kern_event.h

Introduction

This header defines in-kernel functions for generating kernel events as well as functions for receiving kernel events using a kernel event socket.

Structs and Unions

struct kern_event_msg { 
    u_long total_size; /* Size of entire event msg */
    u_long vendor_code; /* For non-Apple extensibility */
    u_long kev_class; /* Layer of event source */
    u_long kev_subclass; /* Component within layer */
    u_long id; /* Monotonically increasing value */
    u_long event_code; /* unique code */
    u_long event_data[1]; /* One or more data longwords */
};  

Fields

total_size

Total size of the kernel event message including the header.

vendor_code

The vendor code indicates which vendor generated the kernel event. This gives every vendor a unique set of classes and subclasses to use. Use the SIOCGKEVVENDOR ioctl to look up vendor codes for vendors other than Apple. Apple uses KEV_VENDOR_APPLE.

kev_class

The class of the kernel event.

kev_subclass

The subclass of the kernel event.

id

Monotonically increasing value.

event_code

The event code.

event_data

Any additional data about this event. Format will depend on the vendor_code, kev_class, kev_subclass, and event_code. The length of the event_data can be determined using total_size - KEV_MSG_HEADER_SIZE.

Discussion

This structure is prepended to all kernel events. This structure is used to determine the format of the remainder of the kernel event. This structure will appear on all messages received on a kernel event socket. To post a kernel event, a slightly different structure is used.

struct kev_request { 
    u_long vendor_code; 
    u_long kev_class; 
    u_long kev_subclass; 
};  

Fields

total_size

Total size of the kernel event message including the header.

vendor_code

All kernel events that don't match this vendor code will be ignored. KEV_ANY_VENDOR can be used to receive kernel events with any vendor code.

kev_class

All kernel events that don't match this class will be ignored. KEV_ANY_CLASS can be used to receive kernel events with any class.

kev_subclass

All kernel events that don't match this subclass will be ignored. KEV_ANY_SUBCLASS can be used to receive kernel events with any subclass.

Discussion

This structure is used with the SIOCSKEVFILT and SIOCGKEVFILT to set and get the control filter setting for a kernel control socket.

struct kev_vendor_code { 
    u_long vendor_code; 
    char vendor_string[200  ]; 
};  

Fields

vendor_code

After making the SIOCGKEVVENDOR ioctl call, this will be filled in with the vendor code if there is one.

vendor_string

A bundle style identifier.

Discussion

This structure is used with the SIOCGKEVVENDOR ioctl to convert from a string identifying a kext or vendor, in the form of a bundle identifier, to a vendor code.

#defines

#define KEV_APPLESHARE_CLASS 4 

Discussion

AppleShare kernel event class.

#define KEV_IOKIT_CLASS 2 

Discussion

IOKit kernel event class.

KEV_SYSTEM_CLASS

#define KEV_SYSTEM_CLASS 3 

Discussion

System kernel event class.

#define KEV_MSG_HEADER_SIZE  

Discussion

Size of the header portion of the kern_event_msg structure. This accounts for everything right up to event_data. The size of the data can be found by subtracting KEV_MSG_HEADER_SIZE from the total size from the kern_event_msg.

#define KEV_NETWORK_CLASS 1 

Discussion

Network kernel event class.

KEV_IOKIT_CLASS

#define KEV_SYSTEM_CLASS 3 

Discussion

System kernel event class.

#define KEV_VENDOR_APPLE 1 

Discussion

Apple generated kernel events use the hard coded vendor code value of 1. Third party kernel events use a dynamically allocated vendor code. The vendor code can be found using the SIOCGKEVVENDOR ioctl.

#define KEV_VENDOR_CODE_MAX_STR_LEN 200 

Discussion

This define sets the maximum length of a string that can be used to identify a vendor or kext when looking up a vendor code.

#define SIOCGKEVFILT _IOR(
    'e', 3, struct kev_request) 

Discussion

Retrieve the kernel event filter for this socket. Kernel events not matching this filter will not be received on this socket.

#define SIOCGKEVID _IOR(
    'e', 1, u_long) 

Discussion

Retrieve the current event id. Each event generated will have a new idea. The next event to be generated will have an id of id+1.

#define SIOCGKEVVENDOR _IOWR(
    'e', 4, struct kev_vendor_code) 

Discussion

Lookup the vendor code for the specified vendor. ENOENT will be returned if a vendor code for that vendor string does not exist.

#define SIOCSKEVFILT _IOW(
    'e', 2, struct kev_request) 

Discussion

Set the kernel event filter for this socket. Kernel events not matching this filter will not be received on this socket.