July 2005 - Darwin-kernel - lists.apple.com

PE_enter_debugger and Darwin 8
by Brian Bergstrand 15 Jul '05

15 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Any way around this? TIA. Brian Bergstrand <http://www.bergstrand.org/brian/> PGP Key ID: 0xB6C7B6A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFC2CbAedHYW7bHtqIRAvzVAKDmhT1216FjL32olWHDxQ23IxMnOgCgqOQW nbZ9Bw44XmpB3phHLkIYJh0= =JJBz -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… So it seems this symbol is not exported by any KPI. And I really do not want to maintain a separate plist that links against the kernel proper for dev versions. I thought maybe asm {"trap"} would do the same thing as in userland (break into the debugger), but that's probably hoping for too much? This email sent to site_archiver(a)lists.apple.com

1 0

Re: File level action protocol
by Mike Smith 15 Jul '05

15 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 9, 2005, at 12:50 AM, Thomas Tempelmann wrote: If the delayed notification is acceptable, how long a delay can you tolerate? Ok. It sounds like the asynchronous interface that Spotlight uses will probably be your best bet. lookup passes a parent object and a name fragment to a filesystem and gets back a child object or an error. You can also look up by a file ID instead of parID+name, right? So, all I need is to know a file's ID for my project. On some filesystems, yes. Lookups performed by fileid may not have a meaningful parent identifier at all But you want to know about "all" files, and there may be many files *not* on HFS+ As long as I can learn the File ID while I do the recording, I should be fine. So, what I need then is a (later) association between a vnode and a File ID. Path. Isn't the Vnode identified by a unique number that is, like the dir and file ID, remaining constant as long as its file/dir exists? Can I record this vnode number when I get a "file change" notification? If you're using the spotlight-style interface, you'll get a path which can be converted in user space to a File ID. On the KAUTH-based interface, you can fetch a path for the vnode. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Several seconds are no problem. On HFS+, they do, and that's all I care about. The interfaces available to you use paths, not File IDs. You can translate these, but again be aware that some volume formats do (can) not support persistent File IDs. The file handle is not relevant at the layer you're interested in; it's a per-process association between a descriptor number and a vnode. Because File IDs are (can) not be ubiquitous, the kernel doesn't use them; it has some mechanisms for looking things up by ID, but they're not otherwise useful. This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc_zone_t - overriding free/malloc
by Glen Beane 15 Jul '05

15 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com turns out there was a bug in my zone->size function I guess I wasn't thinking too clearly On Jul 15, 2005, at 12:23 AM, Glen Beane wrote: malloc: *** Deallocation of a pointer not malloced: If I call my free directly instead it works as expected. This email sent to beaneg(a)umcs.maine.edu _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Also, sorry about the email below - looking at it now I see that the last couple paragraphs really don't make any sense - &malloc obviously isn't the same address as my malloc malloc calls malloc_zone_malloc, and malloc_zone_malloc calls zone- >malloc I use malloc_default_zone to get the default zone and then I overwrite the pointers to malloc,calloc,valloc,realloc and free with pointers to my own functions. My malloc gets called as I expect, but when I call free I get the following error: If I print &malloc, I get the address of my malloc, if I print &free I see the original free. If I call malloc_default_zone and print the pointer to free I see my free, not the default free. Why is the original free being called rather than the function I stick into the default_zone structure? malloc works as expected so I thought I was doing this right. Anyone know what I'm doing wrong? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/beaneg% 40umcs.maine.edu This email sent to site_archiver(a)lists.apple.com

