April 2012 - Darwin-kernel - lists.apple.com

Re: How to get nbr of resident pages
by comex 24 Apr '12

24 Apr '12

On Sat, Apr 21, 2012 at 3:10 AM, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > I thought that vmmeter.v_wire_count + vmmeter .v_active_count would be the answer. > > So I tried: > int mib[] = { CTL_VM, VM_METER }; > int miblen = sizeof(mib) / sizeof(int); > struct vmmeter vmmeter; > size_t len = sizeof(vmmeter); > int res = sysctl(mib, miblen, &vmmeter, &len, NULL, 0); > > But got: errno = 2 = "No such file or directory" > > So: How do I get the number of resident pages of all processes? VM_METER doesn't seem to be implemented in xnu, but top, which reports this information, uses a different call: kr = host_statistics(libtop_port, HOST_VM_INFO, (host_info_t)&tsamp->vm_stat, &count); - http://www.opensource.apple.com/source/top/top-73/libtop.c _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

What is pages_resident (mach_vm_region_recurse) ?
by Gerriet M. Denkmann 24 Apr '12

24 Apr '12

I have a program which does: for ( all pids ) for all memory regions (via mach_vm_region_recurse) remember object_id and pages_resident The problem: The sum (over all object_ids) of pages_resident is larger than what Activity Monitor shows as "Used:". Often it is larger than the physical ram in my computer. (Note: object_ids used by several pids are counted only once). Maybe my program has a bug - or I am misunderstanding what pages_resident is about. Could someone please enlighten me? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Deleting a file in KEXT
by Rupesh Khetawat 23 Apr '12

23 Apr '12

Thanks for the comments regarding Deleting a file in KEXT. Anatol Pomozov : I looked at the VNOP_REMOVE. It appears that this function is not part of kernel framework. I could only see some comments regarding VNOP_REMOVE in vnode_if.h, but not function declaration anywhere. It would be great if someone could provide pointer on this so that I can explore some options. Thanks in advance. Regards, Rupesh -----Original Message----- From: darwin-kernel-bounces+rupesh_khetawat=symantec.com(a)lists.apple.com [mailto:darwin-kernel-bounces+rupesh_khetawat=symantec.com@lists.apple.com] On Behalf Of darwin-kernel-request(a)lists.apple.com Sent: 12 April 2012 AM 12:30 To: darwin-kernel(a)lists.apple.com Subject: Darwin-kernel Digest, Vol 9, Issue 32 Send Darwin-kernel mailing list submissions to darwin-kernel(a)lists.apple.com To subscribe or unsubscribe via the World Wide Web, visit https://lists.apple.com/mailman/listinfo/darwin-kernel or, via email, send a message with subject or body 'help' to darwin-kernel-request(a)lists.apple.com You can reach the person managing the list at darwin-kernel-owner(a)lists.apple.com When replying, please edit your Subject line so it is more specific than "Re: Contents of Darwin-kernel digest..." Today's Topics: 1. Re: Deleting a file in KEXT (Anatol Pomozov) 2. monitoring syscalls (me) ---------------------------------------------------------------------- Message: 1 Date: Tue, 10 Apr 2012 13:49:47 -0700 From: Anatol Pomozov <anatol.pomozov(a)gmail.com> To: Rupesh Khetawat <Rupesh_Khetawat(a)symantec.com> Cc: "darwin-kernel(a)lists.apple.com" <darwin-kernel(a)lists.apple.com> Subject: Re: Deleting a file in KEXT Message-ID: <CAOMFOmUDA3zKTSwq28XxrKy250RgaTxKLuWTUwPo84iX3c68Cw(a)mail.gmail.com> Content-Type: text/plain; charset=UTF-8 Hi On Mon, Apr 9, 2012 at 6:38 AM, Rupesh Khetawat <Rupesh_Khetawat(a)symantec.com> wrote: > Is there anyway a file can be deleted in KEXT? > > > > I have written KEXT where file scope listener is registered with kauth. I am > trying to delete certain files when the action is close with modified flag. > I looked at the documentation, but did not find anything deleting file in > kernel mode. > > Can someone throw some light on this? In kernel you do not have access to POSIX functions such as unlink(). I believe the only way to achieve the goal is to use VNOP operations directly. In your case this will be VNOP_REMOVE. Here is an example from XNU that removes a file https://github.com/anatol/xnu/blob/master/bsd/vfs/vfs_xattr.c#L529 ------------------------------ Message: 2 Date: Tue, 10 Apr 2012 14:06:21 -0700 From: me <kernelkangaroo(a)gmail.com> To: darwin-kernel(a)lists.apple.com Subject: monitoring syscalls Message-ID: <B1B549EF-2137-47B3-ACA5-F0A9D1988F5D(a)gmail.com> Content-Type: text/plain; charset=us-ascii Can anyone point me to documentation for observing syscalls from the kernel? I am currently using a KAUTH VNODE listener scope to look for file opens, but I would like to be able to know which files are being read from as they are read. I could use dtrace, but I would prefer to use system calls as opposed to another process. thanks, Trip ------------------------------ _______________________________________________ Darwin-kernel mailing list Darwin-kernel(a)lists.apple.com https://lists.apple.com/mailman/listinfo/darwin-kernel End of Darwin-kernel Digest, Vol 9, Issue 32 ******************************************** _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Querying for children pid
by José Cornado 23 Apr '12

