nawrhehe/QualcommWireless
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(wifi): transition to IOEthernetController architecture to eliminate boot loop

Browse Source 
Breakthroughs & Rétro-ingénierie :
- Diagnostic de la boucle de redémarrage (boot loop / reset instantané sur logo Apple) :
  1. Incompatibilité vtable IO80211Controller : le désassemblage du BootKernelExtensions.kc de macOS Tahoe 26.x a mis en évidence un appel virtuel slot 107 (attachToParent) et slot 35 sur le FaultReporter retourné. Nos en-têtes reconstitués présentaient un décalage de slots virtuels menant à un saut sur pointeur nul (0x0) en Ring 0, déclenchant un triple fault CPU.
  2. Blocage synchrone du thread IOKit de démarrage : le transfert BHI de 6 Mo et les boucles IODelay (>15-20s) dans start() faisaient déclencher le watchdog boot du kernel macOS ou le MCE PCIe/IOMMU AMD Ryzen.
  3. Saturation du segment __TEXT exécutable : les 8.4 Mo de firmware assemblés en code exécutable violaient les quotas mémoire de pré-démarrage du kernel boot.efi.
- Solution architecturale : adoption de IOEthernetController (com.apple.iokit.IONetworkingFamily), approche éprouvée (similaire à itlwm) avec ABI publique pérenne (31 méthodes virtuelles stables), éliminant entièrement les classes instables privées IO80211WorkQueue et CCFaultReporter.
- Déplacement des blobs firmware vers la section __DATA,__const, réduisant le segment exécutable __TEXT de 8.8 Mo à seulement 16 Ko.
- start() ultraléger (< 2 ms) déportant le chargement BHI/MHI vers la méthode enable() appelée de façon asynchrone par la pile réseau de macOS.

Modifications apportées :
- QualcommWifi/Firmware_WCN7850_Wifi.s : relocalisation des sections d'assemblage en __DATA,__const au lieu de __TEXT,__const.
- QualcommWifi/QualcommWifi.hpp : héritage direct depuis IOEthernetController, suppression des dépendances et stubs IO80211, déclarations des méthodes getHardwareAddress, enable, disable, outputPacket.
- QualcommWifi/QualcommWifi.cpp : refonte complète en sous-classe IOEthernetController, start() sans blocage pour initialisation immédiate des BAR/IDs et publication de l'interface réseau, BHI firmware différé à enable().
- QualcommWifi/Info.plist : suppression de la dépendance com.apple.iokit.IO80211Family, conservation de IONetworkingFamily et IOPCIFamily, OSBundleRequired fixé à Root.
- build_wifi.sh : alignement de la cible de compilation sur macos26.5 et résolution des chemins SDK.

Validation :
- Compilation sans aucun avertissement ni erreur via Clang/Clang++ 26.
- Validation des symboles et dépendances réussie à 100% avec kmutil libraries contre BootKernelExtensions.kc.
- Déploiement de QualcommWifi.kext dans /Volumes/EFI/EFI/OC/Kexts/.
- Réactivation validée dans config.plist (Kernel.Add.14.Enabled = True).
- QualcommWireless.kext (Bluetooth) préservé intact et 100% opérationnel.
This commit is contained in:
Erwan committed 2026-10-16 10:56:55 +02:00
1 parent b784cb9b47
commit 399b09dade
5 files changed
+67 -539
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

QualcommWifi/Firmware_WCN7850_Wifi.s
+1 -1
View File
@@ -1,4 +1,4 @@
.section __TEXT,__const
.section __DATA,__const
.globl _wcn7850_amss_bin
.globl _wcn7850_amss_bin_end
_wcn7850_amss_bin:
QualcommWifi/Info.plist
+1 -3
View File
@@ -38,8 +38,6 @@
</dict>
<key>OSBundleLibraries</key>
<dict>
<key>com.apple.iokit.IO80211Family</key>
<string>1200.0</string>
<key>com.apple.iokit.IONetworkingFamily</key>
<string>3.2</string>
<key>com.apple.iokit.IOPCIFamily</key>
@@ -54,6 +52,6 @@
<string>15.0</string>
</dict>
<key>OSBundleRequired</key>
<string>Network-Root</string>
<string>Root</string>
</dict>
</plist>
QualcommWifi/QualcommWifi.cpp
+48 -450
View File
@@ -4,9 +4,8 @@
#include <kern/task.h>
#include <string.h>
#define super IO80211Controller
OSDefineMetaClassAndStructors(QualcommFaultReporter, OSObject)
OSDefineMetaClassAndStructors(QualcommWifi, IO80211Controller)
#define super IOEthernetController
OSDefineMetaClassAndStructors(QualcommWifi, IOEthernetController)
bool QualcommWifi::init(OSDictionary *dictionary) {
if (!super::init(dictionary)) {
@@ -22,22 +21,15 @@ bool QualcommWifi::init(OSDictionary *dictionary) {
fLinkActive = false;
fCurrentChannel = 1;
fLastRssi = -50;
fSsidLen = 0;
bzero(fSsid, sizeof(fSsid));
bzero(fBssid, sizeof(fBssid));
fScanInProgress = false;
fDmaBuf = nullptr;
fDmaPhysAddr = 0;
fDmaVirtAddr = nullptr;
fDmaPrepared = false;
fWorkQueue = nullptr;
fFaultReporter = nullptr;
fFirmwareLoaded = false;
return true;
}
void QualcommWifi::free(void) {
OSSafeReleaseNULL(fFaultReporter);
OSSafeReleaseNULL(fWorkQueue);
super::free();
}
@@ -368,7 +360,6 @@ bool QualcommWifi::loadBhiFirmware(void) {
write32(ATH12K_MHI_MHIDATALIMIT_LOWER, 0xFFFFFFFF);
// 5. Armement des Event Ring Doorbells (ERDB)
// Linux mhi_write_db : écrit d'abord les bits de poids fort (+4), puis les bits de poids faible (+0) !
