October 2004 - Darwin-kernel

Re: Running foreign binaries
by Quinn 06 Oct '04

06 Oct '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 11:30 +0200 10/9/04, Markus Hitter wrote: But where comes dyld into this play? Is the binary communicating directly with dyld? "nm ls" shows up some entries named "dyld_...". ELF binaries should have the appropriate functions for the elf linker, then. The operation of dyld is something that I've studied in some detail over the past few years. Here's how things work from the kernel perspective. When you exec a binary, the execve (xnu/bsd/kern/kern_exec.c) routine runs. This code reads the first 512 bytes of the executable (look for the "exdata" union). If the executable starts with Mach-O magic, it treats it as a Mach-O file. Otherwise it treats it as a script, finds the shell, and executes that. I won't go into details on this path because you asked about dyld. The next key step is when execve calls load_machfile (xnu/bsd/kern/mach_loader.c). This is the code that's responsible for parsing the Mach-O file and loading it into memory. You'll see that the bulk of the work is done in parse_machfile (same file). This contains some fabulously convoluted logic, but suffice to say that it looks through all of the Mach-O "load commands" and acts on them. One special load command is LC_LOAD_DYLINKER. This command contains the full path to the dynamic linker used to link this program. That eventually triggers a call to load_dylinker to load the dynamic linker's code into the address space (resulting in a recursive call to parse_machfile, yetch!). The return path of this code sets result->dynlinker to true, indicating that a dynamic linker is being used, and sets result->entry_point to the entry point of the dynamic linker rather than the original entry point of the executable. The upshot of this is that dyld is mapped into the process's address space and is the first code that's run. Back in execve you'll see a special case for load_result.dynlinker which causes the kernel to pass an extra parameter to the program if it's using the dynamic linker. This extra parameter, a pointer to the original program's mach_header, allows dyld to do its magic. This email sent to site_archiver(a)lists.apple.com

1 0

pmap_unnest: Other processor did not see interruption request
by Parav Pandit 06 Oct '04

06 Oct '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Importance: Normal Hi, My IOKit driver has provider Class IOPCIDevice. and Driver class is derived from IOSCSIParallelInteraceController. Running my driver on G5 PCI-X dual 1.8GHz system. When I load the driver using kextload -v myDriver.kext Randomly I get kernel panic at this point: ("pmap_unnest: Other processor (%d) did not see interruption request\n", i); This panic is totally occurs in random faction. Event if I restart the system and load the same binary I some times get the kernel panic and even some times it loads perfectly. I am not wiring down even 2-3Mbytes of memory for my PCI firmware. What can be the cause of this kernel panic?? I looked at the kernel panic back trace and none of the address falls in the my driver code. What steps or care should I take to avoid this pmap_unnest kernel panic? ----------------------------------------------------- panic(cpu 1): pmap_unnest: Other processor (0) did not see interruption request Latest stack backtrace for cpu 1: Backtrace: 0x000837BC 0x00083CA0 0x0001EDA4 0x00085D64 0x000600A0 0x000604EC 0x0002FE0C 0x0020ADB0 0x0020AC38 0x002405F4 0x00094300 0x00650079 Kernel loadable modules in backtrace (with dependencies): com.apple.iokit.IOHIDFamily(1.3.4)@0x640000 Proceeding back via exception chain: Exception state (sv=0x1DE52C80) PC=0x90034F4C; MSR=0x0000D030; DAR=0x16E5C004; DSISR=0x40000000; LR=0x9002C8EC; R1=0xBFFFF700; XCP=0x00000030 (0xC00 - System call) Kernel version: Darwin Kernel Version 7.3.1: Fri Mar 5 14:05:05 PST 2004; root:xnu/xnu-517.4.11.obj~1/RELEASE_PPC Regards, Parav Pandit _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: zombproc - generated kernel panic in my driver
by Godfrey van der Linden 04 Oct '04

04 Oct '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Godfrey On Oct 4, , at 10:39, Andrew Gallatin wrote: Parav Pandit writes: <...> This is an indication that the symbols file for some kernel extension was not loaded into gdb with add-symbol-file. Your panic message did not indicate any extensions in the panic stack.. perhaps you omitted this part of the paniclog? FWIW, I've sometimes had to load symbols twice to get the zombproc to go away. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/gvdl%40apple.com This email sent to gvdl(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… 1> In any backtrace the top frame is not to be trusted. 2> If you don't have a real symbol in the backtrace it is as Andrew surmised that you have a unaccounted for kext in your backtrace. 3> It probably isn't relevant in anycase as your panic is a branch to 0 which is usually a programming issue with the first few stack frames. 4> Why are you using semaphores and IOCreateThread to do interrupt processing handoff? Is there some issue with the IOWorkLoop? With this implantation I get kernel panic at Unresolved kernel trap(cpu 1): 0x400 - Inst access DAR=0x0000000002279000 PC=0x0000000000000000 Latest crash info for cpu 1: Exception state (sv=0x1DE5E500) PC=0x00000000; MSR=0x40009030; DAR=0x02279000; DSISR=0x40000000; LR=0x00288520; R1=0x0CD9B9F0; XCP=0x00000010 (0x400 - Inst access) Backtrace: Why I get kernel panic on this zombproc and why my driver jump to zombproc function from the driver thread? This email sent to site_archiver(a)lists.apple.com

