Dtrace no longer have access to HFS data structures

HI all,


With DSCript, I used to write the following script to retreive inode value for a given file handles.


    fi_inode = (F == NULL) ? 0 :
            F->fg_ops->fo_type != DTYPE_VNODE ? 0:
            ((struct vnode *) F->fg_data)->v_tag != 16 ? 0:  / HFS */
            ((struct cnode*) ((struct vnode *) F->fg_data)->v_data)->c_attr.ca_fileid;


However, from OSX Sierra kernel (xnu-3789.21.4), I found out that code for HFS is separated as a different source base.

As a result, above Dscript which used to work for previous versions of OSX up to 10.11 stopped to working since struct cnode which is defined from hfs_internals.h now included from hfs source base and is no longer visible from xnu kernel.



Would you let me know how to resolve this issue?


Thanks!

Replies

Yeah, HFS is now loaded from a KEXT, which is cool in general but makes things hard for DTrace. It would seem logical for the HFS KEXT’s

.dSYM
to be included in the Kernel Debug Kit but it is not. You should definitely file a bug requesting that. Please post your bug number, just for the record.

If no one else chimes in, you might try asking over on the filesystem-dev mailing list.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"