Hello Everyone, I am trying to create a Fake SCSI target based on SCSIControllerDriverKit.framework and inherent from IOUserSCSIParallelInterfaceController, here is the code kern_return_t IMPL(DRV_MAIN_CLASS_NAME, Start) { ... // Programmatically create a null SCSI Target SCSIDeviceIdentifier nullTargetID = 0; // Example target ID, adjust as needed ret = UserCreateTargetForID(nullTargetID, nullptr); if (ret != kIOReturnSuccess) { Log("Failed to create Null SCSI Target for ID %llu", nullTargetID); return ret; } ... } According the document UserCreateTargetForID, after creating a TargetID successfully, the framework will call the UserInitializeTargetForID() The document said: As part of the UserCreateTargetForID call, the kernel calls several APIs like UserInitializeTargetForID which run on the default dispatch queue of the dext. But after UserCreateTargetForID created, why the UserInitializeTargetForID() not be invoked automatically? Here is the part of log show init() - Start init() - End Start() - Start Start() - try 1 times UserCreateTargetForID() - Start Allocating resources for Target ID 0 UserCreateTargetForID() - End Start() - Finished. UserInitializeController() - Start - PCI vendorID: 0x14d6, deviceID: 0x626f. - BAR0: 0x1, BAR1: 0x200004. - GetBARInfo() - BAR1 - MemoryIndex: 0, Size: 262144, Type: 0. UserInitializeController() - End UserStartController() - Start - msiInterruptIndex : 0x00000000 - interruptType info is 0x00010000 - PCI Dext interrupt final value, return status info is 0x00000000 UserStartController() - End Any assistance would be greatly appreciated! Thank you in advance for your support. Best regards, Charles

Hello Everyone, I have noticed an inconsistency in the KEXT status between the System Information Extensions section and the output of the kextstat command. In System Information, the extension appears as loaded: ACS6x: Version: 3.8.3 Last Modified: 2025/3/10, 8:03 PM Bundle ID: com.Accusys.driver.Acxxx Loaded: Yes Get Info String: ACS6x 3.8.4 Copyright (c) 2004-2020 Accusys, Ltd. Architectures: arm64e 64-Bit (Intel): No Location: /Library/Extensions/ACS6x.kext/ Kext Version: 3.8.3 Load Address: 0 Loadable: Yes Dependencies: Satisfied Signed by: Developer ID Application: Accusys, Inc (K3TDMD9Y6B) Issuer: Developer ID Certification Authority Signing time: 2025-03-10 12:03:20 +0000 Identifier: com.Accusys.driver.Acxxx TeamID: K3TDMD9Y6B However, when I check using kextstat, it does not appear as loaded: $ kextstat | grep ACS6x Executing: /usr/bin/kmutil showloaded No variant specified, falling back to release I use a script to do these jobs echo " Change to build/Release" echo " CodeSign ACS6x.kext" echo " Compress to zip file" echo " Notary & Staple" echo " Unload the old Acxxx Driver" echo " Copy ACS6x.kext driver to /Library/Extensions/" echo " Change ACS6x.kext driver owner" echo " Loaded ACS6x.kext driver" sudo kextload ACS6x.kext echo " Rebiuld system cache" sudo kextcache -system-prelinked-kernel sudo kextcache -system-caches sudo kextcache -i / echo " Reboot" sudo reboot But it seems that the KEXT is not always loaded successfully. What did I forget to do? Any help would be greatly appreciated. Best regards, Charles

I have Windows drives on my Mac but I didn't get the Wellness boot Campdrivers how can I install them

Hello Everyone, I am working on migrating a KEXT to DriverKit but am struggling to resolve a specific issue. The code in question is simple, but I haven't been able to find a solution. void AME_IO_milliseconds_Delay(AME_U32 Delay) { Log("AME_IO_milliseconds_Delay()"); IOSleep(Delay); return; } //delay for a number of microseconds void AME_IO_microseconds_Delay(AME_U32 Delay) { Log("AME_IO_microseconds_Delay()"); IODelay(Delay); return; } I've sought help from Copilot and ChatGPT, but their suggestions haven't worked. Any guidance on how to implement this functionality in DriverKit would be greatly appreciated. Thank you for your time and assistance. Best regards, Charles

When my virtual CoreAudio server plugins propagates a change to it´s device name the CoreAudio system does not seem to reflect the change. My user mode application subscribes to the property change and receives the change though. I also alternatively submitted a kAudioObjectPropertyName change with the same effect. Is this possible at all and what needs to be done then? Are there restrictions about which properties can be successfully changed and are reflected by the system? Any hint is highly appreciated! Thanks

