Gain user-space access to hardware devices and drivers using IOKit.

Posts under IOKit tag

54 Posts
Sort by:

Post

Replies

Boosts

Views

Activity

How to properly convert any size of application memory into the kernel space of Driverkit?
Hardware and software configuration MacBook Air M2 2022 16GB, MacOS Ventura 13.2.1 Full description This is a DriverKit that controls PCIE FPGA devices for low-latency data exchange. This driver has been implemented on Iokit, and now it needs to be launched on Driverkit to adapt to newer Macs. Driverkit lacks the IOMemoryDescriptor::withAddressRange(Iokit) function to convert the app's memory of any size to a Descriptor. Currently, we use args->structureOutputDescriptor->CreateMapping to map the Descriptor passed by the application to the kernel layer. // App size_t ***::xxRead(long long addr, size_t size, void * buff){ std::lock_guard<std::mutex> guard(usrLock); kern_return_t kr; uint64_t info[2] = {(uint64_t)addr, (uint64_t)size}; kr = IOConnectCallMethod( connect, kUserReadIO, info, 2, NULL, NULL, NULL, NULL, buff, &size); return size; } // Driverkit const IOUserClientMethodDispatch sMethods[kNumMethods] = { [kUserReadIO] = { (IOUserClientMethodFunction) &SmiPcieUc::sUserReadIo, .checkCompletionExists = false, .checkScalarInputCount = 2, // Read Addr, size .checkStructureInputSize = 0, .checkScalarOutputCount = 0, .checkStructureOutputSize = kIOUserClientVariableStructureSize} // Read Data }; kern_return_t SmiPcieUc::sUserReadIo (OSObject * target, void* reference, IOUserClientMethodArguments* args){ IOMemoryMap * memMap = nullptr; uint32_t * buffKptr = nullptr; kern_return_t rt = 0; if(target == nullptr){ Log("***Err***: sUserReadIo Target is Null!"); return kIOReturnError; } if(args->structureOutputDescriptor){ rt = args->structureOutputDescriptor->CreateMapping(0,0,0,0,0, &memMap); if(rt == kIOReturnSuccess){ buffKptr = reinterpret_cast<uint32_t *>(memMap->GetAddress()); } else { Log("***Err***: sUserReadIo Mapping Failed!"); return kIOReturnNoMemory; } } else { buffKptr = (uint32_t *) args->structureOutput; } rt = ((SmiPcieUc *)target)->UserReadIo((uint64_t *)&args->scalarInput[0], (size_t *)&args->scalarInput[1], buffKptr); OSSafeReleaseNULL(memMap); return rt; } phenomenon When StructureOutputSize is greater than 4096, args>structureOutputDescriptor exists, and when it is less than or equal to 4096, args->structureOutputDescriptor and args->structureOutput are both equal to nullptr, (in IOkit, args->structureOutput is not empty)。 How to properly convert any size of application memory into the kernel space of Driverkit?
1
0
500
Mar ’24
Sanitize and other commands for External SSD Media
I am trying to implement the Sanitize and Firmware Upgrade commands for an external card connected via the Thunderbolt Interface (4.0) Should we consider writing a Kext based off IOBlockStorageDriver or IOPCI interface. NVMController does not expose anything more than the 3 API.. SmartReadData, getLogData and getIdentifyData. The device is connected only on MacOS.(mini and macbooks) My ioregistry look like : | | | +-o DSB1@1 <class IOPCIDevice, id 0x1000003dc, registered, matched, active, busy 0 (194 ms), retain 14> | | | | +-o IOPP <class IOPCI2PCIBridge, id 0x100000457, registered, matched, active, busy 0 (182 ms), retain 8> | | | | +-o UPS0@0 <class IOPCIDevice, id 0x1000003e0, registered, matched, active, busy 0 (182 ms), retain 17> | | | | +-o IOPP <class IOPCI2PCIBridge, id 0x100000477, registered, matched, active, busy 0 (181 ms), retain 8> | | | | +-o pci-bridge@0 <class IOPCIDevice, id 0x1000003e1, registered, matched, active, busy 0 (181 ms), retain 11> | | | | +-o IOPP <class IOPCI2PCIBridge, id 0x10000047d, registered, matched, active, busy 0 (180 ms), retain 8> | | | | +-o pci1987,5021@0 <class IOPCIDevice, id 0x1000003e2, registered, matched, active, busy 0 (180 ms), retain 12> | | | | +-o IONVMeController <class IONVMeController, id 0x100000486, registered, matched, active, busy 0 (166 ms), retain 11> | | | | +-o IONVMeBlockStorageDevice@1 <class IONVMeBlockStorageDevice, id 0x10000048c, registered, matched, active, busy 0 (166 ms), retain 11> | | | | +-o IOBlockStorageDriver <class IOBlockStorageDriver, id 0x10000048d, registered, matched, active, busy 0 (166 ms), retain 8> | | | | +-o Prograde Digital Media <class IOMedia, id 0x10000048e, registered, matched, active, busy 0 (166 ms), retain 12> | | | | +-o IOMediaBSDClient <class IOMediaBSDClient, id 0x100000490, registered, matched, active, busy 0 (0 ms), retain 6> | | | | +-o IOGUIDPartitionScheme <class IOGUIDPartitionScheme, id 0x100000492, !registered, !matched, active, busy 0 (0 ms), retain 7> | | | | +-o EFI System Partition@1 <class IOMedia, id 0x1000004d7, registered, matched, active, busy 0 (0 ms), retain 10> | | | | | +-o IOMediaBSDClient <class IOMediaBSDClient, id 0x1000004db, registered, matched, active, busy 0 (0 ms), retain 6> | | | | +-o Untitled 2@2 <class IOMedia, id 0x1000004d9, registered, matched, active, busy 0 (0 ms), retain 11> | | | | +-o IOMediaBSDClient <class IOMediaBSDClient, id 0x1000004df, registered, matched, active, busy 0 (0 ms), retain 7>Any pointers on this would be helpful.
