Re: Process exit notifcation in a kext
Re: Process exit notifcation in a kext
- Subject: Re: Process exit notifcation in a kext
- From: Bogdan Harjoc <email@hidden>
- Date: Wed, 23 Jun 2010 12:32:10 +0300
On Tue, Jun 22, 2010 at 10:44 PM, Terry Lambert <email@hidden> wrote:
> The tcp_input() doesn't happen in the context of a process, it happens in
> the context of a kernel thread (the moral equivalent of netisr() on BSD
> systems). The data gets unloaded onto a socket at the top end, but the
> binding between a socket and a process is via a file descriptor, and any
> given file descriptor could be referenced by multiple processes [...]
Agreed here, there's no trivial way of mapping socket_t to pid. Since
I'm only dealing with TCP sockets, I can get the pid in the 'attach'
filter callback. The two possible cases are "connect()ed socket" which
the process creates, and "accept()ed socket" for which I assume the
pid is the same as its listening socket, which the process also
creates.
Thanks for the big picture,
Bogdan
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden