getting process exit notifications in kext or how to use kqueue efficiently in user mode daemon
getting process exit notifications in kext or how to use kqueue efficiently in user mode daemon
- Subject: getting process exit notifications in kext or how to use kqueue efficiently in user mode daemon
- From: Volodymyr Shcherbyna <email@hidden>
- Date: Mon, 21 May 2012 13:10:49 +0200
Hello Everyone,
Thanks for reading this and trying to help :).
To make long story short. I am trying to monitor process start & stop in my NKE in order to make associations between processes doing network IO. I need the exit event as I need to clear-up resources associated with the given PID. I saw a simular question here:
http://lists.apple.com/archives/darwin-kernel/2010/Jun/msg00018.html and the basic idea is that if you want to get process exit events you should use user daemon with kqueues.
I did a sample prototype and I can see that the kqueues do work for a single process or a set of processes if I know it's pids. The question is how to use it efficiently for the cases when I don't know a finite set of PIDs beforehand? I would like to use single kqueue on a single thread in order to make things efficient as much as possible. What I need is to be able to add new PIDs in a kqueue while it blocks in kevent. I.e., in the simplest scenario:
struct kevent kev;
int kq = kqueue();
EV_SET(&kev, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT, 0, NULL);
kevent(kq, &kev, 1, NULL, 0, NULL);
How can I add kevent for a new PID while I am blocked in kevent(...) ? I can do a call with timeout and in when I am interrupted I can register for a new set of PIDs, but this way is not free from race conditions and is not efficient.
--
with best regards, Volodymyr.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden