I'm trying to help out one of our vendors by building a skeleton PCI dext which they can flesh out.
However, I can't seem to get the signing right.
I can't sign it at all using no team or my personal team. "Signing for <app> requires a development team", and "Personal development teams ... do not support the System Extension capability".
I can't sign the driver because "DriverKit Team Provisioning Profile: <driver bundle id> doesn't match the entitlements file's value for the com.apple.developer.driverkit.transport.pci entitlement.
I think this problem occurs because our company has already been assigned a transport.pci
entitlement, but for our own PCI vendor ID. But I want to build and test software that works with our vendor's PCI device.
I tried generating a profile for the driver manually, it contained only our own company's PCI driver match:
IOPCIPrimaryMatch = "0x0000MMMM&0x0000FFFF";
where MMMM is our own PCI vendor ID.
Is there a better way to inspect the profile Xcode is using than the postage-stamped sized info popup which truncates the information? I would download the generated profile but it doesn't appear on the profile, but Xcode is accessing it from somewhere.
When I look at the available capabilities I can add to an app identifier on the Developer portal, I see com.apple.developer.driverkit.transport.usb, which is "development only". There's no "development only" capability for PCI. Does this mean it isn't possible to develop even a proof-of-concept PCI driver without being first granted the DriverKit PCI (Primary Match) entitlement?
When adding capabilities to a driver, the list of available capabilities shown in Xcode has one "DriverKit PCI (Primary Match) entry", but if I double click it, two such entries appear in the Signing and Capabilities tab for my driver target. On the Developer portal, when I look at my driver's Identifier, there are two Capabilities labelled DriverKit PCI (Primary Match). Why?
Just to let you know, FB19449747 has been fixed, so there is now a development-only entitlement for PCI DriverKit. For aesthetic reasons, we went with "DriverKit PCI (development)" instead of "DriverKit PCI Transport (development)”, but other than that it should be exactly what you asked for.
Two notes on the entitlement:
(1)
The configuration in your entitlement plist is a bit more complicated than the other development entitlements:
<key>com.apple.developer.driverkit.transport.pci</key>
<array>
<dict>
<key>IOPCIPrimaryMatch</key>
<string>0xFFFFFFFF&0x00000000</string>
</dict>
</array>
In IOPCIDevice, that translates to "match any pid/vid".
(2)
By design, this entitlement will NOT match against "Built In" hardware. That won't have any effect on active product development, but if you try to match against our internal hardware for testing/experimental purposes, this is why*.
*Ironically, we actually discovered this by accident while trying to verify the entitlement was doing what we wanted.
__
Kevin Elliott
DTS Engineer, CoreOS/Hardware