0
0
371
Mar ’24
How to communicate with smart card readers conncetd to USB-C port in iOS?
Hello All, I am new to iOS development and would like to detect the smart card readers connected to USB-C port on iOS (16+) devices. The smart card reader is a custom hardware and not MFi certified. So as per my understanding, I cannot use ExternalAccessory.framework without MFi certification. Correct? How else can I achieve this? Does TKSmartCardSlotManager works for this purpose (or is it only for NFC devices?)? Is there any example for how to use this interface? I couldn't find any example for this as a starting point... Thanks in advance.
4
0
769
Jun ’24
Tracking bluetooth connection from macOS to non-Apple smartphones
Hi! I am trying to figure out whether there are any ways to get notifications when a macOS user connects to another device via Bluetooth (specifically when a smartphone is paired with a MacBook). I know about IOBluetooth, but it seems like you have to send periodic queries for devices when using this framework, and there is no general way to receive such notifications. I know that IOHIDManager may help to track connection with human interface devices such as keyboards, trackpads, joysticks, etc. But is there any API in IOKit/DriverKit that could help get notifications when a macOS user connects to a smartphone? Maybe I am missing an important part of IOBluetooth, so I would appreciate any help.
0
0
326
Apr ’24
internal and external USB device list
Using IOServiceMatching and IOServiceGetMatchingServices api's written in swift to extract the info of both internal and external USB devices connected. For the same code Intel based Mac OS devices gives all the info like product id , vendor id , Serial number and etc for both external and Internal USB devices( Apple and Non Apple devices connected either to Apple T2 bus or USB bus). For the same code M2 Mac Machine only gives the external device info which are connected to USB, doesn't give any info of Internal USB connected devices. Why is this difference ? Which api's need to be used to extract info of internal USB connected devices even in M2 based Mac machine. Thanks
3
0
368
Apr ’24
App sandbox extension revoked on Ventura
Hi everyone, first-time caller, long-ti... wait, no, I just got here. :) I am relatively new to all things Apple, so apologies in advance if it takes me a few goes to properly explain things. We have a framework, which includes an API, an XPC service, etc, and we have a device driver. We also have some sample apps that use the framework, and if they have the app sandbox capability, then we expect them to use the XPC Service instead of accessing our driver directly. This works fine on Monterey and presumably has worked fine on all previous versions of MacOS. Something seems to have changed on Ventura, and we don't understand what. When we build the same app on Ventura, it appears to be in the sandbox (according to the Sandbox column in Activity Monitor), but in the Console there is this line (twice): default <time> <OurAppName> Revoking sandbox extension; key = 0 Which we suspect is linked to the fact that the app then does not use the XPC Service, and instead accesses the driver directly, much to our surprise. Software built on developer's machines is "Automatically managed" and "Signed to Run Locally" in case that matters. Do we need to change our code to support Ventura and onward? Or is it a bizarre bug? Oh, I should say that I'm running the latest version of Ventura (13.6.7 as of writing) but not the latest Xcode (14.2 (14C18)) and CLI tools... can't remember how to find that version... Apple clang version 14.0.0 (clang-1400.0.29.202). Any help would be appreciated, thanks. Jeremy
6
0
448
May ’24
Block iOS device from being mounted on mac.
