December 2008 - Darwin-kernel

Snow Leopard and NDAs
by Quinn 29 Dec '08

29 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Greetings All S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Just a friendly reminder that Snow Leopard is still covered by your Apple developer NDA and, as such, should not be discussed on a public mailing list like this one. This email sent to site_archiver(a)lists.apple.com

1 0

airport ioctls
by Paul Bissonnette 28 Dec '08

28 Dec '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Thanks, Paul _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I've been picking through the apple80211_ioctl.h and apple80211_var.h files in /System/Library/Frameworks/Kernel.framework/Headers/IOKit/ apple80211/ in my free time. I haven't been able to find much in the way of documentation and the combination of generic error messages and my lack of experience has made it a bit difficult. I have gotten a few of the more basic ioctl() calls in apple80211_ioctl.h to work but I was hoping somebody could show me how to get the scanning calls to work. More specifically if someone knows how to do a directed scan asynchronously I could use some help figuring it out. What I have so far is that if you specify exactly which channel the network is on it will work but if you give it a list of possible channels or don't specify any channels it will fail (using the channels array in the apple80211_scan_data structure that gets passed to the driver when requesting APPLE80211_SCAN_REQ). I also know that /dev/ath0 is where all of the notifications are dumped for various events pertaining to the airport including APPLE80211_M_SCAN_DONE (0xA). An example of what I'm trying to do would be: `/System/Library/PrivateFrameworks/Apple80211.framework/Resources/ airport -s<networkname>` I apologize if this is the wrong list or just a stupid question, I'm new to this. I also realize that the above binary already does what I'm trying to figure out, call me curious (and apparently not very good at reverse engineering). This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel panic with 64bit Snow Leopard and sendAsyncNotification
by mm w 26 Dec '08

26 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=0V7T9gPhbeqfz0slpQxV5RkDs6qCEtgyVaQ4/b8k2Rg=; b=GWsx9iZGAU5vC3dq22tJwZSwAzc5t6HKdZZ/vkqRGbh+CUof3M1Pd2o3mqxLwQqFzB Ljq5xWz+pgenL+oilbxe/yH5q2Gt23K1XOGMJXJH0rtIDD9fWO/hkJN0zT3jKFW1ss3J nEZoxfDqOzStcxcbM/zMp0ZprO7JoGk6KRFOU= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=Vj/Kp6iyB0d7ReXq6XonFnR8qnasJjXsAkU8Ys8gzNVeKlEYZqCShlcXeXBhocBv7s 9bPZwbYSFI9m2nPiASUdxXInoRgeC0JU+xpLbT3WOD4eIs7B0iyedeFJSMXDlhRS0ive 1pS3yNHgMgdQH6yjjgEMLacvH+JP+Vnbzdgz0= you should definitely alloc a pointer to your struct On Thu, Dec 25, 2008 at 12:22 PM, Dmitry Skorodumov <sdmitry(a)parallels.com> wrote: > I'm trying to bring to work the kextension + application(32bit, compiled on SDK10.4) on 64 bit Snow Leopard and have permanent Kernel Panic when my kextension does sendAsyncNotification to application. The panic (it seems so) occurs in ipc_object_copyin_from_kernel -> ip_lock(port) -> mutex_lock(...) > > The code looks usual (in the end of the mail).. Anyway, my thoughts that user mode application should not be able to send the kernel to panic, so the mach_port should be checked somewhere in kernel, so it seems to be a problem somewhere in 10.6, doesn't it? Or may be it is I that missing something.. > > I know, that recent sources do the callbacks using the IOConnectCallAsyncMethod, but I don't see the reason why this code causes panics. > > Could someone please point me to directions to look for? (32-bit 10.6 works ok) > > Thanks in advance! > > --- > Dmitry Skorodumov > > PS: Below goes the application and extension > > --- > > Application: > > io_connect_t conn; // initialized somewhere > IONotificationPortRef nport; // nport = IONotificationPortCreate(kIOMasterPortDefault) > typedef void (*notify_func)(void *ref, IOReturn r); > > int > init() > { > notify_func func; // initialized to point to my callback > // ... > mach_port_t port = IONotificationPortGetMachPort(nport) > > if ( IOConnectSetNotificationPort(conn, 0/*type*/, port, some_ctx) != KERN_SUCCESS) > return -1; > > if ( IOConnectMethodScalarIScalarO(conn, kMethodSetCallback, 1, 0, func) != KERN_SUCCESS ) > return -1; > > return 0; > } > > --- > > Extension: > > static struct notification_s { > mach_port_t port; > unsigned conn; > notify_func callback; > OSAsyncReference async; > } notify; // is zeroed somewhere > > IOReturn > Xxx_UserClient::registerNotificationPort( > mach_port_t port, UInt32 type, UInt32 conn) > { > notify.port = port; > notify.conn = conn; > } > > IOReturn > XXX_PrlnetUserClient::iomsetcb( > notify_func callback) > { > if (!this->notify.port || !callback) > return kIOReturnError; > > setAsyncReference( > notify.async, notify.port, > (void *)callback, (void *) notify.conn); > } > > And to fire the callback, > > XXX_PrlnetUserClient::Xxx_Fire() > { > if (!notify.port ) > return; > > this->sendAsyncResult( notify.async, kIOReturnSuccess, NULL/*args*/, 0/*nargs*/); > } > > --- > The end > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Kernel panic with 64bit Snow Leopard and sendAsyncNotification
by Dmitry Skorodumov 25 Dec '08

