19 ms·

macOS Kernel Extensions are officially deprecated

337 points by ameshkov 7y ago

ameshkov 7y ago
As usually, Apple does not give developers any time to react. There is no migration plan save for one video from WWDC where they briefly describe some alternatives. > In macOS 10.15.4, use of deprecated KPIs triggers a notification to the user that the software includes a deprecated API and asks the user to contact the developer for alternatives.
- pjmlp 7y ago
  The alternatives are well known and everyone has half a year to actually read about DriverKit and Network Extensions.
  - ameshkov 7y ago
    Well, let me disagree. The documentation is lagging. Right after the WWDC there were nothing except for some header files. Also, why half a year? Do you think it will take them that much to release 10.15.4?
    - api 7y ago
      What's this "documentation" thing you're talking about? Is it something other than header files and code? I'm joking but documentation (and tech support) do seem to be dying things at Apple and elsewhere.
      - ameshkov 7y ago
        Actually, they are quite helpful on the developer forums. Fully agree on the documentation point, though.
  - zymhan 7y ago
    Surely you don't think 6 months is enough to rewrite entire drivers and Kexts, do you? That is a short transition by any comparison.
    - acdha 7y ago
      How do you get 6 months from June 2019 announcement for the next major OS release which won't be out before September 2020? It still works in Catalina and they won’t change that in a point release.
      - dmitriid 7y ago
        Because you don't have one year to update and release your software. You have to have it ready and begin testing at least by the time betas of the next version of OS ships. And to do that, you have to start much earlier.
  - dmitriid 7y ago
    6 months since the announcement of the entirely new not-seen-before thing with next to zero documentation to understand, develop an alternative (if it's at all possible) and distribute it to users. How is that enough time?
- highlandinfo 7y ago
  Developers who are affected by this (and who were on top of last summer's announcements) knew this day was coming, and have been working on updates since then. 10.15 serves as a testbed that supports legacy kernel extensions as well as the new user-space frameworks (e.g. EndpointSecurity and NetworkExtension) that largely replace the deprecated APIs. Developers that have a revision ready to test against the first 10.16 beta this summer should be in good shape (assuming that Apple doesn't swerve wildly between 10.15 and 10.16 cough 64-bit Carbon cough). Yes, the documentation is scanty in places, and there is some missing functionality at the moment. And the support burden on these companies, once 10.15.4 ships, will be a pain ("It's OK, the software still works, don't worry about that alert message"). But it is incorrect to say that Apple has not given developers time to react.
  - pier25 7y ago
    > knew this day was coming Certainly but the problem is that such changes should be announced years in advance. Cocoa, OpenGL, ObjC... all are going to die some day and Apple will probably announce it 1 year before it happens, at the most.
    - floatingatoll 7y ago
      OpenSSL was deprecated 8 years ago and hasn’t been removed yet. Your bet of 1 year is not well-supported by their historical trends on Carbon, x86 32-bit, PowerPC, 68k, Garbage collection, and so on. Unless you’re suggesting that Apple will only give 1 year’s notice when they remove deprecated features - in which case, they might only give 0.25 years (at WWDC), which happens quite frequently.
      - 1over137 7y ago
        Past cases need not match future cases. They've been tossing things faster than in the past.
        floatingatoll 7y ago
pjmlp 7y ago
> Kernel programming interfaces (KPIs) will be deprecated as alternatives become available, and future OS releases will no longer load kernel extensions that use deprecated KPIs by default. This is the key part, as presented during the WWDC 2019 talks, the long term roadmap is to make macOS into a proper mikro-kernel OS. This is just the start.
- tambourine_man 7y ago
  Could you point us to the talk where they say this? Not doubting, just curious for more info
  - pjmlp 7y ago
    "System Extensions and DriverKit" https://developer.apple.com/videos/play/wwdc2019/702/ https://developer.apple.com/videos/play/wwdc2019/702/ From the transcript: "MacOS 10.15 Catalina will be the last release to fully support Kernel Extensions without compromises." Specifically, for the capabilities supported by System Extensions and the device families supported by DriverKit, using a Kernel Extension to do that same job is now deprecated and a future release of macOS will not load Kernel Extensions of these kinds. In future releases, we will add more kinds of System Extensions and more device families to DriverKit. In turn, Kernel Extensions of those kinds will also be deprecated."
    - AshamedCaptain 7y ago
      Banning third-party developers from loading modules into kernel-space does not a microkernel make. Apple-approved developers are still going to be loading whatever crap they want into kernel space, incl AMD or nVidia graphics drivers and the lot. It's not like they can convert XNU into an actual microkernel in less than a decade or two. This just means that if you're not on the Apple-whitelist then macOS becomes a yet even more close platform for you. Wanted to developed a driver for a PCIe network card? Sorry, no can do!
      - monocasa 7y ago
floatingatoll 7y ago
> At WWDC19, we announced the deprecation of kernel extensions The title as written deserves a (2019) since they announced this to developers last year.
- zymhan 7y ago
  That is only for a post written in, say, 2019. A new post that cites old information is still a new post. Additionally, they _announced_ the deprecation at WWDC, but that did not take immediate effect. The point of this post is that they are as of right now no longer supported.
  - pjmlp 7y ago
    They announced one OS release for deprecation period after an userspace API for a previous Kext gets introduced. So now that Catalina is officially released, they are following up on this.
  - floatingatoll 7y ago
    What information is new? They are still supported in Catalina and they will be unsupported to varying degrees after Catalina, same as they said last year.
loeg 7y ago
Does this mean VFSForGit for Mac is dead? Is there some proposed mechanism for filesystem implementations other than kernel extensions?
- shakna 7y ago
  > Is there some proposed mechanism for filesystem implementations other than kernel extensions? Not currently. Not that I can find.
- comex 7y ago
  Not all kext functionality is deprecated (yet), only things that have userland replacements. Filesystems are not deprecated.
  - pmjordan 7y ago
    VFSForGit is/was not a true file system, it just intercepts file I/O events to dummy files to lazily fill them with content and to log writes so that 'git status' does not have to scan the whole repo for changes. The macOS port uses the KAUTH listener API, which was indeed deprecated with 10.15.
    - comex 7y ago
      Whoops, my mistake. (In my defense, it has VFS in the name! So I just assumed it uses xnu's VFS API, but apparently the name comes from the Windows VFS API.) It sounds like FileProvider would be perfectly suited to the job if it weren't pulled.
      - pmjordan 7y ago
        Someone else on the project experimented with FileProvider during the Catalina beta, so this is all second hand, but it wasn't really suitable for the job - it seemed more designed for having a special folder like the iCloud Drive, and didn't work well with CLI tools. I actually didn't realise it was pulled before the Catalina launch, but that makes sense, I got the impression it was nowhere near production ready.
dzhiurgis 7y ago
How does something like Lulu firewall goons work instead? Is there any alts for virtualbox?
- als0 7y ago
  macOS provides an API called Hypervisor.framework for virtual machine managers like Virtualbox. It means they don't need kernel modules anymore. QEMU also uses it for acceleration.
  - dzhiurgis 7y ago
    Is there anything that I can use for running Windows now?
    - cerberusss 7y ago
