September 2003 - Darwin-kernel

NKE (Network Kernel Extension) / dlil protocol filter
by Nathan Lim 27 Sep '03

27 Sep '03

I am trying to write an application that does the following: A) URL logging (i.e. HTTP GET) B) HTTP GET blocking (URLs will be logged to a separate server; if the URLs can not be logged, then any GETs should be blocked immediately) C) The application needs to be as resistant as possible to the user disabling or killing the application. So I would much prefer if the user/administrator could not simply kill -9 the application. I have chosen the NKE (Network Kernel Extension) DLIL (Data Link Interface Layer) Protocol Filter as the way to implement this logging and blocking in conjunction with a user level process. I have two questions: 1. I have been able to log/block the HTTP GET packets successfully using dlil_attach_protocol_filter() by first calling dlil_find_dltag() to get the dltag for the network interface. However, I discovered that dlil_find_dltag() fails for APPLE_IF_FAM_PPP if the modem is not yet connected. How can I be notified/called whenever a new network interface is connected or disconnected (e.g. when modem makes an internet connection) so I can set up or cleanup the dlil protocol filter? 2. Is there a way to meet my application goals (above) entirely in user-space? It would be great to avoid the pitfalls of kernel programming and the possible instability in OS X that this application could introduce. -Nate Lim mailto:nathanlim@mac.com _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: MIG RPC from kext question
by Jim Magee 26 Sep '03

26 Sep '03

On Sep 26, 2003, at 5:12 AM, Marek Kozubal wrote: I am trying to use an INOUT parameter in a MIG RPC call from the kernel to a user land application, unfortunately all my attempts just cause a kernel panic to happen. Here is basically what I'm doing (hopefully someone can tell me what I am missing): mig .defs file: #include <mach/std_types.defs> #include <mach/mach_types.defs> subsystem KernelUser foo_subsystemServer 1000; type foo_array_t = array[] of uint8_t; routine foo_rpc( server: mach_port_t; inout io_foo_array: foo_array_t ); This produces a function that looks like: mig_external kern_return_t foo_rpc( mach_port_t server, foo_array_t *io_foo_array, mach_msg_type_number_t *io_foo_arrayCnt ) So my question is this, what sort of pointer needs to go into the RPC call and what do I get in user land and what do I get back in return? I have posted about this in the past (look for vm_map_copy_t in the archives - that should hit on the previous discussions). But it's been a while, so a refresher would be nice: The kernel is not "just another task" when it comes to Mach IPC - especially when you use the KernelUser or KernelServer MIG keywords. In those conditions, you are really working with "half-cooked" IPC messages. That is, when a message is sent from user-space to a "KernelServer" kernel receiver, we copyin() and process the message into Mach IPC's internal (message sitting on a queue) form - and then directly call the specified routine. We don't "copyout()" the message to the kernel's address/port name space. The same is true in the opposite direction. When you send a message from the kernel to user-space using "KernelUser" it must already be in Mach IPC's "already-been-copied-in" form. So what does this mean - specifically? First, the two ports in the message header (local and remote) usually get flip-flopped during the message copyout operation (so that each the sender and receiver see local and remote in accordance with their own perspectives). So, after just a message copyin operation, the internal format is still laid out just like the sender would normally see it. If this is a KernelServer routine, we will call the message handling code at this point - and it must deal with the fact that the ports in the header have not been swapped yet. MIG generates code specifically to handle this for you. Second, all port rights are "naked." That is, they are not represented by a name in a port namespace with specific rights enumerated in that space. Each port is represented by just a pointer to the port itself. The right(s) in question are accounted for in the port's global rights counts, but not in any private to the kernel namespace. You have sharp tools at that point (i.e. you have the ability to manipulate the port in any way you chose). You have to be careful to consume only the right you were explicitly granted in the message. But nothing enforces this for you (you are part of the kernel - after all). When sending naked port rights, just the opposite is true. You have to manually add the appropriate right references to the ports first (since the message is assumed to be in the "already copied in" state). Only "move" type dispositions are expected on the ports (since the copy, make, etc... side-effects apply during the message copyin operation). Often, the built-in kernel object's have MIG intrans and outtrans routines defined to handle this. They convert object references to a specific kind of [potentially added] right on the port that is a handle for the object - and then just the naked port pointer and the appropriate "move" disposition in put in the message's port-handling descriptor by MIG. Third, all out-of-line arrays of ports are stored as naked rights (again, just as above) but in kalloc()'ed storage. This is different than the user environment where vm_allocate()'ed storage is used to send/receive out-of-line port arrays. Code that sends and receives these from within the kernel has to allocate and free the kalloc() memory rather than freeing whole vm_allocate()'ed pages. Finally, and most directly related to the question at hand, out-of-line data (unbounded non-port data) is represented by a vm_map_copy_t data structure while messages sit on queues. They are "shorthand notion" about where the data can be found (which VM object's and for what ranges, permissions, etc...), since it would be silly to require the kernel to map all that data into the kernel's address space for every message sitting in a message queue. Because "KernelServer" and "KernelUser" code has to deal with messages in this "sitting on a queue" format, they have to deal with the vm_map_copy_t data structures directly as well. So, what you get and send for out-of-line data is not a pointer to the data, but a pointer to the vm_map_copy_t structure that describes where the data is. If you receive one of these messages in the kernel, you have to vm_map_copyout() the vm_map_copy_t to the kernel's address space manually before you can look at the data. If you want to send this kind of data from the kernel, you have to vm_map_copyin() the data from the kernel's address space and then send a pointer to the vm_map_copy structure. It is often quite a bit more efficient to deal with these half-cooked messages (and since all the Mach kernel operations are implemented using messages, the savings is well worth it). But it's not for the faint of heart. Which is why it is classified as SPI. Things like the IOKit user-client libraries encapsulate all these details, so the average KEXT writer needn't be bothered. But when you wonder outside those protections, that's when the "fun" begins. --Jim _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

