Where is my kext log(kernel log)

Question

Created Oct ’22

Replies 2

Boosts 0

Views 1.5k

Participants 2

I am new to Mac Os kext development. I want to develop a device driver on macOS Mojave (10.14.2) for my device. I created a demo to check the running process of the driver, but after actually running it, I didn't find any log about the driver.

The following is the source code. Compile with xcode.

IOKitTest.cpp

/* add your code here */
#include "IOKitTest.hpp"
#include <IOKit/IOService.h>
#include <IOKit/IOLib.h>


// 类似cocoa中 super关键字
#define super IOService

// 和头文件中的宏定义类似, 自动生成一些特定的代码
OSDefineMetaClassAndStructors(com_apple_driver_IOKitTest, IOService);

bool com_apple_driver_IOKitTest::init(OSDictionary *dict)
{
  bool result = super::init(dict);
   
  IOLog("IOKitTest : did init !! \n"); // IOlog() 生成log日志, 存在在system.log里
   
  log = os_log_create("com.apple.driver", "XmX");
  os_log(log, "xmx Tests!!");
   
  /** 遍历OSDictionary */
  OSCollectionIterator *iter = OSCollectionIterator::withCollection(dict);
  if (iter)
  {
    OSObject *object = NULL;
    while ((object = iter->getNextObject()))
    {
      OSSymbol *key = OSDynamicCast(OSSymbol, object);
      IOLog("iRedTest : key:%s ",key->getCStringNoCopy());
      OSString *value = OSDynamicCast(OSString, dict->getObject(key));
      if (value != NULL)
      {
        IOLog("iRedTest : value:%s\n",value->getCStringNoCopy());
      }
    }
  }
   
  return result;
}

void com_apple_driver_IOKitTest::free(void)
{
  IOLog("IOKitTest : free \n");
  os_log(log, "xmx Tests!!");
  super::free();
}

IOService *com_apple_driver_IOKitTest::probe(IOService *provider, SInt32 *score)
{
  IOService *probe = super::probe(provider, score);
  return probe;
}

bool com_apple_driver_IOKitTest::start(IOService *provider)
{
  bool result = super::start(provider);
  IOLog("IOKitTest : start \n");
  os_log(log, "xmx Tests!!");
  return result;
}

void com_apple_driver_IOKitTest::stop(IOService *provider)
{
  IOLog("IOKitTest : stop \n");
  os_log(log, "xmx Tests!!");
  super::stop(provider);
}

IOKitTest.hpp

/* add your code here */
#include <IOKit/IOService.h>
#include <os/log.h>

#ifndef IOKitTest_hpp
#define IOKitTest_hpp

class com_apple_driver_IOKitTest : public IOService {
   
  //一个宏定义，会自动生成该类的构造方法、析构方法和运行时
  OSDeclareDefaultStructors(com_apple_driver_IOKitTest);
   
public:
  // 该方法与cocoa中init方法和C++中构造函数类似
  virtual bool init(OSDictionary *dict = 0) APPLE_KEXT_OVERRIDE;
  // 该方法与cocoa中dealloc方法和c++中析构函数类似
  virtual void free(void) APPLE_KEXT_OVERRIDE;
  // 进行驱动匹配时调用
  virtual IOService *probe(IOService *provider, SInt32 *score) APPLE_KEXT_OVERRIDE;
  // 进行加载时调用
  virtual bool start(IOService *provider) APPLE_KEXT_OVERRIDE;
  // 进行卸载时调用
  virtual void stop(IOService *provider) APPLE_KEXT_OVERRIDE;
   
  os_log_t log;
};

#endif /* IOKitTest_hpp */

info.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>CFBundleDevelopmentRegion</key>
	<string>$(DEVELOPMENT_LANGUAGE)</string>
	<key>CFBundleExecutable</key>
	<string>$(EXECUTABLE_NAME)</string>
	<key>CFBundleIdentifier</key>
	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
	<key>CFBundleInfoDictionaryVersion</key>
	<string>6.0</string>
	<key>CFBundleName</key>
	<string>$(PRODUCT_NAME)</string>
	<key>CFBundlePackageType</key>
	<string>KEXT</string>
	<key>CFBundleShortVersionString</key>
	<string>1.0</string>
	<key>CFBundleVersion</key>
	<string>1</string>
	<key>IOKitPersonalities</key>
	<dict>
		<key>IOKitTest</key>
		<dict>
			<key>CFBundleIdentifier</key>
			<string>com.apple.driver.IOKitTest</string>
			<key>IOClass</key>
			<string>com_apple_driver_IOKitTest</string>
			<key>IOMatchCategory</key>
			<string>com_apple_driver_IOKitTest</string>
			<key>IOProbeScore</key>
			<integer>10000</integer>
			<key>IOProviderClass</key>
			<string>IOResource</string>
			<key>IOResourceMatch</key>
			<string>IOKit</string>
		</dict>
	</dict>
	<key>NSHumanReadableCopyright</key>
	<string>Copyright © 2022 JingCe. All rights reserved.</string>
	<key>OSBundleLibraries</key>
	<dict>
		<key>com.apple.kpi.iokit</key>
		<string>18.2.0</string>
		<key>com.apple.kpi.libkern</key>
		<string>18.2.0</string>
	</dict>
</dict>
</plist>

After the driver is loaded kextstat shows

Does the above indicate that the driver is loaded successfully?
where to view the kernel log？
Where can I learn kext demo？

Boost

Answer 1

ssmith_c OP

Oct ’22

first question I have is "do you really need a driver"? If your device provides a service which is only useful to one application, a driver may be inappropriate or unnecessary, particularly if the interface is USB. In addition, kexts are being replaced by dexts, so even if you need a driver, that driver may not need to be in the kernel (or at least, not the parts that you write).

I would advise you to use os_log(OS_LOG_DEFAULT, ) to begin with. To view the logs, use the Console app and filter on some unique string in your message (I like to use "XXXX"). This is primitive but there are less things to go wrong. You can also filter on "com.apple.driver.IOKitTest" to find all strings logged from your driver or about your driver. You can also use the command-line interface to the ASL (Apple System Log), log. It has a very long man page which refers to an even longer piece of documentation about how to build the predicates used for --predicate. It is so complicated I rarely use it. See https://developer.apple.com/documentation/os/logging/viewing_log_messages?language=objc

0

Answer 2

XuMoxiao OP

Oct ’22

Thank you for your reply. Our PCIE products do require Mac OS drivers. The os_log function can see the log in the console app when writing the application layer app. But when the os_log is written in the io_kit driver, it cannot be viewed. I want to debug the driver according to the log information, so that the development can be faster

0