1 | /* |
2 | * Copyright (c) 2000-2014 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright (c) 1998, 1999 Apple Computer, Inc. All Rights Reserved */ |
29 | /*! |
30 | @header kern_event.h |
31 | This header defines in-kernel functions for generating kernel events as |
32 | well as functions for receiving kernel events using a kernel event |
33 | socket. |
34 | */ |
35 | |
36 | #ifndef SYS_KERN_EVENT_H |
37 | #define SYS_KERN_EVENT_H |
38 | |
39 | #include <sys/appleapiopts.h> |
40 | #include <sys/ioccom.h> |
41 | #include <sys/sys_domain.h> |
42 | |
43 | #define KEV_SNDSPACE (4 * 1024) |
44 | #define KEV_RECVSPACE (32 * 1024) |
45 | |
46 | #define KEV_ANY_VENDOR 0 |
47 | #define KEV_ANY_CLASS 0 |
48 | #define KEV_ANY_SUBCLASS 0 |
49 | |
50 | /* |
51 | * Vendor Code |
52 | */ |
53 | |
54 | /*! |
55 | @defined KEV_VENDOR_APPLE |
56 | @discussion Apple generated kernel events use the hard coded vendor code |
57 | value of 1. Third party kernel events use a dynamically allocated vendor |
58 | code. The vendor code can be found using the SIOCGKEVVENDOR ioctl. |
59 | */ |
60 | #define KEV_VENDOR_APPLE 1 |
61 | |
62 | /* |
63 | * Definition of top-level classifications for KEV_VENDOR_APPLE |
64 | */ |
65 | |
66 | /*! |
67 | @defined KEV_NETWORK_CLASS |
68 | @discussion Network kernel event class. |
69 | */ |
70 | #define KEV_NETWORK_CLASS 1 |
71 | |
72 | /*! |
73 | @defined KEV_IOKIT_CLASS |
74 | @discussion IOKit kernel event class. |
75 | */ |
76 | #define KEV_IOKIT_CLASS 2 |
77 | |
78 | /*! |
79 | @defined KEV_SYSTEM_CLASS |
80 | @discussion System kernel event class. |
81 | */ |
82 | #define KEV_SYSTEM_CLASS 3 |
83 | |
84 | /*! |
85 | @defined KEV_APPLESHARE_CLASS |
86 | @discussion AppleShare kernel event class. |
87 | */ |
88 | #define KEV_APPLESHARE_CLASS 4 |
89 | |
90 | /*! |
91 | @defined KEV_FIREWALL_CLASS |
92 | @discussion Firewall kernel event class. |
93 | */ |
94 | #define KEV_FIREWALL_CLASS 5 |
95 | |
96 | /*! |
97 | @defined KEV_IEEE80211_CLASS |
98 | @discussion IEEE 802.11 kernel event class. |
99 | */ |
100 | #define KEV_IEEE80211_CLASS 6 |
101 | |
102 | /*! |
103 | @struct kern_event_msg |
104 | @discussion This structure is prepended to all kernel events. This |
105 | structure is used to determine the format of the remainder of |
106 | the kernel event. This structure will appear on all messages |
107 | received on a kernel event socket. To post a kernel event, a |
108 | slightly different structure is used. |
109 | @field total_size Total size of the kernel event message including the |
110 | header. |
111 | @field vendor_code The vendor code indicates which vendor generated the |
112 | kernel event. This gives every vendor a unique set of classes |
113 | and subclasses to use. Use the SIOCGKEVVENDOR ioctl to look up |
114 | vendor codes for vendors other than Apple. Apple uses |
115 | KEV_VENDOR_APPLE. |
116 | @field kev_class The class of the kernel event. |
117 | @field kev_subclass The subclass of the kernel event. |
118 | @field id Monotonically increasing value. |
119 | @field event_code The event code. |
120 | @field event_data Any additional data about this event. Format will |
121 | depend on the vendor_code, kev_class, kev_subclass, and |
122 | event_code. The length of the event_data can be determined |
123 | using total_size - KEV_MSG_HEADER_SIZE. |
124 | */ |
125 | struct kern_event_msg { |
126 | u_int32_t total_size; /* Size of entire event msg */ |
127 | u_int32_t vendor_code; /* For non-Apple extensibility */ |
128 | u_int32_t kev_class; /* Layer of event source */ |
129 | u_int32_t kev_subclass; /* Component within layer */ |
130 | u_int32_t id; /* Monotonically increasing value */ |
131 | u_int32_t event_code; /* unique code */ |
132 | u_int32_t event_data[1]; /* One or more data words */ |
133 | }; |
134 | |
135 | /*! |
