April 2006 - Darwin-kernel - lists.apple.com

Re: Socket filtering
by Josh Graessley 26 Apr '06

26 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com I'm not sure what you are trying to accomplish here. When the socket is closed, any uninjected data should be discarded. -josh On Apr 26, 2006, at 4:31 PM, Eric Long wrote: Thanks, Eric _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com You are asking for a hook to use as a warning that the socket will close. Do you mean a hook before the client calls close on the socket? I'm not sure how one would predict such a thing. A hook after the client calls close seems useless because the client is done calling read, so there is no point in injecting data. If a socket filter swallows a packet but then its sf_detach_func() gets called before it has a chance to reinject the packet, it cannot at that point reinject the packet. What hook should be used to get advanced warning that the socket will close, so the filter can make sure and reinject the packet while it still can? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley% 40apple.com This email sent to jgraessley(a)apple.com smime.p7s

1 0

Socket filtering
by Eric Long 26 Apr '06

26 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Microsoft-Entourage/11.1.0.040913 If a socket filter swallows a packet but then its sf_detach_func() gets called before it has a chance to reinject the packet, it cannot at that point reinject the packet. What hook should be used to get advanced warning that the socket will close, so the filter can make sure and reinject the packet while it still can? Thanks, Eric _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kext fails to load when falloc is used
by Terry Lambert 26 Apr '06

26 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Apr 26, 2006, at 9:11 AM, Brian Bergstrand wrote: This is also correct. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Apr 26, 2006, at 7:44 AM, Sudarshan S wrote: I am trying to use falloc( ) call to mimic file open operation in the kext on 10.4.4 kernel. The loader fails to load kext as it can not resolve the symbol even though the symbol exists in mach_kernel. Is it something to do with specifying proper dependancies in 'OSBundleLibraries' section of info.plist ? -Leo falloc is not a supported KPI, therefore you'd have to link against the kernel proper (using OSBundleLibraries), but in doing so you limit your KEXT to that specific version of the kernel - neither earlier or later versions will work. If you plan on shipping the KEXT to third-party users this is a bad idea. The specific issue for falloc() is that it's a middle-tier function in which we implement locking of the per process open file table. We need to reserve the right to change the locking paradigm between point releases, both to fix any issues that users run into, and for performance or other reasons. The falloc() function also has the issue that it externalizes the struct fileproc pointer - this is a kernel internal structure, which we reserve the right to change the layout - again, either to fix problems, or for performance or other reasons. Because of this, we avoid externalizing the falloc() or falloc_locked () functions. If you absolutely need to be able to rendezvous with a file descriptor (e.g. either through a fork() or a fork(0 and a pass of /dev/fd/XXX on the command line as a security precaution, or through using UNIX domain sockets), then you need to create a device, a pseudo-device, a file system, or a protocol family/socket type to externalize the fd through normal channels. This will avoid the need to use such functions directly. Also, reading/writing to file from a KEXT is highly discouraged. It can lead to all kinds of problems. Better would be to create a userland daemon that acts as a proxy for the kext. When you do anything that might be on the paging path or some other code path that would reference itself through its normal operation, you risk a deadlock at best, or a system panic at worst. The proper approach to this is to create a (pseudo-)device, parse the information in user space in user space code to avoid bringing a large parser into wired memory in the kernel, and then ioctl() down the minimal possible information, as a pre-agreed upon format binary blob, to the (pseudo-) device driver, which then uses it (e.g. to download firmware for a PCI card, etc.). This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kext fails to load when falloc is used
by Brian Bergstrand 26 Apr '06

26 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Apr 26, 2006, at 7:44 AM, Sudarshan S wrote: Brian Bergstrand <http://www.bergstrand.org/brian/> PGP Key ID: 0xB6C7B6A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (Darwin) iD8DBQFET5utedHYW7bHtqIRApuCAKCRWd1FWOSoHhf+c+2tp+DC1da8qwCeK9Ev qKIkNrQOkPZvdboH7f1IwWo= =Atfj -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am trying to use falloc( ) call to mimic file open operation in the kext on 10.4.4 kernel. The loader fails to load kext as it can not resolve the symbol even though the symbol exists in mach_kernel. Is it something to do with specifying proper dependancies in 'OSBundleLibraries' section of info.plist ? -Leo falloc is not a supported KPI, therefore you'd have to link against the kernel proper (using OSBundleLibraries), but in doing so you limit your KEXT to that specific version of the kernel - neither earlier or later versions will work. If you plan on shipping the KEXT to third-party users this is a bad idea. Also, reading/writing to file from a KEXT is highly discouraged. It can lead to all kinds of problems. Better would be to create a userland daemon that acts as a proxy for the kext. This email sent to site_archiver(a)lists.apple.com

