June 2005 - Darwin-kernel - lists.apple.com

Re: Processes running path
by Terry Lambert 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com There isn't a good, straightforward way of doing this. -josh On Jun 16, 2005, at 9:31 PM, matt jaffa wrote: Thanks Matt -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jun 16, 2005, at 11:18 PM, Josh Graessley wrote: If you get in touch with DTS, they may be able to work with you towards a solution. We are aware of the issue and have a bug (enhancement request) filed to track it. Does anyone on this list know of some api or hack of using a processes id (pid) in a network kernel extension to get that process running path? Specifically, the path is stored into the strings area at the top of the user stack during the exec process for use by the "open(1)" command in obtaining bundle ID information. Because this is in memory belonging to the user process, it's possible for the user process to modify its contents after the application has started, so you cannot trust that the information is reliable or accurate to create a security association (as one example use someone might have for needing this information). If it's not for a security association, one method would be to have to program tell the kext. For bundle information, the most correct thing for the process to do is to write a file in /var/run with the information; this is probably not usesful for a kext, though, since you shouldn't be trying to do file I/O from a kext. If you can tell us why you need the information, we can probably tell you a different way to solve the problem you are trying to solve. This email sent to site_archiver(a)lists.apple.com

1 0

Re: vm / physmem info
by Glen Beane 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 17, 2005, at 1:02 PM, Mike Smith wrote: Glen, The short answer is "no". yes yes = Mike I'm really only concerned with one or two processes On Jun 17, 2005, at 9:55 AM, Glen Beane wrote: On Jun 15, 2005, at 2:50 PM, Glen Beane wrote: This email sent to beaneg(a)umcs.maine.edu _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/drivers%40mu.org This email sent to drivers(a)mu.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… You are aware that the answer would be "which processes' address spaces"? And that you may get multiple answers for a single process? And that before the information is even returned to you, it may have changed? I just really need (actually, would like) to get a *rough* idea of how memory is fragmented - if I have a HPC application that allocates a large amount of memory, how fragmented is that in physical ram. It's not the end of the world if I can't, but it would definitely be helpful (for a number of reasons that are outside the scope of my question)... Can anyone help me out here? can I get a list of physical pages, and then if it is holding a virtual page, find out what process's address space that virtual page is mapped to? I'm doing some experiments on on OS X system, and I need to find out how virtual memory is mapped to physical ram at a particular instance. That is I need to be able to find out what physical portions of memory are currently holding active or inactive pages, and what those pages belong to. I was hoping this would be possible to do from a kext, and I would have a client program that could connect to the kext and get a snapshot of what was going on in memory. Thus far I have been unable to find any doccumented APIs that may help me out. Does anyone have any insight or information that can help me out? Glen Beane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/beaneg% 40umcs.maine.edu This email sent to site_archiver(a)lists.apple.com

1 0

Re: vm / physmem info
by Mike Smith 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Glen, The short answer is "no". = Mike On Jun 17, 2005, at 9:55 AM, Glen Beane wrote: On Jun 15, 2005, at 2:50 PM, Glen Beane wrote: This email sent to beaneg(a)umcs.maine.edu _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/drivers%40mu.org This email sent to drivers(a)mu.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… You are aware that the answer would be "which processes' address spaces"? And that you may get multiple answers for a single process? And that before the information is even returned to you, it may have changed? Can anyone help me out here? can I get a list of physical pages, and then if it is holding a virtual page, find out what process's address space that virtual page is mapped to? I'm doing some experiments on on OS X system, and I need to find out how virtual memory is mapped to physical ram at a particular instance. That is I need to be able to find out what physical portions of memory are currently holding active or inactive pages, and what those pages belong to. I was hoping this would be possible to do from a kext, and I would have a client program that could connect to the kext and get a snapshot of what was going on in memory. Thus far I have been unable to find any doccumented APIs that may help me out. Does anyone have any insight or information that can help me out? Glen Beane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/beaneg% 40umcs.maine.edu This email sent to site_archiver(a)lists.apple.com

