November 2004 - Darwin-kernel

kextload error: "not a bundle"
by Brian Jorgage 18 Nov '04

18 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I am following the "Hello Kernel" example under Darwin documentation. When I try to load the kext using "sudo kextload -v HelloKernel.kext" I get the following response: "can't load kernel extension HelloKernel.kext (not a bundle)...". I've looked through the documentation but nothing makes any mention of this error or how to fix it. Does anyone know how to fix this ? Thanks, Brian Jorgage _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Event socket
by Peter Lovell 17 Nov '04

17 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Nov 17, 2004, at 10:38 AM, Stephane Sudre wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… After the complete failure of a search in the Darwin source code (not all the projects but a good part of them), I'm wondering if there wouldn't be one project which shows how to implement a kernel socket event listener in a Kernel Extension (if this is possible). I have always done this in User land, so basically, the question could be sum up to: - is this possible in a Kernel Extension? - is this exactly the same calls? Looking at the Darwin Archive, I saw a post which would tend to make believe this is the case. I seem to remember that the nfs project had quite a bit of kernel-level socket code. It's been a long time, though ... This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Event socket
by stephane sudre 17 Nov '04

17 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Nov 17, 2004, at 6:13 PM, Matthew Jaffa wrote: Stephane, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I believe this is possible, in one of my projects I have a socket that listens for Kernel events such as when a new interface is attached/created. Ah, a search in Google with SYSPROTO_EVENT brought better sorted results than the SearchKit ones. ndrv.c, that's the file I was looking for. This email sent to site_archiver(a)lists.apple.com

1 0

RE: Kernel Event socket
by Matthew Jaffa 17 Nov '04

17 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Stephane, Matt From: Stephane Sudre <ssudre(a)intego.com> To: darwin-kernel(a)lists.apple.com Subject: Kernel Event socket Date: Wed, 17 Nov 2004 16:38:14 +0100 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/mtjaffa%40msn.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I believe this is possible, in one of my projects I have a socket that listens for Kernel events such as when a new interface is attached/created. After the complete failure of a search in the Darwin source code (not all the projects but a good part of them), I'm wondering if there wouldn't be one project which shows how to implement a kernel socket event listener in a Kernel Extension (if this is possible). I have always done this in User land, so basically, the question could be sum up to: - is this possible in a Kernel Extension? - is this exactly the same calls? Looking at the Darwin Archive, I saw a post which would tend to make believe this is the case. This email sent to mtjaffa(a)msn.com This email sent to site_archiver(a)lists.apple.com

1 0

Kernel Event socket
by Stephane Sudre 17 Nov '04

17 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… After the complete failure of a search in the Darwin source code (not all the projects but a good part of them), I'm wondering if there wouldn't be one project which shows how to implement a kernel socket event listener in a Kernel Extension (if this is possible). I have always done this in User land, so basically, the question could be sum up to: - is this possible in a Kernel Extension? - is this exactly the same calls? Looking at the Darwin Archive, I saw a post which would tend to make believe this is the case. This email sent to site_archiver(a)lists.apple.com

1 0

processing IOService in kext
by calcmach＠actcom.net.il 17 Nov '04

17 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -- Hi, I am trying to further implement the following Apple Kernel sample. How do I parse / filter / the IOService which is handed to me? Note: this is a kext with KERNEL = 1, so not all api's are accessible. Thanks, DM ======= Apple Code ======= void com_apple_dts_driver_SampleFilterScheme::read(IOService* client , UInt64 byteStart, IOMemoryDescriptor* buffer, IOStorageCompletion completion) { getProvider()->read(this, byteStart, buffer, completion); } _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I have tried several options, but am getting nowhere. I need to know the name of the class (open, create, etc) and the specific params for each call client->serviceMatching( "open", table ); // Read data from the storage object at the specified byte offset into the // specified buffer, asynchronously. When the read completes, the caller // will be notified via the specified completion action. // // The buffer will be retained for the duration of the read. // // For simple partition schemes, the default behavior is to simply pass the // read through to the provider media. More complex partition schemes such // as RAID will need to do extra processing here. // This email sent to site_archiver(a)lists.apple.com