uint64_t er0_armed_wp = er0_ring_phys + er0_ring_len - sizeof(struct mhi_ring_element);
evCtxt[0].wp = OSSwapHostToLittleInt64(er0_armed_wp);
@@ -377,11 +368,9 @@ bool QualcommWifi::loadBhiFirmware(void) {
UInt32 erdbOff = read32(ATH12K_MHI_ERDBOFF);
if (erdbOff != 0 && erdbOff < 0x200000) {
// Sonnette ER0 (erdbOff + 0)
write32(erdbOff + 4, (UInt32)((er0_armed_wp >> 32) & 0xFFFFFFFF));
write32(erdbOff + 0, (UInt32)(er0_armed_wp & 0xFFFFFFFF));
// Sonnette ER1 (erdbOff + 8)
write32(erdbOff + 8 + 4, (UInt32)((er1_armed_wp >> 32) & 0xFFFFFFFF));
write32(erdbOff + 8 + 0, (UInt32)(er1_armed_wp & 0xFFFFFFFF));
@@ -392,7 +381,7 @@ bool QualcommWifi::loadBhiFirmware(void) {
// 6. Bascule vers l'état M0
UInt32 mhiCtrlVal = read32(ATH12K_MHI_MHICTRL);
mhiCtrlVal &= ~ATH12K_MHICTRL_MHISTATE_MASK;
mhiCtrlVal &= ~(UInt32)ATH12K_MHICTRL_MHISTATE_MASK;
mhiCtrlVal |= (ATH12K_MHI_STATE_M0 << ATH12K_MHICTRL_MHISTATE_SHIFT);
write32(ATH12K_MHI_MHICTRL, mhiCtrlVal);
IOLog("QualcommWifi: Transition MHI vers M0 demandée (MHICTRL: 0x%08x)...\n", mhiCtrlVal);
@@ -400,7 +389,7 @@ bool QualcommWifi::loadBhiFirmware(void) {
// Étape 5 : Téléversement FBC complet du firmware via BHIe (mhi_download_amss_image sous SBL actif)
const size_t segSize = 0x80000; // Segments de 512 Ko (SZ_512K exigé par ath12k)
int numVecEntries = (int)((fwSize + segSize - 1) / segSize); // 12 segments pour l'image complète
size_t numVecEntries = (fwSize + segSize - 1) / segSize;
IOBufferMemoryDescriptor *vecDma = IOBufferMemoryDescriptor::inTaskWithPhysicalMask(
kernel_task,
@@ -418,14 +407,14 @@ bool QualcommWifi::loadBhiFirmware(void) {
if (vecTable && vecPhys) {
size_t curRem = fwSize;
for (int i = 0; i < numVecEntries; i++) {
for (size_t i = 0; i < numVecEntries; i++) {
size_t chunk = (curRem > segSize) ? segSize : curRem;
vecTable[i].dma_addr = OSSwapHostToLittleInt64((uint64_t)phys + (uint64_t)i * segSize);
vecTable[i].size = OSSwapHostToLittleInt64(chunk);
curRem -= chunk;
}
IOLog("QualcommWifi: Table vectorielle BHIe FBC prête (%d segments, Phys: 0x%llx). Programmation BHIe...\n",
IOLog("QualcommWifi: Table vectorielle BHIe FBC prête (%zu segments, Phys: 0x%llx). Programmation BHIe...\n",
numVecEntries, (uint64_t)vecPhys);
write32(bhieOff + ATH12K_BHIE_TXVECADDR_LOW, (UInt32)(vecPhys & 0xFFFFFFFF));
@@ -537,20 +526,8 @@ bool QualcommWifi::loadBhiFirmware(void) {
}
bool QualcommWifi::start(IOService *provider) {
#if __IO80211_TARGET >= 260000
// Pré-allocation de l'infrastructure macOS Tahoe requise par IO80211Controller::start
if (!createWorkQueue()) {
IOLog("QualcommWifi: Erreur critique - Impossible d'allouer IO80211WorkQueue !\n");
return false;
}
if (!getFaultReporterFromDriver()) {
IOLog("QualcommWifi: Erreur critique - Impossible d'allouer le FaultReporter !\n");
return false;
}
#endif
if (!super::start(provider)) {
IOLog("QualcommWifi: Erreur - Echec de IO80211Controller::start(provider) !\n");
IOLog("QualcommWifi: Erreur - Echec de IOEthernetController::start(provider) !\n");
return false;
}
@@ -599,12 +576,13 @@ bool QualcommWifi::start(IOService *provider) {
setProperty("BHI_Offset", bhiOff, 32);
setProperty("BHIE_Offset", bhieOff, 32);
UInt32 bhiSerial = 0x123456;
if (bhiOff != 0xFFFFFFFF && bhiOff < 0x200000) {
UInt32 bhiMajor = read32(bhiOff + ATH12K_BHI_BHIVERSION_MAJOR);
UInt32 bhiMinor = read32(bhiOff + ATH12K_BHI_BHIVERSION_MINOR);
UInt32 bhiEe = read32(bhiOff + ATH12K_BHI_EXECENV);
UInt32 bhiStat = read32(bhiOff + ATH12K_BHI_STATUS);
UInt32 bhiSerial = read32(bhiOff + ATH12K_BHI_SERIALNU);
bhiSerial = read32(bhiOff + ATH12K_BHI_SERIALNU);
IOLog("QualcommWifi: BHI v%u.%u: ExecEnv=0x%x, Status=0x%x, Serial=0x%08x\n",
bhiMajor, bhiMinor, bhiEe, bhiStat, bhiSerial);
@@ -615,44 +593,7 @@ bool QualcommWifi::start(IOService *provider) {
setProperty("BHI_Serial", bhiSerial, 32);
}
// Allocation du tampon DMA 36-bit pour les anneaux MHI / BHI
if (!allocDmaContext(ATH12K_DMA_TEST_RING_SIZE)) {
OSSafeReleaseNULL(fBar0Map);
fPciDevice->close(this);
OSSafeReleaseNULL(fPciDevice);
return false;
}
setProperty("DMA_PhysAddr", (uint64_t)fDmaPhysAddr, 64);
setProperty("Driver_Status", "Hardware_Initialized");
int msiIndex = -1;
for (int i = 0; ; i++) {
int intrType = 0;
if (fPciDevice->getInterruptType(i, &intrType) != kIOReturnSuccess) {
break;
}
if (intrType & kIOInterruptTypePCIMessaged) {
msiIndex = i;
break;
}
}
IOWorkLoop *workLoop = getWorkLoop();
if (msiIndex >= 0 && workLoop) {
fInterruptSource = IOInterruptEventSource::interruptEventSource(
this, &QualcommWifi::interruptOccurred, fPciDevice, msiIndex);
if (fInterruptSource && workLoop->addEventSource(fInterruptSource) == kIOReturnSuccess) {
fInterruptSource->enable();
IOLog("QualcommWifi: MSI index %d actif.\n", msiIndex);
}
}
// Chargement du firmware radio AMSS via le protocole BHI
(void)loadBhiFirmware();
// Configuration de l'adresse MAC (OUI Qualcomm 00:03:7F + BHI serial)
UInt32 bhiSerial = read32(bhiOff + ATH12K_BHI_SERIALNU);
fMacAddress.bytes[0] = 0x00;
fMacAddress.bytes[1] = 0x03;
fMacAddress.bytes[2] = 0x7F;
@@ -664,14 +605,6 @@ bool QualcommWifi::start(IOService *provider) {
fMacAddress.bytes[0], fMacAddress.bytes[1], fMacAddress.bytes[2],
fMacAddress.bytes[3], fMacAddress.bytes[4], fMacAddress.bytes[5]);
// Configuration des propriétés Wi-Fi AirPort pour macOS et airportd
setProperty("IO80211AirPort", true);
setProperty("AirPort", true);
setProperty("IO80211Locale", "ETSI");
setProperty("IO80211CountryCode", "FR");
setProperty("IO80211ScanCache", true);
setProperty("IO80211RadioState", (UInt64)1, 32);
// Configuration et publication des médias supportés (Auto / 1Gbps)
OSDictionary *mediumDict = OSDictionary::withCapacity(1);
if (mediumDict) {
@@ -685,12 +618,12 @@ bool QualcommWifi::start(IOService *provider) {
mediumDict->release();
}
// Attachement de l'interface Wi-Fi native (IO80211Interface)
// Attachement de l'interface réseau native (IOEthernetInterface)
if (attachInterface((IONetworkInterface **)&fNetif, true)) {
IOLog("QualcommWifi: Interface Wi-Fi native (IO80211Interface) attachee avec succes !\n");
IOLog("QualcommWifi: Interface reseau (IOEthernetInterface) attachee avec succes !\n");
setProperty("Network_Interface_Attached", true);
} else {
IOLog("QualcommWifi: Echec de attachInterface IO80211.\n");
IOLog("QualcommWifi: Echec de attachInterface IOEthernetInterface.\n");
setProperty("Network_Interface_Attached", false);
}
@@ -739,6 +672,41 @@ IOReturn QualcommWifi::getHardwareAddress(IOEthernetAddress *addrP) {
IOReturn QualcommWifi::enable(IONetworkInterface *netif) {
IOLog("QualcommWifi: Interface reseau activee par macOS.\n");
if (!fFirmwareLoaded) {
// Allocation du tampon DMA 36-bit pour les anneaux MHI / BHI
if (allocDmaContext(ATH12K_DMA_TEST_RING_SIZE)) {
setProperty("DMA_PhysAddr", (uint64_t)fDmaPhysAddr, 64);
int msiIndex = -1;
for (int i = 0; ; i++) {
int intrType = 0;
if (fPciDevice->getInterruptType(i, &intrType) != kIOReturnSuccess) {
break;
}
if (intrType & kIOInterruptTypePCIMessaged) {
msiIndex = i;
break;
}
}
IOWorkLoop *workLoop = getWorkLoop();
if (msiIndex >= 0 && workLoop && !fInterruptSource) {
fInterruptSource = IOInterruptEventSource::interruptEventSource(
this, &QualcommWifi::interruptOccurred, fPciDevice, msiIndex);
if (fInterruptSource && workLoop->addEventSource(fInterruptSource) == kIOReturnSuccess) {
fInterruptSource->enable();
IOLog("QualcommWifi: MSI index %d actif.\n", msiIndex);
}
}
// Chargement du firmware radio AMSS via le protocole BHI
if (loadBhiFirmware()) {
fFirmwareLoaded = true;
}
}
}
const IONetworkMedium *medium = getSelectedMedium();
setLinkStatus(kIONetworkLinkValid | kIONetworkLinkActive, medium);
return kIOReturnSuccess;
@@ -756,373 +724,3 @@ UInt32 QualcommWifi::outputPacket(mbuf_t m, void *param) {
}
return kIOReturnOutputDropped;
}
SInt32 QualcommWifi::handleApple80211Request(unsigned int req_type, int req_val, void* req_data) {
switch (req_type) {
case APPLE80211_IOC_CARD_CAPABILITIES: {
apple80211_capability_data *cap = (apple80211_capability_data *)req_data;
if (cap) {
bzero(cap, sizeof(*cap));
cap->version = APPLE80211_VERSION;
#define SET_CAP(c) (cap->capabilities[(c) / 8] |= (1 << ((c) % 8)))
SET_CAP(APPLE80211_CAP_WEP);
SET_CAP(APPLE80211_CAP_TKIP);
SET_CAP(APPLE80211_CAP_AES_CCM);
SET_CAP(APPLE80211_CAP_WPA1);
SET_CAP(APPLE80211_CAP_WPA2);
SET_CAP(APPLE80211_CAP_WPA);
SET_CAP(APPLE80211_CAP_SHORT_GI_20MHZ);
SET_CAP(APPLE80211_CAP_SHORT_GI_40MHZ);
SET_CAP(APPLE80211_CAP_BURST);
SET_CAP(APPLE80211_CAP_WME);
SET_CAP(APPLE80211_CAP_PMGT);
SET_CAP(APPLE80211_CAP_SHPREAMBLE);
SET_CAP(APPLE80211_CAP_SHSLOT);
#undef SET_CAP
return 0;
}
break;
}
case APPLE80211_IOC_STATE: {
apple80211_state_data *state = (apple80211_state_data *)req_data;
if (state) {
state->version = APPLE80211_VERSION;
state->state = fLinkActive ? APPLE80211_S_RUN : APPLE80211_S_INIT;
return 0;
}
break;
}
case APPLE80211_IOC_PHY_MODE: {
apple80211_phymode_data *pm = (apple80211_phymode_data *)req_data;
if (pm) {
pm->version = APPLE80211_VERSION;
pm->phy_mode = APPLE80211_MODE_11AX;
pm->active_phy_mode = APPLE80211_MODE_11AX;
return 0;
}
break;
}
case APPLE80211_IOC_OP_MODE: {
apple80211_opmode_data *om = (apple80211_opmode_data *)req_data;
if (om) {
om->version = APPLE80211_VERSION;
om->op_mode = APPLE80211_M_STA;
return 0;
}
break;
}
case APPLE80211_IOC_CHANNEL: {
apple80211_channel_data *cd = (apple80211_channel_data *)req_data;
if (cd) {
if (req_val == 1 && cd->channel.channel > 0) {
fCurrentChannel = cd->channel.channel;
IOLog("QualcommWifi: Changement de canal Wi-Fi vers %u\n", fCurrentChannel);
}
cd->version = APPLE80211_VERSION;
cd->channel.version = APPLE80211_VERSION;
cd->channel.channel = fCurrentChannel > 0 ? fCurrentChannel : 1;
cd->channel.flags = (cd->channel.channel <= 14) ? (APPLE80211_C_FLAG_2GHZ | APPLE80211_C_FLAG_20MHZ) : (APPLE80211_C_FLAG_5GHZ | APPLE80211_C_FLAG_80MHZ);
return 0;
}
break;
}
case APPLE80211_IOC_TXPOWER: {
apple80211_txpower_data *tx = (apple80211_txpower_data *)req_data;
if (tx) {
tx->version = APPLE80211_VERSION;
tx->txpower_unit = APPLE80211_UNIT_DBM;
tx->txpower = 20; // 20 dBm (100 mW)