1 0

Kext fails to load when falloc is used
by Sudarshan S 26 Apr '06

26 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:Received:Date:From:Subject:To:MIME-Version:Content-Type:Content-Transfer-Encoding; b=W3sV8AJcx3lSRMXQKt6MlwxrRZqJXV+5rOOpTuT3mbYZ7Vl2KgdA9J4rSSXzEkBAVuMbK6xrR6cBJ0P9Oe6jo9taRO6BIKO0BVqcGmaKMvH5DLU/LizRiGG/oZJHGatBUDlmMMjRnQ2GdEAWoP8VmP0MHH46xcgFv/9SpQjOZAs= ; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

TCP 'soft' connection death.
by Matt Darland 24 Apr '06

24 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello all, Thanks, Matt Darland _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Scenario: 1. Via the KPI interfaces a TCP connection established to a remote machine. 2. Normal read/write flow of data occurs. 3. Peer goes away without performing TCP teardown (e.g. goes to sleep). At this point, sock_sendmbuf() will happily take additional data, without returning an error. As of waiting about 3 minutes, none of the socket filter events get called. Is the above behavior known to occur (i.e. should I be checking something else in my code)? Does the TCP stack believe the connection is still valid? Is there some way at the KPI level I can detect when TCP believes the connection to be dead, or am I not waiting long enough? This email sent to site_archiver(a)lists.apple.com

1 0

BlueTooth spewage
by Justin C. Walker 18 Apr '06

18 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, all, Thanks, in advance. Regards, Justin -- Justin C. Walker, Curmudgeon at Large Director Institute for the Enhancement of the Director's Income ----------- Nobody knows the trouble I've been ----------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am running Mac OS X/10.4.6, on a dual G5 (2.7GHz). I currently have BlueTooth disabled, and this afternoon, this popped up in my syslog. It's the first time I've seen it, and I'm puzzled. Can anyone educate me on it: what does it mean, why is it showing up, etc.? Apr 17 16:00:15 Zippo kernel[0]: IOBluetoothHCIController::terminateWL .. done Apr 17 16:00:15 Zippo kernel[0]: USBF: 1062442.940 IOUSBPipe [0x388c840]:ClosePipe for address 2, ep 1 had a retain count > 1. Leaking a pipe Apr 17 16:00:16 Zippo kernel[0]: CSRHIDTransitionDriver::probe: Apr 17 16:00:16 Zippo kernel[0]: CSRHIDTransitionDriver::start before command Apr 17 16:00:17 Zippo kernel[0]: USBF: 1062444.537 IOUSBCompositeDevice[0x3bbe500]::GetFullConfigurationDescriptor - Error (e00002ed) getting first 9 bytes of config descriptor Apr 17 16:00:17 Zippo kernel[0]: USBF: 1062444.539 IOUSBCompositeDevice[0x3bbe500]::GetFullConfigurationDescriptor - Error (e00002ed) getting first 9 bytes of config descriptor Apr 17 16:00:17 Zippo kernel[0]: USBF: 1062444.541 IOUSBCompositeDevice[0x3bbe500]::GetFullConfigurationDescriptor - Error (e00002ed) getting first 9 bytes of config descriptor Apr 17 16:00:17 Zippo kernel[0]: CSRHIDTransitionDriver::stop Apr 17 16:00:17 Zippo kernel[0]: IOBluetoothHCIController::start Idle Timer Stopped Apr 17 16:00:17 Zippo kernel[0]: [HCIController][setupHardware] AFH Is Supported This email sent to site_archiver(a)lists.apple.com

1 0

KAUTH_FILEOP_EXEC and interpreted scripts
by Arno Hautala 13 Apr '06

13 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hei, I would expect that a script like: #!/bin/sh curl apple.com Any help on this is appreciated. -- -- arno s. hautala /-\ arno(a)alum.wpi.edu -- -- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I was looking into the KAUTH_SCOPE_FILEOP notifications and ran into an possible inconsistency with the KAUTH_FILEOP_EXEC notification. The documentation (TN 2127 at http://developer.apple.com/technotes/ tn2005/tn2127.html) states of the vnode_t and char pointer: "...for interpreted scripts, such as shell or perl scripts, this is the script, not the interpreter)." In other words the path will refer to the executed script and you'll see a KAUTH_FILEOP_EXEC for ~/bin/ script.sh and not /bin/sh. However, in my testing (using http://developer.apple.com/samplecode/ KauthORama/listing1.html) it seems that an EXEC is not announced for interpreted scripts. should produce a variety of KAUTH_FILEOP_OPEN and KAUTH_FILEOP_CLOSE, which do appear, but also two KAUTH_FILEOP_EXEC notifications. One for the script, and a second for curl. In practice I'm only seeing one for curl. I see the same behavior for perl scripts. Are the other semantics dictating when KAUTH_FILEOP_EXEC is posted or is this a bug with kauth? Because the script IS opened I can always look for KAUTH_FILEOP_OPEN notifications, but it'd be much nicer to only process KAUTH_FILEOP_EXECs. This email sent to site_archiver(a)lists.apple.com