23 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

How to get nbr of resident pages
by Gerriet M. Denkmann 21 Apr '12

21 Apr '12

I thought that vmmeter.v_wire_count + vmmeter .v_active_count would be the answer. So I tried: int mib[] = { CTL_VM, VM_METER }; int miblen = sizeof(mib) / sizeof(int); struct vmmeter vmmeter; size_t len = sizeof(vmmeter); int res = sysctl(mib, miblen, &vmmeter, &len, NULL, 0); But got: errno = 2 = "No such file or directory" So: How do I get the number of resident pages of all processes? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Weird system freeze
by Antoine Missout 19 Apr '12

19 Apr '12

If anyone with a good knowledge of the kernel is willing to debug this, I'd be happy to pay as consultant. Let me know privately. Cheers, Antoine On 2012-04-13, at 11:25, Antoine Missout wrote: > Hi, > > I've encountered an issue with our product Hands Off!. > > We intercept the mac_socket_check_bind call, send a mach msg to our daemon to check if it's allowed. But for some reason, the daemon never wakes up to process it (why?). In the stackshot I was able to get, the only thread we're interfering with is the bind system call made by launchctl (when enabling the Apple File Server). Below are the relevant logs. A complete zip of the stackshot logs is available here: > > http://www.metakine.com/files/ho_freeze12avr2012.zip > > Looking at the bind source code, it's not clear to me what could lock everything else when blocking in it. This bug is hard to reproduce, doesn't always happen, and seems to be dependant on the network environment. > > Any help would be greatly appreciated. > > Thanks, > Antoine > > > ------------------------------------------------- > > PID: 328 > Process: launchctl > Kernel stack: > machine_switch_context (in mach_kernel) + 383 (0xffffff800022c888) > thread_dispatch (in mach_kernel) + 1894 (0xffffff800020990e) > thread_block_reason (in mach_kernel) + 289 (0xffffff8000209acb) > ipc_mqueue_receive (in mach_kernel) + 65 (0xffffff8000203622) > mach_msg_rpc_from_kernel_body (in mach_kernel) + 338 (0xffffff800020589f) > 0xffffff7f8099a72c (0xffffff7f8099a72c) > 0xffffff7f8099ebb0 (0xffffff7f8099ebb0) > 0xffffff7f809a7681 (0xffffff7f809a7681) > bind (in mach_kernel) + 318 (0xffffff80004b45ea) > unix_syscall64 (in mach_kernel) + 544 (0xffffff80004e8168) > hndl_unix_scall64 (in mach_kernel) + 20 (0xffffff80002e4874) > > PID: 67 > Process: HandsOffDaemon > Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) > Continuation: kevent (in mach_kernel) + 62 (0xffffff80004786e4) > Continuation: semaphore_wait_continue (in mach_kernel) + 0 (0xffffff80002815d9) > Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) > Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) > Kernel stack: > machine_idle (in mach_kernel) + 210 (0xffffff800022e461) > thread_setrun (in mach_kernel) + 1344 (0xffffff80002083a4) > thread_go (in mach_kernel) + 2145 (0xffffff8000208fec) > thread_block_reason (in mach_kernel) + 264 (0xffffff8000209ab2) > ipc_mqueue_receive (in mach_kernel) + 58 (0xffffff800020361b) > mach_msg_overwrite_trap (in mach_kernel) + 468 (0xffffff800027426a) > get_user_regs (in mach_kernel) + 545 (0xffffff80002c2daa) > hndl_mach_scall (in mach_kernel) + 230 (0xffffff80002e4536) > Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) > Continuation: semaphore_wait_continue (in mach_kernel) + 0 (0xffffff80002815d9) > Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/antoine.missout%40met… > > This email sent to antoine.missout(a)metakine.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: mach_vm_region vs. vm_region_64
by Quinn "The Eskimo!" 19 Apr '12

