June 2005 - Darwin-kernel - lists.apple.com

Re: Processes running path
by Mike Smith 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 20, 2005, at 6:39 AM, Andrew Gallatin wrote: I'm a little puzzled by this. The kernel makes it easy to run processes, As far as I can tell, it is far from easy to start run a process from inside the kernel. The kernel makes it easy to run processes by providing handy hooks known as system calls, which are called from userspace to start new processes. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Mike Smith writes: I didn't say that it did. Starting a process from inside the kernel is a bad idea; much of our runtime depends on context that is only available from a session, and sessions are only associated with other processes. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using ipf_inject_input with Local Packets
by Josh Graessley 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Or it could be something else completely. -josh On Jun 19, 2005, at 11:16 PM, Raj Doshi wrote: Hello, This email sent to jgraessley(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com It may be possible that you aren't setting the rcvif correctly in the mbuf pkthdr. There is a check that the loopback packets are received on the loopback interface. Another possibility is that the checksum related flags are not being carried over. These flags indicate what checksums were performed in hardware. The loopback uses a trick where it never calculates the checksums on transmit. When the packet is looped back, the loopback interface sets the flags indicating that the checksums were calculated in hardware on the card and the checksums are correct. If you strip the flags indicating the checksum was correct according to hardware, the checksums will be performed in software. Since they were never calculated on the outbound path, the checksums will be wrong and the packet will be dropped. Look for bad checksums using netstat -s. I would first like to thank Vincent Lubet for his help with my previous question on this list. Now, I have another question: I'm intercepting incoming packets in my kext with KPI IP filters (Mac OS X 10.4.1), sending them to a user-space process, getting them back (possibly modified) from the user-space process, and re- injecting them with ipf_inject_input. I've got this working fine in most cases, like when accessing remote web sites. However, http connections to 127.0.0.1:80 fail and result in messages like "NetInfo connection failed for server 127.0.0.1/local" in console.log. To attempt to isolate the problem, I've tried the following: 1. Immediately re-injecting the mbuf that I receive from the filter. In this case, the local connection works. 2. Immediately re-injecting a copy (using mbuf_dup) of the mbuf that I receive from the filter. In this case, the local connection fails. I am wondering what I can do so that these local connections will still work when I inject a copy of the original mbuf. If there is no good solution to this, then I am wondering exactly for which packets I need to avoid making copies of the mbuf. Thanks, Raj Doshi_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com smime.p7s

1 0

Re: what happened to rtredirect()?
by Josh Graessley 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com rtredirect is not part of the supported KPI. -josh On Jun 19, 2005, at 2:16 AM, Chase wrote: rtredirect() is no longer in route.h in tiger. spotlight isn't finding any headers that mention it either. what can be done to replace that functionality? - chase This email sent to jgraessley(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com You can use a routing socket from within the kernel using the socket KPI to make modifications to the routing table. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com smime.p7s

1 0

A stupid question
by Stephane Sudre 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com The question I have regarding this file is the following one: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… While looking at the enetlognke sample code, I discovered the OSFree, OSMalloc, etc... APIs. This leads to the discovery of the OSDebug.h file (in which I would tend to believed there's a typo on _OS_OSDEBBUG_H). Is there a <stupid part> documentation</stupid part> on these APIs or a look at the source code is my only hope? (the problem with code is that it tells you what it does, not what it's supposed to do). This email sent to site_archiver(a)lists.apple.com

1 0

Re: Processes running path
by Andrew Gallatin 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Mike Smith writes: > > I'm a little puzzled by this. The kernel makes it easy to run > processes, As far as I can tell, it is far from easy to start run a process from inside the kernel. I would love to see an example of how to start a helper process from a kernel extension using a supported interface. The only way I know of is KUNCExecute(), which requires linking against com.apple.kernel which is bumped each minor release, or com.apple.kernel.6.0 which is deprecated. In the past, you and Godfrey have talked about communicating with Launchd via a Mach port, but without example code I'm lost and I'm fairly sure others are in the same boat. Can somebody please post an example? Thanks, Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Processes running path
by Stephane Sudre 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Le 18 juin 05, à 19:42, Mike Smith a écrit : On Jun 17, 2005, at 4:35 PM, matt jaffa wrote: Well basically I am trying to associate outgoing traffic with the process that is sending it using a socket filter. It works great, and right now I have my kext sending the pid to a super user process in user space that gets the process path and sends it back. This is less than ideal, I would rather have the kext be able to get this info. I assume you want the path because you use the path to the application to associate the application with some rules regarding the traffic it can send. This isn't very robust though; what if someone moves the application? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I would be much more inclined to use the proc_name KPI; in most cases this will remain unique. It's still not such a great idea to depend on the application name, but this is at least resistant to the application moving. Isn't proc_name just the p_comm parameter? In this case, it's not the name of the application, it's sometimes the name of the application, sometimes a shortcut name. My current fear with the stack solution is that it may not survive the switch to the bunnies' processor. This email sent to site_archiver(a)lists.apple.com

