February 2010 - Darwin-kernel

Re: Possible bug with nanosleep()?
by Chris Wilson 28 Feb '10

28 Feb '10

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com User-agent: Alpine 1.00 (DEB 882 2007-12-20) Hi all, The code in question does this: void safe_sleep(int seconds) { struct timespec ts, tr; memset(&ts, 0, sizeof(ts)); ts.tv_sec = seconds; ts.tv_nsec = 0; while (nanosleep(&ts, &tr) == -1 && errno == EINTR) { BOX_TRACE("nanosleep interrupted with " << ts.tv_sec << "." << ts.tv_nsec << " secs remaining, sleeping again"); if (ts.tv_sec >= seconds) { BOX_WARNING("nanosleep returned with junk in " << "struct: " << ts.tv_sec << "." << ts.tv_nsec); return; } ts = tr; /* sleep again */ } } On OSX 10.6.2, I get the warning: nanosleep returned with junk in struct: 4294967295.999958431 int secs = (int32_t) tr.tv_sec; if (secs < 0) { BOX_WARNING("nanosleep interrupted late, " << secs << "." << tr.tv_nsec << " secs remaining"); return; } I see instead: nanosleep interrupted late, -1.999971228 secs remaining http://opensource.apple.com/source/Libc/Libc-583/gen/nanosleep.c /* This depends on the layout of a mach_timespec_t and timespec_t being equivalent */ ADD_MACH_TIMESPEC(&current, requested_time); SUB_MACH_TIMESPEC(&current, &remain); remaining_time->tv_sec = current.tv_sec; remaining_time->tv_nsec = current.tv_nsec; struct mach_timespec { unsigned int tv_sec; /* seconds */ clock_res_t tv_nsec; /* nanoseconds */ }; typedef struct mach_timespec mach_timespec_t; The SUB_MACH_TIMESPEC macro does: /* t1 -= t2 */ #define SUB_MACH_TIMESPEC(t1, t2) \ do { \ if (((t1)->tv_nsec -= (t2)->tv_nsec) < 0) { \ (t1)->tv_nsec += NSEC_PER_SEC; \ (t1)->tv_sec -= 1; \ } \ (t1)->tv_sec -= (t2)->tv_sec; \ } while (0) struct timespec is defined thus in sys/structs.h: #define _STRUCT_TIMESPEC struct timespec _STRUCT_TIMESPEC { __darwin_time_t tv_sec; long tv_nsec; }; and __darwin_time_t is defined as long in /usr/include/i386/_types.h: typedef long __darwin_time_t; /* time() */ So I wrote this test program: #include <mach/clock_types.h> #include <time.h> #include <stdio.h> int main(int argc, char** argv) { mach_timespec_t current, remain; current.tv_sec = 1267383159; current.tv_nsec = 300; remain.tv_sec = 1267383160; // 1.0000012 seconds later remain.tv_nsec = 1500; struct timespec requested_time, remaining_time; requested_time.tv_sec = 1; requested_time.tv_nsec = 0; ADD_MACH_TIMESPEC(&current, &requested_time); SUB_MACH_TIMESPEC(&current, &remain); remaining_time.tv_sec = current.tv_sec; remaining_time.tv_nsec = current.tv_nsec; int64_t remain_ns = (remaining_time.tv_sec * 1000000000) + remaining_time.tv_nsec; printf("remaining time (native tv_sec): %lld\n", remain_ns); remain_ns = ((long) remaining_time.tv_sec) * 1000000000; remain_ns += remaining_time.tv_nsec; printf("remaining time (long tv_sec): %lld\n", remain_ns); remain_ns = ((int32_t) remaining_time.tv_sec) * 1000000000; remain_ns += remaining_time.tv_nsec; printf("remaining time (int32_t tv_sec): %lld\n", remain_ns); return 0; } And it outputs: chris@jmac(~)$ ./test remaining time (native tv_sec): 4294967295999998800 remaining time (long tv_sec): 4294967295999998800 remaining time (int32_t tv_sec): -1200 Is this a bug, or did I misunderstand something? Please let me know. Cheers, Chris. -- _ ___ __ _ / __/ / ,__(_)_ | Chris Wilson <0000 at qwirx.com> - Cambs UK | / (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Perl/SQL/HTML Developer | \ _/_/_/_//_/___/ | We are GNU-free your mind-and your software | _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I'm developing open source software that runs on MacOS among other platforms. I recently discovered a problem where code that works fine on other platforms is hanging indefinitely on OSX 10.6.2. I'm sure it worked in 10.3 on PPC hardware. And before I added a test for this condition, it would loop and sleep again for 4294967295 seconds, i.e. hang forever. I noticed that 4294967295 looks suspiciously like the int32_t representation of -1 treated as unsigned (cast to uint32_t). When I added the following code to check for this: and the loop does exit. Looking at the code for nanosleep in libc, which you can find here: and noting that the first version, for__DARWIN_UNIX03, appears to be used in this case, as gdb interrupts the hung process in __semwait_signal(), I can see that it does integer arithmetic on a mach_timespec_t structure, whose values are then assigned to the returned structure: First of all, the comment raised my suspicions, although the macros access the members directly so the actual memory layouts do not need to be identical. mach_timespec_t appears to be defined thus: (I cannot find this on the web, I copied it from /usr/include/mach/clock_types.h on this OSX 10.6.2 box). Since long is a 64-bit type on this platform, the value it contains is not appropriate. Only treating it as a 32-bit signed type gives the correct value. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Process Exit Notification within KEXT
by Ed Wynne 27 Feb '10

