June 2006 - Darwin-kernel - lists.apple.com

Re: dlil_output_list and interface filters
by Anton Kuzmin 09 Jun '06

09 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 1.5.0.4 (Windows/20060516) Anton Thanks, -josh On Jun 9, 2006, at 12:20 PM, Anton Kuzmin wrote: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks, I'll file a report later today, and what about the second question, about the way it's designed to free the whole list if a single packet fails or gets filtered? Or is that also a design flaw and going to be changed in the next release? Also, is there any chance of fixing this in 10.4.7 update? We've got some pretty unhappy customers due to this and I couldn't find any straightforward workaround. Josh Graessley wrote: That is definitely a bug. Please file a bug report. It does look like this is fixed in the sources for the next major release (part of some re-factoring), but it doesn't look like there were any changes made for a software update fix. I've been trying to nail down a mysterious kernel panic that occurs when our KPI interface filter is enabled and stumbled across a possible reason for it: in dlil_output_list after a call to filt_output, a check for EJUSTRETURN leads to what seems to be an erroneous "continue", which skips to the next interface filter instead of bailing out. So basically any packet consumed by an interface filter still gets passed to if_output and freed, which leads to a nasty surprise for an unsuspecting filter still referencing the freed mbuf. Could someone do a sanity check on this and if it's indeed a bug, I'll file a radar. Also, I would be grateful if someone could explain why a failure to process a single packet from a list should cause freeing of the whole list. This email sent to site_archiver(a)lists.apple.com

1 0

Re: dlil_output_list and interface filters
by Josh Graessley 09 Jun '06

09 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Thanks, -josh On Jun 9, 2006, at 12:20 PM, Anton Kuzmin wrote: Thanks, Anton _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/jgraessley%40apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com That is definitely a bug. Please file a bug report. It does look like this is fixed in the sources for the next major release (part of some re-factoring), but it doesn't look like there were any changes made for a software update fix. I've been trying to nail down a mysterious kernel panic that occurs when our KPI interface filter is enabled and stumbled across a possible reason for it: in dlil_output_list after a call to filt_output, a check for EJUSTRETURN leads to what seems to be an erroneous "continue", which skips to the next interface filter instead of bailing out. So basically any packet consumed by an interface filter still gets passed to if_output and freed, which leads to a nasty surprise for an unsuspecting filter still referencing the freed mbuf. Could someone do a sanity check on this and if it's indeed a bug, I'll file a radar. Also, I would be grateful if someone could explain why a failure to process a single packet from a list should cause freeing of the whole list. This email sent to jgraessley(a)apple.com smime.p7s

1 0

dlil_output_list and interface filters
by Anton Kuzmin 09 Jun '06

09 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 1.5.0.4 (Windows/20060516) Thanks, Anton _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I've been trying to nail down a mysterious kernel panic that occurs when our KPI interface filter is enabled and stumbled across a possible reason for it: in dlil_output_list after a call to filt_output, a check for EJUSTRETURN leads to what seems to be an erroneous "continue", which skips to the next interface filter instead of bailing out. So basically any packet consumed by an interface filter still gets passed to if_output and freed, which leads to a nasty surprise for an unsuspecting filter still referencing the freed mbuf. Could someone do a sanity check on this and if it's indeed a bug, I'll file a radar. Also, I would be grateful if someone could explain why a failure to process a single packet from a list should cause freeing of the whole list. This email sent to site_archiver(a)lists.apple.com

1 0

Re: My KEXT fails to unload, if USB device removed. Why?
by Garth Cummings 08 Jun '06