Hello Everyone, I'm encountering an issue while setting up a timer event in DriverKit and would appreciate any guidance. Here's my current implementation: void DRV_MAIN_CLASS_NAME::SetupEventTimer() { // 1. Create dispatch queue kern_return_t ret = IODispatchQueue::Create("TimerQueue", 0, 0, &ivars->dispatchQueue); if (ret != kIOReturnSuccess) { LogErr("Failed to create dispatch queue: 0x%x", ret); return; } // 2. Create timer source ret = IOTimerDispatchSource::Create(ivars->dispatchQueue, &ivars->dispatchSource); if (ret != kIOReturnSuccess) { LogErr("Failed to create timer: 0x%x", ret); OSSafeReleaseNULL(ivars->dispatchQueue); return; } /*! * @brief Create an instance of OSAction. * @discussion Methods to allocate an OSAction instance are generated for each method defined in a class with * a TYPE attribute, so there should not be any need to directly call OSAction::Create(). * @param target OSObject to receive the callback. This object will be retained until the OSAction is * canceled or freed. * @param targetmsgid Generated message ID for the target method. * @param msgid Generated message ID for the method invoked by the receiver of the OSAction * to generate the callback. * @param referenceSize Size of additional state structure available to the creator of the OSAction * with GetReference. * @param action Created OSAction with +1 retain count to be released by the caller. * @return kIOReturnSuccess on success. See IOReturn.h for error codes. */ // 3: Create an OSAction for the TimerOccurred method // THIS IS WHERE I NEED HELP OSAction* timerAction = nullptr; ret = OSAction::Create(this, 0, 0, 0, &timerAction); if (ret != kIOReturnSuccess) { LogErr("Failed to create OSAction: 0x%x", ret); goto cleanup; } // 4. Set handler ret = ivars->dispatchSource->SetHandler(timerAction); if (ret != kIOReturnSuccess) { LogErr("Failed to set handler: 0x%x", ret); goto cleanup; } // 5. Schedule timer (1 second) uint64_t deadline = mach_absolute_time() + NSEC_PER_SEC; ivars->dispatchSource->WakeAtTime(0, deadline, 0); cleanup: if (ret != kIOReturnSuccess) { OSSafeReleaseNULL(timerAction); OSSafeReleaseNULL(ivars->dispatchSource); OSSafeReleaseNULL(ivars->dispatchQueue); } } Problem: The code runs but the OSAction callback binding seems incorrect (Step 3). According to the OSAction documentation, I need to use the TYPE macro to properly bind the callback method. But I try to use TYPE(DRV_MAIN_CLASS_NAME::TimerOccurred) kern_return_t TimerOccurred() LOCALONLY; TYPE(TimerOccurred) kern_return_t TimerOccurred() LOCALONLY; kern_return_t TimerOccurred() TYPE(DRV_MAIN_CLASS_NAME::TimerOccurred) LOCALONLY; All results in Out-of-line definition of 'TimerOccurred' does not match any declaration in 'DRV_MAIN_CLASS_NAME' Questions: What is the correct way to declare a timer callback method using TYPE? How to get the values targetmsgid & msgid generated by Xcode? Any help would be greatly appreciated! Best Regards, Charles

I have a custom USB Audio Class 2 (UAC2) compatible device. When I connect this custom device to a MacBook with a configuration of up to 10 channels (16-bit), everything seems to work fine. However, when I increase the channel count to 12, the MacBook does not recognize the 12 channels. It only shows the channel count as 0. TN2274 is the only source where I found some information about Apple's Audio Class Drivers, but it doesn't mention any limitations regarding channel counts. Could you let me know the current limitations of the Audio Class Drivers on the latest macOS versions? What configuration should I use to get 12 channels working? P.S. I also found that a 12-channel, 8-bit configuration is detected by the MacBook, bit I want it to work with 16bits. For more detail please check FB17098863

When I develop the system extension tool, I need to subscribe to the remote thread creation event. When the remote thread injection is triggered, I want to get the id, module name and starting function name of the remote thread. How can I get this information from es_event_remote_thread_create_t? If I can't get this information from es_event_remote_thread_create_t, is there any other way to get it?

Hi Everyone! I want to block the USB wired mouse from accessing my machine. Which framework is used to implement ? PS: I have already tried DriverKit Framework but it requires Apple's paid developer account. What will be alternative ?

Hello, I recently created an app with the Calldirectory Extension. It worked all good as long as I was on my development iphone. I tried to install the app on my privat iphone (same phone/same os version), but then I faced an issue. I couldn't enable the Calldirectory Extension with an error (Error Enabling Extension Failed to request data for APPNAME. You may try enabling the extension again, and if the problem persists, conatact the application developer.)