27 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -Ed On Feb 27, 2010, at 8:27 AM, Dave Keck wrote: Hey list, After exhausting all other options, I've determined that I need to write a KEXT that will take advantage of the Kauth KPIs, which will tighten the security around a specific process and its children. The KEXT will be loaded by a daemon process, which will then register itself with the KEXT as the process needing protection. My problem is that of robustness: should the daemon crash, ideally the KEXT would notice and tear down the resources that it held. Unfortunately I'm not sure it's possible for a KEXT to be notified when a process exits. I'm pretty certain it's impossible using the BSD kernel KPIs, but perhaps there's a way with the Mach ones? Thanks for any insight! This email sent to arwyn(a)phasic.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This is a common problem with a supported solution. Your daemon just needs to hold open a user client connection to the kext. When your daemon exits cleanly, clientClose() will be called, otherwise clientDied() will be called. The IOKit infrastructure provides this for you. David _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/arwyn %40phasic.com This email sent to site_archiver(a)lists.apple.com

1 0

Re: Process Exit Notification within KEXT
by Maxim Zhuravlev 27 Feb '10

27 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type; bh=c8fAF6Zygjph/+GCWr2FBtVX1uVJbPoZVScUC934W1o=; b=vOfHlrs1pmVYCJYtKjmlmdjMH1S4gMgVHO2n+670U4wO+RCL//fMe6PPwiC/KqUoUf pEKukT5owbJ3RQi2OHlR546v7hWHHBeFFVochKdo+kTSa8ha0A4mZQr7SUye+7LIh3Rz 7nUtGEWAf0EPRgYBYLVST8MVN/vaP+9i/eZyk= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=Hwbv+8sAHULVnOnKbPsfDS3vllFRm0y945IfI6/K4z995KTvYFvBv/Dal+i44nHoLb HTSFW9Wfs3iKg9eozgBgoD9iQk9GbEIQOt3+x1YqWqp3M7KYKKtrIeRpa6He6GI5wdC3 cKRlUfUH+t50bQNP7kZ59n5ZD12IFa8ewlbw4= Hi, Dave the answer depends on the way your daemon connects to the kext. If you choose IOUserClient, you should override IOUserClient::clientDied() call. In case of connection through kernel control socket the kext will recieve disconnect event on that socket. 2010/2/27 Dave Keck <davekeck(a)gmail.com>: > My problem is that of robustness: should the daemon crash, ideally the > KEXT would notice and tear down the resources that it held. > Unfortunately I'm not sure it's possible for a KEXT to be notified > when a process exits. I'm pretty certain it's impossible using the BSD > kernel KPIs, but perhaps there's a way with the Mach ones? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Process Exit Notification within KEXT
by Dave Keck 27 Feb '10