      I'm pretty sure Parallels will come up with a solution. If you want to play with virtualizing Windows via Hypervisor.framework right now, I remember that the people from Veertu.com had Windows running via their Veertu Desktop product. But they seem to be focused on virtualizing macOS-on-macOS right now.
      - cmsj 7y ago
        Parallels can already use Hypervisor.framework - it's a per-VM configuration option.
        cerberusss 7y ago
        Thanks, good information
    - kccqzy 7y ago
      If you actually mean now, VirtualBox still works. If you want a Hypervisor.framework based system, I think Veertu used to have an app on the App Store.
- 7y ago
smcleod 7y ago
I really hope that this is the final nail in the coffin for third party Anti Virus vendors. It's been really worrying to see large enterprises that have moved from Windows to macOS and carry their thinking that the need to install a third party AV product (which in turn often acts as a near-unrestricted way into the kernel).
- r00fus 7y ago
  Does this also doom the corporate spyware that's in almost every large enterprise Mac deployment, or does that install without KE?
  - jedieaston 7y ago
    Define "spyware". JAMF uses the MDM APIs that Apple provides. It also can't access personal data via those APIs. Your anti-virus may use kernel extensions, in which case it will stop working.
    - floatingatoll 7y ago
      JAMF additionally permits the provisioning server to run arbitrary scripts on the endpoints, using an installed daemon that implements functionality beyond what MDM offers.
  - yoz-y 7y ago
    What would be the ideal solution to manage fleets of computers though? Afaik Apple does not have a full featured first party solution, or do they?
- 0az 7y ago
  I can't wait until I can uninstall University-mandated AV. I'm still waiting for Jumpshot to respond to my CCPA inquiry.
  - jedieaston 7y ago
    You don't have to worry about that anymore... https://www.jumpshot.com/ https://www.jumpshot.com/
big_chungus 7y ago
How will hackintoshing work without kexts? I'm no expert but have built a few, and they make extensive use of them to make non-apple hardware work properly and to add functionality.
- turdnagel 7y ago
  Was wondering the same thing. I'm guessing you'll always be able to install them as long as System Integrity Protection is disabled.
  - nottorp 7y ago
    Hmm I just checked and I have far fewer 3rd party kexts than i thought. 8 hackintosh related kexts, out of which one is for the temperature sensors that i can live without. What worries me is stuff like Paragon NTFS, intel haxm for Android emulation, osxfuse used by pCloud...
    - Hamuko 7y ago
      I checked my Hackintosh and I had like 32 kexts, although a few of them were immediately noticeable as unrelated to Hackintoshing. However, there does appear to be quite a number, so this is a bit worrisome of a development. Hopefully people will find new ways to support macOS on PC hardware, since Apple doesn't really seem interested in the prosumer desktop market.
      - nottorp 7y ago
        Oh, I do have more 3rd party kexts but they're not related to hackintoshing and most of them are for usb stuff; Apple seems to have provided a migration path for those. I might need to get a new Creative Labs audio thingy because they're not known for updating drivers for old products...
  - pjmlp 7y ago
    Kexts will be completely removed, as long term plan. It goes into two steps. 1 - A new user space API for what was previously kernel API gets introduced 2 - There is one OS release where the kernel API gets deprecated 3 - The release thereafter removes the kernel API Long term roadmap is to make macOS into a proper micro-kernel OS.
steeleduncan 7y ago
Is this the end of any form of fuse style fs on macOS? (whether osxfuse, or an open source fork of an earlier version of it) They say that future OS releases will no longer load deprecated KPIs, but they do not note the VFS KPIs as deprecated in their list.
- als0 7y ago
  Potentially, although OSXFUSE only works on old macOS versions now.
  - hemancuso 7y ago
    That’s not accurate.
  - jdeibele 7y ago
    2 weeks ago I used OSXFUSE to read an old Linux hard disk. It was running ext4 and I was able to install OSXFUSE and EXT4FUSE under Catalina. It let me browse and copy files off. I had a few directories that were password-protected and I wasn't able to access them. There might be a way to do so but they just weren't important enough to me to do more investigation. https://www.maketecheasier.com/mount-access-ext4-partition-mac/ https://www.maketecheasier.com/mount-access-ext4-partition-m... is the instructions I followed. I've since removed the components since I don't have any other old Linux drives lurking around. Removal seems to have worked just fine.
  - re 7y ago
    The latest version of FUSE for macOS, which is still freely available to end users but no longer open source and not licensed to allow redistribution, works on the current version of macOS. The open source code has not been updated in a few years and as such only works on older macOS releases.
- hemancuso 7y ago
  They currently offer no replacement for VFS. But I bet they will offer something fuse-like if they offer anything at all. Also: the file provider api they use for iCloud Drive that was supposed to ship in Catalina but got yanked is still likely to happen.
GeekyBear 7y ago
Here's a text transcript from the WWDC 2019 session that gave an overview. >A System Extension is part of your app that extends the functionality of the operating system in ways similar to a Kernel Extension but running in user space outside the kernel. https://asciiwwdc.com/2019/sessions/702 https://asciiwwdc.com/2019/sessions/702
- teruakohatu 7y ago
  Can this handle filesystem drivers? I am going to miss NTFS for Mac and one or two Serial drivers I use.
  - GeekyBear 7y ago
    Drivers are moving to user space too, but it's another case of something that will phase-in over two versions of the OS. >DriverKit is a new SDK with all new frameworks based on IOKit but updated and modernized, designed for building Driver Extensions in user space outside the kernel. You can build and test certain types of drivers in Catalina, but they won't be required until the next version of the OS ships. >In Catalina, you can control USB, Serial, Network Interface, and Human Interface devices. They will announce support for more kinds of user space drivers over time. If there is not an available user space option for a particular use case, the existing kernel space option will continue to work.
  - szc 7y ago
    I'm curious which ones -- CDC drivers are supported automatically and since Mavericks there is built-in support for FTDI and CH340G written by Apple. I think there is still a PL2303 driver but I've not used something with one of those for a couple of years. I definitely do not miss the kernel panics from unplugging an older FTDI based Arduino while it was sending serial data!
    - 1over137 7y ago
      Apple's FTDI driver doesn't match against every FTDI device though, sometimes you still need the VCP driver FTDI themselves provide.
chatmasta 7y ago
What if I need to format a FAT32 flash drive?
- duskwuff 7y ago
  That has never required a kernel extension.
  - chatmasta 7y ago
    Sorry, I meant NTFS. That requires a "system extension" AFAIK -- is this not the same thing as a kernel extension?
    - Wowfunhappy 7y ago
      A̶F̶A̶I̶K̶ ̶n̶o̶n̶e̶ ̶o̶f̶ ̶t̶h̶e̶ ̶m̶a̶j̶o̶r̶ ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ ̶N̶T̶F̶S̶ ̶M̶a̶c̶ ̶d̶r̶i̶v̶e̶r̶s̶ ̶u̶s̶e̶ ̶k̶e̶x̶t̶s̶. Edit: I'm completely, totally, and utterly wrong, don't mind me.
      - SyneRyder 7y ago
        Both Tuxera NTFS and Paragon NTFS are kernel extensions.
        Wowfunhappy 7y ago
        Tuxera is a kernel extension? I have Tuxera installed right now, and there's no kext for it in /Library/Extensions. I also could have sworn Tuxera was FUSE based... Edit: Oh, but it shows up in `sudo kextstat`. Okay, I'm completely wrong then. I was wondering how a FUSE filesystem could have such good performance...
        SyneRyder 7y ago
        Yeah, I was going by Tuxera's website FAQ that has an answer for "I'm Getting A System Extension Blocked Message During Installation". Didn't actually check for the kexts myself, so thanks for verifying. A macOS without Tuxera NTFS and Parallels Desktop is going to be really problematic for me, but presumably Apple will find workarounds for them. I already switched back to Windows a year ago anyway.