25 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Thread-index: AclmznNcsBPNqTjSTaSfJPWbJNhn9w== Thread-topic: Kernel panic with 64bit Snow Leopard and sendAsyncNotification I'm trying to bring to work the kextension + application(32bit, compiled on SDK10.4) on 64 bit Snow Leopard and have permanent Kernel Panic when my kextension does sendAsyncNotification to application. The panic (it seems so) occurs in ipc_object_copyin_from_kernel -> ip_lock(port) -> mutex_lock(...) The code looks usual (in the end of the mail).. Anyway, my thoughts that user mode application should not be able to send the kernel to panic, so the mach_port should be checked somewhere in kernel, so it seems to be a problem somewhere in 10.6, doesn't it? Or may be it is I that missing something.. I know, that recent sources do the callbacks using the IOConnectCallAsyncMethod, but I don't see the reason why this code causes panics. Could someone please point me to directions to look for? (32-bit 10.6 works ok) Thanks in advance! --- Dmitry Skorodumov PS: Below goes the application and extension --- Application: io_connect_t conn; // initialized somewhere IONotificationPortRef nport; // nport = IONotificationPortCreate(kIOMasterPortDefault) typedef void (*notify_func)(void *ref, IOReturn r); int init() { notify_func func; // initialized to point to my callback // ... mach_port_t port = IONotificationPortGetMachPort(nport) if ( IOConnectSetNotificationPort(conn, 0/*type*/, port, some_ctx) != KERN_SUCCESS) return -1; if ( IOConnectMethodScalarIScalarO(conn, kMethodSetCallback, 1, 0, func) != KERN_SUCCESS ) return -1; return 0; } --- Extension: static struct notification_s { mach_port_t port; unsigned conn; notify_func callback; OSAsyncReference async; } notify; // is zeroed somewhere IOReturn Xxx_UserClient::registerNotificationPort( mach_port_t port, UInt32 type, UInt32 conn) { notify.port = port; notify.conn = conn; } IOReturn XXX_PrlnetUserClient::iomsetcb( notify_func callback) { if (!this->notify.port || !callback) return kIOReturnError; setAsyncReference( notify.async, notify.port, (void *)callback, (void *) notify.conn); } And to fire the callback, XXX_PrlnetUserClient::Xxx_Fire() { if (!notify.port ) return; this->sendAsyncResult( notify.async, kIOReturnSuccess, NULL/*args*/, 0/*nargs*/); } --- The end _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Allocate contiguous wired memory and obtain physical address
by Terry Lambert 21 Dec '08