Hi, our virtual CoreAudio server plugin creates and removes dynamically CoreAudio devices. Each time it does so it leaves traces in /Library/Preferences/Audio com.apple.audio.DeviceSettings.plist com.apple.audio.SystemSettings.plist The files on the test machine now have become >1Mb and the system keeps recreating them. How can I manually remove/cleanup these files? (This is for development only. It already became pretty tedious to evaluate current device settings for debugging purposes.) How can the CoreAudio server plugin make sure once a device has been removed also its entries are removed from the .plist (It already removes it's storage, but the system still keeps other settings.) Is there some documentation about what gets stored and how the settings are organized in these preferences? (This is also for development and debugging only. We are not intending to access these settings directly ) Thanks!

Hello everyone. I have been developing PCIe device driver through Thunderbolt. However, it was confirmed that up to three devices connected to the daisy chain worked normally, but the fourth device failed to operate the _CopyDeviceMemoryWithIndex() function for connection with the BAR0 App and did not work properly. The standard specification of Thunderbolt 3/4 is said to be supported by daisy chain connection up to 6-device, but in reality, it is only 3 units, so I ask the forum for technical confirmation. Of course total 4 device by 2-port x 2-device daisy chain connecting has working well. The PCI entry in System information indicates that all devices have normal load of the PCIe device driver. Thank you.

We’re looking for a reliable way to determine whether an iPad device supports DriverKit. Since there doesn't appear to be a direct public API for this, our current approach is as follows: Retrieve the device’s model identifier (e.g., "iPad14,8") and the iOS/iPadOS version. Map the model identifier to a known iPad model and its associated chip. If the device has an M-series chip, we assume it supports DriverKit. For future-proofing, we plan to assume that any future iPad with a model identifier of iPad15,* or higher will contain an M-series chip and therefore support DriverKit. We have a couple of questions: Is there a more reliable or official API to determine the chip version or DriverKit support? Is it reasonable to rely on the assumptions outlined in steps 2 and 3 for determining DriverKit compatibility?

Hi everyone, I was following the Video Modernize PCI and SCSI drivers with DriverKit and the Document to implement UserMapHBAData(), and here’s my current implementation: // kern_return_t DRV_MAIN_CLASS_NAME::UserMapHBAData_Impl(uint32_t *uniqueTaskID) kern_return_t IMPL(DRV_MAIN_CLASS_NAME, UserMapHBAData) { Log("UserMapHBAData() - Start"); // Define the vm_page_size explicitly const uint32_t vm_page_size = 4096; kern_return_t ret; IOBufferMemoryDescriptor *buffer = nullptr; IOMemoryMap *memMap = nullptr; void *taskData = nullptr; // Create a buffer for HBA-specific task data ret = IOBufferMemoryDescriptor::Create(kIOMemoryDirectionOutIn, ivars->fTaskDataSize, vm_page_size, &buffer); __Require((kIOReturnSuccess == ret), Exit); // Map memory to the driver extension's memory space ret = buffer->CreateMapping(0, 0, 0, 0, 0, &memMap); __Require((kIOReturnSuccess == ret), Exit); // Retrieve mapped memory address taskData = reinterpret_cast<void *>(memMap->GetAddress()); __Require(taskData, Exit); // WARNING: Potential leak of an object stored into 'buffer' // WARNING: Potential leak of an object stored into 'memMap' // Assign a unique task ID ivars->fTaskID++; // ERROR: No member named 'fTaskID' in 'DriverKitAcxxx_IVars' ivars->fTaskArray[ivars->fTaskID] = taskData; *uniqueTaskID = ivars->fTaskID; Log("UserMapHBAData() - End"); return kIOReturnSuccess; Exit: // Cleanup in case of failure if (memMap) { memMap->free(); // Correct method for releasing memory maps } if (buffer) { buffer->free(); // Correct method for releasing buffer memory } LogErr("ret = 0x%0x", ret); Log("UserMapHBAData() - End"); return ret; } For reference, in KEXT, memory allocation is typically done using: IOBufferMemoryDescriptor *buffer = IOBufferMemoryDescriptor::inTaskWithOptions( kernel_task, // Task in which memory is allocated kIODirectionOutIn, // Direction (read/write) 1024, // Size of the buffer in bytes 4); // Alignment requirements However, after installing the dext, macOS hangs, and I have to do a hardware reset. After rebooting, the sysctl list output shows: % sectl list 1 extension(s) --- com.apple.system_extension.driver_extension enabled active teamID bundleID (version) name [state] * - com.accusys.DriverKitAcxxx (5.0/11) com.accusys.DriverKitAcxxx [activated waiting for user] Questions: What could be causing macOS to halt? How should I approach debugging and resolving this issue? Looking forward to your insights, any suggestions would be greatly appreciated! Best regards, Charles