gentle 7y ago
This is yet another reason to move away from MacOS. The blocking of 32-bit apps, a requirement to have Apple notarize every application, and now the removal of kexts. If Apple still made great software and even better hardware then I wouldn't care, but that hasn't been the case for years.
- favorited 7y ago
  If you've been unhappy with hardware and software for years, why haven't you moved to another platform? At least your OS if you didn't want to buy new hardware.
  - trevyn 7y ago
    Other platforms are even worse right now, in different ways. Perhaps that will change, or perhaps Apple will get so bad that they’re no longer the least-worst option.
  - viraptor 7y ago
    You effectively can't use alternative OSes on new mbps easily. Drivers are not available and wifi firmware is broken (wontfix, don't care) for use with Linux stack. Reasons to stick with them: company purchasing policy.
    - georgebarnett 7y ago
      Your company will only purchase macs? Is there no windows option? That would be .. unusual.
      - viraptor 7y ago
        There is, but the choice available doesn't quite work for developers. In my opinion anyway. (reasonable for generic office workers though)
- monkin 7y ago
  > If Apple still made great software and even better hardware then I wouldn't care, but that hasn't been the case for years. Can you tell what is a better hardware and/or software for you?
mrpippy 7y ago
Kernel extensions being deprecated is not news (it was announced at WWDC). The only real new info in this post is that 10.15.4 will pop up warning dialogs when loading the certain types of kexts that have replacement APIs available.
drewg123 7y ago
I wonder if this is the end of drivers for 3rd party PCIe/thunderbolt high performance NICs? I imagine that this may make Macs less viable for situations where having a reasonably high performance 3rd party NIC is important (eg, video editing). Are there any details about DriverKit that are available? I used to be a Mac driver developer ~10 years ago or so. I did one of the first 10G drivers for Macos, and MacOS performance was always terrible compared to Linux or BSD, but I can't imagine that moving it into userspace is going to help anything. MacOS boundary crossing (eg, syscall, ioctl, and Mach traps) performed even worse than their network stack as compared to Linux/BSD.
- pjmlp 7y ago
  Yes, WWDC video https://developer.apple.com/videos/play/wwdc2019/702/ https://developer.apple.com/videos/play/wwdc2019/702/ https://developer.apple.com/documentation/driverkit?language=objc https://developer.apple.com/documentation/driverkit?language... https://developer.apple.com/system-extensions/ https://developer.apple.com/system-extensions/ Regarding performance, on the other hand Linux/BSD still don't match macOS real time audio capabilities.
  - drewg123 7y ago
    At least its found one thing to be good at.
    - fxtentacle 7y ago
      Sadly not. Many professional DAWs rely on custom kexts and are therefore advising their customers against upgrading.
  - phonethrowaway 7y ago
    > Regarding performance, on the other hand Linux/BSD still don't match macOS real time audio capabilities. Got a source for that? I use a Debian machine for an audio workstation. I moved there from OSX and am using the same DAW and get less latency now. Especially because I can run a real-time kernel...
sircastor 7y ago
Right now I use an empty kext to prevent macOS from seizing control of a hardware programmer (keeping it from being accessed by the program that uses it). It was a hack of a solution, but it worked. This means for the moment, I don't have an upgrade path that works for me...
- comex 7y ago
  USBDriverKit is the new way to do that.
sircastor 7y ago
Does this mean Hackintoshes are on their way out? Kexts have been used in that community to maintain support for non Apple hardware.
- chundicus 7y ago
  Life, uh, finds a way
- aspenmayer 7y ago
  OpenCore loads kexts differently (sorry for lack of technical explanation) so you can keep SIP enalbed, in addition to other advantages over Clover or other methods. More info below. OpenCore Reference Manual https://github.com/acidanthera/OpenCorePkg/blob/master/Docs/Configuration.pdf https://github.com/acidanthera/OpenCorePkg/blob/master/Docs/... OpenCore Vanilla Guide https://khronokernel.github.io/Opencore-Vanilla-Desktop-Guide/ https://khronokernel.github.io/Opencore-Vanilla-Desktop-Guid...
- Teknoman117 7y ago
  It might mean switching more towards virtualization for Hackintoshes. It's now possible to run a completely, 100% unmodified macOS in qemu/kvm on Linux and use vfio passthrough to place GPUs (mostly Radeon cards) and other PCIe devices into macOS.
  - asveikau 7y ago
    Speaking of virtualization, what about using macOS as a VM host? This typically requires kernel mode drivers. It would be awfully inconvenient to not be able to host VMs on a Mac development machine.
    - angry_octet 7y ago
      It could be this is done by MacOS itself, in a similar manner to Hyper-V on Windows, where you can no longer use VMWare/VirtualBox/etc. Virtualisation is critical to Win 10 security, wouldn't be surprised to see MacOS going in that direction.
sys_64738 7y ago
What does this mean for VM technology like Parallels and Oracle?
- wmf 7y ago
  They should have switched to Hypervisor.framework already.
hemancuso 7y ago
Curious if anyone knows what Dropbox will do about SmartSync. KAuth extensions are likely out as of 10.16, and the Endpoint Security extensions don’t let you block a reply for more than 60 seconds, so you can’t dynamically page in large files anymore.
- jinushaun 7y ago
  The new FileProvider API supports something like smart sync: placeholders for files that live in the cloud and download on demand.
  - Mister_Snuggles 7y ago
    OneDrive does this without requiring a kernel module.
    - hemancuso 7y ago
      They have access to a kernel module and entitlement that only they have access to, com.apple.fileutil - and Apple has said they aren't giving out any more entitlements for it.
- pronglelord9 7y ago
  I would bet hard cash that it'll be out as of 10.17. Almost every major vendor is done, and the ones that aren't have a 2020 OKR (or equivalent) around this. > more than 60 seconds, so you can’t dynamically page in large files anymore certain vendors with legacy engines they've ported 10 years into the future are in trouble. But, assuming a 10.17 release, which they've worked out with apple? They'll be fine, mostly.
  - hemancuso 7y ago
    Fine how?
    - pronglelord9 7y ago
pronglelord9 7y ago
>IOUSBFamily has been deprecated and headers removed from SDK since macOS El Capitan (10.11). All clients should move to IOUSBHostFamily or USBDriverKit, where appropriate and outlined below. lol which one of you? i fully sympathize but oof, guess you lost that fight
leoh 7y ago
This was my favorite kennel extension. It allowed for accessing memory via a device that you could call `cat` on, grep etc. https://www.osxbook.com/book/bonus/chapter8/kma/ https://www.osxbook.com/book/bonus/chapter8/kma/
actionowl 7y ago
Does anyone know if this will impact: - FUSE - XQuartz - LittleSnitch
- szc 7y ago
  XQuartz doesn't use a kernel extension to work, so it should be fine.
- PappaPatat 7y ago
  I do not know about impact, but $ kextstat -l | grep -v com.apple | tr -s ' ' | cut -f 7,8 -d ' ' at.obdev.nke.LittleSnitch (5430) It does use a kernel extention.
jes 7y ago
I wonder about drivers for PCIe add-in cards for the new Mac Pro. I have a client that has asked me to develop such a driver for their card so they can run on modern Mac Pro systems. I’d work entirely in userland via DriverKit if I could, but I don’t think the necessary APIs to interact with PCIe hardware are available.
- rarepostinlurkr 7y ago
  They are in 10.15.4
CountSessine 7y ago
Interesting. The company I worked for and our competitor VMWare both had to create small kexts to enable on-the-fly capture of USB devices. We both accessed USB devices from user-space, but we needed to put small kexts in the kernel to prevent class drivers from being automatically attached to general USB devices. There was really no race-free user-space way of doing this and Apple ignored our messages on their dev forums when we asked for assistance. I wonder if they’ve added an interface for this? Or maybe promiscuous USB device control just isn’t going to be possible now?
