April 2003 - Darwin-kernel - lists.apple.com

CPU scheduling
by Srinidhi Rao 03 Apr '03

03 Apr '03

HI all, Please pardon me if this query is offtopic here. I am working on a project which needs 100% CPU time when it is running. But Mac OS X being a pre-emptive multitasking OS, my processes will be allocated a CPU time slice after which it might be scheduled to a wait loop. (I hope I am right here) My question is how exactly Mac OS X (darwin) CPU scheduler functions? Can I find some documents on this? I tried looking into Mach CPU scheduling but little confused. Also, what is the timeslice allocated to a process in normal condition? Is there is any way to increase this timeslice (kind of burst mode)? One way I could think is to have a Real time thread in my application. But will this assure me continuous CPU time? Any pointers is greatly appreciated. TIA Srinidhi. -------------------------------------------------------------- Robosoft Technologies - Partners in Product Development _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Non-executable stack
by Robert Plantz 03 Apr '03

03 Apr '03

On Wednesday, April 2, 2003, at 07:10 PM, Justin Walker wrote: tisdagen den 1 april 2003 kl 05.54 skrev Jim Magee: Out of curiosity, I've always wondered why the ABI grows the stack downwards. It seems to be just as easy to grow it upwards, which would make buffer overflows much harder, if not impossible. Habit, mostly, I think. Most of this stuff grew up on PDP11's, and the PDP11 architecture gave downward growing stacks (among other things, interrupts and subroutine calls predecremented stack pointers; and the register specifiers in instructions made it easy to 'comply' with that mode of operation). With modernXXXmore recent architectures like PowerPC where a stack is more ABI than ISA, you can, as it were, go either way (:-}). Perhaps I'm being too simplistic, but if I wanted to make maximum use of memory, I would store my program code at one end and start my stack at the other, then let them grow toward each other. --Bob _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Non-executable stack
by Justin Walker 03 Apr '03

03 Apr '03

A brief reply: On Wednesday, Apr 2, 2003, at 06:32 US/Pacific, Pelle Johansson wrote: tisdagen den 1 april 2003 kl 05.54 skrev Jim Magee: Out of curiosity, I've always wondered why the ABI grows the stack downwards. It seems to be just as easy to grow it upwards, which would make buffer overflows much harder, if not impossible. Habit, mostly, I think. Most of this stuff grew up on PDP11's, and the PDP11 architecture gave downward growing stacks (among other things, interrupts and subroutine calls predecremented stack pointers; and the register specifiers in instructions made it easy to 'comply' with that mode of operation). With modernXXXmore recent architectures like PowerPC where a stack is more ABI than ISA, you can, as it were, go either way (:-}). Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | It's not whether you win or lose... | It's whether *I* win or lose. *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Disk idling and energy saving in darwin
by Joey Echeverria 02 Apr '03

02 Apr '03

This may not be quite the right list for this, but I was wondering if someone could tell me how to set a hard disk to idle after a timeout in darwin. I can do this in OS X easily using System Preferences, but I can't figure out how to do the same energy saving things in darwin. Ideally I would be able to set a specific timeout after which to turn of the disk, backlight, etc. Any help would be greatly appreciated. Thanks, Joey Echeverria Department of Electrical and Computer Engineering Carnegie Mellon University P.S. This is for a research project I'm working on at Carnegie Mellon _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Non-executable stack
by Ragnar Sundblad 02 Apr '03