1 0

Re: Processes running path
by Mike Smith 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 16, 2005, at 9:31 PM, matt jaffa wrote: Does anyone on this list know of some api or hack of using a processes id (pid) in a network kernel extension to get that process running path? = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… As a general rule, this is a bad thing. There's no guarantee that the path will mean anything to anyone else, nor that it's still valid. If there's an interface offered that returns a path, but no guarantee and no race-proof mechanism to be sure that it's correct, the interface is worthless. This email sent to site_archiver(a)lists.apple.com

1 0

Re: vm / physmem info
by Glen Beane 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 15, 2005, at 2:50 PM, Glen Beane wrote: This email sent to beaneg(a)umcs.maine.edu _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Can anyone help me out here? can I get a list of physical pages, and then if it is holding a virtual page, find out what process's address space that virtual page is mapped to? I'm doing some experiments on on OS X system, and I need to find out how virtual memory is mapped to physical ram at a particular instance. That is I need to be able to find out what physical portions of memory are currently holding active or inactive pages, and what those pages belong to. I was hoping this would be possible to do from a kext, and I would have a client program that could connect to the kext and get a snapshot of what was going on in memory. Thus far I have been unable to find any doccumented APIs that may help me out. Does anyone have any insight or information that can help me out? Glen Beane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/beaneg% 40umcs.maine.edu This email sent to site_archiver(a)lists.apple.com

1 0

ioblockstoragedriver help
by santosh katvate 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=kzX+2oiJuqXmNFLwJaHtvfk+Oq6twDj7nOQSn2M8BKxgX0Cuw7ceYmRb/JQxNSNwfEAUqTaXHtvaBFKo3VEzr/snSdWN+03/GPwlkjX4bbLhuzPxid5ivfQdVXYs6OlP+6HEwV+TV/7psyzW8ZKZwsH7Qcah/pl1KkB4iypPtuw= Hello EveryBody I am new to MAC OS driver development. I have few doubts regarding the filter driver. Can I have my filter driver build in such a way that my entry in io registry would be looking like something given below. (My_Driver entry given below) Is it possible to build such a filter driver. If i am going incorrect do please correct me. | +-o pci@f4000000 <class IOPlatformDevice, registered, matched, active, busy 0, retain count 10> | | +-o AppleMacRiscPCI <class AppleMacRiscPCI, !registered, !matched, active, busy 0, retain count 12> | | +-o ata-6@D <class IOPCIDevice, registered, matched, active, busy 0, retain count 13> | | | +-o AppleKauaiATA <class AppleKauaiATA, !registered, !matched, active, busy 0, retain count 6> | | | +-o ATADeviceNub@0 <class ATADeviceNub, registered, matched, active, busy 0, retain count 6> | | | | +-o IOATABlockStorageDriver <class IOATABlockStorageDriver, registered, matched, active, busy 0, r$ | | | | +-o IOATABlockStorageDevice <class IOATABlockStorageDevice, registered, matched, active, busy 0,$ | | | | +-o *****My_Driver****** <class *****My_Driver******, registered, matched, active,$ | | | | +-o ST940110A Media <class IOMedia, registered, matched, active, busy 0, retain count 10> | | | | +-o IOMediaBSDClient <class IOMediaBSDClient, registered, matched, active, busy 0, retain $ | | | | +-o IOApplePartitionScheme <class IOApplePartitionScheme, !registered, !matched, active, b$ | | | | +-o Apple@1 <class IOMedia, registered, matched, active, busy 0, retain count 8> | | | | | +-o IOMediaBSDClient <class IOMediaBSDClient, registered, matched, active, busy 0, ret$ | | | | +-o Untitled@3 <class IOMedia, registered, matched, active, busy 0, retain count 9> | | | | +-o IOMediaBSDClient <class IOMediaBSDClient, registered, matched, active, busy 0, ret$ | | | +-o ATADeviceNub@1 <class ATADeviceNub, registered, matched, active, busy 0, retain count 6> | | | +-o IOATAPIProtocolTransport <class IOATAPIProtocolTransport, registered, matched, active, busy 0,$ | | | +-o IOSCSIPeripheralDeviceNub <class IOSCSIPeripheralDeviceNub, registered, matched, active, bus$ | | | +-o IOSCSIPeripheralDeviceType05 <class IOSCSIPeripheralDeviceType05, !registered, !matched, a$ | | | +-o IODVDServices <class IODVDServices, registered, matched, active, busy 0, retain count 6> | | | +-o SCSITaskUserClientIniter <class SCSITaskUserClientIniter, !registered, !matched, activ$ | | | +-o IODVDBlockStorageDriver <class IODVDBlockStorageDriver, registered, matched, active, b$ thanking in advance santosh k _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Processes running path
by Josh Graessley 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com There isn't a good, straightforward way of doing this. -josh On Jun 16, 2005, at 9:31 PM, matt jaffa wrote: Does anyone on this list know of some api or hack of using a processes id (pid) in a network kernel extension to get that process running path? This email sent to jgraessley(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com If you get in touch with DTS, they may be able to work with you towards a solution. We are aware of the issue and have a bug (enhancement request) filed to track it. Thanks Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com smime.p7s