I have reference some related post for this issue: https://developer.apple.com/documentation/xcode-release-notes/xcode-16-release-notes#Foundation https://developer.apple.com/forums/thread/762711 Unfortunately, I'm facing the similar issues even though using Xcode Version 16.2 (16C5032a). we have the following build environment: Xcode version: Xcode 16.2 (16C5032a) macOS Version: macOS 14.7.4 (23H420) Everything builds and install fine. But when attempting to plug on Device on macOS 14.7.4 it crashes immediately with what appears to be a missing Foundation symbol. Crashed Thread: 0 Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Termination Reason: Namespace DYLD, Code 4 Symbol missing Symbol not found: __ZThn48_N21IOUserNetworkEthernet25registerEthernetInterfaceE10ether_addrPP24IOUserNetworkPacketQueuejP29IOUserNetworkPacketBufferPoolS5_ Referenced from: &lt;ECE57ABF-0633-3C3B-8427-FB25CC706343&gt; /Library/SystemExtensions/*/com.asix.dext.pciedevice Expected in: &lt;CDEB3490-B1E0-3D60-80CE-59C0682A4B03&gt; /System/DriverKit/System/Library/Frameworks/NetworkingDriverKit.framework/NetworkingDriverKit (terminated at launch; ignore backtrace) Thread 0 Crashed: 0 dyld 0x1041da4c8 __abort_with_payload + 8 1 dyld 0x1041e50cc abort_with_payload_wrapper_internal + 104 2 dyld 0x1041e5100 abort_with_payload + 16 3 dyld 0x1041767f0 dyld4::halt(char const*, dyld4::StructuredError const*) + 304 4 dyld 0x1041732ec dyld4::prepare(dyld4::APIs&amp;, dyld3::MachOAnalyzer const*) + 3888 5 dyld 0x104171ef4 start + 1868 Thread 0 crashed with ARM Thread State (64-bit): x0: 0x0000000000000006 x1: 0x0000000000000004 x2: 0x000000016bdd2810 x3: 0x0000000000000172 x4: 0x000000016bdd2410 x5: 0x0000000000000000 x6: 0x000000016bdd1400 x7: 0x000000016bdd1460 x8: 0x0000000000000020 x9: 0x000000016bdd237c x10: 0x000000000000000a x11: 0x0000000000000000 x12: 0x0000000000000038 x13: 0x0000000000000000 x14: 0x0000000188e77f9d x15: 0x0000000000008000 x16: 0x0000000000000209 x17: 0x000000010416f37c x18: 0x0000000000000000 x19: 0x0000000000000000 x20: 0x000000016bdd2410 x21: 0x0000000000000172 x22: 0x000000016bdd2810 x23: 0x0000000000000004 x24: 0x0000000000000006 x25: 0x00000000000000a8 x26: 0x000000016bdd32d8 x27: 0x000000010405e090 x28: 0x0000000000000001 fp: 0x000000016bdd23e0 lr: 0x00000001041e50cc sp: 0x000000016bdd23a0 pc: 0x00000001041da4c8 cpsr: 0x80001000 far: 0x0000000000000000 esr: 0x56000080 Address size fault Binary Images: 0x10416c000 - 0x1041f7fff dyld (*) &lt;4fe051cf-29dc-3f02-890b-33144fa09253&gt; /usr/lib/dyld 0x10402c000 - 0x10403ffff com.asix.dext.pciedevice (0.1.6) &lt;ece57abf-0633-3c3b-8427-fb25cc706343&gt; /Library/SystemExtensions/*/com.asix.dext.pciedevice 0x0 - 0xffffffffffffffff ??? (*) &lt;00000000-0000-0000-0000-000000000000&gt; ??? External Modification Summary: Calls made by other processes targeting this process: task_for_pid: 0 thread_create: 0 thread_set_state: 0 Calls made by this process: task_for_pid: 0 thread_create: 0 thread_set_state: 0 Calls made by all processes on this machine: task_for_pid: 0 thread_create: 0 thread_set_state: 0 VM Region Summary: ReadOnly portion of Libraries: Total=8612K resident=0K(0%) swapped_out_or_unallocated=8612K(100%) Writable regions: Total=12.2M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=12.2M(100%) Is it expected that this should work? Is this a known issue? Is there any workaround for it? Should I file feedback or a DTS?

