Drivers on macOS

Introduction to IOKit and BSD drivers on macOS

INTRO

This article dives into the internals of XNU, specifically focusing on drivers. Since the main article on XNU has grown quite extensive, I decided to split this topic into its own pieces to keep things manageable — for you and me.

Here, you will learn what drivers do, how they are identified, and, most importantly, how we can interact with them from user mode.

Enjoy!

Drivers

They are software that allows OS communication with hardware. Think of them as translators between the hardware that speaks its own language and the OS that needs to understand it, e.g., when we plug in a USB device:

1. The hardware sends electrical signals
2. The driver converts these signals into data the OS can understand
3. The OS can then interact with the device through the driver

We encounter two main types of drivers on macOS: IOKit and BSD.

BSD Drivers

This older approach was inherited from Unix. They are accessed through files in /dev and follow the traditional Unix file I/O model (written in C):

// Opening a BSD device
int fd = open("/dev/mydrive", O_RDWR);
if (fd < 0) {
    perror("Failed to open device");
    return 1;
}

// Writing to device
char buffer[] = "Hello Device";
write(fd, buffer, strlen(buffer));

// Reading from device
char read_buffer[1024];
ssize_t bytes_read = read(fd, read_buffer, sizeof(read_buffer));

// Device control
struct my_ioctl_data data = {.value = 42};
int result = ioctl(fd, MY_IOCTL_CMD, &data);

// Closing device
close(fd);

Each device file in /dev represents a communication channel with a specific driver. We have there two types of BSD device files:

• Character (c): Handle data as a stream of bytes
• Block (b): Handle data in fixed-size blocks (typically storage devices)