- zZorgz 7y ago
  As a side note, the forums aren't the best place for that; the post could just be unseen by the people that matter. The appropriate channels are through Feedback Assistant and/or a technical support report (https://developer.apple.com/support/technical/ https://developer.apple.com/support/technical/) which has bit more visibility.
  - dehrmann 7y ago
    For things vaguely like this, the places I've worked had contacts within the company helping us to varying degrees. Apply was not one of these companies, and unless there's money or contracts are being signed, getting that contact is a challenge.
    - zZorgz 7y ago
      Sure, but for clarification the channels I noted are if you are any registered developer and don't have close contact.
      - ksec 7y ago
        Or Else the best place these days seems to be Twitter and getting other developers support.
  - jchb 7y ago
    Second this, you get two free Technical Support Incident requests per year as a registered developer, and you can purchase additional ones. We regularly file such requests and have always got timely and helpful responses.
rswail 7y ago
Just looked through my kexts. I've got two that I use, one that I dont, all signed and approved by Apple: * Driver for RTL815X that works with my USB Ethernet adapter from RTL. The standard Apple driver refused to run at 1G, only at 100Mb. It'll be interesting to see if they update the drivers any time soon. * Tripmode that controls network I/O (I don't use it) * Karabiner Elements to handle my custom keyboard I use the (excellent) Karbiner-Elements to handle my keyboard and it has a kext that sets up a virtual keyboard and virtual pointer as HID devices. So I'm guessing that's going to need to be converted from a kext to something using the HIDDriverKit.
deleted 7y ago
[deleted]
cerberusss 7y ago
If you want to know how much non-Apple kernel extensions you use, use "kextstat" and filter out com.apple. In my case, I only use Karabiner: % kextstat | grep -v com.apple Index Refs Address Size Wired Name (Version) UUID <Linked Against> 185 0 0xffffff7f84cc0000 0x5000 0x5000 org.pqrs.driver.Karabiner.VirtualHIDDevice.v061000 (6.10.0) 4D004D1A-ED2F-3780-AD53-A10F286EC759 <51 6 5 3 1> %
- emit_time 7y ago
  Also, use this[1]! [1]: https://objective-see.com/products/kextviewr.html https://objective-see.com/products/kextviewr.html
  - woadwarrior01 7y ago
    Interestingly, the only other kext (besides the one for Karabiner) I see on my machine is for LittleSnitch, which is also from Objective-See. Also, I was expecting to see a kext from VMWare, because I use VMWare Fusion, but there wasn't one.
    - sascha_sl 7y ago
      Huh, I have: com.vmware.kext.vmnet com.vmware.kext.vmx86 com.vmware.kext.vmioplug.18.7.0
      - woadwarrior01 7y ago
        You're right. I've got the same. It looks like the VMWare kexts don't get loaded until you launch VMWare Fusion and they're unloaded when it exits.
    - mintplant 7y ago
      Little Snitch is actually from Objective Development. Objective-See does make a firewall application called Lulu, however.
    - November-Echo 7y ago
riddlemethat 7y ago
I’m still on MacOS 10.14 thanks to depreciation of 32 bit support. Guess Apple really wants to keep me locked in an old OS for as long as possible.
cgb223 7y ago
As a total layman to developing kernel extensions, is this another example of apple limiting what you can do with their hardware, or just an effort to get developers to modernize how they make drivers for macOS?
- takeda 7y ago
  Well, apple makes the hardware, so they would typically make the drivers as well. From what I read and understood is that without being able to load own extensions you can only do whatever Apple allowed you to do. It could be compared to changes that Chrome plans (or already introduced?) to restrict extensions that filter sites which affect adblockers and you're at mercy of Google what you can block and what you cannot. Similarly here, you will only be able to hook to interfaces Apple provided, but if you plan to do something that wasn't thought of, or Apple does not approve, tough luck.
- Someone 7y ago
  This doesn’t limit what you can do with their hardware, it limits what you can do with their software. This doesn’t change anything w.r.t. running your own software on hardware you bought from them. They want MacOS to be stable and secure. Disallowing kernel extensions is a step towards that.
mister_hn 7y ago
Is this a move to kill any Hackintosh attempt?
- Hamuko 7y ago
  There's probably easier ways of going about it. I doubt Apple really cares that much about Hackintosh users. Many of them probably have legit Apple hardware as well. I personally own a Hackintosh, a MacBook, an iPhone and an Apple Watch, and also have a MacBook at work.
- djmobley 7y ago
  I see it as part of a general trend whereby Apple are locking down macOS and making it more akin to iOS. Think System Integrity Protection (SIP), the read-only system volume introduced in Catalina, etc. All good for security and your typical macOS user. That these changes are also frustrating for hackers is just a side-effect they are willing to accept.
quotemstr 7y ago
It's shit like this that drives me never to use Apple products. Oh, your company gives Apple laptops to SWEs and I can't order something different? No, I won't work with you. I need full control over the machine I spend my day driving, and this control includes loading kernel modules on my own damned computer if i want to do that.
dijit 7y ago
Interesting. I can track 100% of my kernel panics on MacOS to kernel extentions (VirtualBox in particular). Hopefully this improves stability.
0x0 7y ago
Really hope this won't kill osxfuse, virtualbox or vmware. Will it?
- comex 7y ago
  No; none of those are using deprecated APIs. VirtualBox and VMware could avoid the need for a kext by moving to Hypervisor.framework, but there's no immediate need to.
  - cmsj 7y ago
    Perhaps worth noting that Parallels can already use Hypervisor.framework - it's a configuration option per VM (although I don't know if you can have a mixture of the options running at the same time).
    - Wowfunhappy 7y ago
      I tried switching Parallels to the Apple hypervisor once because I was curious. I ran a quick x264 encode to test performance, and Apple's hypervisor was quite clearly worse. Far from a comprehensive test, but, yeah, there's probably a reason Parallels defaults to their custom kext.
pgt 7y ago
I need Kernel Extensions for Karabiner and USB-to-TTY drivers to talk to and program firmware on embedded boards. If I can no longer do this, my next machine is not a Macbook. Unless there is a different way, this is a dealbreaker.
- deleted 7y ago
  [deleted]
greatjack613 7y ago
Could this be the beginning of the arm transition? I mean porting kernel extensions would probably be a big deal, so deprecating them would be the first step.
- m0dest 7y ago
  Short term, I suspect that it’s going to be more relevant for porting functionality to iPadOS and/or allowing that functionality to be shared between Mac and iPad (in Catalyst apps).
synthecypher 7y ago
RIP tonymacx86 :(
phn 7y ago
I'd just like to point out that the title is a bit misleading -- They are deprecating extensions that use parts of the kernel API that have alternatives, as these become available. How well that will work in practice remains to be seen. But they aren't simply deprecating all kernel extensions.
BooneJS 7y ago
I haven’t had experience with kexts lately, but they were a source of instability for me in the past. Not sad to see them go.
lsiebert 7y ago
I just found Turbo Boost Switcher, which uses a kernel extension to manage intel turbo boosting. I'm a little worried that this sort of change will prevent this kind of innovative work (and quite possibly the application altogether. http://tbswitcher.rugarciap.com/ http://tbswitcher.rugarciap.com/
ubermonkey 7y ago
Huh. The only non-Apple ones on my Mac are for: * VMWare Fusion * Little Snitch * Dropbox plus one for a firewall I don't run anymore and could get rid of.

