Search code examples
macosfilesystemskernel-extensionxnu

Checking local filesystem fsid from osx kernel extension (kext)

I've got WA for checking what is the local fsid from within kext context, simply by reading predefined local file status.

static inline uint64_t get_fsid(const vfs_context_t ctx, const vnode_t vp) {
    struct vnode_attr vap;
    VATTR_INIT(&vap);
    VATTR_WANTED(&vap, va_fsid);
    vnode_getattr(vp, &vap, ctx);
    return (uint64_t)vap.va_fsid;
}

another option is to calculate the fsid from user-space and pass this info to the driver (using getmntinfo)

However, I prefer getting this data from directly from the kernel space without relying on any files currently existed. is there any KPI to support this request ?

Solution

  • You can iterate over all mount points in the system using the function

    int vfs_iterate(int, int (*)(struct mount *, void *), void *);

    For each mount object, you can check its fsid using

    struct vfsstatfs *  vfs_statfs(mount_t);

    vfsstatfs has an f_fsid field.

    Both functions and the struct are declared and documented in <sys/mount.h>. The functions are exported in the BSD KPI.