02 Apr '03

--On den 31 mars 2003 22:54 -0500 Jim Magee <jmagee(a)apple.com> wrote: We can make suggestions for the next architecture. Yes, this is what I meant. Apple is a big buyer and user of PPCs, and what the OS designers think of the chip should of course be fed back to the chip designers. I hope this already is the case, but the page-exec thing maybe is an issue that hasn't been brought up but should be. But we'll never have any luck changing the one that's sitting on your desk. I fully understand that you won't come over here and carve in the silicon in my box. :-) But you could change the OS to it for an, in my eyes, pretty small penalty for the programs. Others may think different. Besides, all this is on the assumption that you have to execute code on the stack. More common (from a PowerPC hack perspective) is to just change link register values saved on the stack to trick the program into running code that already exists (the blr instruction is used to both call and return from a function). The only stuff that has to be on the stack is the argument data and the stomped address. Jumping to the well-known address for the system() library routine should do nicely. ;-) As you said you have to have the argument(s) in place, but sure, there are other ways to crack it without having to deal with putting new code in the machine. So, we should also have separate data and link stacks! :-) Non-exec memory and capabilities and jails and *trusted* things and all the others are of course not elegant or The Correct Way to fix problems with software with security holes, still I think their popularity are the sad consequence of a reality that we just have to face. You may be right that the cache syncing issues makes PPC less susceptible to code insertion problems. /ragge _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Non-executable stack
by Pelle Johansson 02 Apr '03

02 Apr '03

tisdagen den 1 april 2003 kl 05.54 skrev Jim Magee: Besides, all this is on the assumption that you have to execute code on the stack. More common (from a PowerPC hack perspective) is to just change link register values saved on the stack to trick the program into running code that already exists (the blr instruction is used to both call and return from a function). The only stuff that has to be on the stack is the argument data and the stomped address. Jumping to the well-known address for the system() library routine should do nicely. ;-) A very limited approach. You already need to have stdin and stdout as the right descriptors for example. Good enough for local exploits I suppose. In fact, arranging to execute code just written on the stack is fairly tricky on the PowerPC. You have to manually synchronize the icache to the dcache. Finding code to do that in an existing application (since you can't reliably execute even it from the stack until you run it) and then getting a branch back to your code is much less likely to be successful. I can only imagine that was one of the thoughts behind the processors lack of granular no-execute permissions. Most data pages "behave" that way often enough (because of the cache issues) to sway hackers into other means (like the one I described above which would not be helped by no-execute permissions on any data). I've found this to not be true in practise. At least if the stack is not already in the dcache (which is likely if you've been sleeping inside a read() or similar), the code will load just fine. If you are restricted to not having any null bytes in your code, it's a bit harder (the icache has to be flushed), but it can simply be solved by putting a sufficiently large loop in your code, forcing a context switch before the rest of the code is run. Out of curiosity, I've always wondered why the ABI grows the stack downwards. It seems to be just as easy to grow it upwards, which would make buffer overflows much harder, if not impossible. And for the record, no I'm not a hacker, I just have an interest in these things. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: mprotect with PROT_NONE throws SIGBUS, not SIGSEGV
by Andre Pang 02 Apr '03

02 Apr '03

On Wednesday, April 2, 2003, at 01:59 AM, Steven Bytnar wrote: On Tue, Apr 01, 2003 at 11:05:19PM +1000, Andre Pang wrote: I have feeling that the following diff to xnu-10 is a start to solving the problem, and may even be sufficient: --- ./bsd/uxkern/ux_exception.c.old Tue Apr 1 22:52:52 2003 +++ ./bsd/uxkern/ux_exception.c Tue Apr 1 22:53:39 2003 @@ -277,7 +277,8 @@ switch(exception) { case EXC_BAD_ACCESS: - if (code == KERN_INVALID_ADDRESS) + if (code == KERN_INVALID_ADDRESS || + code == KERN_PROTECTION_FAILURE) *ux_signal = SIGSEGV; else *ux_signal = SIGBUS; However, I can't actually test this because I'm running Mac OS X 10.2.4, and the 10.2.4 kernel (xnu-344.26) isn't up on the Apple CVS servers yet :(. You could always do a binary patch to your kernel! B) [... snip ...] This binary patch assumes that it's ok to return SIGSEGV for code == KERN_SUCCESS, when before, it would return SIGBUS. I tried doing a binary patch on the kernel (I just twiddled the word so that it now returns a SIGSEGV instead of a SIGBUS), and while that worked, it didn't really fix things because the SIGSEGV signal handler doesn't get the faulting address. Oh well! Thanks very much for the suggestion anyway, Steven. -- % Andre Pang : trust.in.love.to.save _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Which header file(s) define 'ether_header' and 'ether_header_t'
by Joshua Graessley 02 Apr '03