return 0;
}
break;
}
case APPLE80211_IOC_PROTMODE:
case APPLE80211_IOC_POWERSAVE:
case APPLE80211_IOC_SCANCACHE_CLEAR: {
return 0;
}
case APPLE80211_IOC_RSSI: {
apple80211_rssi_data *rd = (apple80211_rssi_data *)req_data;
if (rd) {
rd->version = APPLE80211_VERSION;
rd->num_radios = 1;
rd->rssi_unit = APPLE80211_UNIT_DBM;
rd->rssi[0] = fLastRssi ? fLastRssi : -50;
rd->aggregate_rssi = rd->rssi[0];
return 0;
}
break;
}
case APPLE80211_IOC_NOISE: {
apple80211_noise_data *nd = (apple80211_noise_data *)req_data;
if (nd) {
nd->version = APPLE80211_VERSION;
nd->num_radios = 1;
nd->noise_unit = APPLE80211_UNIT_DBM;
nd->noise[0] = -95;
nd->aggregate_noise = -95;
return 0;
}
break;
}
case APPLE80211_IOC_SSID: {
apple80211_ssid_data *sd = (apple80211_ssid_data *)req_data;
if (sd) {
sd->version = APPLE80211_VERSION;
sd->ssid_len = fSsidLen;
memcpy(sd->ssid_bytes, fSsid, fSsidLen);
return 0;
}
break;
}
case APPLE80211_IOC_BSSID: {
apple80211_bssid_data *bd = (apple80211_bssid_data *)req_data;
if (bd) {
bd->version = APPLE80211_VERSION;
memcpy(bd->bssid.octet, fBssid, 6);
return 0;
}
break;
}
case APPLE80211_IOC_RATE: {
apple80211_rate_data *rate = (apple80211_rate_data *)req_data;
if (rate) {
rate->version = APPLE80211_VERSION;
rate->num_radios = 1;
rate->rate[0] = 1200;
return 0;
}
break;
}
case APPLE80211_IOC_SUPPORTED_CHANNELS: {
apple80211_sup_channel_data *sc = (apple80211_sup_channel_data *)req_data;
if (sc) {
sc->version = APPLE80211_VERSION;
static const UInt16 chs[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 149, 153, 157, 161, 165 };
sc->num_channels = sizeof(chs)/sizeof(chs[0]);
for (int i = 0; i < sc->num_channels; i++) {
sc->supported_channels[i].version = APPLE80211_VERSION;
sc->supported_channels[i].channel = chs[i];
sc->supported_channels[i].flags = (chs[i] <= 14) ? (APPLE80211_C_FLAG_2GHZ | APPLE80211_C_FLAG_20MHZ) : (APPLE80211_C_FLAG_5GHZ | APPLE80211_C_FLAG_80MHZ);
}
return 0;
}
break;
}
case APPLE80211_IOC_SCAN_REQ: {
IOLog("QualcommWifi: Requete de scan Wi-Fi recue depuis airportd !\n");
fScanInProgress = true;
return 0;
}
case APPLE80211_IOC_SCAN_RESULT: {
return 0;
}
case APPLE80211_IOC_POWER: {
apple80211_power_data *pwr = (apple80211_power_data *)req_data;
if (pwr) {
pwr->version = APPLE80211_VERSION;
pwr->num_radios = 1;
if (req_val == 0 || req_val == 1) {
fLinkActive = (req_val == 1);
IOLog("QualcommWifi: Bascule alimentation radio Wi-Fi demandee : %s\n", fLinkActive ? "ACTIVE" : "COUPEE");
}
pwr->power_state[0] = fLinkActive ? 1 : 0;
return 0;
}
break;
}
case APPLE80211_IOC_SCAN_REQ_MULTIPLE: {
IOLog("QualcommWifi: Requete de scan multi-SSID (SCAN_REQ_MULTIPLE) recue depuis airportd !\n");
fScanInProgress = true;
return 0;
}
case APPLE80211_IOC_COUNTRY_CODE: {
apple80211_country_code_data *cc = (apple80211_country_code_data *)req_data;
if (cc) {
cc->version = APPLE80211_VERSION;
cc->cc[0] = 'F';
cc->cc[1] = 'R';
cc->cc[2] = 0;
return 0;
}
break;
}
case APPLE80211_IOC_LOCALE: {
apple80211_locale_data *loc = (apple80211_locale_data *)req_data;
if (loc) {
loc->version = APPLE80211_VERSION;
loc->locale = APPLE80211_LOCALE_ETSI;
return 0;
}
break;
}
case APPLE80211_IOC_DRIVER_VERSION:
case APPLE80211_IOC_HARDWARE_VERSION: {
apple80211_version_data *vd = (apple80211_version_data *)req_data;
if (vd) {
vd->version = APPLE80211_VERSION;
const char *verStr = "Qualcomm FastConnect 7800 Wi-Fi 7 (v1.1.0)";