I have a dext that creates a periodic timer on its own dispatch queue. The callback is declared as follows: virtual void HandleTimer( OSAction *action, uint64_t time ) TYPE(IOTimerDispatchSource::TimerOccurred); The timer is allocated as follows: CreateActionHandleTimer( size, &ivars->TimerHandler ); IODispatchQueue::Create( "TimerQueue", 0, 0, &ivars->TimerDispatchQueue ); IOTimerDispatchSource::Create( ivars->TimerDispatchQueue, &ivars->TimerDispatchSrc ); I can start up the timer and it works just fine. However, in my Stop() method, when trying to shut the timer down, I get an assertion in OSAction::Cancel() for TimerHandler: Assertion failed: (queue), function Cancel, file uioserver.cpp, line 4401. What does this assertion indicate or is the source code available? If so, where? I'm using macOS 15.5. Note I am attempting to cancel the handler after the dispatch source and queue are canceled and the cleanup methods have been called (which is working). But, cancelling TimerHandler first also asserts.

I need to implement an app that exchanges data with peripherals through TypeC on Apple 15 phones, but I have two questions that I need to ask for help: Which library is used to communicate with peripherals through the TypeC port of the Apple mobile phone? Do peripherals need to pass MFi authentication before they can communicate with the App?

I'm trying to implement a custom back button in a CPInformationTemplate using CPBarButton. It works as expected on iOS 18 — the button appears in the navigation bar and correctly pops the template when tapped. However, on iOS 16 devices, the custom back button does not respond to taps at all. The reason I need a custom back button is because I want to perform cleanup and reset logic before popping the template. Is there any workaround for making this work on iOS 16? Or is there a recommended way to hook into the system back button behavior so that I can execute code when the template is dismissed?

I'm developing a CarPlay Fueling app with CarPlay entitlement properly configured. While testing, I ran into two issues and would appreciate any guidance: UserDefaults access while iPhone is locked: In my CarPlay implementation, I read values from UserDefaults that were previously saved in the iOS app. However, when the iPhone is locked and the CarPlay session is active, it seems that the CarPlay extension cannot read the stored values. Is this the expected behavior? If so, how can I persist and access data across the app and CarPlay reliably? API calls while iPhone is locked: The CarPlay interface in my app communicates with a server to display lists and detail views. When the iPhone is locked, are network calls still allowed from the CarPlay extension? Currently, I do not have any background modes enabled in the app capabilities. If I enable background modes and implement background network logic to ensure API calls complete properly, would this be considered acceptable usage for CarPlay in App Store review? Or could it raise any rejection concerns during the approval process? Thanks in advance for your help.

I am currently developing a kiosk system that incorporates an iPad along with a custom peripheral device. The two components are intended to communicate via USB serial. I have encountered a critical issue while working with the official DriverKit sample code provided at the following link: https://developer.apple.com/documentation/driverkit/communicating-between-a-driverkit-extension-and-a-client-app Model info : iPad Pro 12.9-inch (5th generation / M1 chipset) iPadOS 18.4.1 App Stops Functioning After Repeated Builds When I first build and run the sample code without any modifications, it works as expected. However, after making changes and running the app repeatedly on the iPad, it eventually reaches a state where the app stops functioning completely — no logs are printed, and device communication fails. Reinstalling the app or rebooting the iPad does not resolve the issue. Even when I revert to the original, unmodified sample code, the problem persists. Surprisingly, if I generate a new Bundle Identifier, the app functions normally again. I would like to ask: What could be causing this behavior? Have similar cases been reported before? For your reference, I’ve attached a video demonstrating the issue and the source code used during the recording: Source Code: https://drive.google.com/file/d/14whvWwuhrmS5VoR3sSKyNT-GpTPC_c_8/view?usp=sharing Video: https://drive.google.com/file/d/1SfqIkEphSDrvg-CKS6KBcJ1VBP3cPqCC/view?usp=sharing Request for USB Serial Communication Reference Currently, due to the issue above, I am unable to obtain a device instance at all. Even assuming this is resolved, I noticed that the sample code does not include any implementation or reference material for USB serial communication itself. Is there any official sample code or documentation available that demonstrates USB serial communication between an iPad and an external device using DriverKit? Difficulty Debugging Due to Missing os_log Output Another challenge I'm facing is the inability to view os_log output while connecting the USB device to the iPad. This significantly hinders the debugging process during DriverKit development. Are there any recommended or supported methods for accessing logs and debugging effectively in this environment?