19 Apr '12

On 13 Apr 2012, at 14:54, Gerriet M. Denkmann wrote: > What is the difference between mach_vm_region() and. vm_region_64() ? The former takes the address and size in terms of the address space invariant mach_vm_address_t and mach_vm_size_t. > Which one if more future-proof? In general I prefer the "mach_" prefixed routines, but it's hard to talk about "future proof" and "Mach APIs" in the same sentence. Share and Enjoy -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Info about memory objects
by Gerriet M. Denkmann 14 Apr '12

14 Apr '12

Given an obj_id (as returned by mach_vm_region(VM_REGION_TOP_INFO) is it possible to get some information about this memory object, like: what kind? mapping a file? if yes, what file? etc. ? A somehow related question: The memory_object_offset_t offset as returned by mach_vm_region(VM_REGION_BASIC_INFO) is often somewhat unexpected. E.g.: TextEdit has the following load commands: path: "/Applications/TextEdit.app/Contents/MacOS/TextEdit" FAT_CIGAM with 2 headers: header[0]: Intel-64 -- selected header[1]: Intel-x86 -- ignored do 21 load commands: lc[0]: LC_SEGMENT_64 __PAGEZERO file 0 + 0 → 0 + 0 lc[1]: LC_SEGMENT_64 __TEXT file 0 + 0x1e000 → 0 + 0x1e000 lc[2]: LC_SEGMENT_64 __DATA file 0x1e000 + 0x7000 → 0x1e000 + 0x7000 lc[3]: LC_SEGMENT_64 __LINKEDIT file 0x25000 + 0x56e0 → 0x25000 + 0x6000 But the offsets from mach_vm_region() are 0x1000, 0, 0x26000. That is: shifted by one page and the offset of __DATA is zero. Why? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: is mach_vm_region confused or am I?
by Gerriet M. Denkmann 14 Apr '12

14 Apr '12

On 14 Apr 2012, at 09:55, comex wrote: > On Fri, Apr 13, 2012 at 9:47 PM, Gerriet M. Denkmann > <gerriet(a)mdenkmann.de> wrote: >> Doing: >> pid_t pid = ... (of any 64-Bit process) >> vm_map_t target_task = task_for_pid( pid ...) >> mach_vm_address_t address = ... >> mach_vm_size_t size >> mach_vm_region( target_task, &address, &size, VM_REGION_TOP_INFO ...) >> >> I get: >> size = 0x1000 (i.e. one page) >> top.shared_pages_resident = 2 >> >> When I do proc_regionfilename( pid, address, ... ) I get: "/usr/lib/dyld". >> >> Is mach_vm_region not to be trusted? Am I misunderstanding something? > > What address are you using? I am using mach_vm_region() to iterate through all memory regions. The address in question varies of course, but is not far below SHARED_REGION_BASE_X86_64. > What does vmmap say about that address? vmmap does NOT show top.shared_pages_resident. It just shows extended.pages_resident. For Xcode I get: vmmap -interleaved -resident <pid of Xcode>: [...] __DATA 00007fff68ef6000-00007fff68ef7000 [ 4K 4K] rw-/rwx SM=ZER /usr/lib/dyld __DATA 00007fff68ef7000-00007fff68ef8000 [ 4K 4K] rw-/rwx SM=COW /usr/lib/dyld [...] But mach_vm_region( VM_REGION_TOP_INFO) has: top.shared_pages_resident = 2 for both these regions. Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: is mach_vm_region confused or am I?
by comex 14 Apr '12

14 Apr '12

On Fri, Apr 13, 2012 at 9:47 PM, Gerriet M. Denkmann <gerriet(a)mdenkmann.de> wrote: > Doing: > pid_t pid = ... (of any 64-Bit process) > vm_map_t target_task = task_for_pid( pid ...) > mach_vm_address_t address = ... > mach_vm_size_t size > mach_vm_region( target_task, &address, &size, VM_REGION_TOP_INFO ...) > > I get: > size = 0x1000 (i.e. one page) > top.shared_pages_resident = 2 > > When I do proc_regionfilename( pid, address, ... ) I get: "/usr/lib/dyld". > > Is mach_vm_region not to be trusted? Am I misunderstanding something? What address are you using? What does vmmap say about that address? _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0