July 2008 - Darwin-kernel - lists.apple.com

Re: Computer not shutting down
by Greg 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com http://lists.apple.com/archives/darwin-kernel/2007/Jun/msg00111.html - Greg On Jul 22, 2008, at 11:10 PM, Greg wrote: continuing continuing done CPU halted Much appreciated, - Greg _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/greg%40kinostudios.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… After much trial and error I fixed the problem. I know that I'm probably not going to win any fans here by complaining, but I feel that Apple could do a whole lot more to document the kernel. While searching for a potential solution I discovered an email on this mailing list, from myself, asking for information about the vnode_lookup function: The only reply I received was from Michael telling me to look through the kernel source for example uses, which I did, couldn't find any examples, replied as such, and received no further replies. My entire experience writing the kernel extension has been one of poking around in the dark. Since kernel programming is already such a difficult and dangerous task, why should it be made even *more* difficult by providing virtually zero documentation for the API? Should third-party developers really be expected to simply know everything there is to know about how Darwin works before attempting to write a KEXT? If that's the case at the very least that should be stated somewhere in one of the introductory texts Apple offers like "KEXTConcept" or "KernelProgramming". My problem was solved by a single vnode_put function call after the vnode_lookup. The only reason I was able to figure this out was because I somehow managed to find in the depths of the mailing list an unanswered email about what the difference between 'vnode_put' and 'vnode_rele' was, and so I figured perhaps I needed to "release" the vnode_t given to me by vnode_lookup, which was not at all obvious even after looking at the source for vnode_lookup. Sorry for the rant. Hopefully this email might prove useful for somebody else encountering the same problem. Release your vnodes! Hi, I'm encountering an odd problem, that seems to be occurring on both 10.4 and 10.5. I have a C-based kernel extension (_start/_stop routines) that is loaded by a launchd daemon on startup and unloaded on shutdown (when the daemon gets a signal). The kernel reports (via printf messages) that it has been unloaded, in other words the _stop function was called, and it got to a point where all resources should have been freed and then it returns KERN_SUCCESS. However, the output on the screen stops at the following and sits there: Proper shutdown (when the KEXT is not installed) results in this output: I'd be very grateful for any ideas or theories as to why this is happening, what could be going wrong, as I'm not sure where to look, everything seems to be right.. This email sent to greg(a)kinostudios.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determining specific file sessions
by mm w 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=UAW0w3l4zLRcQ2DuVJWR53OTKevf8qkiFzTG349p828=; b=Mn4lavubRWQqiWCI1E7gBCm9zBD82kimNlbyxu1S2L9af9z1TBoA0sQZ1GASHnISXq 2gM/W87gPXy4FvQzMaAYsVLzfaLRx/r+eYa2saViVH6K3gSSxkUIJWVxE9isgxvFPhgK 8R0Qko1pjhaO4u5Sd4NcQvz4O1NtsJrS6hEnk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=h43CGogjYBNpXOtn1EZBkSZ1pxl06UWdm6XsiYy4/ZcAsS3UqeowRi+/YmVZeuJ+0J EqeeUbumUFxzCpMcAwjjcNc1AVIL5HwCYWgRADwElkaRIlhlkPHu4D2l4lHQxGWWbuwN hneY+WMON8Wxw3g2ihfJxnXCujDt6Vd6GuPao= you can also use what Terry did (UNIX03) for catching symbols, but it required a set of modificated headers with your own decoration @+ On Wed, Jul 23, 2008 at 1:57 AM, Quinn <eskimo1(a)apple.com> wrote: > At 10:27 +0200 23/7/08, Jernej Azarija wrote: >> >> As for the userspace interposition, do you see any clever way of doing it? > > There is no supported way to do dyld interposition. If you're building a > product that you plan to sell to the general public, this is not an option. > > If you're just experimenting, there's a discussion of dyld interposition in > the "Mac OS X Internals" book. It's not publicly documented by Apple > because it's not something we support. > > <http://osxbook.com/> > > S+E > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: About disk snapshot
by mm w 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=lrcLhsuq9/c2JX6kAGSrmio/4QM9BStfNthE+WScgHI=; b=g6YWAiKI/8aniNOAOng3Bdget15BfdYlsU2DJJSNaq/AE3rC5APoz7IbMAArzvYRtv TB1eyJ1b0D2iVV/qQ3eo1SKrjh/yt7Sf5jE9mzLByQjxuTm93PAL54gDW54znAI8MJtR HEQbSJ7SGvL+ZZFS8qfFxcxc5/+N+DDb+L74M= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=p9Q7YeneyGOKy/MzSU8r2S0eNLRAtaorewGRIamxa03IoB26xYkjPZHAibMVlcd3ne L356KWDawyAWwsvM6ODmHwducXIAO5dtzQyLZ1mB1sMYRKZ4BXIAiReAIUwoCgvgFTAN PI7IJsfVeEaAQSVR8gJtHE091sr+B/wTgmCA4= boot from your macos cd-rom, menu utilities -> disk utilities On Wed, Jul 23, 2008 at 12:02 AM, XiongJia Le <lexiongjia(a)gmail.com> wrote: > Hi all, > > Because I work for an application what need automatically create a > disk snapshot on OS X. > > I read some documents about this. I think we can use the shadow file. > Example, we can mount a disk like this: "hdituilt mount disk -shadow > /shadow.image" > > I think at this time all I/O will redirected to shadow file and I can > copy my snapshot from the RAW Device. > But that have some problems. The first that is must need re-mount the > disk, and I think at system run time we can't re-mount the boot > volume. > The second is I can not merge the shadow data to the real device when > after created the snapshot. > > Is have any easy way to create a snapshot for local disk? > > Thanks, > Xiongjia Le > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Real Time question
by Andrea Di Pasquale 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:mime-version :content-transfer-encoding:message-id:content-type:to:from:subject :date:x-mailer; bh=od8++Ukttpz4GOsTj3n/ytOOA1CMtB7Y/aOdWDj76YQ=; b=xriP3EQXzhmvcBfGFWljbKbHiHcj9BoyVx/9J/HoufJEo9ZaPaoZPaMsXFMZZ2aSvM Q8uFxYfLPXAd15BWHc35o/ue1Qu97NKWs3NeJCtQdvKkFUJWLZnDZmDRnLYVXAM7rA7/ rWnTazo5kcKH5E/lViFYzkhzC0X0pBLitVGNk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:content-transfer-encoding:message-id:content-type:to :from:subject:date:x-mailer; b=WPrdmRVL8mhsHJjH9dw2tfUZcG355P7tPI9A8CuhO1N1OQALtvPzYG3Gtj4EAOWinX lke1iiCw4enG/7T5YvH+lt3ZfUr45kAOxRR+QsWnTaubo5bZjVw8+VI2p3QWnW/+CgvM xEV4dbDpfpO+SIdU9v+ta3etgV0/sVC+o610w= Best regars, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Hi guys! I'm reading than mac os x supported real time meccanysm through Mach, is it true? What can i read about it? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determining specific file sessions
by Quinn 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://osxbook.com/> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 10:27 +0200 23/7/08, Jernej Azarija wrote: As for the userspace interposition, do you see any clever way of doing it? There is no supported way to do dyld interposition. If you're building a product that you plan to sell to the general public, this is not an option. If you're just experimenting, there's a discussion of dyld interposition in the "Mac OS X Internals" book. It's not publicly documented by Apple because it's not something we support. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determining specific file sessions
by Jernej Azarija 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=aSIFsI6TkhJAT3xVgVw8Pg86KO7KRQlqzP58RiX0g9Q=; b=NGToc+5JQGfcYgaFVOrqpa74h5Mv+cqgK3LY3g+KFusQ7zS9gCHyeMzQoNRv7fXcQP axrYEEhNc11yRPozYHIRgVqFKoTnzVcGwALVltC5KeIAw7oZE8umwNxgjC5jhn8DkbxL qSkkS/cNlQonBHKp13s6i+jFWDsfdu3SIPfUo= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=q8vqfdE2O53ofd7QzsCpiF2ciU8hwpIowAgopsMYVrtZmq2/mwR3ipbpulDqjj7WVj nzyEki/lP9OLEUFRL8SdSxsrqlWT/+sV8D17o+azBh4MsaFKPMbVksFS92h9kx3AVzrq cgkDQeGQSYMqYCeZcyEUJQkEv4rBxbRCTB3bY= On Wed, Jul 23, 2008 at 6:06 AM, Terry Lambert <tlambert(a)apple.com> wrote: > As Mike said, your only other option besides hacking and building your own > kernel (not recommended) is library interposition in user space. I don't like the idea of a hacked kernel either... As for the userspace interposition, do you see any clever way of doing it? The only thing I could think of at the moment is to set LD_PRELOAD to a special lib wrapping open/close, but I'm not sure that would work in all cases.. Thank you for your help, Jernej Azarija. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

