August 2007 - Darwin-kernel

Re: Finding symbols in loaded kexts
by Andrew Gallatin 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dean Reece writes: > If the symbol you want is not global (lower-case type specifier in > the nm output), or has been stripped out of the target kext entirely, > then there isn't really anything you can do. If the symbol is not global, but still present, would it work to call it via a function pointer initialized to the correct address? Eg, does the "global" property mean anything once the module is relocated? I vaguely remember a trick somebody here used to play with Linux. There was some function that wasn't exported that his module needed to call. So he had a wrapper script for his module that groveled around in kernel memory to find the function, then passed its address to his module, which used it in a function pointer. I don't remember if it was global or non global though.. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Michael Cashwell 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Aug 5, 2007, at 10:07 PM, Jim Clause wrote: You may not mean this literally, but just in case... By doing this using a blocking user thread this problem is avoided. Good luck! -Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… ... one question that's never been definitively answered is how the kernel can block and then call out to a user level application. The kernel does not "call out" to user space. If you think of the issue this way you are likely to make some poor design choices and have a rough time of it. The correct approach is to have a thread belonging to your background userland app call into your KEXT and block there waiting for something to do. Then, when some other event requires the utility app to do something it can (after arranging for some state or data to be passed to it) unblock that blocked thread. When it's done, it can call into the KEXT and block again. The key difference is thread ownership. If a kernel thread were to execute userland code and that code were to fault it would be very hard to kill the process and clean up the thread without causing a kernel panic. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Debugging Help
by Arvind Dalvi 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=IipoQE06iNipO+jpRUxVKyTsse/LmK9HU8X7Qj7mv5nUhX2bKOtzitE82NsBi/yiIEKvSEYCCSDYF70LiWIJCDUKyA9H7LsmI3UcrJMJJFTtKItQ6hijKaWc+9upD5mKTVh3uPT1OdTOWxAl3k1yzyerChaialOuJJiKaazBBNg= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=kRXv/BKPkzA7ZfEk6iB8yWcEAv6puDMmjWlgQefJdcZVLtlMQ8cNpz9+BedNLF7+Q50HqBI2dzsOGrxmEa75d3ryAEbLdglzHcLtFB8hdGoQJDXlGeocYAO0Nmja5i5JxoYHJd8tZ4Ap7al/+Z//jwEnn9foWBQ3GTo+MbhKRG4= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Michael Smith 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Aug 5, 2007, at 7:07 PM, Jim Clause wrote: This is very similar to a hypothetical virus scanner so many of the techniques should apply. I've read TN2127 and the list archives about implementing a virus scanner and one question that's never been definitively answered is how the kernel can block and then call out to a user level application. In fact TN2127 says in the Listener Gotchas section that the only foolproof method is the implement the scanner completely in the kernel. Is this still the recommended approach? If it is will I be able to implement my version of Time Machine? = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… It is legitimate to block in the VNODE scope handlers; the kernel will do this in some cases. What you're describing (a lazy file backup mechanism) is quite practical, but note that it may have a very poor user experience (due to high latency introduced by blocking file opens while making backups). You may find it wiser to perform deferred last-close backups; wait for a few seconds after a FILEOP_CLOSE notification (so you don't backup something that's going to be opened or deleted shortly afterwards) and then make the backup in the background. Yes, I know that you're envisaging an "undo" semantic, but trust me, users like to have backups that protect them from more than just their own mistakes... This email sent to site_archiver(a)lists.apple.com

