August 2012 - Darwin-kernel

Re: Integrity checks for Mac kernel extensions
by Ken Hornstein 24 Aug '12

24 Aug '12

>You seem to be drawing conclusions based on writing a BSD filesystem >kext (?) which is not the general case, and certainly has a different >operating environment than 99% of kexts (which are IOKit kexts, >match asynchronously with respect to the root filesystem and each >other, and cannot in general call into the BSD side of the kernel >early in boot without panicking) Well, yeah, that's my experience, and I hope I've never presented myself as the be-all expert when it comes to MacOS kernel extensions because obviously I'm not. My original point was that you can definitely access filesystems from kexts, but I was under the impression that kext loading was handled exclusively by kextd and friends and obviously everything will be up and running by that time. As you've pointed out, that's not a valid assumption; I learned something new today. It occurs to me that if your kext is loaded before the root filesystem is mounted you could do somet goofy stuff like have a thread wait around until it is available, but that probably falls under "here be dragons". --Ken _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Integrity checks for Mac kernel extensions
by al ameen shah 24 Aug '12

24 Aug '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Integrity checks for Mac kernel extensions
by Shantonu Sen 24 Aug '12

24 Aug '12

I'm talking about the 99% of kexts that are loaded by the preboot environment or in the prelinked kernelcache. You know, like the platform expert, IOStorageFamily, the AHCI driver stack, most everything in /System/Library/Extensions You seem to be drawing conclusions based on writing a BSD filesystem kext (?) which is not the general case, and certainly has a different operating environment than 99% of kexts (which are IOKit kexts, match asynchronously with respect to the root filesystem and each other, and cannot in general call into the BSD side of the kernel early in boot without panicking) Shantonu On Aug 24, 2012, at 11:04 AM, Ken Hornstein <kenh(a)cmf.nrl.navy.mil> wrote: >> What happens if the root filesystem isn't mounted (which it typically >> isn't when 99% of kernel extensions are loaded, which is what the >> OP asked for)? > > Wait ... the root filesystem isn't mounted when kexts are loaded? And > kextd is running? How does THAT work? I will freely confess that when > I did this it was well pass system boot time, so obviously the root filesystem > was mounted. > > --Ken > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ssen%40apple.com > > This email sent to ssen(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Integrity checks for Mac kernel extensions
by Ken Hornstein 24 Aug '12

24 Aug '12

>What happens if the root filesystem isn't mounted (which it typically >isn't when 99% of kernel extensions are loaded, which is what the >OP asked for)? Wait ... the root filesystem isn't mounted when kexts are loaded? And kextd is running? How does THAT work? I will freely confess that when I did this it was well pass system boot time, so obviously the root filesystem was mounted. --Ken _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Integrity checks for Mac kernel extensions
by Shantonu Sen 24 Aug '12

24 Aug '12

What happens if the root filesystem isn't mounted (which it typically isn't when 99% of kernel extensions are loaded, which is what the OP asked for)? Shantonu On Aug 24, 2012, at 7:19 AM, Ken Hornstein <kenh(a)cmf.nrl.navy.mil> wrote: >> I would like to perform self integrity checks (validate against a known >> hash value) for my kernel extensions when they gets loaded into the memory. >> Since i can't access files from the kernel extension, what is the best way >> of achieving this within kernel extesions? > > You CAN read files from kernel extensions. The API exists. Some say that > it's is very hard to use, but I personally didn't have a problem with it. > I wouldn't want to do a lot of complicated stuff, but if you just need to > read a file it should be doable. > > --Ken > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > https://lists.apple.com/mailman/options/darwin-kernel/ssen%40apple.com > > This email sent to ssen(a)apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Fwd: Integrity checks for Mac kernel extensions
by Ken Pillay 24 Aug '12

24 Aug '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Integrity checks for Mac kernel extensions
by Ken Hornstein 24 Aug '12

24 Aug '12

>I would like to perform self integrity checks (validate against a known >hash value) for my kernel extensions when they gets loaded into the memory. >Since i can't access files from the kernel extension, what is the best way >of achieving this within kernel extesions? You CAN read files from kernel extensions. The API exists. Some say that it's is very hard to use, but I personally didn't have a problem with it. I wouldn't want to do a lot of complicated stuff, but if you just need to read a file it should be doable. --Ken _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Integrity checks for Mac kernel extensions
by Arun 24 Aug '12

24 Aug '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: ThunderBolt....
by Chris Suter 16 Aug '12

16 Aug '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

ThunderBolt....
by James Wise 15 Aug '12

15 Aug '12

Hey Everyone, We currently sell and support a PCIe add-in card for Macs. I have recently added Thunderbolt support to the kext driver, so that it works correctly when used in an external Thunderbolt enclosure. Cheers, James _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com Now that the hard part is done i am wondering if there is any marketing/specification/certification requirements we need to follow in order to advertise our device as "ThunderBolt compatible" ??

1 0