December 2011 - Darwin-kernel

nlist and stab headers
by José Cornado 31 Dec '11

31 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=xxVL90e0SAaNmunRfHulEqwkbXs5EDVTsPcK0o7/QFA=; b=kBd1Vhia05REBHKcaWOQuf2qdnsUtugKPHcbWQQm10nrb8Tjc2kOzrjYwyqT0B+EPs LUqC0nhFgUzswvEeVtGpathcG3yPg0qE+P2shw7iGFTMKEL19oqX1PBTfJ+3Mn8BlXz6 GIzYvERfAPopj8fK8BSsEeenxc8LUEnczbH7Q= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Kext ring level
by José Cornado 27 Dec '11

27 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=aLKCWhnh+jwk+53/qZg5/FeCwXRU32P/RZCB0qjhYQw=; b=XdKOQHihkQm0XuPthVdOZXymDg15VeDhb61OsEmVEPrgj+Doa21SiWI/3nWw2XQ4aa dEjg4XIyuGpizJJDt4VZRU7Wc75t94WgWUFrl45JHipbOqxnjnUkbA31Vta2xHm5Troz aB7VgGD6no9s7Vfj+LOGoQtT+AtoFI6HkGIjE= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Detecting process start/exit notifications in Mac OS X
by Stéphane Sudre 27 Dec '11

27 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 28 nov. 11, at 10:26, Volodymyr Shcherbyna wrote: Hello Everyone, http://hints.macworld.com/article.php?story=20110906200849542 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am trying to port my Windows project to Mac OS X and it seems like I am experiencing problems with this task. The main idea of the project is to show network usage by applications. Therefore, it is essential to know the following information about each connection: [...] And the implementation at the kernel level is visible in the xnu source code correspond to the Mac OS X Lion release IIRC. This email sent to site_archiver(a)lists.apple.com

1 0

Debugging a kext
by Michael Tuexen 25 Dec '11

25 Dec '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dear all, I want to debug a kext (actually I've done this a lot of times before), however, after creating a *.sym using kextutil as I did before, I get: [mba:~/Desktop/files] tuexen% gdb /Volumes/KernelDebugKit/mach_kernel GNU gdb 6.3.50-20050815 (Apple version gdb-1708) (Thu Nov 3 21:59:02 UTC 2011) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "x86_64-apple-darwin"...Reading symbols from /Volumes/KernelDebugKit/mach_kernel...Reading symbols from /Volumes/KernelDebugKit/mach_kernel.dSYM/Contents/Resources/DWARF/mach_kernel...done. done. (gdb) add-symbol-file org.sctp.SCTP.sym add symbol table from file "org.sctp.SCTP.sym"? (y or n) y Reading symbols from /Users/tuexen/Desktop/files/org.sctp.SCTP.sym...Reading symbols from /Users/tuexen/Desktop/files/SCTP.kext.dSYM/Contents/Resources/DWARF/SCTP...gdb stack crawl at point of internal error: 0 gdb-i386-apple-darwin 0x000000010ae0ed08 internal_vproblem + 296 1 gdb-i386-apple-darwin 0x000000010ae0ebd6 internal_verror + 30 2 gdb-i386-apple-darwin 0x000000010ae0e307 do_cleanups + 0 3 gdb-i386-apple-darwin 0x000000010ada480f objfile_section_offset + 157 4 gdb-i386-apple-darwin 0x000000010ad56c59 syms_from_objfile + 1354 5 gdb-i386-apple-darwin 0x000000010ad57a86 symbol_file_add_with_addrs_or_offsets_using_objfile + 760 6 gdb-i386-apple-darwin 0x000000010ad57a3c symbol_file_add_with_addrs_or_offsets_using_objfile + 686 7 gdb-i386-apple-darwin 0x000000010ad5b557 add_symbol_file_command + 999 8 gdb-i386-apple-darwin 0x000000010ae0c5e6 execute_command + 518 9 gdb-i386-apple-darwin 0x000000010ad82f94 command_handler + 208 10 gdb-i386-apple-darwin 0x000000010ad82e72 command_line_handler + 1090 11 gdb-i386-apple-darwin 0x000000010ae8e55b rl_callback_read_char + 109 12 gdb-i386-apple-darwin 0x000000010ad82a1c rl_callback_read_char_wrapper + 9 13 gdb-i386-apple-darwin 0x000000010ad8159b process_event + 151 14 gdb-i386-apple-darwin 0x000000010ad814ee gdb_do_one_event + 1187 /SourceCache/gdb/gdb-1708/src/gdb/objfiles.c:2330: internal-error: Section index is out of range for objfile (exec_objfile '/Users/tuexen/Desktop/files/SCTP.kext.dSYM/Contents/Resources/DWARF/SCTP' objfile '/Users/tuexen/Desktop/files/SCTP.kext.dSYM/Contents/Resources/DWARF/SCTP') A problem internal to GDB has been detected, further debugging may prove unreliable. Quit this debugging session? (y or n) Any idea what the problem is? I'm using 10.7.2 with the latest Xcode stuff. Best regards Michael _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: ipf_inject_input return error 45
by Mike C. 17 Dec '11