02 Apr '03

On Tuesday, Apr 1, 2003, at 16:04 US/Pacific, Justin Walker wrote: On Tuesday, Apr 1, 2003, at 11:52 US/Pacific, Joshua Graessley wrote: Michael isn't exactly imagining things. We removed a header between 10.1.x and 10.2. While merging in changes from the FreeBSD 4.4 stack to our own, we noticed a few extra files (NeXTisms). One of those NeXTisms was a header that contained nearly identical definitions to what was in net/ethernet.h. We simply eliminated the NeXTism in 10.2 in an attempt to clean up and simplify things a bit. Was this in the kernel tree? I have a few old trees, and don't see it in 'xnu/bsd' anywhere: ethernet.h and ip_compat.h are the only places it's defined, AFAICT. The old file I was thinking of is net/etherdefs.h. It didn't actually contain a definition of struct ether_header, but it did contain typedef struct ether_addr enet_addr_t and a few other odd things. <sigh> It looks like we didn't manage to eliminate it, so it seems to be unrelated to Michael's problems. -josh _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Which header file(s) define 'ether_header' and 'ether_header_t'
by Justin Walker 02 Apr '03

02 Apr '03

On Tuesday, Apr 1, 2003, at 11:52 US/Pacific, Joshua Graessley wrote: On Tuesday, Apr 1, 2003, at 11:22 US/Pacific, Justin Walker wrote: On Tuesday, Apr 1, 2003, at 10:23 US/Pacific, Michael Birdsong wrote: I have run into an issue in building an NKE after a few months of NOT compiling this particular project. In the latest version of Mac OS X (after 10.1.5) it seems the definitions for the structures: "ether_header" and "ether_header_t" have been moved from their old header file locations, I'm throwing compile errors. On my system (10.2.4) the structure is defined in <net/ethernet.h>. There is also a different definition in the kernel tree (xnu/bsd/netinet/ip_compat.h). I'd use the former. FWIW, it does not seem to have moved. Michael isn't exactly imagining things. We removed a header between 10.1.x and 10.2. While merging in changes from the FreeBSD 4.4 stack to our own, we noticed a few extra files (NeXTisms). One of those NeXTisms was a header that contained nearly identical definitions to what was in net/ethernet.h. We simply eliminated the NeXTism in 10.2 in an attempt to clean up and simplify things a bit. Was this in the kernel tree? I have a few old trees, and don't see it in 'xnu/bsd' anywhere: ethernet.h and ip_compat.h are the only places it's defined, AFAICT. Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | Men are from Earth. | Women are from Earth. | Deal with it. *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Which header file(s) define 'ether_header' and 'ether_header_t'
by Joshua Graessley 01 Apr '03

01 Apr '03

On Tuesday, Apr 1, 2003, at 11:22 US/Pacific, Justin Walker wrote: On Tuesday, Apr 1, 2003, at 10:23 US/Pacific, Michael Birdsong wrote: I have run into an issue in building an NKE after a few months of NOT compiling this particular project. In the latest version of Mac OS X (after 10.1.5) it seems the definitions for the structures: "ether_header" and "ether_header_t" have been moved from their old header file locations, I'm throwing compile errors. On my system (10.2.4) the structure is defined in <net/ethernet.h>. There is also a different definition in the kernel tree (xnu/bsd/netinet/ip_compat.h). I'd use the former. FWIW, it does not seem to have moved. Michael isn't exactly imagining things. We removed a header between 10.1.x and 10.2. While merging in changes from the FreeBSD 4.4 stack to our own, we noticed a few extra files (NeXTisms). One of those NeXTisms was a header that contained nearly identical definitions to what was in net/ethernet.h. We simply eliminated the NeXTism in 10.2 in an attempt to clean up and simplify things a bit. -josh _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0