21 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com I'm toying with how the IDT is handled in XNU. Basically I need to setup my own IDT via LIDT. Apparently doing this via mp_rendezvous() (this is for a project involving a patch to the kernel source) and using the physical address returned by IOMallocContiguous won't help. Obviously I'm copying the original IDT and saving its original location to be restored eventually, albeit it's not required in this scenario. I come from a Linux kernel development background and never experienced this issue before, so I suppose I'm missing something specific to XNU. Does the returned phys addr truly contain a fixed address value? I asked because kmem_alloc API functions exist for the same purpose but they aren't even exported through com.apple.kernel. There was no pun intended there, at all. I was simply stating a fact. Since IOLib provides perfectly useful API for this, it's not a problem this time. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Dec 21, 2008, at 1:13 PM, "John D." <johndenkar(a)gmail.com> wrote: On Sun, Dec 21, 2008 at 10:03 PM, Michael Smith <msmith(a)mu.org> wrote: If you were to explain *why* you want this allocation, it might be easier to help you. We have supported API for this. Take a look at the WINE sources for example usage. If you are trying to take over the normal system call vector, though, that's not supported. >From a security perspective, if you wrote code that succeeded in doing this, I would feel more or less obligated to break it by declaring the kernel virtual address space off limits to modification by Mach vm_* API. Mike already indicated that kernel memory allocations are wired. There is an API to get pageable kernel memory, but almost no one uses it (I know of one caller). Wired allocations have fixed physical addresses, by definition; that's what "wired" means. Give it a break already. I think Mike was merely pointing out that you'll be more likely to get useful responses if you don't make back-handed jabs at architectural decisions which have already been explained as to their purpose. This email sent to site_archiver(a)lists.apple.com

1 0

Re: vm_read() implementation details
by Terry Lambert 21 Dec '08

21 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Hi, I wanted to confirm that vm_read() is implemented using the Mach IPC backend. If positive, what is the message header and structure, and how could I emulate this via mach_msg() style API. Apparently dtruss can't be used to intercept and log mach traps. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Dec 21, 2008, at 1:04 PM, "John D." <johndenkar(a)gmail.com> wrote: Please file an enhancement request using the web interface. I agree that this would be a useful enhancement to dtruss, although I'm unsure how much of the arguments will end up decoded, or when such a request would be satisfied. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Allocate contiguous wired memory and obtain physical address
by John D. 21 Dec '08

21 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=3t393qXf5SulXeD9GQDXU5OXfA1sBk9zNWiSeF38VEQ=; b=E71azzE0IZpOT8yLBNINA90Ah3/5rZd31EsGkFN6B4XgPZ8+Z0FzCx9APp5Jr8V+Uu FLAd1HRYvjPyPuoRlV2SIk15HiITArwhlDtxPpQwMmTTMA9qszaoTuxRgAnF3oUFqwav 2GBLkXZcDR5uoJv6yIWTyrbA34OjDfkgP4TEk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=ie6/5svsOwWrqfBoFiG7WwN5AJ+RJq7aJ36B4ob5ylfWyOgPhPZh7vddLbWWjBqdlS 0pZeucEx3173uZIaWRxHYBKt3nfqMJZjMn+SZz2sq8B0t3wn63d+LWT2ajA+vKxhKZEr 8Oi/GIEiHGVeLyDPJtHx+kviqN4IMzp0MLnQ4= On Sun, Dec 21, 2008 at 10:03 PM, Michael Smith <msmith(a)mu.org> wrote: > If you were to explain *why* you want this allocation, it might be easier to > help you. I'm toying with how the IDT is handled in XNU. Basically I need to setup my own IDT via LIDT. Apparently doing this via mp_rendezvous() (this is for a project involving a patch to the kernel source) and using the physical address returned by IOMallocContiguous won't help. Obviously I'm copying the original IDT and saving its original location to be restored eventually, albeit it's not required in this scenario. I come from a Linux kernel development background and never experienced this issue before, so I suppose I'm missing something specific to XNU. Does the returned phys addr truly contain a fixed address value? >> I asked because kmem_alloc API functions exist for the same purpose >> but they aren't even exported through com.apple.kernel. > Give it a break already. There was no pun intended there, at all. I was simply stating a fact. Since IOLib provides perfectly useful API for this, it's not a problem this time. -- John Denkar _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