1 0

Processes running path
by matt jaffa 17 Jun '05

17 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=Ku5aC/q3OIyDHlzFQ+7iIIrdYH0Ui5C248wWWv3FE3wpFuUajqzaLW/0lx0G+0j8bMPD7EPdFKZBHeA8cuuqVkGprayXh7SpZrfXofLEO3dUE1w5HcxY/xJ4Jjx3klJOaN/rHt6wOGL4qXeYge178EwsHVRa8Px1BUnHRKR/KA8= Does anyone on this list know of some api or hack of using a processes id (pid) in a network kernel extension to get that process running path? Thanks Matt _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: KEXT IP Filter sample code?
by Kevin Brock 16 Jun '05

16 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 16, 2005, at 2:20 AM, Quinn wrote: At 18:39 -0700 15/6/05, Allan Hoeltje wrote: You should check out the enetlognke. <http://developer.apple.com/samplecode/enetlognke/enetlognke.html> Kevin Brock apple(a)kevin.com Thanks for the quick reply. I know that tcplognke is a socket filter and even though I need an IP filter it would still be helpful to see some kind of sample code, Tiger or pre-Tiger, that uses KEXT. This new, Tiger-based sample is not directly relevant (it intercepts at the Ethernet layer rather than the IP layer), but it does show general NKE concepts, including packaging, memory allocation, locking, and so on. It's also much easier to understand than the tcplognke (-: ps One of the reasons that the tcplognke isn't published yet is because socket-level filters are tricky to get exactly right. The packet oriented filters (IP and Ethernet) are much easier. I've looked at the pre-release socket NKE example and at enetlognke. I've even got the basic stuff working on X.4.*. The thing that's missing from my viewpoint is legacy examples... Anything I develop is going to need to support X.3 users for at least a couple of years. Apple's own projections at the WWDC keynote showed a significant X.3 user base a year out. Is there a source for example code for X.3 NKEs? The documentation is still up there, but samples appear have simply been removed. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: KEXT IP Filter sample code?
by Allan Hoeltje 16 Jun '05

16 Jun '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Microsoft-Entourage/10.1.4.030702.0 Excellent! Thank you very much Quinn! -Allan "Quinn" <eskimo1(a)apple.com> wrote on 6/16/05 2:20 AM: > At 18:39 -0700 15/6/05, Allan Hoeltje wrote: >> Thanks for the quick reply. I know that tcplognke is a socket filter and >> even though I need an IP filter it would still be helpful to see some kind >> of sample code, Tiger or pre-Tiger, that uses KEXT. > > You should check out the enetlognke. > > <http://developer.apple.com/samplecode/enetlognke/enetlognke.html> > > This new, Tiger-based sample is not directly relevant (it intercepts > at the Ethernet layer rather than the IP layer), but it does show > general NKE concepts, including packaging, memory allocation, > locking, and so on. It's also much easier to understand than the > tcplognke (-: > > ps One of the reasons that the tcplognke isn't published yet is > because socket-level filters are tricky to get exactly right. The > packet oriented filters (IP and Ethernet) are much easier. > > S+E _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0