08 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

My KEXT fails to unload, if USB device removed. Why?
by rohit dhamija 08 Jun '06

08 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=FkYChMpOXX8CHzmT2N3mz+on5RVsy+pXYw1VqSEZU6nbFBR3hqK9tOMt73SL38Jdi9uo/uh9ewpYcqb1poXaPMrf2eA2fiz6bdcS6ysss7jxaByvniiEZPMdSZMl7dNwPOXMMHIuNdP+tt2qJ74mTPipVXCyD/13EucDfCcV5Qg= Dear All, I am developing kernel extension , KEXT for my USB bulk type and control type devices for Mac OS 10.4 PowerPC and Intel Mac. I am encountering some issues while unloading the kext. The kext fails to unload in a situation if I first remove the USB device and then try to unload the KEXT. Below are the two different scenerios: Scene 1) I attach my USB Device, perform the operations on the device and then unload the kext , (sudo kextunload -v myDriver.kext). In the above case, the kext gets unloaded successfully without issues. ioclasscount myDriver = 1 , before unloading the kext and ioclasscount myDriver = 0, after unloading the kext. So this works perfectly. Now comes the next scenerio (the main issue ) Scene 2) I attach my USB device, perform some operations, and DETACH the USB device and then try to "unload the kext". But this time the kext fails to unload ioclasscount myDriver = 1 before unloading after detach and attach ioclasscount myDriver = 2 and after trying to unload my kext, the class count remains the same. ////// At implementation level , 1. At probe:: IOService *myDriver::probe(IOService *provider, SInt32 *score) I have implemented a singleton class that maintains list of IOUSBDevice* and IOUSBInterface* correspoding to each device ( i did it because i have multiple usb devices to support) 2. In order to receive message from my provider, myDriver implement message IOReturn Sentinel::message(UInt32 type, IOService *provider, void *argument) Under this, i capture the device removal situation, kIOMessageServiceIsTerminated case,get called up when the device has been removed. So I close and release the IOUSBDevice* and IOUSBInterface* under this case corresponding to each device removed. ///// Is this the correct way to detect whether my USB device has been removed ? Or Is it advisable to release the allocated memory (i.e.IOUSBDevice*, IOUSBInterface* ) at service stop rather than doing it at message()? Or Am I missing something ? Please suggest. Any pointers, suggestions, comments, are most welcome. Regards, Rohit Dhamija -- Rohit Dhamija(M) 9818446545 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: mbuf data access
by jy.cases＠mac.com 08 Jun '06

08 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 7 juin 06, at 19:26, Josh Graessley wrote: Is there a way to find out if those mbufs are shared ? Jean-Yves _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… mbuf_len like mbuf_data works whether or not MBUF_EXT is set. MBUF_EXT just indicates that the actual implementation of the mbuf is storing the data in an external cluster and not in the mbuf data structure itself. The one reason this would be important to a client of the mbuf is the case where you may modify data. In some cases, the reference to the external cluster may be shared. If this is the case, you will need to duplicate the data before modifying it. Duplicate data means duplicate mbuf or the whole chain ? In my code (in sf_data_in and sf_data_out) , i check out if mbuf was tagged, in this case filter simply return, otherwise i set a tag for the mbuf and push it in a queue for re- injection. When timer is fired mbuf is retrieve from queue and the mbuf is processed. So, do i need to duplicate mbuf before tag ? before push it in queue ? or before re-injection ? This email sent to site_archiver(a)lists.apple.com

1 0

Re: mbuf data access
by jy.cases＠mac.com 08 Jun '06

08 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 7 juin 06, at 19:31, Vincent Lubet wrote: I'm confused, in previous thread Josh Graessley wrote: I'm working at the socket filter level ..... Jean-Yves _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Yes you need to recompute the checksum(s) to compensate for the modification. Depending on what you modify this will be the IP checksum or the UDP checksum or both. .... "Sometimes. At the socket filter layer, no. At the IP filter layer yes." This email sent to site_archiver(a)lists.apple.com