17 Dec '11

site_archiver(a)lists.apple.com Delivered-To: Darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=JtFRX22+9VNRjepe5CziM3if57YS41LtMLE1rTLhOs0=; b=pkt4yy8AcwlleZADXthdfRgWy5/5PdTJ2JqvsaxcKsfNCQWvyMZ1rMIJshu9c2eMhD 4n5QnYILdjTSWo97fVZCFjLpS9vZYhvGd8OdYsfX4n7MA9INlsTSE7fJUc984kWaGY9l 5xsgKerQONOfhqHzIYBKevgi2L59+PT4X4NK0= Hello again, I solved my problem by copying the mbuf with mbuf_dup before returning from the input_fn function. When I later inject that copy everything works as expected. I probably misinterpreted the documentation of ipf_input_func [1]. I thought returning EJUSTRETURN means that I can hold on to the mbuf to reinject it later. But as it turns out, someone is messing with the memory of that mbuf making the injection fail. Copying the mbuf solved the problem. Thanks again for your help! Mike [1] http://developer.apple.com/library/mac/#documentation/Darwin/Reference/Kern… 2011/12/8 Vincent Lubet <vlubet(a)apple.com>: > Mike, > > It's not clear to me what's going wrong but in case like these I use printf to show the detail of the mbuf. I would compare the saved_packet > mbuf before calling ctl_enqueuembuf() and before ipf_inject_input(). > > Vincent > > Le Dec 8, 2011 à 9:57 AM, Mike C. a écrit : > >> Hello Vincent, >> >> Thanks for your response! >> >> I am not modifying the mbuf captured in the input_fn function by the >> IP filter in any way. In fact, if I re-inject the mbuf right after >> capturing it while I am still in the input_fn function, everything >> works out as expected. However, when I re-inject the same mbuf later >> (after receiving the processing result from user mode) I get an >> ENOTSUP error. Am I not allowed to hold on to the mbuf reference to >> re-inject it later?? >> >> Mike >> >> 2011/12/8 Vincent Lubet <vlubet(a)apple.com>: >>> Mike, >>> >>> ENOTSUP is returned by ipf_inject_input() when the packet is not an IPv4 or IPv6 packet. You need to make sure the mbuf data pointer points to the start of the IPv4 or IPv6 packet. >>> >>> Vincent >>> >>> Le Dec 8, 2011 à 4:02 AM, Mike C. a écrit : >>> >>>> Hello, >>>> >>>> I am working on a Network Kernel Extension that re-injects packets >>>> after they have been captured with an IP Filter. However, the >>>> re-injection doesn't work. ipf_inject_input always returns error code >>>> 45, which means "Operation not supported". What am I doing wrong? Here >>>> is my setup and (simplified) code: >>>> >>>> mbuf_t *saved_packet = NULL; >>>> >>>> // function called by ip filter when new ip packet arrives >>>> errno_t input_fn(void *cookie, mbuf_t *data, int offset, u_int8_t protocol) { >>>> >>>> // test, if packet is interesting for us >>>> // [...] >>>> >>>> if (saved_packet != NULL) { >>>> // Drop >>>> return -1; >>>> } >>>> >>>> // keep reference to packet for later injection >>>> saved_packet = data; >>>> >>>> // send packet to usermode for further processing >>>> mbuf_t new_mbuf; >>>> mbuf_dup(*data, MBUF_WAITOK, &new_mbuf); >>>> if (ctl_enqueuembuf(ctlref, ctrl_unit, new_mbuf, 0) != 0) { >>>> // error, drop packet >>>> saved_packet = NULL; >>>> retrun -1; >>>> } >>>> >>>> // EJUSTRETURN = the packet will not be freed >>>> return EJUSTRETURN; >>>> } >>>> >>>> >>>> // function called when usermode sends processing result back >>>> errno_t ctl_send_fn(kern_ctl_ref kctlref, u_int32_t unit, void >>>> *unitinfo, mbuf_t m, int flags) { >>>> int result; >>>> mbuf_copydata(m, 0, sizeof(result), &result); >>>> >>>> if (result == 1) { >>>> >>>> // the following call returns 45 ("Operation not supported") - WHY?? >>>> errno_t errno = ipf_inject_input(*saved_packet, installed_filter); >>>> >>>> saved_packet = NULL; >>>> } else { >>>> // [...] >>>> } >>>> >>>> return 0; >>>> } >>>> >>>> Where is my mistake? Your help is greatly appreciated! >>> > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Questions about task_create
by José Cornado 17 Dec '11