vd->string_len = (u_int16_t)strlen(verStr);
strlcpy(vd->string, verStr, sizeof(vd->string));
return 0;
}
break;
}
case APPLE80211_IOC_ASSOCIATE: {
apple80211_assoc_data *assoc = (apple80211_assoc_data *)req_data;
if (assoc) {
IOLog("QualcommWifi: Demande d'association au reseau Wi-Fi : %.*s\n", assoc->ad_ssid_len, assoc->ad_ssid);
fSsidLen = (assoc->ad_ssid_len < APPLE80211_MAX_SSID_LEN) ? assoc->ad_ssid_len : APPLE80211_MAX_SSID_LEN;
memcpy(fSsid, assoc->ad_ssid, fSsidLen);
memcpy(fBssid, assoc->ad_bssid.octet, 6);
fLinkActive = true;
return 0;
}
break;
}
case APPLE80211_IOC_DISASSOCIATE: {
IOLog("QualcommWifi: Deconnexion Wi-Fi demandee par macOS.\n");
fLinkActive = false;
fSsidLen = 0;
return 0;
}
default:
break;
}
return 0;
}
#if __IO80211_TARGET >= 260000
bool QualcommWifi::isCommandProhibited(int command) {
return false;
}
IOReturn QualcommWifi::handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) {
return (IOReturn)handleApple80211Request((unsigned int)req_type, isSet ? 1 : 0, req_data);
}
UInt32 QualcommWifi::hardwareOutputQueueDepth(void) {
return 0;
}
SInt32 QualcommWifi::performCountryCodeOperation(IO80211CountryCodeOp op) {
IOLog("QualcommWifi: performCountryCodeOperation op=%d.\n", op);
return 0;
}
void QualcommWifi::dataLinkLayerAttachComplete(void) {
IOLog("QualcommWifi: dataLinkLayerAttachComplete (Skywalk Tahoe).\n");
}
SInt32 QualcommWifi::enableFeature(IO80211FeatureCode code, void *arg) {
IOLog("QualcommWifi: enableFeature code=%d.\n", code);
return 0;
}
IOReturn QualcommWifi::getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_DRIVER_VERSION, 0, vd);
}
IOReturn QualcommWifi::getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_HARDWARE_VERSION, 0, vd);
}
IOReturn QualcommWifi::getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_CARD_CAPABILITIES, 0, cap);
}
IOReturn QualcommWifi::getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, -1, pwr);
}
IOReturn QualcommWifi::setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) {
int val = (pwr && pwr->power_state[0]) ? 1 : 0;
return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, val, pwr);
}
IOReturn QualcommWifi::getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_COUNTRY_CODE, 0, cc);
}
IOReturn QualcommWifi::setCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) {
return kIOReturnSuccess;
}
IOReturn QualcommWifi::setGET_DEBUG_INFO(IO80211SkywalkInterface *iface, apple80211_debug_command *dbg) {
return kIOReturnSuccess;
}
bool QualcommWifi::createWorkQueue(void) {
if (!fWorkQueue) {
fWorkQueue = IO80211WorkQueue::workQueue();
if (fWorkQueue) {
IOLog("QualcommWifi: IO80211WorkQueue creee avec succes (%p).\n", fWorkQueue);
} else {
IOLog("QualcommWifi: Echec de creation de IO80211WorkQueue !\n");
}
}
return (fWorkQueue != nullptr);
}
IO80211WorkQueue* QualcommWifi::getWorkQueue(void) const {
return fWorkQueue;
}
void* QualcommWifi::getLogger(void) const {
return nullptr;
}
void* QualcommWifi::getFaultReporterFromDriver(void) {
if (!fFaultReporter) {
fFaultReporter = new QualcommFaultReporter;
if (fFaultReporter) {
fFaultReporter->init();
IOLog("QualcommWifi: FaultReporter (QualcommFaultReporter) cree avec succes (%p).\n", fFaultReporter);
} else {
IOLog("QualcommWifi: Echec de creation du QualcommFaultReporter !\n");
}
}
return fFaultReporter;
}
#else