1 0

Re: malloc_zone_t - overriding free/malloc
by Glen Beane 15 Jul '05

15 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Mozilla Thunderbird 0.5 (Windows/20040207) Glen Beane wrote: malloc: *** Deallocation of a pointer not malloced: If I call my free directly instead it works as expected. This email sent to beaneg(a)umcs.maine.edu _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… OK, I was tired when I wrote that... that bit about &malloc showing the address of my malloc doesn't even sense. anyway I've dug through malloc.c and I figured out why I was getting that error, now I just need to figure out how to fix it... I use malloc_default_zone to get the default zone and then I overwrite the pointers to malloc,calloc,valloc,realloc and free with pointers to my own functions. My malloc gets called as I expect, but when I call free I get the following error: If I print &malloc, I get the address of my malloc, if I print &free I see the original free. If I call malloc_default_zone and print the pointer to free I see my free, not the default free. Why is the original free being called rather than the function I stick into the default_zone structure? malloc works as expected so I thought I was doing this right. Anyone know what I'm doing wrong? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/beaneg%40umcs.maine.edu This email sent to site_archiver(a)lists.apple.com

1 0

malloc_zone_t - overriding free/malloc
by Glen Beane 15 Jul '05

15 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Mozilla Thunderbird 0.5 (Windows/20040207) malloc: *** Deallocation of a pointer not malloced: If I call my free directly instead it works as expected. Anyone know what I'm doing wrong? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I use malloc_default_zone to get the default zone and then I overwrite the pointers to malloc,calloc,valloc,realloc and free with pointers to my own functions. My malloc gets called as I expect, but when I call free I get the following error: If I print &malloc, I get the address of my malloc, if I print &free I see the original free. If I call malloc_default_zone and print the pointer to free I see my free, not the default free. Why is the original free being called rather than the function I stick into the default_zone structure? malloc works as expected so I thought I was doing this right. This email sent to site_archiver(a)lists.apple.com

1 0

Ctl_enqueuedata ENOBUFS error solved
by Allan Hoeltje 15 Jul '05

15 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Microsoft-Entourage/10.1.4.030702.0 The ENOBUFS error I was getting last week in my call to ctl_enqueuedata was caused by my me. I have been programming with high-level interfaces for too long and forgot that speed is critical to some processes. :-} Ctl_enqueuedata was running out of queue space because the data was not being read fast enough from the queue by my user app. My user app was calling printf's to dump the data obtained by recv. I now have the recv in one thread and the printf's in another thread with a little TAILQ to pass the data. So, don't worry, the kernel code is sound and only throws an ENOBUF when it has a good reason. -Allan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Unloading a KEXT with Client still connected
by Josh Graessley 13 Jul '05

13 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 13, 2005, at 3:47 PM, Allan Hoeltje wrote: <snip> -josh _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com So, are you all saying that in my _stop() there is a way to see if a client is connected and if so merely return KERN_FAILURE to prevent the KEXT from unloading? What api is this? There is no ctl_ call available in kern_control.h to do this ... Unless I call ctl_deregister first in my _stop() and return KERN_FAILURE immediately if I get EBUSY - is that it? Yes, that is a good solution. If that succeeds, you can unload the filters. You should note that unloading the filters may not happen immediately too. When you register your ip filters, you also specify a function to be notified when the filter has been disconnected (ipf_detach). You can't let your kext unload until that callback has been called for all filters you registered. As long as your kext is still in use by the kernel (has filters or anything with a callback, even an open socket with an upcall function), you must not let your kext unload. Doing so will lead to a kernel panic when the kernel calls in to your unloaded kext. Users shouldn't be manually unloading your kext. Even if they try, your _stop function can prevent it by returning the error. smime.p7s