1 0

Re: zombproc - generated kernel panic in my driver
by Andrew Gallatin 04 Oct '04

04 Oct '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Parav Pandit writes: > With this implantation I get kernel panic at > Unresolved kernel trap(cpu 1): 0x400 - Inst access DAR=0x0000000002279000 > PC=0x0000000000000000 > Latest crash info for cpu 1: > Exception state (sv=0x1DE5E500) > PC=0x00000000; MSR=0x40009030; DAR=0x02279000; DSISR=0x40000000; > LR=0x00288520; R1=0x0CD9B9F0; XCP=0x00000010 (0x400 - Inst access) > Backtrace: <...> > Why I get kernel panic on this zombproc and why my driver jump to zombproc > function from the driver thread? This is an indication that the symbols file for some kernel extension was not loaded into gdb with add-symbol-file. Your panic message did not indicate any extensions in the panic stack.. perhaps you omitted this part of the paniclog? FWIW, I've sometimes had to load symbols twice to get the zombproc to go away. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

zombproc - generated kernel panic in my driver
by Parav Pandit 04 Oct '04

04 Oct '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Importance: Normal Hi, In my driver one thread my_Thread is created using IOKit API IOCreatThread(). This thread does processing of Asynchronous events. This thread runs a while(1) loop, and inside while loop waits on a semaphore created using semaphore_create( waiting, SYNC_FIFO_POLICY). whenever any interrupts arrives from the PCI card, isr is handled via HandleInterrupt(), and after completing isr, at the end it signal the my_Thread using semaphore_signal(waiting). With this implantation I get kernel panic at Unresolved kernel trap(cpu 1): 0x400 - Inst access DAR=0x0000000002279000 PC=0x0000000000000000 Latest crash info for cpu 1: Exception state (sv=0x1DE5E500) PC=0x00000000; MSR=0x40009030; DAR=0x02279000; DSISR=0x40000000; LR=0x00288520; R1=0x0CD9B9F0; XCP=0x00000010 (0x400 - Inst access) Backtrace: back trace shows this: --------------------------------------------------- 0x241998 <IOLibInit+220>: mflr r0 (gdb) x/i 0x002419D4 0x2419d4 <IOLibInit+280>: lwz r0,88(r1) (gdb) x/i 0x1E58DCC8 0x1e58dcc8 <my_Thread+5480>: lwz r2,64(r30) (gdb) x/i 0x1E5A126C 0x1e5aa8c4 <_ZN31com_myCompany_driver_HBAdriver20CompleteParallelTaskEP8OSObject14SCSIT askStatus19SCSIServiceResponse+72>: lwz r1,0(r1) (gdb) x/i 0x1E57AEC0 0x1e57aec0 <_ZN33IOSCSIParallelInterfaceController20CompleteParallelTaskEP8OSObject14SC SITaskStatus19SCSIServiceResponse+104>: lwz r0,88(r1) (gdb) x/i 0x1E57D57C 0x1e57d57c <_ZN29IOSCSIParallelInterfaceDevice16CompleteSCSITaskEP8OSObject19SCSIServic eResponse14SCSITaskStatus+332>: lwz r0,204(r30) (gdb) (gdb) x/i 0x003B4B24 0x3b4b24 <zombproc+405712>: xoris r4,r10,25974 (gdb) x/i 0x00241998 (gdb) x/i 0x003B4884 0x3b4884 <zombproc+405040>: andi. r13,r19,25957 Why I get kernel panic on this zombproc and why my driver jump to zombproc function from the driver thread? How can I avoid my driver to jump to zomproc? Regards, Parav Pandit _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

NKE examples?
by Mark Woollard 02 Oct '04

02 Oct '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thanks Mark _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm looking at writing an NKE and am looking for some sample code. The Apple document on the subject mentions TCPLogger as an example but I can't find the code online anywhere. Could someone point me to it or a similar sample? This email sent to site_archiver(a)lists.apple.com

1 0