MIG RPC from kext question
by Marek Kozubal 26 Sep '03

26 Sep '03

I am trying to use an INOUT parameter in a MIG RPC call from the kernel to a user land application, unfortunately all my attempts just cause a kernel panic to happen. Here is basically what I'm doing (hopefully someone can tell me what I am missing): mig .defs file: #include <mach/std_types.defs> #include <mach/mach_types.defs> subsystem KernelUser foo_subsystemServer 1000; type foo_array_t = array[] of uint8_t; routine foo_rpc( server: mach_port_t; inout io_foo_array: foo_array_t ); This produces a function that looks like: mig_external kern_return_t foo_rpc( mach_port_t server, foo_array_t *io_foo_array, mach_msg_type_number_t *io_foo_arrayCnt ) So my question is this, what sort of pointer needs to go into the RPC call and what do I get in user land and what do I get back in return? My goal is to send io_foo_array to the userland daemon which makes some changes to some fields, and then sends it back to the kext I am running in. I've had success w/fixed length in and out parameters, but this needs to be variable length. Do I need to do some copyin/copyout stuff? some vm_map_copyin type stuff? Should I be useing a pointer_t mach type instead? Currently I am doing the following: MALLOC( foo, caddr_t, len, M_TEMP, M_WAITOK ); /* do some stuff that puts useful data into foo */ foo_rpc( server, (foo_array_t *)foo, (mach_msg_type_number_t *)&len ); but this just kernal panics deep within the mach message sending code either with an unhandled exception (bad memory access I think) or trying to unmap unmappable memory. So whats the right way to do this, and do I need to do any copyin/copyout type stuff in the user land client either? Do I need to change this to having 2 buffers with a seperate IN and OUT buffer? And for what its worth this is from a file system KEXT. Thanks in advance! --- Marek Kozubal marek(a)portents.com _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Panther VFS unmount gotcha
by Quinn 25 Sep '03

25 Sep '03

Greetings All If you're developing a VFS plug-in and you have problems unmounting your volumes on Panther, you should read the following. We've made changes in Panther that cause the VFS layer to hold extra references to your volume's root vnode. Depending on how your xxx_unmount VOP is implemented, you may find that an attempt to unmount your volume fails with the error EBUSY. Specifically, you xxx_unmount VOP should call vflush *before* checking the v_usecount of the root vnode. For example, your code might previous have looked like this... if (rootvp->v_usecount > 1 && !(flags & FORCECLOSE)) { return (EBUSY); } error = vflush(mp, rootvp, flags); if (error) { return (error); } You should make sure that it looks like this... error = vflush(mp, rootvp, flags); if (error) { return (error); } if (rootvp->v_usecount > 1 && !(flags & FORCECLOSE)) { return (EBUSY); } S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Kernel Panic When Invoking Functions in Non-Standard Sections
by Geoffrey Schmit 24 Sep '03

24 Sep '03

If I compile a function into a section other than __text (i.e., using __attribute__((section("__TEXT,__mysection"))) ) and invoke that function when my kernel extension is loading, I get a kernel panic. If I look at the contents of that function, using gdb, just before I jump to its address, it is all zeros. It appears that not all sections are loaded before the kernel extension is initialized. If I don't invoke this function when the kernel extension is loading but, rather, wait and invoke it after the kernel extension has loaded, a kernel panic does not occur. Should all sections be loaded before the kernel extension is initialized? Is this observed behavior to be expected? If so, any suggestions to work around this problem? (Yes, not compiling functions into non-standard sections would work. However, doing so is currently solving another problem. I'll pursue solving this other problem in another way if there are no other options.) Thanks! geoff -- Geoffrey Schmit Senior Software Engineer National Instruments geoffrey.schmit(a)ni.com www.ni.com _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