Hello. Is there a legal way to block iOS devices from being mounted on macOS? I noticed, that when an iOS device is connected, it pretends to be like a storage device but it is not. It not even going through diskArbitration. It seems that some fileProvider is taking place there. I know that it is possible to do via the MDM profile: <key>PayloadContent</key> <dict> <key>.GlobalPreferences</key> <dict> <key>Forced</key> <array> <dict> <key>mcx_preference_settings</key> <dict> <key>ignore-devices</key> <true/> </dict> </dict> </array> </dict> </dict> But is there some programmatic solution? If I use EndpointSecurity and block file operations for the usbmuxd process on /var folder, it prevents iOS devices from being mounted. But wouldn't be there any negative side effects from such a solution?
1
0
589
May ’24
How to get Magic Mouse/Trackpad InputValueCallback
I confirmed that I had successfully turned on the device and registered the callback method, but the callback method was not successfully invoked when moving with Magic mouse. What method does the Magic Mouse and Magic Trackpad need to use to get the input value of the device? IOReturn ioReturn = IOHIDDeviceOpen(deviceRef, kIOHIDOptionsTypeNone); if ( kIOReturnSuccess == ioReturn ) { IOHIDDeviceRegisterInputValueCallback(deviceRef, mouseInputValueCallback, NULL); } static void mouseInputValueCallback(void *context, IOReturn result, void *sender, IOHIDValueRef value) { NSLog(@"handle input value"); } I passed the __IOHIDDeviceCopyMatchingInputElements get magic mouse input element <__NSArrayM 0x6000012c4900>( timestamp: 0 type: 1 usagePage: 1 usage: 48 reportID: 16 value: 0, timestamp: 0 type: 1 usagePage: 1 usage: 49 reportID: 16 value: 0, timestamp: 0 type: 2 usagePage: 9 usage: 1 reportID: 16 value: 0, timestamp: 0 type: 2 usagePage: 9 usage: 2 reportID: 16 value: 0 ) (NSArray *)getHIDReprots { if (!deviceRef) { return nil; } NSMutableArray *reports = [[NSMutableArray alloc] init]; CFArrayRef elements; CFIndex i; elements = IOHIDDeviceCopyMatchingElements(deviceRef, NULL, kIOHIDOptionsTypeNone); for (i = 0; i<CFArrayGetCount(elements); i++) { const IOHIDElementRef element = (void*)CFArrayGetValueAtIndex(elements, i); IOHIDElementType eleType = IOHIDElementGetType(element); NSString *eleTypeStr = @""; switch (eleType) { case kIOHIDElementTypeInput_Misc: eleTypeStr = @"kIOHIDElementTypeInput_Misc"; break; case kIOHIDElementTypeInput_Button: eleTypeStr = @"kIOHIDElementTypeInput_Button"; break; case kIOHIDElementTypeInput_Axis: eleTypeStr = @"kIOHIDElementTypeInput_Axis"; break; case kIOHIDElementTypeInput_ScanCodes: eleTypeStr = @"kIOHIDElementTypeInput_ScanCodes"; break; case kIOHIDElementTypeInput_NULL: eleTypeStr = @"kIOHIDElementTypeInput_NULL"; break; case kIOHIDElementTypeOutput: eleTypeStr = @"kIOHIDElementTypeOutput"; break; case kIOHIDElementTypeFeature: eleTypeStr = @"kIOHIDElementTypeFeature"; break; case kIOHIDElementTypeCollection: eleTypeStr = @"kIOHIDElementTypeCollection"; break; default: break; } uint32_t page = IOHIDElementGetUsagePage(element); uint32_t usage = IOHIDElementGetUsage(element); uint32_t reportID = IOHIDElementGetReportID(element); uint32_t reportSize = IOHIDElementGetReportSize(element); uint32_t reportCount = IOHIDElementGetReportCount(element); NSString *elementStr = [[NSString alloc] initWithFormat:@" reportID:%d, reportSize:%d, type:%@, UsagePage:%d, usage:%d, reportCount:%d\n\n",reportID, reportSize, eleTypeStr, page, usage, reportCount]; [reports addObject:elementStr]; } return reports; } reportID:0, reportSize:0, type:kIOHIDElementTypeCollection, UsagePage:1, usage:2, reportCount:1 reportID:0, reportSize:0, type:kIOHIDElementTypeCollection, UsagePage:1, usage:1, reportCount:1 reportID:16, reportSize:16, type:kIOHIDElementTypeInput_Misc, UsagePage:1, usage:48, reportCount:1 reportID:16, reportSize:16, type:kIOHIDElementTypeInput_Misc, UsagePage:1, usage:49, reportCount:1 reportID:16, reportSize:1, type:kIOHIDElementTypeInput_Button, UsagePage:9, usage:1, reportCount:1 reportID:16, reportSize:1, type:kIOHIDElementTypeInput_Button, UsagePage:9, usage:2, reportCount:1 reportID:71, reportSize:8, type:kIOHIDElementTypeFeature, UsagePage:6, usage:32, reportCount:1 reportID:85, reportSize:512, type:kIOHIDElementTypeFeature, UsagePage:65282, usage:85, reportCount:64 reportID:0, reportSize:0, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:-1, reportCount:1 reportID:0, reportSize:1, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:0, reportCount:1 reportID:16, reportSize:0, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:-1, reportCount:1 