site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com Domainkey-signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=received:message-id:date:from:to:subject:mime-version: content-type:content-transfer-encoding:content-disposition; b=XbUQkdn49HOxLk5jF4471QigdKbCPlr6D0iDtQ7Ju5PdogXWrN+bgZlX0L4eHnrPy EWgqErq9b5IGTxCmEBvHQ== Hi folks, I'm playing around with socket filters (sys/kpi_socketfilter.h) on 10.4.8 on Intel, mostly just to experiment and learn. I followed the tcplognke sample code pretty closely (the code from 11/27, http://developer.apple.com/samplecode/tcplognke/) and wrote a small KEXT that basically just logs messages when the sf_notify function is called. However, I noticed that occasionally the KEXT would fail to unload. The call to sflt_unregister() succeeded, but my sf_unregistered function was never getting called back. To eliminate my code as a suspect, I tried this with the tcplognke code itself, and it seems to exhibit the same behavior. I have read the docs and code comments that explain that "[sflt_unregister()] will not detach the socket filter from all sockets it may be attached to at the time, it will just prevent the socket filter from being attached to any new sockets", but the issue seems to be that sometimes the sf_unregistered function is never called, and so the socket filter can never safely be unloaded. Again, this only seems to happen on occasion, and it doesn't seem to be related to Intel (I've seen it on my G5 as well). When it happens, it's typically after maybe 5 - 10 minutes of usage with network traffic. Am I missing something obvious? Is it a known issue that sometimes socket filters won't be able to unload? Thanks in advance. Greg -- Greg Miller jgm@google.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com