About disk snapshot
by XiongJia Le 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=WQBzzClwdflLaFRv5BkodDXMFXJFz2HHONkuG2BKAdY=; b=jgjVSQjhzXrshVtL9yFPSuPj5fFpNFnplPG9Ocfs+KI8MmC01RHFRasLK5fLW2Goz3 GQsMz6UkriXACy6PRzOLyQCCdtvxrVChQTYQ5kJQtJg4TS6MhNQrw7TgybGawgaaBIPT W2bo/Nyl2bZ/NfdIMHSyugkgUkOayGuJi0uCM= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=LCuKMPxOX2WILBjA9hyZ/qKpRWo6irGoHIFcVT/P4HvRN3uqtHYKJVSdTlwSkkt3bk a5+A9NuYyi4K9rHccVF1qlVRsElmm97tuXV88Fwy/zXJLYllFKGgllOGWRHy+CzD0xGV YmFqfZ9AjCtR9NbgveuPMH5G8ws/KOaJ7Q0BU= Hi all, Because I work for an application what need automatically create a disk snapshot on OS X. I read some documents about this. I think we can use the shadow file. Example, we can mount a disk like this: "hdituilt mount disk -shadow /shadow.image" I think at this time all I/O will redirected to shadow file and I can copy my snapshot from the RAW Device. But that have some problems. The first that is must need re-mount the disk, and I think at system run time we can't re-mount the boot volume. The second is I can not merge the shadow data to the real device when after created the snapshot. Is have any easy way to create a snapshot for local disk? Thanks, Xiongjia Le _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determining specific file sessions
by Terry Lambert 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello, in my current project I'm using Kauth for a security application. Part of the application deals with file operation checking and therefore uses KAUTH_SCOPE_VNODE. It is required for the application to exactly know when a specific process open/closed a file. For example, the file `foo.bar' may be accessed by many processes each holding more than one file descriptor associated with the given file. It is therefore not enough to know the time a file was opened/closed as it may relate to different processes and/or file descriptors within the process. The only valid idea I could think of to distinguish between various instances of opened files is to relate each open session with the process ID and process FD associated with the file. As to my knowledge, this is impossible within the VNODE scope, and I'm afraid there is no legal way to do it either (am I right?). I'd be really thankful is someone could tell me if there is a way to achieve what I've specified, or alternatively anoher way to get the same result (either in kernel or user mode). -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jul 22, 2008, at 5:59 AM, Jernej Azarija wrote: You are correct. You will only get the KAUTH_FILEOP_CLOSE notification for the last close instance on a file, in which the fileglob is destroyed and the vnode_put() happens, releasing the vnode in question so that it can be reclaimed and reused by the system. In general, fileglobs are typically shared between open instances resuliting for dup, dup2, passing an fd to another process via UNIX domain socket, or inherited from the parent process by a child process. Only when the last close happens does the last reference go away so you get the notification. You will get to know when the last reference goes away, but nothing about any of the other references floating around, since in theory you secured your software which is passing them around, so it's not a problem, and if it becomes a problem, you will make sure that you don't pass it over an authorization scope boundary. As Mike said, your only other option besides hacking and building your own kernel (not recommended) is library interposition in user space. The notifications by the kernel are intended to provide a KAUTH listener with the credential associated with the fileglob at the time of the initial open -- which might not be the credential of the calling process, either because the process changed privilege level, or because the descriptor was handed to you by someone else. In addition, you get the KAUTH_FILEOP_CLOSE notification, the f_data field from the struct fileproc (which is a vnode or a socket or some other data, depending on the type of the descriptor), and the fileop_flags - indicating whether or not the file has been modified while it was open. Basically, descriptors carry their rights from when they were created around with them. If you are a process with rights to a file and/or socket, you can create an open descriptor to it and hand it off to your children or to another process, or you can drop the privilege that allowed you to open the thing in the first place, without your rights to it getting revoked. This is an intentional part of how the UNIX privilege separation model works (though most people don't take advantage of it). This email sent to site_archiver(a)lists.apple.com

1 0

Computer not shutting down
by Greg 23 Jul '08

23 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com However, the output on the screen stops at the following and sits there: continuing Proper shutdown (when the KEXT is not installed) results in this output: continuing done CPU halted Much appreciated, - Greg _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Hi, I'm encountering an odd problem, that seems to be occurring on both 10.4 and 10.5. I have a C-based kernel extension (_start/_stop routines) that is loaded by a launchd daemon on startup and unloaded on shutdown (when the daemon gets a signal). The kernel reports (via printf messages) that it has been unloaded, in other words the _stop function was called, and it got to a point where all resources should have been freed and then it returns KERN_SUCCESS. I'd be very grateful for any ideas or theories as to why this is happening, what could be going wrong, as I'm not sure where to look, everything seems to be right.. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determining specific file sessions
by Michael Smith 22 Jul '08

22 Jul '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 22, 2008, at 5:59 AM, Jernej Azarija wrote: in my current project I'm using Kauth for a security application. Part of the application deals with file operation checking and therefore uses KAUTH_SCOPE_VNODE. It is required for the application to exactly know when a specific process open/closed a file. For example, the file `foo.bar' may be accessed by many processes each holding more than one file descriptor associated with the given file. It is therefore not enough to know the time a file was opened/closed as it may relate to different processes and/or file descriptors within the process. The only valid idea I could think of to distinguish between various instances of opened files is to relate each open session with the process ID and process FD associated with the file. As to my knowledge, this is impossible within the VNODE scope, and I'm afraid there is no legal way to do it either (am I right?). I'd be really thankful is someone could tell me if there is a way to achieve what I've specified, or alternatively anoher way to get the same result (either in kernel or user mode). - opening the file - being the child of a process that opened the file - receiving the file descriptor from another process - duplicating the descriptor from another already held = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Firstly, you need to be aware that applications may obtain a file descriptor referencing file by several methods, including: If you want to track all of these things, your best bet is going to be to interpose libSystem in user space. This email sent to site_archiver(a)lists.apple.com

1 0