svc · unix #510
__channel_open
Opens a Skywalk user-space channel into a kernel nexus for zero-copy packet I/O.
Prototype
int __channel_open(struct ch_init *init, uint32_t init_len);Returns: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| init | struct ch_init | - | |
| init_len | uint32_t | - |
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-8792.41.9 | macOS 13.0 Ventura | 510 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 510 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 510 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 510 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 510 |
| xnu-10002.41.9 | — | 510 |
| xnu-10002.61.3 | — | 510 |
| xnu-10002.81.5 | — | 510 |
| xnu-10063.101.15 | — | 510 |
| xnu-10063.121.3 | — | 510 |
| xnu-10063.141.1 | — | 510 |
| xnu-11215.41.3 | — | 510 |
| xnu-11215.61.5 | — | 510 |
| xnu-11215.81.4 | — | 510 |
| xnu-11417.121.6 | — | 510 |
| xnu-11417.140.69 | — | 510 |
| xnu-12377.101.15 | — | 510 |
| xnu-12377.41.6 | — | 510 |
| xnu-12377.61.12 | — | 510 |
| xnu-12377.81.4 | — | 510 |
| xnu-8019.80.24 | — | 510 |
| xnu-8020.101.4 | — | 510 |
| xnu-8020.121.3 | — | 510 |
| xnu-8020.140.41 | — | 510 |
| xnu-8792.61.2 | — | 510 |
| xnu-8792.81.2 | — | 510 |
| xnu-8796.101.5 | — | 510 |
| xnu-8796.121.2 | — | 510 |
| xnu-8796.141.3 | — | 510 |
Notes
Skywalk is xnu's modern networking data path: nexuses (kernel) own packet pools and per-flow rings, channels (user) map those rings via shared memory so processes like Network.framework can DMA packets without a syscall per send. __channel_open takes a nexus uuid plus a channel attribute blob and returns a fd whose mmap region contains tx/rx rings and a metadata segment. Restricted to entitled processes — primarily nettrace, nehelper, and the kernel-side flow switch.
Detection
Highly privileged surface; opens by anything other than Apple's networking daemons should be alerted on. ES has no probe; auditing relies on the syscall number plus the calling code signature.