337 points by ameshkov 7y ago

As usually, Apple does not give developers any time to react. There is no migration plan save for one video from WWDC where they briefly describe some alternatives. > In macOS 10.15.4, use of deprecated KPIs triggers a notification to the user that the software includes a deprecated API and asks the user to contact the developer for alternatives.

pjmlp 7y ago
The alternatives are well known and everyone has half a year to actually read about DriverKit and Network Extensions.
- ameshkov 7y ago
  Well, let me disagree. The documentation is lagging. Right after the WWDC there were nothing except for some header files. Also, why half a year? Do you think it will take them that much to release 10.15.4?
  - api 7y ago
    What's this "documentation" thing you're talking about? Is it something other than header files and code? I'm joking but documentation (and tech support) do seem to be dying things at Apple and elsewhere.
    - ameshkov 7y ago
      Actually, they are quite helpful on the developer forums. Fully agree on the documentation point, though.
- zymhan 7y ago
  Surely you don't think 6 months is enough to rewrite entire drivers and Kexts, do you? That is a short transition by any comparison.
  - acdha 7y ago
    How do you get 6 months from June 2019 announcement for the next major OS release which won't be out before September 2020? It still works in Catalina and they won’t change that in a point release.
    - dmitriid 7y ago
      Because you don't have one year to update and release your software. You have to have it ready and begin testing at least by the time betas of the next version of OS ships. And to do that, you have to start much earlier.
- dmitriid 7y ago
  6 months since the announcement of the entirely new not-seen-before thing with next to zero documentation to understand, develop an alternative (if it's at all possible) and distribute it to users. How is that enough time?
highlandinfo 7y ago
Developers who are affected by this (and who were on top of last summer's announcements) knew this day was coming, and have been working on updates since then. 10.15 serves as a testbed that supports legacy kernel extensions as well as the new user-space frameworks (e.g. EndpointSecurity and NetworkExtension) that largely replace the deprecated APIs. Developers that have a revision ready to test against the first 10.16 beta this summer should be in good shape (assuming that Apple doesn't swerve wildly between 10.15 and 10.16 cough 64-bit Carbon cough). Yes, the documentation is scanty in places, and there is some missing functionality at the moment. And the support burden on these companies, once 10.15.4 ships, will be a pain ("It's OK, the software still works, don't worry about that alert message"). But it is incorrect to say that Apple has not given developers time to react.
- pier25 7y ago
  > knew this day was coming Certainly but the problem is that such changes should be announced years in advance. Cocoa, OpenGL, ObjC... all are going to die some day and Apple will probably announce it 1 year before it happens, at the most.
  - floatingatoll 7y ago
    OpenSSL was deprecated 8 years ago and hasn’t been removed yet. Your bet of 1 year is not well-supported by their historical trends on Carbon, x86 32-bit, PowerPC, 68k, Garbage collection, and so on. Unless you’re suggesting that Apple will only give 1 year’s notice when they remove deprecated features - in which case, they might only give 0.25 years (at WWDC), which happens quite frequently.
    - 1over137 7y ago
      Past cases need not match future cases. They've been tossing things faster than in the past.
      - floatingatoll 7y ago

pjmlp 7y ago

> Kernel programming interfaces (KPIs) will be deprecated as alternatives become available, and future OS releases will no longer load kernel extensions that use deprecated KPIs by default. This is the key part, as presented during the WWDC 2019 talks, the long term roadmap is to make macOS into a proper mikro-kernel OS. This is just the start.

tambourine_man 7y ago
Could you point us to the talk where they say this? Not doubting, just curious for more info
- pjmlp 7y ago
  "System Extensions and DriverKit" https://developer.apple.com/videos/play/wwdc2019/702/ https://developer.apple.com/videos/play/wwdc2019/702/ From the transcript: "MacOS 10.15 Catalina will be the last release to fully support Kernel Extensions without compromises." Specifically, for the capabilities supported by System Extensions and the device families supported by DriverKit, using a Kernel Extension to do that same job is now deprecated and a future release of macOS will not load Kernel Extensions of these kinds. In future releases, we will add more kinds of System Extensions and more device families to DriverKit. In turn, Kernel Extensions of those kinds will also be deprecated."
  - AshamedCaptain 7y ago
    Banning third-party developers from loading modules into kernel-space does not a microkernel make. Apple-approved developers are still going to be loading whatever crap they want into kernel space, incl AMD or nVidia graphics drivers and the lot. It's not like they can convert XNU into an actual microkernel in less than a decade or two. This just means that if you're not on the Apple-whitelist then macOS becomes a yet even more close platform for you. Wanted to developed a driver for a PCIe network card? Sorry, no can do!
    - monocasa 7y ago

floatingatoll 7y ago

> At WWDC19, we announced the deprecation of kernel extensions The title as written deserves a (2019) since they announced this to developers last year.

zymhan 7y ago
That is only for a post written in, say, 2019. A new post that cites old information is still a new post. Additionally, they _announced_ the deprecation at WWDC, but that did not take immediate effect. The point of this post is that they are as of right now no longer supported.
- pjmlp 7y ago
  They announced one OS release for deprecation period after an userspace API for a previous Kext gets introduced. So now that Catalina is officially released, they are following up on this.
- floatingatoll 7y ago
  What information is new? They are still supported in Catalina and they will be unsupported to varying degrees after Catalina, same as they said last year.

loeg 7y ago

Does this mean VFSForGit for Mac is dead? Is there some proposed mechanism for filesystem implementations other than kernel extensions?

shakna 7y ago
> Is there some proposed mechanism for filesystem implementations other than kernel extensions? Not currently. Not that I can find.
comex 7y ago
Not all kext functionality is deprecated (yet), only things that have userland replacements. Filesystems are not deprecated.
- pmjordan 7y ago
  VFSForGit is/was not a true file system, it just intercepts file I/O events to dummy files to lazily fill them with content and to log writes so that 'git status' does not have to scan the whole repo for changes. The macOS port uses the KAUTH listener API, which was indeed deprecated with 10.15.
  - comex 7y ago
    Whoops, my mistake. (In my defense, it has VFS in the name! So I just assumed it uses xnu's VFS API, but apparently the name comes from the Windows VFS API.) It sounds like FileProvider would be perfectly suited to the job if it weren't pulled.
    - pmjordan 7y ago
      Someone else on the project experimented with FileProvider during the Catalina beta, so this is all second hand, but it wasn't really suitable for the job - it seemed more designed for having a special folder like the iCloud Drive, and didn't work well with CLI tools. I actually didn't realise it was pulled before the Catalina launch, but that makes sense, I got the impression it was nowhere near production ready.

dzhiurgis 7y ago

How does something like Lulu firewall goons work instead? Is there any alts for virtualbox?

als0 7y ago
macOS provides an API called Hypervisor.framework for virtual machine managers like Virtualbox. It means they don't need kernel modules anymore. QEMU also uses it for acceleration.
- dzhiurgis 7y ago
  Is there anything that I can use for running Windows now?
  - cerberusss 7y ago
    I'm pretty sure Parallels will come up with a solution. If you want to play with virtualizing Windows via Hypervisor.framework right now, I remember that the people from Veertu.com had Windows running via their Veertu Desktop product. But they seem to be focused on virtualizing macOS-on-macOS right now.
    - cmsj 7y ago
      Parallels can already use Hypervisor.framework - it's a per-VM configuration option.
      - cerberusss 7y ago
        Thanks, good information
  - kccqzy 7y ago
    If you actually mean now, VirtualBox still works. If you want a Hypervisor.framework based system, I think Veertu used to have an app on the App Store.
7y ago

smcleod 7y ago

I really hope that this is the final nail in the coffin for third party Anti Virus vendors. It's been really worrying to see large enterprises that have moved from Windows to macOS and carry their thinking that the need to install a third party AV product (which in turn often acts as a near-unrestricted way into the kernel).