1 0

Re: vm / physmem info
by Andrew Gallatin 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Mike Smith writes: > > On Jun 17, 2005, at 11:24 AM, Glen Beane wrote: > > > I just really need (actually, would like) to get a *rough* idea of > > how memory is fragmented - if I have a HPC application that > > allocates a large amount of memory, how fragmented is that in > > physical ram. It's not the end of the world if I can't, but it > > would definitely be helpful (for a number of reasons that are > > outside the scope of my question)... > > > > I'm really only concerned with one or two processes > > If you can make some minor changes to the application and write an I/ > O kit driver, you could easily have the app issue an I/O against the > driver and then have the driver use the IOKit functionality to do the > virtual->physical mapping. That avoids trying to go backwards, which > is what you're describing there. I haven't had my coffee yet, so excuse me if I'm missing something simple... But won't using an IOKit driver to do virt->phys translations require using IOMemoryDescriptors and "preparing" the memory? This would require page-ins if the memory was not currently resident, so you might see 2 different virtual address mapped to the same physical address.. If it is somehow possible to get a hold of the thread's pmap, it seems like it *might* be better to walk the address space using the (unsupported) pmap_find_phys. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Using ipf_inject_input with Local Packets
by Raj Doshi 20 Jun '05

20 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello, I would first like to thank Vincent Lubet for his help with my previous question on this list. Now, I have another question: I'm intercepting incoming packets in my kext with KPI IP filters (Mac OS X 10.4.1), sending them to a user-space process, getting them back (possibly modified) from the user-space process, and re-injecting them with ipf_inject_input. I've got this working fine in most cases, like when accessing remote web sites. However, http connections to 127.0.0.1:80 fail and result in messages like "NetInfo connection failed for server 127.0.0.1/local" in console.log. To attempt to isolate the problem, I've tried the following: 1. Immediately re-injecting the mbuf that I receive from the filter. In this case, the local connection works. 2. Immediately re-injecting a copy (using mbuf_dup) of the mbuf that I receive from the filter. In this case, the local connection fails. I am wondering what I can do so that these local connections will still work when I inject a copy of the original mbuf. If there is no good solution to this, then I am wondering exactly for which packets I need to avoid making copies of the mbuf. Thanks, Raj Doshi _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: getattrlist needed for Darwin 8?
by Brian Bergstrand 19 Jun '05

19 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Jun 19, 2005, at 3:28 PM, Mike Smith wrote: > > On Jun 18, 2005, at 3:22 PM, Brian Bergstrand wrote: > >> So is >> getattrlist needed anymore? Will old userland clients be shunted >> through getattr as necessary? >> > > The VFS uses the VFS_GETATTR call for volume information, and > VNOP_GETATTR for vnode information. The getattrlist(2) syscall > is backed by these, and the old VOP_GETATTRLIST is not used. > > = Mike > Thanks Mike. I was a bit confused because a vnop desc is still exported by the 8.x kernel. Brian Bergstrand <http://www.bergstrand.org/brian/> PGP Key ID: 0xB6C7B6A2 -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQA/AwUBQrXeyXnR2Fu2x7aiEQKE6ACdGQb66Ge9Ry8xiJkonNCpDpTxUsAAnRZt qO2stxr5U5+axZp80mtVFqvm =hO01 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: getattrlist needed for Darwin 8?
by Mike Smith 19 Jun '05

19 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 18, 2005, at 3:22 PM, Brian Bergstrand wrote: Our filesystem implemented getattrlist under Darwin 7 to return some Volume information -- if the node was not the root we just returned ENOTSUP. Now under Darwin 8 there is getattr at the VFS level and it looks to handle all the stuff that getattrlist used to. So is getattrlist needed anymore? Will old userland clients be shunted through getattr as necessary? The VFS uses the VFS_GETATTR call for volume information, and VNOP_GETATTR for vnode information. The getattrlist(2) syscall is backed by these, and the old VOP_GETATTRLIST is not used. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0