136 | @defined KEV_MSG_HEADER_SIZE |
137 | @discussion Size of the header portion of the kern_event_msg structure. |
138 | This accounts for everything right up to event_data. The size |
139 | of the data can be found by subtracting KEV_MSG_HEADER_SIZE |
140 | from the total size from the kern_event_msg. |
141 | */ |
142 | #define (offsetof(struct kern_event_msg, event_data[0])) |
143 | |
144 | /*! |
145 | @struct kev_request |
146 | @discussion This structure is used with the SIOCSKEVFILT and |
147 | SIOCGKEVFILT to set and get the control filter setting for a |
148 | kernel control socket. |
149 | @field total_size Total size of the kernel event message including the |
150 | header. |
151 | @field vendor_code All kernel events that don't match this vendor code |
152 | will be ignored. KEV_ANY_VENDOR can be used to receive kernel |
153 | events with any vendor code. |
154 | @field kev_class All kernel events that don't match this class will be |
155 | ignored. KEV_ANY_CLASS can be used to receive kernel events with |
156 | any class. |
157 | @field kev_subclass All kernel events that don't match this subclass |
158 | will be ignored. KEV_ANY_SUBCLASS can be used to receive kernel |
159 | events with any subclass. |
160 | */ |
161 | struct kev_request { |
162 | u_int32_t vendor_code; |
163 | u_int32_t kev_class; |
164 | u_int32_t kev_subclass; |
165 | }; |
166 | |
167 | /*! |
168 | @defined KEV_VENDOR_CODE_MAX_STR_LEN |
169 | @discussion This define sets the maximum length of a string that can be |
170 | used to identify a vendor or kext when looking up a vendor code. |
171 | */ |
172 | #define KEV_VENDOR_CODE_MAX_STR_LEN 200 |
173 | |
174 | /*! |
175 | @struct kev_vendor_code |
176 | @discussion This structure is used with the SIOCGKEVVENDOR ioctl to |
177 | convert from a string identifying a kext or vendor, in the |
178 | form of a bundle identifier, to a vendor code. |
179 | @field vendor_code After making the SIOCGKEVVENDOR ioctl call, this will |
180 | be filled in with the vendor code if there is one. |
181 | @field vendor_string A bundle style identifier. |
182 | */ |
183 | #pragma pack(4) |
184 | struct kev_vendor_code { |
185 | u_int32_t vendor_code; |
186 | char vendor_string[KEV_VENDOR_CODE_MAX_STR_LEN]; |
187 | }; |
188 | #pragma pack() |
189 | |
190 | /*! |
191 | @defined SIOCGKEVID |
192 | @discussion Retrieve the current event id. Each event generated will |
193 | have a new id. The next event to be generated will have an id |
194 | of id+1. |
195 | */ |
196 | #define SIOCGKEVID _IOR('e', 1, u_int32_t) |
197 | |
198 | /*! |
199 | @defined SIOCSKEVFILT |
200 | @discussion Set the kernel event filter for this socket. Kernel events |
201 | not matching this filter will not be received on this socket. |
202 | */ |
203 | #define SIOCSKEVFILT _IOW('e', 2, struct kev_request) |
204 | |
205 | /*! |
206 | @defined SIOCGKEVFILT |
207 | @discussion Retrieve the kernel event filter for this socket. Kernel |
208 | events not matching this filter will not be received on this |
209 | socket. |
210 | */ |
211 | #define SIOCGKEVFILT _IOR('e', 3, struct kev_request) |
212 | |
213 | /*! |
214 | @defined SIOCGKEVVENDOR |
215 | @discussion Lookup the vendor code for the specified vendor. ENOENT will |
216 | be returned if a vendor code for that vendor string does not |
217 | exist. |
218 | */ |
219 | #define SIOCGKEVVENDOR _IOWR('e', 4, struct kev_vendor_code) |
220 | |
221 | #ifdef PRIVATE |
222 | struct xkevtpcb { |
223 | u_int32_t kep_len; |
224 | u_int32_t kep_kind; |
225 | u_int64_t kep_evtpcb; |
226 | u_int32_t kep_vendor_code_filter; |
227 | u_int32_t kep_class_filter; |
228 | u_int32_t kep_subclass_filter; |
229 | }; |
230 | |
231 | struct kevtstat { |
232 | u_int64_t kes_pcbcount __attribute__((aligned(8))); |
233 | u_int64_t kes_gencnt __attribute__((aligned(8))); |
