AQYd4/CI6viWO/lvJlvoD4ZQUclvVAwtQOjC9TEfprxidptP5KGTPwxFk5KtpvE93 tPAbShSqagZ+mVHTHfFpagjFb9Bac+gJrDO68= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=ZfB3vMceKGmhtCLZwBZPRJj8Ks6KGpKfhY0ckAeRgNlbbnPb5bntC8bqnZNu3gd37X NJnkGI7y/oz7H9ZoMwpU5lvEtKsnb/3Av8nXshfr+JSMbwg8arHgW+aTQDYu5MrCP79y IQd5psAASUHj+K9BNtueJtbVz4g2sLA6EknWc= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.app… This email sent to site_archiver(a)lists.apple.com

1 0