17 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=L5FGSnsdbuAc0HCmthXhb79VbaJAHbgPX2QRHj+v4uI=; b=uiO9t6oCGakYYQcUNfIO/u7ROaVmKDG0Wpid94LirLbrThQJOWKTtXHDMDOMZ0sRSO EU1O0RwhjALlJLMNWfe2dciqzYByfdurAI5EwWzRlW3jPOBkkvWlY8uVbzTIDU/DW7fL SOgsVGyWtWSRcitOEFlT5uBgC/pvxQt7RkEaQ= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Questions about task_create
by comex 17 Dec '11

17 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; bh=Hf9Ye9qFKD0YyVoujhXwxqN0k9Kl7ht944dgJDDw46A=; b=CR0hI/bGPBUMIPZJCJwinOmFXkK9rArrR4Z9CL46QtSrkjMGIkF76lSyJOwHMFCwp3 qmuVvJvLtyjVFsGtigmqUrLfHuldifVN0emZbiU7l3gyHqm1BPrtBgZT4FjEMshYb1z+ Y+jZJWhaeULYKtBtqe4EEfsFyN20ttW55nzGs= 2011/12/16 José Cornado <jose.cornado(a)gmail.com>: > If parent task has inherit none flag set. > > What happens when task_create is called? If it doesn't inherit any of the > VM: > > is it created and suspended? Nothing: kern_return_t task_create( task_t parent_task, __unused ledger_port_array_t ledger_ports, __unused mach_msg_type_number_t num_ledger_ports, __unused boolean_t inherit_memory, __unused task_t *child_task) /* OUT */ { if (parent_task == TASK_NULL) return(KERN_INVALID_ARGUMENT); /* * No longer supported: too many calls assume that a task has a valid * process attached. */ return(KERN_FAILURE); } _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Questions about task_create
by José Cornado 16 Dec '11

16 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=20dp6dCclcRIGgYnwqNp3nDdwKw+Sh6bUVlRugazVHA=; b=kKKFSO8mdKQddpUg+RBFSnQBB1mc4s0MSdYsRHM/mnqNfV/VlDzH5L3XRLWSAfuBcs UJ16IoMaI+xRG/dLMqUUTlaa391J7C08SO3OlMdsQVX5v57TqG/j87J+9kHAFK4bF/w9 nUWxm/oS1KNAkk4d+/O0K0Rvn68DlBP+Sjv5c= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Reasonable location for GDT?
by Shantonu Sen 14 Dec '11

14 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Reasonable location for GDT?
by José Cornado 14 Dec '11

14 Dec '11

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=8Ij6Z6DsIu/hCkbFqtSXS3TdLR7cSsuSUDX9ZmjXdNs=; b=famFU8PkzuP/OUej4cbe7CQr0ZKI+5eEeURhALI7SyalT5aDHlR21vVnmJLzF5VAtu WbzwZ1budH4ajpd23//tLIC04dUjNfVwQdInVqU5EegMSan8sawrpmjikjf3BgQqjwkA VS+NNEFnhdQpE88lmav7rxeY4zhYMUufap/f0= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0