May 2012 - Darwin-kernel - lists.apple.com

Re: Detecting TCP connection failure reason in socket level NKE
by Volodymyr Shcherbyna 30 May '12

30 May '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Detecting TCP connection failure reason in socket level NKE
by Josh Graessley 30 May '12

30 May '12

Have you tried calling sock_getsockopt(socket, SOL_SOCKET, SO_ERROR, &err, &optlen)? I'm not certain the suggestion above will work, but that is where I'd start. Hope this helps, -josh On May 30, 2012, at 8:49 AM, Volodymyr Shcherbyna <volodymyr(a)shcherbyna.com> wrote: > Hello Everyone, > > I am trying to detect in socket level NKE failed TCP connections and to determine the reason why they are failed. I can see that successful TCP connections are generating sock_evt_connected event in sp_notify_func : this way I am able to distinguish between successful connections and failed one. > > The next step is to try to determine the reason of failure: is it a time out, or host is down, or port is closed, etc. It seems like I don't get any errors at socket level NKE. I was trying to see in sf_setopt_func any options which are set on a socket after connections is failed but I could not find any clue on what to filter out. Is there any chance to get this data at socket level NKE? I was hoping to get last error associated with a socket or something simular to GetLastError(...) functions under Windows. > > Otherwise, it seems like I have to use IP level filters for that? In this case it seems like it is complicating the task as I would have to have a state machine per each TCP connection and do some manipulations when frames are leaving my machine ... > > Thanks for any hints, > > -- > with best regards, Volodymyr. > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/jgraessley%40apple.com > > This email sent to jgraessley(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Detecting TCP connection failure reason in socket level NKE
by Volodymyr Shcherbyna 30 May '12

30 May '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

To differentiate in DELETE and RENAME operation in Kauth.
by simran charley 22 May '12

22 May '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: getting process exit notifications in kext or how to use kqueue efficiently in user mode daemon
by James C 21 May '12

21 May '12

Hello Volodymyr, This is a cut-from-whole-cloth response, made from user-land network programming experience. There are two ways in which a signal can interrupt kevent(). One is by being unexpected, and causing it to return EINTR; the other is by being expected, and being returned as a kernel event. Can you arrange for the watcher of process exits to be interruptible by a signal, and then to read a thread-safe queue of processes to add? If so, can you arrange for the watcher of process starts to put them on the queue and then generate the signal? None of this tells you how to do the locking around the rest of your per-process state, which also needs to be done right. Alternatively, taking a giant leap into left field, does anyone know if Grand Central Dispatch can take input from kqueue? If so, there may be an elegant GCD solution to this problem. Regards, James. On Tue, May 22, 2012 at 7:00 AM, <darwin-kernel-request(a)lists.apple.com> wrote: > Message: 1 > Date: Mon, 21 May 2012 13:10:49 +0200 > From: Volodymyr Shcherbyna <volodymyr(a)shcherbyna.com> > To: darwin-kernel(a)lists.apple.com > Subject: getting process exit notifications in kext or how to use > kqueue efficiently in user mode daemon > Message-ID: > <CAPzHgeJ77hppDMTW_cYjUbdigfEA0yOd7AcpnQ9=vTPCgbX0+Q(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hello Everyone, > > Thanks for reading this and trying to help :). > > To make long story short. I am trying to monitor process start & stop in my > NKE in order to make associations between processes doing network IO. I > need the exit event as I need to clear-up resources associated with the > given PID. I saw a simular question here: > http://lists.apple.com/archives/darwin-kernel/2010/Jun/msg00018.html and > the basic idea is that if you want to get process exit events you should > use user daemon with kqueues. > > I did a sample prototype and I can see that the kqueues do work for a > single process or a set of processes if I know it's pids. The question is > how to use it efficiently for the cases when I don't know a finite set of > PIDs beforehand? I would like to use single kqueue on a single thread in > order to make things efficient as much as possible. What I need is to be > able to add new PIDs in a kqueue while it blocks in kevent. I.e., in the > simplest scenario: > > struct kevent kev; > int kq = kqueue(); > EV_SET(&kev, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL); > kevent(kq, &kev, 1, NULL, 0, NULL); > > How can I add kevent for a new PID while I am blocked in kevent(...) ? I > can do a call with timeout and in when I am interrupted I can register for > a new set of PIDs, but this way is not free from race conditions and is not > efficient. > > -- > with best regards, Volodymyr. >

1 0

getting process exit notifications in kext or how to use kqueue efficiently in user mode daemon
by Volodymyr Shcherbyna 21 May '12

21 May '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using KERN_KDGETBUF thread values
by Shantonu Sen 17 May '12

17 May '12

It's not current_thread() (a pointer), it's a 64-bit non-repeating thread ID (thread_tid(current_thread())) What information are you trying to get? You can try using proc_info(PROC_PIDTHREADID64INFO). Shantonu On May 14, 2012, at 12:21 PM, James Boulton <james.boulton(a)eiconic.com> wrote: > I'm using sysctl / KERN_KDGETBUF to get some profiling information and arg5 of the kd_buf structure returned is the currently executing thread (as returned by current_thread() in the XNU kernel). > > I'm trying to figure out how to use this thread id to get some useful details about the thread, but I cant seem to figure out how to do this. > > If I try and use the value with any standard thread functions I get an error of MACH_SEND_INVALID_DEST. I assume this value is a kernel thread id of some kind (it doesnt appear to be a pointer) and not a mach port. It looks like I should be using something like thread_get_kernel_port to get the send right to the thread, but this also comes back with MACH_SEND_INVALID_DEST. > > Any kernel guru's out there, I'd really appreciate some help! :o) > > Cheers, > -- James > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ssen%40apple.com > > This email sent to ssen(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Using KERN_KDGETBUF thread values
by James Boulton 14 May '12

14 May '12

Any kernel guru's out there, I'd really appreciate some help! :o) Cheers, _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com I'm using sysctl / KERN_KDGETBUF to get some profiling information and arg5 of the kd_buf structure returned is the currently executing thread (as returned by current_thread() in the XNU kernel). I'm trying to figure out how to use this thread id to get some useful details about the thread, but I cant seem to figure out how to do this. If I try and use the value with any standard thread functions I get an error of MACH_SEND_INVALID_DEST. I assume this value is a kernel thread id of some kind (it doesnt appear to be a pointer) and not a mach port. It looks like I should be using something like thread_get_kernel_port to get the send right to the thread, but this also comes back with MACH_SEND_INVALID_DEST. -- James

1 0

Re: To identify spotlight process in KAUTH
by comex 09 May '12

09 May '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: To identify spotlight process in KAUTH
by me 09 May '12

09 May '12

To answer your question, you should. I think it actually comes up as a process names mdworker, and not spotlight if I remember correctly. On May 8, 2012, at 11:43 PM, simran charley wrote: > Hi, > > Is it possible to identify spotlight process in KAUTH Vnode listener? > Do Vnode listener provide any way to find process information? > > Thanks, > Simran. > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/kernelkangaroo%40gmai… > > This email sent to kernelkangaroo(a)gmail.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0