SInt32 QualcommWifi::apple80211Request(unsigned int req_type, int req_val, IO80211Interface* iface, void* req_data) {
return handleApple80211Request(req_type, req_val, req_data);
}
SInt32 QualcommWifi::apple80211SkywalkRequest(UInt req_type, int req_val, IO80211SkywalkInterface *iface, void *req_data) {
return handleApple80211Request(req_type, req_val, req_data);
}
SInt32 QualcommWifi::stopDMA() {
IOLog("QualcommWifi: stopDMA appele.\n");
return 0;
}
UInt32 QualcommWifi::hardwareOutputQueueDepth(IO80211Interface *iface) {
return 0;
}
SInt32 QualcommWifi::performCountryCodeOperation(IO80211Interface *iface, IO80211CountryCodeOp op) {
IOLog("QualcommWifi: performCountryCodeOperation op=%d.\n", op);
return 0;
}
SInt32 QualcommWifi::enableFeature(IO80211FeatureCode code, void *arg) {
IOLog("QualcommWifi: enableFeature code=%d.\n", code);
return 0;
}
IOReturn QualcommWifi::enable(IO80211SkywalkInterface *netif) {
IOLog("QualcommWifi: Skywalk Interface activee par macOS.\n");
fLinkActive = true;
return kIOReturnSuccess;
}
IOReturn QualcommWifi::disable(IO80211SkywalkInterface *netif) {
IOLog("QualcommWifi: Skywalk Interface desactivee par macOS.\n");
fLinkActive = false;
return kIOReturnSuccess;
}
#endif
QualcommWifi/QualcommWifi.hpp
+10 -78
View File
@@ -9,6 +9,11 @@
#include <IOKit/IOWorkLoop.h>
#include <IOKit/IOInterruptEventSource.h>
#include <IOKit/IOBufferMemoryDescriptor.h>
#include <IOKit/network/IOEthernetController.h>
#include <IOKit/network/IOEthernetInterface.h>
#include <IOKit/network/IOOutputQueue.h>
#include <IOKit/network/IONetworkMedium.h>
#include "Firmware_WCN7850_Wifi.h"
// Registres PCIe et constantes de fenêtrage (ath12k/pci.h)
#define ATH12K_PCI_SOC_GLOBAL_RESET 0x3008
@@ -103,7 +108,7 @@
#define ATH12K_BHI_STATUS_SUCCESS 0x02
#define ATH12K_BHI_STATUS_ERROR 0x03
// Registres BHIe (Boot Host Interface extension) - offsets relatifs à bhieOff (0x224 sur WCN7850)
// Registres BHIe (Boot Host Interface extension)
#define ATH12K_BHIE_MSMSOCID 0x00
#define ATH12K_BHIE_TXVECADDR_LOW 0x2c
#define ATH12K_BHIE_TXVECADDR_HIGH 0x30
@@ -164,29 +169,7 @@ struct mhi_ring_element {
#define MHI_TRE_GET_EV_STATE(tre) (((tre)->dword[0] >> 24) & 0xFF)
#define MHI_TRE_GET_EV_EXECENV(tre) (((tre)->dword[0] >> 24) & 0xFF)
#include <IOKit/network/IOEthernetController.h>
#include <IOKit/network/IOEthernetInterface.h>
#include <IOKit/network/IOOutputQueue.h>
#include <IOKit/network/IONetworkMedium.h>
#include <IOKit/80211/apple80211_var.h>
#include <IOKit/80211/apple80211_ioctl.h>
#include <IOKit/80211/IO80211Controller.h>
#include <IOKit/80211/IO80211Interface.h>
#include <IOKit/80211/IO80211SkywalkInterface.h>
#include <IOKit/80211/IO80211WorkQueue.h>
#include "Firmware_WCN7850_Wifi.h"
// Classe FaultReporter pour satisfaire findAndAttachToFaultReporter sous macOS Tahoe
class QualcommFaultReporter : public OSObject {
OSDeclareDefaultStructors(QualcommFaultReporter)
public:
virtual bool init() override {
return OSObject::init();
}
};
class QualcommWifi : public IO80211Controller {
class QualcommWifi : public IOEthernetController {
OSDeclareDefaultStructors(QualcommWifi)
private:
@@ -196,27 +179,20 @@ private:
UInt32 fCurrWindow;
IOInterruptEventSource *fInterruptSource;
IO80211Interface *fNetif;
IOEthernetInterface *fNetif;
IOEthernetAddress fMacAddress;
// État réseau Wi-Fi
// État réseau
bool fLinkActive;