r00fus 7y ago
Does this also doom the corporate spyware that's in almost every large enterprise Mac deployment, or does that install without KE?
- jedieaston 7y ago
  Define "spyware". JAMF uses the MDM APIs that Apple provides. It also can't access personal data via those APIs. Your anti-virus may use kernel extensions, in which case it will stop working.
  - floatingatoll 7y ago
    JAMF additionally permits the provisioning server to run arbitrary scripts on the endpoints, using an installed daemon that implements functionality beyond what MDM offers.
- yoz-y 7y ago
  What would be the ideal solution to manage fleets of computers though? Afaik Apple does not have a full featured first party solution, or do they?
0az 7y ago
I can't wait until I can uninstall University-mandated AV. I'm still waiting for Jumpshot to respond to my CCPA inquiry.
- jedieaston 7y ago
  You don't have to worry about that anymore... https://www.jumpshot.com/ https://www.jumpshot.com/

big_chungus 7y ago

How will hackintoshing work without kexts? I'm no expert but have built a few, and they make extensive use of them to make non-apple hardware work properly and to add functionality.

turdnagel 7y ago
Was wondering the same thing. I'm guessing you'll always be able to install them as long as System Integrity Protection is disabled.
- nottorp 7y ago
  Hmm I just checked and I have far fewer 3rd party kexts than i thought. 8 hackintosh related kexts, out of which one is for the temperature sensors that i can live without. What worries me is stuff like Paragon NTFS, intel haxm for Android emulation, osxfuse used by pCloud...
  - Hamuko 7y ago
    I checked my Hackintosh and I had like 32 kexts, although a few of them were immediately noticeable as unrelated to Hackintoshing. However, there does appear to be quite a number, so this is a bit worrisome of a development. Hopefully people will find new ways to support macOS on PC hardware, since Apple doesn't really seem interested in the prosumer desktop market.
    - nottorp 7y ago
      Oh, I do have more 3rd party kexts but they're not related to hackintoshing and most of them are for usb stuff; Apple seems to have provided a migration path for those. I might need to get a new Creative Labs audio thingy because they're not known for updating drivers for old products...
- pjmlp 7y ago
  Kexts will be completely removed, as long term plan. It goes into two steps. 1 - A new user space API for what was previously kernel API gets introduced 2 - There is one OS release where the kernel API gets deprecated 3 - The release thereafter removes the kernel API Long term roadmap is to make macOS into a proper micro-kernel OS.

steeleduncan 7y ago

Is this the end of any form of fuse style fs on macOS? (whether osxfuse, or an open source fork of an earlier version of it) They say that future OS releases will no longer load deprecated KPIs, but they do not note the VFS KPIs as deprecated in their list.

als0 7y ago
Potentially, although OSXFUSE only works on old macOS versions now.
- hemancuso 7y ago
  That’s not accurate.
- jdeibele 7y ago
  2 weeks ago I used OSXFUSE to read an old Linux hard disk. It was running ext4 and I was able to install OSXFUSE and EXT4FUSE under Catalina. It let me browse and copy files off. I had a few directories that were password-protected and I wasn't able to access them. There might be a way to do so but they just weren't important enough to me to do more investigation. https://www.maketecheasier.com/mount-access-ext4-partition-mac/ https://www.maketecheasier.com/mount-access-ext4-partition-m... is the instructions I followed. I've since removed the components since I don't have any other old Linux drives lurking around. Removal seems to have worked just fine.
- re 7y ago
  The latest version of FUSE for macOS, which is still freely available to end users but no longer open source and not licensed to allow redistribution, works on the current version of macOS. The open source code has not been updated in a few years and as such only works on older macOS releases.
hemancuso 7y ago
They currently offer no replacement for VFS. But I bet they will offer something fuse-like if they offer anything at all. Also: the file provider api they use for iCloud Drive that was supposed to ship in Catalina but got yanked is still likely to happen.

GeekyBear 7y ago

Here's a text transcript from the WWDC 2019 session that gave an overview. >A System Extension is part of your app that extends the functionality of the operating system in ways similar to a Kernel Extension but running in user space outside the kernel. https://asciiwwdc.com/2019/sessions/702 https://asciiwwdc.com/2019/sessions/702

teruakohatu 7y ago
Can this handle filesystem drivers? I am going to miss NTFS for Mac and one or two Serial drivers I use.
- GeekyBear 7y ago
  Drivers are moving to user space too, but it's another case of something that will phase-in over two versions of the OS. >DriverKit is a new SDK with all new frameworks based on IOKit but updated and modernized, designed for building Driver Extensions in user space outside the kernel. You can build and test certain types of drivers in Catalina, but they won't be required until the next version of the OS ships. >In Catalina, you can control USB, Serial, Network Interface, and Human Interface devices. They will announce support for more kinds of user space drivers over time. If there is not an available user space option for a particular use case, the existing kernel space option will continue to work.
- szc 7y ago
  I'm curious which ones -- CDC drivers are supported automatically and since Mavericks there is built-in support for FTDI and CH340G written by Apple. I think there is still a PL2303 driver but I've not used something with one of those for a couple of years. I definitely do not miss the kernel panics from unplugging an older FTDI based Arduino while it was sending serial data!
  - 1over137 7y ago
    Apple's FTDI driver doesn't match against every FTDI device though, sometimes you still need the VCP driver FTDI themselves provide.

chatmasta 7y ago

What if I need to format a FAT32 flash drive?

duskwuff 7y ago
That has never required a kernel extension.
- chatmasta 7y ago
  Sorry, I meant NTFS. That requires a "system extension" AFAIK -- is this not the same thing as a kernel extension?
  - Wowfunhappy 7y ago
    A̶F̶A̶I̶K̶ ̶n̶o̶n̶e̶ ̶o̶f̶ ̶t̶h̶e̶ ̶m̶a̶j̶o̶r̶ ̶t̶h̶i̶r̶d̶ ̶p̶a̶r̶t̶y̶ ̶N̶T̶F̶S̶ ̶M̶a̶c̶ ̶d̶r̶i̶v̶e̶r̶s̶ ̶u̶s̶e̶ ̶k̶e̶x̶t̶s̶. Edit: I'm completely, totally, and utterly wrong, don't mind me.
    - SyneRyder 7y ago
      Both Tuxera NTFS and Paragon NTFS are kernel extensions.
      - Wowfunhappy 7y ago
        Tuxera is a kernel extension? I have Tuxera installed right now, and there's no kext for it in /Library/Extensions. I also could have sworn Tuxera was FUSE based... Edit: Oh, but it shows up in `sudo kextstat`. Okay, I'm completely wrong then. I was wondering how a FUSE filesystem could have such good performance...
        SyneRyder 7y ago
        Yeah, I was going by Tuxera's website FAQ that has an answer for "I'm Getting A System Extension Blocked Message During Installation". Didn't actually check for the kexts myself, so thanks for verifying. A macOS without Tuxera NTFS and Parallels Desktop is going to be really problematic for me, but presumably Apple will find workarounds for them. I already switched back to Windows a year ago anyway.