vm_read() implementation details
by John D. 21 Dec '08

21 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=Fbocm0gc+dYT2gKUbL+iDfmD4BEvtWDj9KdYXNK91Dw=; b=c/33Uv3U18ub+uPhOg7miUwgLXubF+Qpz4Kno2RZs6wvRvrSZpnwMXeDO+ikt2VFoR DtoUeUwpxBDt6j+FTGS0v/7C+hdS7WkFC1J49DqVbsjmyLqM6ps2zQGxCWIEKbYUh6/m 7Su+OxJUsQjXkRgAElxzSzGzKsZODJ0olm9ks= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=NRqiOuJuqmXVSZVgbNqEKiTrLHZBHpfH6wfy9jsmQ/LYls6ml9uGfRX1S2iAPuNPUo Ck33uEeNnPL23ZVy5yJY/79spuSiagum3AquLAhW6hqPpNwu6GhWF44R++BHtueNWxw5 8NhA3ZZw6tCl3QFSUMwI7imZevysA1S4++SoM= Hi, I wanted to confirm that vm_read() is implemented using the Mach IPC backend. If positive, what is the message header and structure, and how could I emulate this via mach_msg() style API. Apparently dtruss can't be used to intercept and log mach traps. Thanks. -- John Denkar _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Allocate contiguous wired memory and obtain physical address
by John D. 21 Dec '08

21 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=xNhnDwoQCpNnok4dBw1DACEOadE8igPwfJRKWEUGOhs=; b=fTN4AkcfaOxHbq6K8JeQr/gw4R0pkK+UHMWPuwdspMhJCxEuj7ZG5evGEPQ8XSyiOZ 3+v5jilBHiA40Q9NDztpv6yf4faGunbnWP8O/J4YaDrAb/MjD2cVaq8LWcUDU7l4zpk7 P+GGtTU1EhXxFcrVhbfkjVzS79IYaeUMHTc0g= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=COi0hZM9LwgORNNSHdR63/ME4+lozryq13aaaYCBHIq/V8VZ1B4nKpgCE48D76eolY QR+Z/l5NfVWGYsiqFjCoOOP9yavc0yAuskeA+4zwRCR20GAG5QAS14v2mt5J3rn64LP2 3mp4uz+Am/wikOeIOYfCRLXbhSI38epW1mPiw= Unfortunately I need a explicitly not-to-be-paged-out contiguous region. The space I require is less than a page in size, thus it's not an issue here. I asked because kmem_alloc API functions exist for the same purpose but they aren't even exported through com.apple.kernel. Thanks. On Sun, Dec 21, 2008 at 7:30 PM, Terry Lambert <tlambert(a)apple.com> wrote: > > > On Dec 21, 2008, at 9:43 AM, "John D." <johndenkar(a)gmail.com> wrote: > >> Hi, >> >> I would like to know what KPIs are exported to kernel extensions for >> allocating contiguous wired memory (non pageable) and then obtain its >> physical address. >> Do the IOKit IOMalloc functions provide this functionality? > > IOMallocContiguous > > You can read more about it on <http://developer.apple.com>; it's the first > result you get from typing /contiguous wired memory/ into the search box > there. The third result tells you why you should not be doing it. > > -- Terry > -- John Denkar _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Allocate contiguous wired memory and obtain physical address
by Michael Smith 21 Dec '08

21 Dec '08

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com On Dec 21, 2008, at 9:43 AM, John D. wrote: I would like to know what KPIs are exported to kernel extensions for allocating contiguous wired memory (non pageable) and then obtain its physical address. Do the IOKit IOMalloc functions provide this functionality? This functionality is provided by IOBufferMemoryDescriptor. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… IOMallocContiguous only gets you half of the picture. Note that you should not attempt to allocate contiguous memory on your work path, as the scan/relocation process can be exceptionally expensive once the system has been up and running. It's best shortly after system startup, and acceptable at module load time or during other exceptional events (hardware arrival, for example). This email sent to site_archiver(a)lists.apple.com

1 0