An open kernel provides many avenues for attack vectors to hit. Apple has been on a multi-year strategy to close off the kernel to third parties through SIP, kernel driver signing, etc, culminating in closing off the kernel driver loading API completely. It is possible to link any drivers into the kernel directly so it solves that issue.
On the latter, errr no. Linking isn't going to "solve" the problem. Apple is kicking some (most ) of their drivers out of the kernel also. Once the "back door" for kernel extensions is permanently closed, the evolved kernel is going to be different. Slapping some 'duck tape' around an extension and binding it t other kernel isn't necessarily going to get it initialized correctly. You can wave hands and say how going to jam the kernel extension loading back into a hacked kernel too in addition to linking. At that point really talking about a substantively forked version of macOS. Not really a "hackintosh" that is trying to run a clean macOS.
Kicking most of the stuff out of the kernel is similar to the transition between original Mac OS (up through 7-9 ) and macOS X (10) change from no process memory isolation/protection and protected (via virtual memory addressing) . (and with co-operative multi tasking where apps voluntary gave up control explicit at the "right time" ) . Drivers aren't technically being kicked up to userland. It is still a privileged mode that required signed/authorized approval. They are being moved to a space in between where only have a slice of the memory space that belongs to the device they are in charge of "driving". There isn't really a good reason with modern IOMMU that the USB driver needs direct access to the same I/O memory space as the GPU ( and vice versa).
Third party uses for the kernel can fall into various buckets like virtualization, third party cards, and the like. Virtualization drivers are solved by switching to ARM where no virtualization drivers will be supported.
Going to drivers that primarily depend upon IOMMU support is hardly "no virtualization drivers". Managed ( 'virtual' ) addressing is being applied here.
All hooks to support that will come via the HV FW.
The key here is not firmware (FW) , it is the hardware IOMMU support in the processor. Yes there is a layer that the kernel implements on top of that. The x86-64 Intel chips of Vt-d (IOMMU) support are kicking the kernel extensions out too. It isn't Apple Silicon specific. It is more a kernel designed in the 2010's era technology specific to what is common on processors in that era and into the future.
The basic concept of the technology has be common on 'big iron' for multiple decades. It has made its want down to pervasive at the "personal computer" level now.
Apple has also been doing this strategy for all manner of prior requirements to run a driver in the kernel. Kernel programming is a dying art. Even the net filter has user land hooks now.
Not so much a dying art as much as don't need to let in the untrained and inattentive to detail. Handing out the Unix root password to every user isn't necessary. Neither is stuffing lots of extra stuff into the kernel.
Third party cards will only be supported on the 'high end' systems like the ARM MacPro. I think this is where it's headed by different versions of the kernel of Mac OS for the ARM.
Probably not.
1. All Macs probably will come with an Apple GPU and apple defined minimal I/O ports. As far as getting a boot environment up and running with a display, Apple will have a complete set of stuff. So bootfirmare wise it will just run. ( that probably includes the Mac Pro also. Get a "good enough" to drive 4 Thunderbolt 4 ports (four 4K displays for 2D workloads. ) . A small expansion into minimalistic external booting for standard NVM-e drives and basically done.
[ There are some corner cases like SoftRAID who have managed to get minimal drivers stuffed into the early boot environment support. But it is unlikely they will be 'special cased' into Mac Pro firmware and not 'special cased' into the rest. Probably in or out across the whole line up. ]
2. Once at the process of loading drivers from the MacOS instance drive then Thunderbolt means there can be PCI-e slots hanging off of a non Mac Pro also. Why there would be a major difference in the driver loading process isn't well grounded.
It is the drivers for the cards that will be the major gating issue (not the Macs themselves). Apple is making everybody rewrite drivers. Some vendors won't. And even those that do some won't extend the support back to older products that don't have R&D funding attached to them anymore. That is going to be the major drop off.
Consumer will not support kernel driver loading at all but there will be limited support on the professional Macs not bought by the unwashed masses.
There is still going to be driver loading. It is just not into the completely unprotected kernel space.
This is where HW RoT comes in.
Err no. At least in the hackintosh space. At Hackintosh doesn't necessarily care about Root of Trust.
The kernel will be signed with keys that are fused into Apple Silicon so you can't load unsigned versions of the OS.
Apple signatures.... just ignore them and move on. That's the thing about Root of trust. The stuff on top of the trusted foundation doesn't particularly go back and validate the foundation but it is supposed to have been validated at that point before the layer on top ever got started. Once something else is underneath then don't really have a trusted root layer. The lower signature checks can all be skipped if stick something else in at the lower levels.
This is what Apple was alluding to in their WWDC presentation. The boot loader is immaterial as you can't fiddle with it now. In essence, there will be bootstrap code which is signed, that loads the boot loader which is signed, which loads the signed OS. Each phase of loading code is signed with the private key and hash verified by the fused public key in Apple Silicon.
You are talking there about a Mac. On a hackintosh there isn't no Apple secure enclave. The ability for a Window 10 standard hardware PC to run Windows 10 or Linux isn't a huge feat on that hard. Just boot with the UEFI process that is already there. Getting Windows to run on a piece of hardware isn't major part of being a Hackintoush; getting macOS to run is.
Correct in so far at some point the Hackintosh probably won't be able to run anything connected TouchID, FaceID , ApplePay , Siri ( or any highly optimized Apple AI/ML app that is 100% dependent upon Apple Neural cores being present) , etc. When Apple drops all non Apple Silicon support there is going to be a substantial amount of non ARM stuff present in every Mac which will have hooks into a substantive number of features.
And if the kernel does any kind of sanity check ( hey since secure enclave is required now and there is no secure enclave ... abort , not on a licensed system. ), then Hackintosh will need a hacked kernel bundle to get around that also. The signatures aren't going to be major issue. The missing-in-action hardware is. ( in part because Apple isn't going to sell that to anyone.)
I'd expect only a whitelist of vendors will be allowed to sign their drivers for higher end systems. Lowerend systems will no longer have the ability to load any type of driver after kernel is instantiated by the boot loader.
MacOS may be the boot loader long term. The Apple Silicon (AS) system will likely have an early boot stage with iBoot. The T2 systems do. In the T2 systems the iBoot hands off to UEFI. The AS iboot might hand off to the "System Recovery" volume in a boot support mode. It loads that ultra minimalistic macOS instance in handle external boot, volume selection, and the standard login screen stuff (filevault / regular ).
Just would need drivers that were bundled and didn't have major UEFI assumptions built into them. Again nothing about "high end" vs "low end" macs segmentation.
For developers who are trying to get their drivers qualified for inclusion in the "System Recovery" mode, all Apple would need is a way for those devs to attach a "data" volume to the system recovery volume for their driver. It would necessarily be a mode that Mac Pro could do and a MacBook Air couldn't. It is just a relatively small allocation of disk space.
The normal mode for kernel extension drivers now is to get them signed. That System extensions have to nominally signed isn't really "new". A secure boot parameter that says unsigned System Extensions would be loaded wouldn't really be all that "new". ( or need to be restricted to only a subset of macs. )