svc · unix #363
kevent
Appel classique de soumission et récupération kqueue utilisant struct kevent.
Prototype
int kevent(int fd, const struct kevent *changelist, int nchanges, struct kevent *eventlist, int nevents, const struct timespec *timeout);Retour: int
Arguments
| Name | Type | Dir | Description |
|---|---|---|---|
| fd | int | - | |
| changelist | const struct kevent | - | |
| nchanges | int | - | |
| eventlist | struct kevent | - | |
| nevents | int | - | |
| timeout | const struct timespec | - |
Historique des versions
| XNU tag | macOS | # |
|---|---|---|
| xnu-1456.1.26 | macOS 10.6 Snow Leopard | 363 |
| xnu-1699.24.8 | macOS 10.7 Lion | 363 |
| xnu-2050.18.24 | macOS 10.8 Mountain Lion | 363 |
| xnu-2422.115.4 | macOS 10.9 Mavericks | 363 |
| xnu-2782.40.9 | macOS 10.10 Yosemite | 363 |
| xnu-3247.1.106 | macOS 10.11 El Capitan | 363 |
| xnu-3789.1.32 | macOS 10.12 Sierra | 363 |
| xnu-4570.1.46 | macOS 10.13 High Sierra | 363 |
| xnu-4903.221.2 | macOS 10.14 Mojave | 363 |
| xnu-6153.11.26 | macOS 10.15 Catalina | 363 |
| xnu-7195.50.7.100.1 | macOS 11.0 Big Sur | 363 |
| xnu-8019.41.5 | macOS 12.0 Monterey | 363 |
| xnu-8792.41.9 | macOS 13.0 Ventura | 363 |
| xnu-10002.1.13 | macOS 14.0 Sonoma | 363 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | 363 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | 363 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | 363 |
| xnu-10002.41.9 | — | 363 |
| xnu-10002.61.3 | — | 363 |
| xnu-10002.81.5 | — | 363 |
| xnu-10063.101.15 | — | 363 |
| xnu-10063.121.3 | — | 363 |
| xnu-10063.141.1 | — | 363 |
| xnu-11215.41.3 | — | 363 |
| xnu-11215.61.5 | — | 363 |
| xnu-11215.81.4 | — | 363 |
| xnu-11417.121.6 | — | 363 |
| xnu-11417.140.69 | — | 363 |
| xnu-12377.101.15 | — | 363 |
| xnu-12377.41.6 | — | 363 |
| xnu-12377.61.12 | — | 363 |
| xnu-12377.81.4 | — | 363 |
| xnu-1486.2.11 | — | 363 |
| xnu-1504.15.3 | — | 363 |
| xnu-1504.3.12 | — | 363 |
| xnu-1504.7.4 | — | 363 |
| xnu-1504.9.17 | — | 363 |
| xnu-1504.9.26 | — | 363 |
| xnu-1504.9.37 | — | 363 |
| xnu-1699.22.73 | — | 363 |
| xnu-1699.22.81 | — | 363 |
| xnu-1699.24.23 | — | 363 |
| xnu-1699.26.8 | — | 363 |
| xnu-1699.32.7 | — | 363 |
| xnu-2050.22.13 | — | 363 |
| xnu-2050.24.15 | — | 363 |
| xnu-2050.48.11 | — | 363 |
| xnu-2050.7.9 | — | 363 |
| xnu-2050.9.2 | — | 363 |
| xnu-2422.1.72 | — | 363 |
| xnu-2422.100.13 | — | 363 |
| xnu-2422.110.17 | — | 363 |
| xnu-2422.90.20 | — | 363 |
| xnu-2782.1.97 | — | 363 |
| xnu-2782.10.72 | — | 363 |
| xnu-2782.20.48 | — | 363 |
| xnu-2782.30.5 | — | 363 |
| xnu-3247.10.11 | — | 363 |
| xnu-3248.20.55 | — | 363 |
| xnu-3248.30.4 | — | 363 |
| xnu-3248.40.184 | — | 363 |
| xnu-3248.50.21 | — | 363 |
| xnu-3248.60.10 | — | 363 |
| xnu-3789.21.4 | — | 363 |
| xnu-3789.31.2 | — | 363 |
| xnu-3789.41.3 | — | 363 |
| xnu-3789.51.2 | — | 363 |
| xnu-3789.60.24 | — | 363 |
| xnu-3789.70.16 | — | 363 |
| xnu-4570.20.62 | — | 363 |
| xnu-4570.31.3 | — | 363 |
| xnu-4570.41.2 | — | 363 |
| xnu-4570.51.1 | — | 363 |
| xnu-4570.61.1 | — | 363 |
| xnu-4570.71.2 | — | 363 |
| xnu-4903.231.4 | — | 363 |
| xnu-4903.241.1 | — | 363 |
| xnu-4903.270.47 | — | 363 |
| xnu-6153.101.6 | — | 363 |
| xnu-6153.121.1 | — | 363 |
| xnu-6153.141.1 | — | 363 |
| xnu-6153.41.3 | — | 363 |
| xnu-6153.61.1 | — | 363 |
| xnu-6153.81.5 | — | 363 |
| xnu-7195.101.1 | — | 363 |
| xnu-7195.121.3 | — | 363 |
| xnu-7195.141.2 | — | 363 |
| xnu-7195.60.75 | — | 363 |
| xnu-7195.81.3 | — | 363 |
| xnu-8019.61.5 | — | 363 |
| xnu-8019.80.24 | — | 363 |
| xnu-8020.101.4 | — | 363 |
| xnu-8020.121.3 | — | 363 |
| xnu-8020.140.41 | — | 363 |
| xnu-8792.61.2 | — | 363 |
| xnu-8792.81.2 | — | 363 |
| xnu-8796.101.5 | — | 363 |
| xnu-8796.121.2 | — | 363 |
| xnu-8796.141.3 | — | 363 |
Notes
kevent(kq, changes, nchanges, events, nevents, timeout) est la moitié laborieuse de kqueue : enregistrer des filtres via la changelist, drainer les événements prêts via l'eventlist. C'est le point d'entrée plus petit commun dénominateur, sur lequel le runloop de libdispatch reposait avant 10.10. Le nouveau code devrait préférer kevent_qos pour la propagation de QoS.
Détection
Les enregistrements EVFILT_PROC, EVFILT_VNODE et EVFILT_SIGNAL depuis des processus non-IDE méritent d'être signalés — c'est ainsi que les implants espionnent les cycles de vie de PIDs ou surveillent des dépôts de fichiers sans polling. Le fournisseur DTrace kevent::: expose des sondes par filtre.