1 0

Re: Unloading a KEXT with Client still connected
by Allan Hoeltje 13 Jul '05

13 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Microsoft-Entourage/10.1.4.030702.0 Thank you all for responding: > Can it be possible to rethink the issue and wonder if instead, you > could not just prevent the kext from being unloaded when the client is > connected? > Your kext can, and probably should, refuse to unload if there are > connections open. > Can you better outline what type of KEXT this is? What IOKit family, > etc. are you based on? > > The answer can depend on family / type of KEXT (but also listen to > what other have already responded with). OK, let me be more specific. My KEXT is an IP filter and I am sending selected IP packets to my client. In the KEXT _start() function I add IPv4 and IPv6 filters and then do a ctl_register with a dynamic ID. My client app opens the KEXT connection via: sockNum = socket( PF_SYSTEM, SOCK_DGRAM, SYSPROTO_CONTROL ) ioctl( sockNum, CTLIOCGINFO, &info ) // to get the ctl_id connect( sockNum, (struct sockaddr *)&sockAddr, sizeof( struct sockaddr_ctl )) When the client starts, the KEXT gets a call in its ctl_connect_func and I save the kctlref and unit ID. When the client quits, the KEXT gets a call in its ctl_disconnect_func and I clean up any connection state that I maintain. My concern here is that my KEXT has no way of anticipating when the user (that's me) pulls the plug with kextunload while the connected app is still running. At that point the _stop funtion in my KEXT is called and I remove my IPv4 and IPv6 filters and then call ctl_deregister and deregister fails with EBUSY. So, are you all saying that in my _stop() there is a way to see if a client is connected and if so merely return KERN_FAILURE to prevent the KEXT from unloading? What api is this? There is no ctl_ call available in kern_control.h to do this ... Unless I call ctl_deregister first in my _stop() and return KERN_FAILURE immediately if I get EBUSY - is that it? > When shutting down or restarting, a non-IOKit kext will not be > unloaded automatically, so you will not get a panic if your client is > still connected. This is good news for when my KEXT goes into the startup folder. -Allan _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Unloading a KEXT with Client still connected
by Josh Graessley 13 Jul '05

13 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -josh On Jul 13, 2005, at 1:42 PM, Peter Lovell wrote: On Jul 13, 2005, at 4:25 PM, Allan Hoeltje wrote: Is there some way I can handle this? -Allan This email sent to jgraessley(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com Peter is correct. To elaborate further, I assume you're using a kernel control socket to communicate with your kext? When your kext's unload function is called, you need to unregister any filters, interfaces, and kernel control sockets you have registered. To unregister a kernel control socket, use the function ctl_deregister. This function will return an error if a client is connected. If this function returns an error, your kernel unload function should return KERN_FAILURE. When shutting down or restarting, a non-IOKit kext will not be unloaded automatically, so you will not get a panic if your client is still connected. Thank you all for coping with my continuous stream of newbie questions, hopefully including this one: I have a client application that connects to my KEXT and I am currently testing the KEXT by using kextload and kextunload. I noticed the hard way that if I kextunload the KEXT while my client is running and connected I get the scary "gray curtain of death" - which I guess is the kernel panic everybody refers to. Eventually my KEXT will be put in the startup folder. If the user shuts down with the client still running and connected to the KEXT will I get a kernel panic? I have looked at the XNU source code (thank you Justin!) and thought maybe there was some way for a KEXT to force close all client connections but found none. Your kext can, and probably should, refuse to unload if there are connections open. Try to think of the kext as a servant and look at the close-down sequence from the other direction. Your kext should stay there until its client (the application, or whatever) closes, and then you can unload. Don't try to close anything from your kext, but instead get the application to close the connection, with a little "help" if necessary. Cheers.....Peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com smime.p7s

1 0

Re: Unloading a KEXT with Client still connected
by Shawn Erickson 13 Jul '05

13 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 13, 2005, at 1:25 PM, Allan Hoeltje wrote: -Shawn _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thank you all for coping with my continuous stream of newbie questions, hopefully including this one: I have a client application that connects to my KEXT and I am currently testing the KEXT by using kextload and kextunload. I noticed the hard way that if I kextunload the KEXT while my client is running and connected I get the scary "gray curtain of death" - which I guess is the kernel panic everybody refers to. Eventually my KEXT will be put in the startup folder. If the user shuts down with the client still running and connected to the KEXT will I get a kernel panic? I have looked at the XNU source code (thank you Justin!) and thought maybe there was some way for a KEXT to force close all client connections but found none. Is there some way I can handle this? Can you better outline what type of KEXT this is? What IOKit family, etc. are you based on? The answer can depend on family / type of KEXT (but also listen to what other have already responded with). This email sent to site_archiver(a)lists.apple.com

1 0