234 | u_int64_t kes_badvendor __attribute__((aligned(8))); |
235 | u_int64_t kes_toobig __attribute__((aligned(8))); |
236 | u_int64_t kes_nomem __attribute__((aligned(8))); |
237 | u_int64_t kes_fullsock __attribute__((aligned(8))); |
238 | u_int64_t kes_posted __attribute__((aligned(8))); |
239 | |
240 | }; |
241 | #endif /* PRIVATE */ |
242 | |
243 | #ifdef KERNEL |
244 | /*! |
245 | @define N_KEV_VECTORS |
246 | @discussion The maximum number of kev_d_vectors for a kernel event. |
247 | */ |
248 | #define N_KEV_VECTORS 5 |
249 | |
250 | /*! |
251 | @struct kev_d_vectors |
252 | @discussion This structure is used to append some data to a kernel |
253 | event. |
254 | @field data_length The length of data. |
255 | @field data_ptr A pointer to data. |
256 | */ |
257 | struct kev_d_vectors { |
258 | u_int32_t data_length; /* Length of the event data */ |
259 | void *data_ptr; /* Pointer to event data */ |
260 | }; |
261 | |
262 | /*! |
263 | @struct kev_msg |
264 | @discussion This structure is used when posting a kernel event. |
265 | @field vendor_code The vendor code assigned by kev_vendor_code_find. |
266 | @field kev_class The event's class. |
267 | @field kev_class The event's subclass. |
268 | @field kev_class The event's code. |
269 | @field dv An array of vectors describing additional data to be appended |
270 | to the kernel event. |
271 | */ |
272 | struct kev_msg { |
273 | u_int32_t vendor_code; /* For non-Apple extensibility */ |
274 | u_int32_t kev_class; /* Layer of event source */ |
275 | u_int32_t kev_subclass; /* Component within layer */ |
276 | u_int32_t event_code; /* The event code */ |
277 | struct kev_d_vectors dv[N_KEV_VECTORS]; /* Up to n data vectors */ |
278 | }; |
279 | |
280 | /*! |
281 | @function kev_vendor_code_find |
282 | @discussion Lookup a vendor_code given a unique string. If the vendor |
283 | code has not been used since launch, a unique integer will be |
284 | assigned for that string. Vendor codes will remain the same |
285 | until the machine is rebooted. |
286 | @param vendor_string A bundle style vendor identifier(i.e. com.apple). |
287 | @param vendor_code Upon return, a unique vendor code for use when |
288 | posting kernel events. |
289 | @result May return ENOMEM if memory constraints prevent allocation of a |
290 | new vendor code. |
291 | */ |
292 | errno_t kev_vendor_code_find(const char *vendor_string, u_int32_t *vendor_code); |
293 | |
294 | /*! |
295 | @function kev_msg_post |
296 | @discussion Post a kernel event message. |
297 | @param event_msg A structure defining the kernel event message to post. |
298 | @result Will return zero upon success. May return a number of errors |
299 | depending on the type of failure. EINVAL indicates that there |
300 | was something wrong with the kerne event. The vendor code of |
301 | the kernel event must be assigned using kev_vendor_code_find. |
302 | If the message is too large, EMSGSIZE will be returned. |
303 | */ |
304 | errno_t kev_msg_post(struct kev_msg *event_msg); |
305 | |
306 | #ifdef PRIVATE |
307 | /* |
308 | * Internal version of kev_msg_post. Allows posting Apple vendor code kernel |
309 | * events. |
310 | */ |
311 | int kev_post_msg(struct kev_msg *event); |
312 | |
313 | LIST_HEAD(kern_event_head, kern_event_pcb); |
314 | |
315 | struct kern_event_pcb { |
316 | decl_lck_mtx_data(, evp_mtx); /* per-socket mutex */ |
317 | LIST_ENTRY(kern_event_pcb) evp_link; /* glue on list of all PCBs */ |
318 | struct socket *evp_socket; /* pointer back to socket */ |
319 | u_int32_t evp_vendor_code_filter; |
320 | u_int32_t evp_class_filter; |
321 | u_int32_t evp_subclass_filter; |
322 | }; |
323 | |
324 | #define sotoevpcb(so) ((struct kern_event_pcb *)((so)->so_pcb)) |
325 | |
326 | #endif /* PRIVATE */ |
327 | #endif /* KERNEL */ |
328 | #endif /* SYS_KERN_EVENT_H */ |
329 | |