nawrhehe/QualcommWireless
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(tahoe): port QualcommWireless & QualcommWifi to macOS Tahoe 26.x (Darwin 25)

Browse Source 
Breakthroughs & Reverse Engineering (macOS Tahoe 26.7.1 / Darwin 25.6.0):
- Reconstructed the complete 463-slot Skywalk vtable and class layout (0x128 / 296 bytes) of IO80211Controller (__ZTV17IO80211Controller at 0xffffff8002461148) and AppleBCMWLANCore from BootKernelExtensions.kc (IO80211Family 1200.13.1, source 1566.5).
- Verified IOUSBHostDevice::deviceRequest vtable slot in Tahoe's BootKernelExtensions.kc (__ZTV15IOUSBHostDevice at 0xffffff8002e72720): confirmed exact match at slot 374 (0x176, byte offset 0xbb0).
- Disassembled Tahoe's /usr/sbin/bluetoothd (FindTransportType at 0x10014c700, Found_USB_Dongle at 0x1000e9559, GetProductAndVendorID at 0x1000edf2a) confirming USB transport matching on 'Bluetooth USB Host Controller' and CSR 0x0a12 descriptor spoofing.

Code & Build Modifications (v1.1.0):
- IO80211Controller.h: Add full 463-slot Tahoe Skywalk vtable declaration (slots 394..462, offsets 0xc50..0xe70) and exact 0x80 filler size when __IO80211_TARGET >= 260000 while preserving legacy compatibility.
- QualcommWifi.hpp/.cpp: Implement Tahoe IO80211Controller pure virtual methods (isCommandProhibited, handleCardSpecific, getDRIVER_VERSION, getHARDWARE_VERSION, getCARD_CAPABILITIES, getPOWER, setPOWER, getCOUNTRY_CODE, setCOUNTRY_CODE, setGET_DEBUG_INFO, getLogger, getFaultReporterFromDriver) and guard un-reserved IONetworkController slots 6..7 on SDK 26.5.
- QualcommWireless.cpp: Add non-null vtable slot sanity check prior to installing the shadow vtable hook on IOUSBHostDevice::deviceRequest.
- project.pbxproj & Info.plist: Upgrade to Xcode 26.6 (MacOSX26.5.sdk), MACOSX_DEPLOYMENT_TARGET = 26.0, __IO80211_TARGET = 260000, and bump version to 1.1.0.
- docs & README: Document macOS Tahoe (Darwin 25) architecture, bluetoothd offsets, and Skywalk IO80211Controller ABI.
This commit is contained in:
Erwan committed 2026-10-16 02:41:25 +02:00
1 parent 820154e54b
commit a10e097a7e
11 files changed
+262 -135
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