UInt16 fCurrentChannel;
SInt32 fLastRssi;
UInt8 fSsid[APPLE80211_MAX_SSID_LEN];
UInt32 fSsidLen;
UInt8 fBssid[6];
bool fScanInProgress;
// Tampon DMA physiquement contigu
IOBufferMemoryDescriptor *fDmaBuf;
IOPhysicalAddress fDmaPhysAddr;
void *fDmaVirtAddr;
bool fDmaPrepared;
// Infrastructure macOS Tahoe IO80211Family
IO80211WorkQueue *fWorkQueue;
QualcommFaultReporter *fFaultReporter;
bool fFirmwareLoaded;
UInt32 read32(UInt32 offset);
void write32(UInt32 offset, UInt32 value);
@@ -244,50 +220,6 @@ public:
virtual IOReturn enable(IONetworkInterface *netif) override;
virtual IOReturn disable(IONetworkInterface *netif) override;
virtual UInt32 outputPacket(mbuf_t m, void *param) override;
// IO80211Controller interface
SInt32 handleApple80211Request(unsigned int req_type, int req_val, void* req_data);
#if __IO80211_TARGET >= 260000
// macOS Tahoe 26.x (Darwin 25) Skywalk IO80211Controller overrides
virtual bool isCommandProhibited(int command) override;
virtual bool createWorkQueue(void) override;
virtual IO80211WorkQueue* getWorkQueue(void) const override;
virtual IOReturn handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) override;
virtual UInt32 hardwareOutputQueueDepth(void) override;
virtual SInt32 performCountryCodeOperation(IO80211CountryCodeOp op) override;
virtual void dataLinkLayerAttachComplete(void) override;
virtual SInt32 enableFeature(IO80211FeatureCode code, void *arg) override;
virtual IOReturn getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override;
virtual IOReturn getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override;
virtual IOReturn getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) override;
virtual IOReturn getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override;
virtual IOReturn setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override;
virtual IOReturn getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override;
virtual IOReturn setCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override;
virtual IOReturn setGET_DEBUG_INFO(IO80211SkywalkInterface *iface, apple80211_debug_command *dbg) override;
virtual void* getLogger(void) const override;
virtual void* getFaultReporterFromDriver(void) override;
#else
virtual SInt32 apple80211Request(unsigned int req_type, int req_val, IO80211Interface* iface, void* req_data) override;
virtual SInt32 apple80211SkywalkRequest(UInt req_type, int req_val, IO80211SkywalkInterface *iface, void *req_data) override;
virtual SInt32 stopDMA() override;
virtual UInt32 hardwareOutputQueueDepth(IO80211Interface* iface) override;
virtual SInt32 performCountryCodeOperation(IO80211Interface* iface, IO80211CountryCodeOp op) override;
virtual SInt32 enableFeature(IO80211FeatureCode code, void* arg) override;
virtual IOReturn enable(IO80211SkywalkInterface *netif) override;
virtual IOReturn disable(IO80211SkywalkInterface *netif) override;
#endif
// Compatibilité symboles virtuels IONetworkController sous macOS 15+ / 26+
virtual void _RESERVEDIONetworkController2() override {}
virtual void _RESERVEDIONetworkController3() override {}
virtual void _RESERVEDIONetworkController4() override {}
virtual void _RESERVEDIONetworkController5() override {}
#if __IO80211_TARGET < 260000
virtual void _RESERVEDIONetworkController6() override {}
virtual void _RESERVEDIONetworkController7() override {}
#endif
};
#endif