Apple

I am working on an antivirus project for MAC. We have taken vnode level file system activity monitor code from MAC OS X internals book as our guide. What we are trying to achieve is monitoring on the vnode scope. When a file operation takes place at the vnode level the kernel will pass on the filename to usermode application for scanning. Meanwhile the kernel needs to wait for the scanning to complete and look at the return value. The user mode app will wake up the kernel once scanning is done and pass the scan result down to the kernel. Based on the scan result the kernel then either allows or denies the request. So basically we want to achieve synchronous communication between the kernel extension and the user mode application. We are newbies on MAC. We read documentation but is confusing as to how we can create event in user mode and pass it down to kernel on which the kernel will wait. If you could point us to a sample piece of code or clear documentation on how we can achieve our objective it will be great. Which are the synchronisation objects to be used in user mode and which ones to use in user mode. Is this the right design ? I have gone through posts on the forum but did not get how to achieve our objective.