27 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:from:date:message-id :subject:to:content-type; bh=qvL8odqj1Cwfaj/c/IC7AED4qZbpSONDZ5L/B45uHew=; b=lDpkTLpYiKpUtz/m06u25txVc0LLaXw+8uOfOmTkwGVJ450IjfajK76VRN1CWwpuDu QTGbonkQ67XxCuLhZBb7uSgWoNt6ltRtIHyPtcRloulPTqF/trlC7Arb+qJTZhc//UkV i6pHImspaQcYQj+7TDawUsmBaH5nftUyLUI3M= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=a+okp3H6VIYGE9KTf6l6Y8x+QAjRKpcDHF66nCkEX1BvxuAmAwGb2q3QlY315Hn87F ERfcFigZJRB1s0MXX3bNbbAVSQk6lLRjI1f9jM6H9HPntvURqxHF+YULIUpSlVWOjFlH pOCgcu4osU+f3EynW61BKFCENrm0iF7rODtEU= Hey list, After exhausting all other options, I've determined that I need to write a KEXT that will take advantage of the Kauth KPIs, which will tighten the security around a specific process and its children. The KEXT will be loaded by a daemon process, which will then register itself with the KEXT as the process needing protection. My problem is that of robustness: should the daemon crash, ideally the KEXT would notice and tear down the resources that it held. Unfortunately I'm not sure it's possible for a KEXT to be notified when a process exits. I'm pretty certain it's impossible using the BSD kernel KPIs, but perhaps there's a way with the Mach ones? Thanks for any insight! David _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Panic Ideas
by William Kucharski 26 Feb '10

26 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Feb 25, 2010, at 8:21 PM, Duane Murphy wrote: > Enclosed are two kernel panics, while they look very different at first, a closer inspection shows that the panic cause is the same. IS it? One is a page fault. One is because of a bad opcode because the code jumped off into the weeds. They may look similar, but I question whether they are ACTUALLY "the same" save for a bug somewhere. > First panic: 0x1b3ebd98 : 0x4257ac (0xe 0xbd0048 0x88a40010 0x10) > Second panic: 0x212c7d78 :0x1423090 (0xe 0x48 0x26d0010 0x26f0010) The second panic is the result of jumping to a bad location, likely due to an uninitialized variable somewhere. The first is a page fault at address 0x488367c3, also a seemingly random bad address. Since 0xe is 14, I wonder if there's not a trap handler being invoked somewhere as a root cause. But in particular, in the first panic, whatever instruction was at 0x4257ac tried to dereference memory location 0x488367c3. In the second, something attempted to jump to location 0x1423090, and that address did not contain a valid opcode. Given the second backtrace, it appears that jump may have come from somewhere around 0x42349e. William Kucharski _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Panic Ideas
by Duane Murphy 26 Feb '10

26 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello Fellow Kernel Folks, I'm looking for ideas for how to deduce what is causing a kernel panic. Here is some background. First panic: 0x1b3ebd98 : 0x4257ac (0xe 0xbd0048 0x88a40010 0x10) Second panic: 0x212c7d78 : 0x1423090 (0xe 0x48 0x26d0010 0x26f0010) Thanks, ...Duane _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com Enclosed are two kernel panics, while they look very different at first, a closer inspection shows that the panic cause is the same. Suggestions on how to interpret these panics and how I might locate the cause would be great. Both panics are random/inconsistent. They are located by repeatedly restarting the computer. After 20-40 (sometimes more) restarts the panic will occur. On some machines the panic never occurs (>200 restarts). The problem occurs on Leopard and Snow Leopard. The examples are from Leopard. The first panic (involving IOUSBFamily.kext) occurs with our standard kext. The second panic is now occurring as I have been removing sections of code trying to narrow down the culprit. This last change, affected the timing, a lot. (A dependency on another kext was removed.) I find the similarity that both kinds of panics include this in the backtrace at the point of the panic: This is the location of the kernel panic. The 0xe seems significant. I am also suspicious of the 0x48, and two 0x10. It's just a pattern but it's in each panic. The return address of the first panic (0x4257ac ) happens to be IOEventSource::openGate(). But the 0xe make no sense as a "this" pointer. The return address in the second trace (0x1423090 ) appears to be unmapped (I can't find a kext in that address space.) I'm slowly working towards finding this problem , but any hints, tips, or ideas are all quite welcome! 2010-02-25-143823.panic 2010-02-25-172012.panic PGP.sig