1 0

Re: Finding symbols in loaded kexts
by Dean Reece 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hope this helps, - Dean _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 5, 2007, at 6:21 PM, Ryan Govostes wrote: Is it possible for one kext to locate a symbol in another kext? I've tried APETools, dlcompat, kld, and a couple other tricks without success, but I'll admit (and it should be obvious) that I only have a vague notion of what I'm doing. Obviously this is not for anything production and I accept responsibility for the horrible condition I'll likely leave my kernel in if I screw up! I did notice that kextstat is able to get a list of loaded kexts and their addresses, but I could not replicate its functionality from within the kernel. Surely there is a way to do so, but I'm not familiar with the functions used. [below, I refer to the kext that contains the symbol you are after as the "target" kext, and the one that is doing the lookup as the "probe" kext. When you say "find a symbol", I assume you trying get the kernel- virtual address of the storage/entry point for a symbol defined in the target kext by running code only in your probe kext. Is the symbol you are after global? (Use the nm command to examine the binary of your target kext. if the symbol of interest has a type specifier that is capital, then it is global.) Does the target kext allow other kexts to link against it? (does it have the "OSBundleCompatibleVersion" property.) If the answer to both of these it yes, then the solution is quite simple: Just have your probe kext declare a dependency on the target kext. You can then declare an extern reference to the symbol in question, and when the probe kext loads, it'll have its reference patched to the same address as the global symbol in the target kext. This is typically used to share data and make direct function calls between kexts, but you can also take the address of such symbols if that is what you want. If the target kext does not allow linking, then you can fake it by adding the "OSBundleCompatibleVersion" property with a value that is less-than-or-equal the CFBundleVersion value. Obviously, this is just a hack, and you shouldn't go and modify somebody else's kext in production code (you indicated this was just for your own experimentation). If the symbol you want is not global (lower-case type specifier in the nm output), or has been stripped out of the target kext entirely, then there isn't really anything you can do. This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Jim Clause 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:reply-to:sender:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition:x-google-sender-auth; b=bQD+OADrNwj2XarQESUAyzVgy0Ongol16MDO5ecZwX1DkmM901GZr8IL6l+u8UwViAf8o9zUynHC5cv3KfbeL/BE/m5gNoZYzDROT6maIO3LK5UBG7LA8co/XGOe7O9f5l66y7TGKT0JaewrFEv9K/k9zGaDtZyXLcIP+OtlUfo= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:reply-to:sender:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition:x-google-sender-auth; b=qgVR4TFxBDaOMBY7zN8sQxbkcgdqGwVoLA/+9QlBAslIxgnE+1pBMTsK/Zx2mckrIMhCVnsYwd6/K/50fFDGvhM7pxfpiFMR6yE3kDOYDrydAG0CdbsrvH/1p55yZMTSCMwNwQHUa52eNDFPDlcoDUL3C24GmzwBpAkSSD1JQ1A= All, I'd appreciate a little bit more information about some points in this thread, specifically what Terry said in points (3) and (4). I'd like to implement a technique that's very similar to Time Machine. Basically, a userland process would register with the kernel extension and provide a pid. The kernel extension would call the userland application whenever a vnode scope operation is performed by the pid. The userland app would then create a backup of the file that's being accessed. In this case I want to have blocking communication between the kernel and the userland application so that I can create the backup before the application can access the file. This is very similar to a hypothetical virus scanner so many of the techniques should apply. I've read TN2127 and the list archives about implementing a virus scanner and one question that's never been definitively answered is how the kernel can block and then call out to a user level application. In fact TN2127 says in the Listener Gotchas section that the only foolproof method is the implement the scanner completely in the kernel. Is this still the recommended approach? If it is will I be able to implement my version of Time Machine? Thanks, Jim _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Finding symbols in loaded kexts
by Justin C. Walker 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Aug 5, 2007, at 18:21 , Ryan Govostes wrote: Another one: what are you trying to accomplish with this effort? Justin -- Justin C. Walker, Curmudgeon-At-Large Institute for the Absorption of Federal Funds -------- If you're not confused, You're not paying attention -------- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Is it possible for one kext to locate a symbol in another kext? I've tried APETools, dlcompat, kld, and a couple other tricks without success, but I'll admit (and it should be obvious) that I only have a vague notion of what I'm doing. Obviously this is not for anything production and I accept responsibility for the horrible condition I'll likely leave my kernel in if I screw up! I did notice that kextstat is able to get a list of loaded kexts and their addresses, but I could not replicate its functionality from within the kernel. Surely there is a way to do so, but I'm not familiar with the functions used. I think you will find that symbol tables are not loaded into the kernel address space. To paraphrase an oft-repeated refrain on this list, what happens in user-mode should stay in user-mode. This email sent to site_archiver(a)lists.apple.com

1 0

Finding symbols in loaded kexts
by Ryan Govostes 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:resent-message-id:mime-version:content-type:resent-date:message-id:resent-to:from:subject:resent-from:date:to:x-mailer; b=KM7vJHRoBxLjjNFpe8wTwOKFUUmUugXAz33L/r1H3ot1Jvf+t4Z6aboxJVGlXWztX1+WDwdM0Jk6I9aJZaH3K3EqapRx/LDfZSzJyFLxP967d7sJc/laga6w7q8U88goBC/ixBfSDy+KKVt66VJkvxgIw6b/wWF4Huil66mwdVc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:resent-message-id:mime-version:content-type:resent-date:message-id:resent-to:from:subject:resent-from:date:to:x-mailer; b=W9y/kXu8eflEgwZ7HfC+wUx5YJa2S+NiqrZDtK4eta3S68UKJ/gNfpFf8OcPA7GM6PGHrd/z5taiq8mpND6bjFtX5RaZiXU6wQzvjbiuUHCrFoAAL4WVysMZ0dH4J33jALJLYOiOJ3b0g2X3SCV1XNKenKfJeb5SFVqUCG2RkFM= Resent-date: Sun, 5 Aug 2007 21:23:28 -0400 Resent-from: Ryan Govostes <rgovostes(a)gmail.com> Resent-message-id: <BAA0754A-32BA-461B-857D-E444C92AB0B6(a)gmail.com> Resent-to: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Kernel Panics
by Frederick Pearce 05 Aug '07

05 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Here's what the panic log indicates: IONetworkingFamily - I Dependencies: Satisfied Integrity: Kext has no receipt Any help would be greatly appreciated! Thanks. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm hoping that someone can shed some light on the almost daily panics I've been getting on my X-Serve Dual G4. Sun Aug 5 07:56:34 2007 panic(cpu 1 caller 0x0003FFE8): zalloc: "kalloc.64" (3860160 elements) retry fail 3 Latest stack backtrace for cpu 1: Backtrace: 0x000952D8 0x000957F0 0x00026898 0x0003FFE8 0x0002BC34 0x0007C284 0x0007C4AC 0x0028B114 0x002A5B18 0x00089D0C 0x00061340 0x00063258 0x000A84F0 0x000AB980 Proceeding back via exception chain: Exception state (sv=0x2D3F4000) PC=0x0005B134; MSR=0x4000D030; DAR=0xED2B7000; DSISR=0x40000000; LR=0x0004F5FC; R1=0xBFFFECF0; XCP=0x00000010 (0x400 - Inst access) Kernel version: Darwin Kernel Version 8.10.0: Wed May 23 16:50:59 PDT 2007; root:xnu-792.21.3~1/RELEASE_PPC ********* There are no third party extensions running and no keyboard or monitor attached. Original 1 Gig of RAM checked out fine. There are a few extensions that are interesting: AppleBCM5701Ethernet - Dependencies: Incomplete Dependency Errors: com.apple.iokit.IONetworkingFamily: No valid version of this dependency can be found Integrity: Kext has no receipt AppleGMACEthernet - Dependencies: Incomplete Dependency Errors: com.apple.iokit.IONetworkingFamily: No valid version of this dependency can be found Integrity: Kext has no receipt This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Michael Smith 04 Aug '07

04 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0