1 0

vm_protect from within the kernel
by Chandra Khan 16 Nov '04

16 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding; b=ZaeUs2poDVqa47VeDKGTNel9CMHi/ivegNfcb87GAgibQsRIn0gk6/ihaurHQ0irM9eJ2TOODPXUvdY0I1+u/p/PrxJia3qKv4H7iwYIr2axRxv9eYop82rWD17UoFGFjRzuRhT0fmfus7psiVTT6nNp7FxOyvn1Q3stNTfNLw4= Hi I posted on this earlier, but here's another attempt with a different slant. I'm really stuck on this after much searching, reading and experimentation, and would appreciate any thoughts. Do you see any "gotchas" or anything "bad" with using any of the following calls - vm_region, vm_protect, vm_read, vm_write, vm_machine_attribute - on current_map() from within the process context in kernel mode? I use these calls from within the kernel to write instructions to a process's address space. I had to use the VM_PROT_COPY flag when the user address in question was in the commpage area. It appears that the kernel gets unhandled faults on any further accesses to the commpage (such as by ntpd). My understanding: the commpage (0xffff8000-0xffffefff) is mapped shared and read-only into every process's space. Since my target process now wants to write to it, and changed protections to COW, the kernel creates a separate backing store for the overwritten pages. This should not affect either the protections, or the contents, or the sharing level, of the commpages for any other process. On a related note, gdb seems to get away with doing this -- What am I missing? Thanks Chandra _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: change boot-file doesn't work
by John Davidorff Pell 16 Nov '04

16 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Here's the direct link: http://opendarwin.org/~jpm/naughty/darwin/kswap.sh JP On 14 Nov 2004, at 06:54, Gong Michael wrote: Hi, all, I successfully built the latest kernel, xnu-517.9.4. Before actually using it , I need to test whether it works or not. >From some previous threads, I learn that I can change boot-file variable to boot the Mac with my built kernel, but it seems not works. Here is what I did: sudo cp <path_to_my_built_kernel>/mach_kernel /mach_kernel.gcc sudo nvram boot-device boot-device hd:,\\:tbxi sudo nvram boot-file='hd:, mach_kernel.gcc' sudo reboot #the system doesn't come up. reboot the machine, press crt-option-o-f keys, set-defaults /* this reset the boot-file varabile back to its default, which is mach_kernel */ reboot the machine, the system comes up. sudo cp /mach_kernel /mach_kernel_good /* save the currently working kernel */ sudo cp /mach_kernel.gcc /mach_kernel /* rename my built kernel with the default name: mach_kernel */ sudo reboot #the system comes up, so it proves that my built kernel is working. As a conclusion, it looks like only by changing the boot-file variable name can't boot the system with a kernel having a different name other than mach_kernel. I am wondering has anyone successfully booted a system with a kernel, whose name is not mach_kernel ? If so, could you please provide some insights ? Thanks a lot. Michael ______________________________________________________________________ Post your free ad now! http://personals.yahoo.ca _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/johnpell%40mac.com This email sent to johnpell(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… You probably know about this, but there is a script available from this site: http://opendarwin.org/~jpm/xnu.html called kswap.sh that may be useful. -- "NOTICE: This E-mail (including attachments) is covered by the Electronic Communications Privacy Act, 18 U.S.C. 2510-2521, is confidential and may be legally privileged. If you are not the intended recipient, you are hereby notified that any retention, dissemination, distribution or copying of this communication is strictly prohibited, Please reply to the sender that you have received the message in error, then delete it. Thank you." This email sent to site_archiver(a)lists.apple.com

1 0

Control an applications file system calls
by calcmach＠actcom.net.il 16 Nov '04

16 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -- Any advice, help, pointers, etc would be much appreciated. OSX 10.3.x Thanks, DM _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I would like be able to lunch ANY GIVEN application and gain full control over its file system calls (read, write, open, close, etc) Notes: 1) I have NO control over the building of the application I want to intercept..... 2) I have seen such an implementation which involves replacing the entire "mach_kernel", I'd prefer not going down that path. (a kernel extension is OK) This email sent to site_archiver(a)lists.apple.com

1 0

Compiling ppp-142 - SCDPlugin, SCPrivate, netisr, in_var header files
by Jim Witte 16 Nov '04

16 Nov '04

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com schednetisr(NETISR_IP); // in: ppp_ip.c line 223 if (IF_QFULL(&ipintrq)) { // in: ppp_ip.c line 227

1 0