1 0

Re: Exporting kext symbol
by Sudarshan S 25 Feb '10

25 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1267090515; bh=XJ9JKN9+ur5bnA1DLCFYIdvN/SOJS6xGWB5kadMRHPc=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=L2B0tuzDqaEOUT2i4VErLKDJGanOgtwH0isvLvAhzogazz4FbmLxufbLpfeGkE6ZDC5sGRHFu4nbx4E/0P1BWIxiZigA89VZvcU0ykuVsLj22Ee94kl93j6OUL0Yg8FntqJ5n4KFsLXrO83r8ZgmZlK4Guvfwc98YzlZJXkqP08= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type; b=u5NLLw0mB4mchsFvBWywswgz0VDg6M3l1WaJN+BIFvuEQD786mRmHkvnRCcCC0d38gghVNQIB7uJigPkiASF7+Ul4o66EASgC1mofMQBG7ntB94A/PvyAR9y79le2Rxr5IwWMTzWvBhI7+7a9Mp4o5WSDEMPStVdG0iBCikYRlA=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Exporting kext symbol
by Nik Gervae 24 Feb '10

24 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Exporting kext symbol
by Sudarshan S 24 Feb '10

24 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1267009293; bh=1qUHbkRa8qk05Ed+Gcd7TaD8Fg/nCWPQIp+at2z16kQ=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=fDSyogEUdKsY+5xVv/vn4VDLM93E10hp6W4UO9srhJOF7/v7IO2/zBPINXyTMSxBkGQHHCCdFVf6lxzE53NFUFtxvkjoMd3isH2e7YlafxOYh5h/2gcJEP1k8aB1bVuHB5fQhLEd7sD3sK0HmmlTZrKzvakl23+r3cOlAPknMiE= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=PcB2kF2JVa1HrJS5liAuXU50T8Iv5wYGSSovehOVqcC2oa1NBsLPUzrxJaXoJPbQrv/1+OOWllmHjVX+HcCSKZdirS+SwRQ5TZwrvghBx/Ig9kbC8HC32aO4tDbKKgcH7R2pe3pJYe2+nbyxSEkqscDHCKN5ot/kPJr5TskgGT0=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Panics and Logging Messages
by Duane Murphy 23 Feb '10

23 Feb '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This has happen only this one time out of many that I have noticed. The exact same panic log has been recorded successfully several times. It's mostly a curiosity. But when you are hunting elusive bugs every curiosity raises interest as to a hint for the reason for the bug. Thanks, ...Duane On Feb 23, 2010, at 1:01 PM, Shantonu Sen wrote: > Well, what are you logging in your panic message? If you're logging > a ginormous amount of data, you won't be able to. > > Shantonu Sen > ssen(a)apple.com > > Sent from my Mac Pro > > On Feb 23, 2010, at 12:58 PM, Brian Bechtel wrote: > >> On Tue, Feb 23, 2010 at 11:57 AM, Duane Murphy >> <duanemurphy(a)mac.com> wrote: >> >>> I've noticed this message after of the kernel panic logged to >>> fwkpfv: >>> >>> Attempting to commit panic log to NVRAM >>> EFI: couldn't save panic info (err = 80000009) >>> >>> I've never noticed the second message before (EFI: etc). Can someone >>> translate that into English? >> >>> From xnu source, efi.h >> >> #define EFI_OUT_OF_RESOURCES EFIERR (9) >> >> >> I would recommend filing a bug report. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.10.0 (Build 500) Charset: US-ASCII wsBVAwUBS4RJcUrg9acQ4r2CAQhyEQgAtK0JCTVZS8EgOYz03XypZMYVndTb8Euz ltWV0g2XiHbYQqpTRLYMuLj8IbRIO6wm37JxCXn2D11FL7gvPAjOcvFAsVTifN8U q+WPGbbD/EaMKiElVc4j2I9UlynACGzjiOcyNvdq9Rxci4RXHxK7+280zImisxiS eioqEWkYAIDFhWSr0odESgfREesTajzpowJxbwtRQX8YjP8QzxdjcqAwSgoVebbJ i+2hYIi3MtLwPLxPTJznJ1qIdMowIE+rSMggnweMv4tNcOSaiUDB5vd+u0RxWs34 JkvPVilKSEceoGt0z02bPHouvTCd7ZtmOOVgPEc1SEk1w31AA0o5dg== =+Cm7 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0