gentle 7y ago

This is yet another reason to move away from MacOS. The blocking of 32-bit apps, a requirement to have Apple notarize every application, and now the removal of kexts. If Apple still made great software and even better hardware then I wouldn't care, but that hasn't been the case for years.

favorited 7y ago
If you've been unhappy with hardware and software for years, why haven't you moved to another platform? At least your OS if you didn't want to buy new hardware.
- trevyn 7y ago
  Other platforms are even worse right now, in different ways. Perhaps that will change, or perhaps Apple will get so bad that they’re no longer the least-worst option.
- viraptor 7y ago
  You effectively can't use alternative OSes on new mbps easily. Drivers are not available and wifi firmware is broken (wontfix, don't care) for use with Linux stack. Reasons to stick with them: company purchasing policy.
  - georgebarnett 7y ago
    Your company will only purchase macs? Is there no windows option? That would be .. unusual.
    - viraptor 7y ago
      There is, but the choice available doesn't quite work for developers. In my opinion anyway. (reasonable for generic office workers though)
monkin 7y ago
> If Apple still made great software and even better hardware then I wouldn't care, but that hasn't been the case for years. Can you tell what is a better hardware and/or software for you?

mrpippy 7y ago

Kernel extensions being deprecated is not news (it was announced at WWDC). The only real new info in this post is that 10.15.4 will pop up warning dialogs when loading the certain types of kexts that have replacement APIs available.

drewg123 7y ago

I wonder if this is the end of drivers for 3rd party PCIe/thunderbolt high performance NICs? I imagine that this may make Macs less viable for situations where having a reasonably high performance 3rd party NIC is important (eg, video editing). Are there any details about DriverKit that are available? I used to be a Mac driver developer ~10 years ago or so. I did one of the first 10G drivers for Macos, and MacOS performance was always terrible compared to Linux or BSD, but I can't imagine that moving it into userspace is going to help anything. MacOS boundary crossing (eg, syscall, ioctl, and Mach traps) performed even worse than their network stack as compared to Linux/BSD.

pjmlp 7y ago
Yes, WWDC video https://developer.apple.com/videos/play/wwdc2019/702/ https://developer.apple.com/videos/play/wwdc2019/702/ https://developer.apple.com/documentation/driverkit?language=objc https://developer.apple.com/documentation/driverkit?language... https://developer.apple.com/system-extensions/ https://developer.apple.com/system-extensions/ Regarding performance, on the other hand Linux/BSD still don't match macOS real time audio capabilities.
- drewg123 7y ago
  At least its found one thing to be good at.
  - fxtentacle 7y ago
    Sadly not. Many professional DAWs rely on custom kexts and are therefore advising their customers against upgrading.
- phonethrowaway 7y ago
  > Regarding performance, on the other hand Linux/BSD still don't match macOS real time audio capabilities. Got a source for that? I use a Debian machine for an audio workstation. I moved there from OSX and am using the same DAW and get less latency now. Especially because I can run a real-time kernel...

sircastor 7y ago

Right now I use an empty kext to prevent macOS from seizing control of a hardware programmer (keeping it from being accessed by the program that uses it). It was a hack of a solution, but it worked. This means for the moment, I don't have an upgrade path that works for me...

comex 7y ago
USBDriverKit is the new way to do that.

sircastor 7y ago

Does this mean Hackintoshes are on their way out? Kexts have been used in that community to maintain support for non Apple hardware.

chundicus 7y ago
Life, uh, finds a way
aspenmayer 7y ago
OpenCore loads kexts differently (sorry for lack of technical explanation) so you can keep SIP enalbed, in addition to other advantages over Clover or other methods. More info below. OpenCore Reference Manual https://github.com/acidanthera/OpenCorePkg/blob/master/Docs/Configuration.pdf https://github.com/acidanthera/OpenCorePkg/blob/master/Docs/... OpenCore Vanilla Guide https://khronokernel.github.io/Opencore-Vanilla-Desktop-Guide/ https://khronokernel.github.io/Opencore-Vanilla-Desktop-Guid...
Teknoman117 7y ago
It might mean switching more towards virtualization for Hackintoshes. It's now possible to run a completely, 100% unmodified macOS in qemu/kvm on Linux and use vfio passthrough to place GPUs (mostly Radeon cards) and other PCIe devices into macOS.
- asveikau 7y ago
  Speaking of virtualization, what about using macOS as a VM host? This typically requires kernel mode drivers. It would be awfully inconvenient to not be able to host VMs on a Mac development machine.
  - angry_octet 7y ago
    It could be this is done by MacOS itself, in a similar manner to Hyper-V on Windows, where you can no longer use VMWare/VirtualBox/etc. Virtualisation is critical to Win 10 security, wouldn't be surprised to see MacOS going in that direction.

sys_64738 7y ago

What does this mean for VM technology like Parallels and Oracle?

wmf 7y ago
They should have switched to Hypervisor.framework already.

hemancuso 7y ago

Curious if anyone knows what Dropbox will do about SmartSync. KAuth extensions are likely out as of 10.16, and the Endpoint Security extensions don’t let you block a reply for more than 60 seconds, so you can’t dynamically page in large files anymore.

jinushaun 7y ago
The new FileProvider API supports something like smart sync: placeholders for files that live in the cloud and download on demand.
- Mister_Snuggles 7y ago
  OneDrive does this without requiring a kernel module.
  - hemancuso 7y ago
    They have access to a kernel module and entitlement that only they have access to, com.apple.fileutil - and Apple has said they aren't giving out any more entitlements for it.
pronglelord9 7y ago
I would bet hard cash that it'll be out as of 10.17. Almost every major vendor is done, and the ones that aren't have a 2020 OKR (or equivalent) around this. > more than 60 seconds, so you can’t dynamically page in large files anymore certain vendors with legacy engines they've ported 10 years into the future are in trouble. But, assuming a 10.17 release, which they've worked out with apple? They'll be fine, mostly.
- hemancuso 7y ago
  Fine how?
  - pronglelord9 7y ago

pronglelord9 7y ago

>IOUSBFamily has been deprecated and headers removed from SDK since macOS El Capitan (10.11). All clients should move to IOUSBHostFamily or USBDriverKit, where appropriate and outlined below. lol which one of you? i fully sympathize but oof, guess you lost that fight

leoh 7y ago

This was my favorite kennel extension. It allowed for accessing memory via a device that you could call `cat` on, grep etc. https://www.osxbook.com/book/bonus/chapter8/kma/ https://www.osxbook.com/book/bonus/chapter8/kma/

actionowl 7y ago

Does anyone know if this will impact: - FUSE - XQuartz - LittleSnitch

szc 7y ago
XQuartz doesn't use a kernel extension to work, so it should be fine.
PappaPatat 7y ago
I do not know about impact, but $ kextstat -l | grep -v com.apple | tr -s ' ' | cut -f 7,8 -d ' ' at.obdev.nke.LittleSnitch (5430) It does use a kernel extention.

jes 7y ago

I wonder about drivers for PCIe add-in cards for the new Mac Pro. I have a client that has asked me to develop such a driver for their card so they can run on modern Mac Pro systems. I’d work entirely in userland via DriverKit if I could, but I don’t think the necessary APIs to interact with PCIe hardware are available.

rarepostinlurkr 7y ago
They are in 10.15.4

CountSessine 7y ago

Interesting. The company I worked for and our competitor VMWare both had to create small kexts to enable on-the-fly capture of USB devices. We both accessed USB devices from user-space, but we needed to put small kexts in the kernel to prevent class drivers from being automatically attached to general USB devices. There was really no race-free user-space way of doing this and Apple ignored our messages on their dev forums when we asked for assistance. I wonder if they’ve added an interface for this? Or maybe promiscuous USB device control just isn’t going to be possible now?