1 0

Re: block size limit in mmap()
by Terry Lambert 11 Apr '06

11 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Apr 11, 2006, at 11:47 AM, Roberto Toro wrote: I'm trying to make some processes share a quite large block of memory (~8MB). I started using shmget(). It worked well for files ~800KB but not for 8MB. So I moved to shm_open() and mmap(), and now I can't allocate more than a single page of memory, 4096 bytes !! This code shows the problem: [ ... ] off_t len = 4096; #include <stdio.h> #include <errno.h> #include <sys/mman.h> #include <fcntl.h> #include <unistd.h> #include <string.h> int main(__unused int argc, __unused char *argv[]) { int err, fd; off_t len = 4097; char *shm; fd = shm_open("/1234",O_CREAT|O_RDWR|O_EXCL,0666); if(fd<0) printf("shm_open() failed: %s\n",strerror(errno)); err = ftruncate(fd,len); if(err<0) printf("ftruncate() failed: %s\n",strerror(errno)); shm = mmap(NULL,len,PROT_READ|PROT_WRITE,MAP_SHARED,fd,(off_t)0); err = munmap(shm,len); if(err<0) printf("munmap() failed: %s\n",strerror(errno)); err = shm_unlink("/1234"); if(err<0) printf("shm_unlink() failed: %s\n",strerror(errno)); err = close(fd); if(err<0) printf("clos() failed: %s\n",strerror(errno)); return 0; } -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… size_t len=4096; Any help/hint/code-snippet will be *very* appreciated. It's unreported compilation warnings that are biting you; the minimum change required is: since the length argument to mmap() and ftruncate() is an off_t (64 bits), not a size_t (32 bits). The variable fails to be automatically coerced because you don't have the ftruncate() prototype in scope, since you failed to include <unistd.h>. You should also include <string.h> for the prototype for the strerror() function. Here are the warning flags I tend to use when compiling my own code to catch things like this in the compiler: CFLAGS= -Wall -Wno-format-y2k -W -Wstrict-prototypes -Wmissing- prototypes \ -Wpointer-arith -Wreturn-type -Wcast-qual -Wwrite-strings - Wswitch \ -Wshadow -Wcast-align -Wbad-function-cast -Wchar-subscripts -Winline \ -Wnested-externs -Wredundant-decls -Werror The last option makes warnings a fatal compilation error; in this case, you'd also need to have <sys/cdefs.h> (which is pretty much automatic) and add the __unused attribute before the argc/argv parameter declarations, since your code doesn't use them. Here's a compilation warning free version of the code that works like you want it to work: /* * technically MAP_FAILED should be compared here, instead of (char *)-1; * but I'm not sure if it's defined in the <sys/mman.h> header in your * version of the SDK that you're using here. */ if (shm==(char*)-1) printf("mmap() failed: %s\n",strerror(errno)); This email sent to site_archiver(a)lists.apple.com

1 0

block size limit in mmap()
by Roberto Toro 11 Apr '06

11 Apr '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Importance: Normal Hi, I'm trying to make some processes share a quite large block of memory (~8MB). I started using shmget(). It worked well for files ~800KB but not for 8MB. So I moved to shm_open() and mmap(), and now I can't allocate more than a single page of memory, 4096 bytes !! This code shows the problem: #include <stdio.h> #include <errno.h> #include <sys/mman.h> #include <fcntl.h> int main(int argc, char *argv[]) { int err,fd; size_t len=4096; char *shm; fd=shm_open("/1234",O_CREAT|O_RDWR|O_EXCL,0666); if(fd<0) printf ("shm_open() failed: %s\n",strerror(errno)); err=ftruncate(fd,len); if(err<0) printf("ftruncate() failed: %s \n",strerror(errno)); shm=mmap(NULL,len,PROT_READ|PROT_WRITE,MAP_SHARED,fd,(off_t)0); if (shm==(char*)-1) printf("mmap() failed: %s\n",strerror(errno)); err=munmap(shm,len); if(err<0) printf("munmap() failed: %s \n",strerror(errno)); err=shm_unlink("/1234"); if(err<0) printf("shm_unlink() failed: %s \n",strerror(errno)); err=close(fd); if(err<0) printf("clos() failed: %s\n",strerror(errno)); return 0; } I've compiled that in a PB G4 and in a G5 (both 10.4.5, gcc 4.0.0), and it fails at mmap() with and "Invalid argument" error, but if I change sz from 4097 to 4096, it works! Yet, if I read the man page for mmap it says: "The mmap function causes the pages starting at addr [the first argument: NULL] and continuing for at most len bytes to be mapped from the object described by fd, starting at byte offset offset. If offset or len is not a multiple of the pagesize, the mapped region may extend past the specified range." So, it *may* extend beyond one single page.... One year ago someone asked a quite similar question in this list ("shm_open and mmap: Invalid argument", Feb 2005), but the answer there should have the same problem of page-size limit. But I haven't found anything about a 1 page limit nor in google nor in the man pages of shm_open/ftruncate/ mmap (I didn't find for shmget/shmat neither)... there's something that I'm not understanding... Any help/hint/code-snippet will be *very* appreciated. Thank you, Roberto _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0