1 0

Fwd: mbuf data access
by Stephane Sudre 08 Jun '06

08 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Was sent to the wrong list Begin forwarded message: From: Josh Graessley Date: 7 juin 2006 19:26:36 GMT+02:00 To: "jy.cases" Cc: Darwin-dev(a)lists.apple.com Subject: Re: mbuf data access On Jun 7, 2006, at 9:34 AM, jy.cases(a)mac.com wrote: Hi all, I'm writing some NKE UDP filter with packet mangling + packet re- injection, when i have a mbuf (in chain) with flags set to MBUF_PKTHDR i've got an access to data using MTOD(tMbuf, caddr_t), at this point every things works fine but when the mbuf in the chain is marked as MBUF_EXT nothing work at all. - mbuf_len() on a mbuf (marked as MBUF_EXT) in a mbuf chain is a valid length ? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… - How can have access to packet data ? mbuf_data will give you access to the data stored in that mbuf. It is possible the data is stored in multiple mbufs chained together. You can call mbuf_next to get the next mbuf in the chain. mbuf_len like mbuf_data works whether or not MBUF_EXT is set. MBUF_EXT just indicates that the actual implementation of the mbuf is storing the data in an external cluster and not in the mbuf data structure itself. The one reason this would be important to a client of the mbuf is the case where you may modify data. In some cases, the reference to the external cluster may be shared. If this is the case, you will need to duplicate the data before modifying it. This often happens with data sent from a TCP socket. The TCP data sits in the socket's send queue. mbufs are created to reference that data without copying it. Your filter will see mbufs pointing to that referenced data. If you did something like encrypt that data, you would be encrypting the copy in the socket buffer. If this data was retransmitted, you would have corrupted the data stream. - when modifying such packets do i need to compute some checksums ? Sometimes. At the socket filter layer, no. At the IP filter layer yes. On the inbound path, you need to verify the original checksum yourself. Discard the packet if the checksum is bad. If not, modify the data. Once the data has been modified, calculate the right checksum and call mbuf_inbound_modified. You can also modify the checksum to account for the changes instead of checking the old one and generating a new one. You still need to call mbuf_inbound_modified. For more information, look at mbuf_inbound_modified. On the outbound path, you need to call mbuf_outbound_finalize before you start modifying the packet. You will be responsible for modifying the checksums once you have called this function. This email sent to site_archiver(a)lists.apple.com

1 0

Re: mbuf data access
by Vincent Lubet 07 Jun '06

07 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 7, 2006, at 9:34 AM, jy.cases(a)mac.com wrote: mbuf_data() gives you access to the start of the data. - mbuf_len() on a mbuf (marked as MBUF_EXT) in a mbuf chain is a valid length ? Vincent _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm writing some NKE UDP filter with packet mangling + packet re- injection, when i have a mbuf (in chain) with flags set to MBUF_PKTHDR i've got an access to data using MTOD(tMbuf, caddr_t), at this point every things works fine but when the mbuf in the chain is marked as MBUF_EXT nothing work at all. - How can have access to packet data ? A packet can be made of several mbuf that are chained. mbuf_len() gives you the length of each mbuf. The linkage to the next mbuf of the chain is given by mbuf_next(). The total length of the packet is given by mbuf_pkthdr_len() of the first mbuf of the chain (the one marked with MBUF_PKTHDR) - when modifying such packets do i need to compute some checksums ? Yes you need to recompute the checksum(s) to compensate for the modification. Depending on what you modify this will be the IP checksum or the UDP checksum or both. This email sent to site_archiver(a)lists.apple.com

1 0

mbuf data access
by jy.cases＠mac.com 07 Jun '06

07 Jun '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi all, - How can have access to packet data ? - mbuf_len() on a mbuf (marked as MBUF_EXT) in a mbuf chain is a valid length ? - when modifying such packets do i need to compute some checksums ? Any tips, clarifications,..., will be appreciate. * My MTOD macro is: #define MTOD(m, t) ((t)(mbuf_data(m))) Jean-Yves Cases jy.cases(a)mac.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm writing some NKE UDP filter with packet mangling + packet re- injection, when i have a mbuf (in chain) with flags set to MBUF_PKTHDR i've got an access to data using MTOD(tMbuf, caddr_t), at this point every things works fine but when the mbuf in the chain is marked as MBUF_EXT nothing work at all. This email sent to site_archiver(a)lists.apple.com

1 0