zZorgz 7y ago
As a side note, the forums aren't the best place for that; the post could just be unseen by the people that matter. The appropriate channels are through Feedback Assistant and/or a technical support report (https://developer.apple.com/support/technical/ https://developer.apple.com/support/technical/) which has bit more visibility.
- dehrmann 7y ago
  For things vaguely like this, the places I've worked had contacts within the company helping us to varying degrees. Apply was not one of these companies, and unless there's money or contracts are being signed, getting that contact is a challenge.
  - zZorgz 7y ago
    Sure, but for clarification the channels I noted are if you are any registered developer and don't have close contact.
    - ksec 7y ago
      Or Else the best place these days seems to be Twitter and getting other developers support.
- jchb 7y ago
  Second this, you get two free Technical Support Incident requests per year as a registered developer, and you can purchase additional ones. We regularly file such requests and have always got timely and helpful responses.

rswail 7y ago

Just looked through my kexts. I've got two that I use, one that I dont, all signed and approved by Apple: * Driver for RTL815X that works with my USB Ethernet adapter from RTL. The standard Apple driver refused to run at 1G, only at 100Mb. It'll be interesting to see if they update the drivers any time soon. * Tripmode that controls network I/O (I don't use it) * Karabiner Elements to handle my custom keyboard I use the (excellent) Karbiner-Elements to handle my keyboard and it has a kext that sets up a virtual keyboard and virtual pointer as HID devices. So I'm guessing that's going to need to be converted from a kext to something using the HIDDriverKit.

deleted 7y ago

[deleted]

cerberusss 7y ago

If you want to know how much non-Apple kernel extensions you use, use "kextstat" and filter out com.apple. In my case, I only use Karabiner: % kextstat | grep -v com.apple Index Refs Address Size Wired Name (Version) UUID <Linked Against> 185 0 0xffffff7f84cc0000 0x5000 0x5000 org.pqrs.driver.Karabiner.VirtualHIDDevice.v061000 (6.10.0) 4D004D1A-ED2F-3780-AD53-A10F286EC759 <51 6 5 3 1> %

emit_time 7y ago
Also, use this[1]! [1]: https://objective-see.com/products/kextviewr.html https://objective-see.com/products/kextviewr.html
- woadwarrior01 7y ago
  Interestingly, the only other kext (besides the one for Karabiner) I see on my machine is for LittleSnitch, which is also from Objective-See. Also, I was expecting to see a kext from VMWare, because I use VMWare Fusion, but there wasn't one.
  - sascha_sl 7y ago
    Huh, I have: com.vmware.kext.vmnet com.vmware.kext.vmx86 com.vmware.kext.vmioplug.18.7.0
    - woadwarrior01 7y ago
      You're right. I've got the same. It looks like the VMWare kexts don't get loaded until you launch VMWare Fusion and they're unloaded when it exits.
  - mintplant 7y ago
    Little Snitch is actually from Objective Development. Objective-See does make a firewall application called Lulu, however.
  - November-Echo 7y ago

riddlemethat 7y ago

I’m still on MacOS 10.14 thanks to depreciation of 32 bit support. Guess Apple really wants to keep me locked in an old OS for as long as possible.

cgb223 7y ago

As a total layman to developing kernel extensions, is this another example of apple limiting what you can do with their hardware, or just an effort to get developers to modernize how they make drivers for macOS?

takeda 7y ago
Well, apple makes the hardware, so they would typically make the drivers as well. From what I read and understood is that without being able to load own extensions you can only do whatever Apple allowed you to do. It could be compared to changes that Chrome plans (or already introduced?) to restrict extensions that filter sites which affect adblockers and you're at mercy of Google what you can block and what you cannot. Similarly here, you will only be able to hook to interfaces Apple provided, but if you plan to do something that wasn't thought of, or Apple does not approve, tough luck.
Someone 7y ago
This doesn’t limit what you can do with their hardware, it limits what you can do with their software. This doesn’t change anything w.r.t. running your own software on hardware you bought from them. They want MacOS to be stable and secure. Disallowing kernel extensions is a step towards that.

mister_hn 7y ago

Is this a move to kill any Hackintosh attempt?

Hamuko 7y ago
There's probably easier ways of going about it. I doubt Apple really cares that much about Hackintosh users. Many of them probably have legit Apple hardware as well. I personally own a Hackintosh, a MacBook, an iPhone and an Apple Watch, and also have a MacBook at work.
djmobley 7y ago
I see it as part of a general trend whereby Apple are locking down macOS and making it more akin to iOS. Think System Integrity Protection (SIP), the read-only system volume introduced in Catalina, etc. All good for security and your typical macOS user. That these changes are also frustrating for hackers is just a side-effect they are willing to accept.

quotemstr 7y ago

It's shit like this that drives me never to use Apple products. Oh, your company gives Apple laptops to SWEs and I can't order something different? No, I won't work with you. I need full control over the machine I spend my day driving, and this control includes loading kernel modules on my own damned computer if i want to do that.

dijit 7y ago

Interesting. I can track 100% of my kernel panics on MacOS to kernel extentions (VirtualBox in particular). Hopefully this improves stability.

0x0 7y ago

Really hope this won't kill osxfuse, virtualbox or vmware. Will it?

comex 7y ago
No; none of those are using deprecated APIs. VirtualBox and VMware could avoid the need for a kext by moving to Hypervisor.framework, but there's no immediate need to.
- cmsj 7y ago
  Perhaps worth noting that Parallels can already use Hypervisor.framework - it's a configuration option per VM (although I don't know if you can have a mixture of the options running at the same time).
  - Wowfunhappy 7y ago
    I tried switching Parallels to the Apple hypervisor once because I was curious. I ran a quick x264 encode to test performance, and Apple's hypervisor was quite clearly worse. Far from a comprehensive test, but, yeah, there's probably a reason Parallels defaults to their custom kext.

pgt 7y ago

I need Kernel Extensions for Karabiner and USB-to-TTY drivers to talk to and program firmware on embedded boards. If I can no longer do this, my next machine is not a Macbook. Unless there is a different way, this is a dealbreaker.

deleted 7y ago
[deleted]

greatjack613 7y ago

Could this be the beginning of the arm transition? I mean porting kernel extensions would probably be a big deal, so deprecating them would be the first step.

m0dest 7y ago
Short term, I suspect that it’s going to be more relevant for porting functionality to iPadOS and/or allowing that functionality to be shared between Mac and iPad (in Catalyst apps).

synthecypher 7y ago

RIP tonymacx86 :(

phn 7y ago

I'd just like to point out that the title is a bit misleading -- They are deprecating extensions that use parts of the kernel API that have alternatives, as these become available. How well that will work in practice remains to be seen. But they aren't simply deprecating all kernel extensions.

BooneJS 7y ago

I haven’t had experience with kexts lately, but they were a source of instability for me in the past. Not sad to see them go.

lsiebert 7y ago

I just found Turbo Boost Switcher, which uses a kernel extension to manage intel turbo boosting. I'm a little worried that this sort of change will prevent this kind of innovative work (and quite possibly the application altogether. http://tbswitcher.rugarciap.com/ http://tbswitcher.rugarciap.com/

ubermonkey 7y ago

Huh. The only non-Apple ones on my Mac are for: * VMWare Fusion * Little Snitch * Dropbox plus one for a firewall I don't run anymore and could get rid of.