RE: 50 + Concurrent NFS Shares
by Talwar, Puneet (NIH/NIAID) 24 Sep '03

24 Sep '03

well i have a NFS server and the user will connect to the OS X server via Appletalk and mount there home dir which is gonig to be the NFS share. so that is why i wanted to have more than 50 + nfs shares. Puneet > ---------- > From: Markus Hitter > Sent: Wednesday, September 24, 2003 12:57 PM > To: Talwar, Puneet (NIH/NIAID) > Cc: 'darwin-kernel(a)lists.apple.com' > Subject: Re: 50 + Concurrent NFS Shares > > > Am Mittwoch, 24.09.03 um 14:50 Uhr schrieb Talwar, Puneet (NIH/NIAID): > > > I would like to know if I can have 50 + Concurrent NFS share at one > > time? > > Fifty? As you can export larger parts of a volume and then mount > sub-parts of it on the remote machine, what makes you feeling a need > for 50+ shares? > > > > But by tweaking the Kernel am I jeopardizing the stability and > > performance of the OS? > > Probably not. Just be aware you have to rebuild and replace the kernel > with (almost) each System Update again. And, doing such things on > customer machines is a big no-no. > > > Cheers, > Markus > > - - - - - - - - - - - - - - - - - - - > Dipl. Ing. Markus Hitter > http://www.jump-ing.de/ _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: 50 + Concurrent NFS Shares
by Markus Hitter 24 Sep '03

24 Sep '03

Am Mittwoch, 24.09.03 um 14:50 Uhr schrieb Talwar, Puneet (NIH/NIAID): I would like to know if I can have 50 + Concurrent NFS share at one time? Fifty? As you can export larger parts of a volume and then mount sub-parts of it on the remote machine, what makes you feeling a need for 50+ shares? But by tweaking the Kernel am I jeopardizing the stability and performance of the OS? Probably not. Just be aware you have to rebuild and replace the kernel with (almost) each System Update again. And, doing such things on customer machines is a big no-no. Cheers, Markus - - - - - - - - - - - - - - - - - - - Dipl. Ing. Markus Hitter http://www.jump-ing.de/ _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

50 + Concurrent NFS Shares
by Talwar, Puneet (NIH/NIAID) 24 Sep '03

24 Sep '03

HI, I would like to know if I can have 50 + Concurrent NFS share at one time? I have heard that I can tweak the kernel to support more than 50 Concurrent NFS shares. But by tweaking the Kernel am I jeopardizing the stability and performance of the OS? Thanks, Puneet ---------------------------------------------------------- Puneet Talwar Unix Administrator _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

SCSI device driver configure() function not called
by Jeff Collins 22 Sep '03

22 Sep '03

Sending this out again and cross posting to darwin-drivers, as there has been no answer yet. I realize that this is a basic question, but one the eludes me. After some problems, I finally got a stub SCSI HBA driver to load on OSX using the developers kit from December 2002 by setting com.apple.kernel.mach = 6.1 (Thanks to apple folks for the proper advice on setting the version to 6.1). Please forgive my ignorance, but now I do not know how to get the configure() function called. The stub driver is loaded, and it has successfully brought 68 1 0x10f7b000 0x9000 0x8000 com.apple.iokit.IOSCSIParallelFamily (1.2.4) <35> 69 0 0x10f84000 0x2000 0x1000 ods (1.0d1) <68 11> the IOSCSIParallelFamily driver into memory as well. However, I do not know how to get the SCSI layer to call the configure() function of my driver. Any help would be greatly appreciated. Jeff Collins _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: wanted: sosend() howto
by Hiroo Yamada 20 Sep '03

20 Sep '03

Hi Stefan, It's not so difficult to send UDP packets in a kernel. Here is brief function calls. function read/write tcp/udp in darwin kernel { thread_funnel_switch KERNEL_FUNNEL,NETWORK_FUNNEL so=socreate AF_INET // create socket soreserve so,1536,1536 // set max packet size setup sockaddr_in sa (s_addr=dest. ip address or INADDR_BROADCAST) if (udp) sosetopt SOL_SOCKET,SO_BROADCAST,on // turn on broadcast option else // tcp { soconnect so,&sa check so_create !SS_ISCONNECTING // check connection state } setup uio UIO_SYSSPACE,UIO_WRITE if (send) sosend so,&sa,&uio,NULL,NULL,0 // send tcp/udp else // receive { setup sockopt sopt SOL_SOCKET,SO_NREAD sogetopt so,&sopt if (sopt.sopt_val != 0) // check data available soreceive so,NULL,&uio,NULL,NULL,&flag // receive tcp/udp } soclose so thread_funnel_switch NETWORK_FUNNEL,KERNEL_FUNNEL } You can find udp samples by searching keyword 'SO_BROADCAST'. Hope this helps. hiroo / Hiroo Yamada / Active Open Communications K.K -- > Hi, > > I want to send UDP packets from kernel space and am currently > struggling with the sosocket() call. It appears to be close to > undocumented and almost an hour of research on google did not turn up > much. I'd be very happy if I could get a simple code snippet that will > allow me to send a void* buffer (I haven't figured out how to use mbuf > yet) to a remote IP/Port. I found a little code in the nfs source code, > but I couldn't quite figure out where exactly the payload is and what > the other values mean. > > Thanks a lot, > Stefan -- Hiroo Yamada / JK1ASL ._ ... ._.. Internet: asl(a)mac.com Active Open Communications K.K _._ NIFTY-Serve: SDI00177 http://www.activeopen.co.jp/ activeopen(a)mac.com _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0