reportID:16, reportSize:1, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:0, reportCount:1 reportID:71, reportSize:0, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:-1, reportCount:1 reportID:71, reportSize:1, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:0, reportCount:1 reportID:85, reportSize:0, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:-1, reportCount:1 reportID:85, reportSize:1, type:kIOHIDElementTypeInput_NULL, UsagePage:0, usage:0, reportCount:1 Devices: VendorID ProductID LocationID UsagePage Usage RegistryID Transport Class Product UserClass Built-In 0x4c 0x265 0x3bab3ec3 1 2 0x100001ec4 Bluetooth AppleHSBluetoothHIDDriver Magic Trackpad (null) 0 0x4c 0x265 0x3bab3ec3 0 1 0x100001eb2 Bluetooth AppleHSBluetoothDevice Magic Trackpad (null) 0 0x5ac 0x30d 0x5abbb32b 1 2 0x100001221 Bluetooth BNBMouseDevice Magic Mouse (null) 0 0x4c 0x265 0x3bab3ec3 65280 3 0x100001ed2 Bluetooth AppleHSBluetoothHIDDriver Magic Trackpad (null) 0 0x4c 0x265 0x3bab3ec3 65280 13 0x100001ecc Bluetooth AppleHSBluetoothHIDDriver Magic Trackpad (null) 0 0x4c 0x265 0x3bab3ec3 65280 11 0x100001eba Bluetooth AppleHSBluetoothHIDDriver Magic Trackpad (null) 0
5
0
367
Jun ’24
Proper way to use IOKit in iOS app?
Hello, forum, I'm trying to build connection between a non-MFi HID device (like keyboard) and iOS app with IOKit and Swift. Thanks to this post, I have manage to import the IOKit into objc header. IOKit on iOS/iPadOS 16.0+ #import <IOKit/IOKitLib.h> However, I have this compiler error when I try to imitate same methods in the SerialPortSaple project from following article, but the IOKit can not be imported to Swift at first place. Communicating with a Modem on a Serial Port The screen shot of the sample project: It looks like the complier unable to reach the io_object_t type somehow, is there any workaround or approach?
4
0
436
Jun ’24
Access NVMe SMART on iPad
When using external NVMe devices on iOS / iPadOS I cannot tell how to access the disk SMART data. On macOS I can use NVMeSMARTLibExternal.h to access this information but the same system does not seem to work on iPadOS (even with Thunderbolt NVMe devices). When using M series iPads with professional Thunderbolt storage this woudlbe very useful.
2
0
249
2w
"SYSTEM EXTENSION" entitlements in framework
Hello everyone! I'm developing framework and app for macOS for PCI devices. For communication with driverkit, I'm verifying by giving userclient access entities of system extension to app. However, the app is just a sample program, and our customer is trying to develop the app using a framework with PCI communication part. Is there a way to build a framework with my company's signature, and to build and execute it without acquiring userclient access elements by any chance by a customer developer? Moreover, userclient access is only available to developers who have subscribed to the Apple Developer Program, so I hope that client/developers do not need to obtain separate entries.
3
0
252
2w
Low-level event-posting help needed.
Hi there, I am working on a little application which processes cursor and graphics tablet data and adds some extra control to the output. So far it makes use of... if let eventTap = CGEvent.tapCreate(tap: .cgSessionEventTap, //.cghidEventTap place: .headInsertEventTap, options: .defaultTap, eventsOfInterest: eventMask, callback: handleTapEvent, userInfo: userInfo) ... to modify existing events. The issue that in some cases arises (it's a globally working app) - that some other applications pull and process pointer-data aside the event stream and therefor create conflicting values. Would creating and posting events to a 'virtual pointing device' on a lower system level (kext) help? Let's discuss. BR, E
0
0
108
2w
How to implement NVMESMARTLib for USB-NVMe bridge chip?
Many USB storage devices are NVMe devices accessed through a USB-NVMe bridge chip, such as those by JMicron and Asmedia. These chipsets do not forward SMART data requests to the devices, but do have the capability to forward raw NVMe commands to the devices using vendor specific requests. How can we provide access to SMART data for NVMe devices accessed through a bridge chip like this? Many people used the OSX SAT SMART kext driver to provide access to SMART data for devices using USB-SATA chips, but it is a kext and doesn't support NVMe. See https://binaryfruit.com/drivedx/usb-drive-support#install-instructions Would we need to implement a kext like that to make this work? Is there a DriverKit way to do this?
4
0
272
1w