QualcommWifi/QualcommWifi.cpp
+79 -4
View File
@@ -739,7 +739,7 @@ UInt32 QualcommWifi::outputPacket(mbuf_t m, void *param) {
return kIOReturnOutputDropped;
}
SInt32 QualcommWifi::apple80211Request(unsigned int req_type, int req_val, IO80211Interface* iface, void* req_data) {
SInt32 QualcommWifi::handleApple80211Request(unsigned int req_type, int req_val, void* req_data) {
switch (req_type) {
case APPLE80211_IOC_CARD_CAPABILITIES: {
apple80211_capability_data *cap = (apple80211_capability_data *)req_data;
@@ -939,11 +939,12 @@ SInt32 QualcommWifi::apple80211Request(unsigned int req_type, int req_val, IO802
}
break;
}
case APPLE80211_IOC_DRIVER_VERSION: {
case APPLE80211_IOC_DRIVER_VERSION:
case APPLE80211_IOC_HARDWARE_VERSION: {
apple80211_version_data *vd = (apple80211_version_data *)req_data;
if (vd) {
vd->version = APPLE80211_VERSION;
const char *verStr = "Qualcomm FastConnect 7800 Wi-Fi 7 (v1.0.2)";
const char *verStr = "Qualcomm FastConnect 7800 Wi-Fi 7 (v1.1.0)";
vd->string_len = (u_int16_t)strlen(verStr);
strlcpy(vd->string, verStr, sizeof(vd->string));
return 0;
@@ -974,8 +975,80 @@ SInt32 QualcommWifi::apple80211Request(unsigned int req_type, int req_val, IO802
return 0;
}
#if __IO80211_TARGET >= 260000
bool QualcommWifi::isCommandProhibited(int command) {
return false;
}
IOReturn QualcommWifi::handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) {
return (IOReturn)handleApple80211Request((unsigned int)req_type, isSet ? 1 : 0, req_data);
}
UInt32 QualcommWifi::hardwareOutputQueueDepth(void) {
return 0;
}
SInt32 QualcommWifi::performCountryCodeOperation(IO80211CountryCodeOp op) {
IOLog("QualcommWifi: performCountryCodeOperation op=%d.\n", op);
return 0;
}
void QualcommWifi::dataLinkLayerAttachComplete(void) {
IOLog("QualcommWifi: dataLinkLayerAttachComplete (Skywalk Tahoe).\n");
}
SInt32 QualcommWifi::enableFeature(IO80211FeatureCode code, void *arg) {
IOLog("QualcommWifi: enableFeature code=%d.\n", code);
return 0;
}
IOReturn QualcommWifi::getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_DRIVER_VERSION, 0, vd);
}
IOReturn QualcommWifi::getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_HARDWARE_VERSION, 0, vd);
}
IOReturn QualcommWifi::getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_CARD_CAPABILITIES, 0, cap);
}
IOReturn QualcommWifi::getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, -1, pwr);
}
IOReturn QualcommWifi::setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) {
int val = (pwr && pwr->power_state[0]) ? 1 : 0;
return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, val, pwr);
}
IOReturn QualcommWifi::getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_COUNTRY_CODE, 0, cc);
}
IOReturn QualcommWifi::setCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) {
return kIOReturnSuccess;
}
IOReturn QualcommWifi::setGET_DEBUG_INFO(IO80211SkywalkInterface *iface, apple80211_debug_command *dbg) {
return kIOReturnSuccess;
}
void* QualcommWifi::getLogger(void) const {
return nullptr;
}
void* QualcommWifi::getFaultReporterFromDriver(void) {
return nullptr;
}
#else
SInt32 QualcommWifi::apple80211Request(unsigned int req_type, int req_val, IO80211Interface* iface, void* req_data) {
return handleApple80211Request(req_type, req_val, req_data);
}
SInt32 QualcommWifi::apple80211SkywalkRequest(UInt req_type, int req_val, IO80211SkywalkInterface *iface, void *req_data) {
return apple80211Request(req_type, req_val, nullptr, req_data);
return handleApple80211Request(req_type, req_val, req_data);
}
SInt32 QualcommWifi::stopDMA() {
@@ -1008,3 +1081,5 @@ IOReturn QualcommWifi::disable(IO80211SkywalkInterface *netif) {
fLinkActive = false;
return kIOReturnSuccess;
}
#endif
QualcommWifi/QualcommWifi.hpp
+25 -3
View File
@@ -232,24 +232,46 @@ public:
virtual UInt32 outputPacket(mbuf_t m, void *param) override;
// IO80211Controller interface
SInt32 handleApple80211Request(unsigned int req_type, int req_val, void* req_data);
#if __IO80211_TARGET >= 260000
// macOS Tahoe 26.x (Darwin 25) Skywalk IO80211Controller overrides
virtual bool isCommandProhibited(int command) override;
virtual IOReturn handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) override;
virtual UInt32 hardwareOutputQueueDepth(void) override;
virtual SInt32 performCountryCodeOperation(IO80211CountryCodeOp op) override;
virtual void dataLinkLayerAttachComplete(void) override;
virtual SInt32 enableFeature(IO80211FeatureCode code, void *arg) override;
virtual IOReturn getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override;
virtual IOReturn getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override;
virtual IOReturn getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) override;
virtual IOReturn getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override;
virtual IOReturn setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override;
virtual IOReturn getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override;
virtual IOReturn setCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override;
virtual IOReturn setGET_DEBUG_INFO(IO80211SkywalkInterface *iface, apple80211_debug_command *dbg) override;
virtual void* getLogger(void) const override;
virtual void* getFaultReporterFromDriver(void) override;
#else
virtual SInt32 apple80211Request(unsigned int req_type, int req_val, IO80211Interface* iface, void* req_data) override;
virtual SInt32 apple80211SkywalkRequest(UInt req_type, int req_val, IO80211SkywalkInterface *iface, void *req_data) override;
virtual SInt32 stopDMA() override;
virtual UInt32 hardwareOutputQueueDepth(IO80211Interface* iface) override;
virtual SInt32 performCountryCodeOperation(IO80211Interface* iface, IO80211CountryCodeOp op) override;
virtual SInt32 enableFeature(IO80211FeatureCode code, void* arg) override;
// Skywalk interface
virtual IOReturn enable(IO80211SkywalkInterface *netif) override;
virtual IOReturn disable(IO80211SkywalkInterface *netif) override;
#endif
// Compatibilité symboles virtuels IONetworkController sous macOS 15
// Compatibilité symboles virtuels IONetworkController sous macOS 15+ / 26+
virtual void _RESERVEDIONetworkController2() override {}
virtual void _RESERVEDIONetworkController3() override {}
virtual void _RESERVEDIONetworkController4() override {}
virtual void _RESERVEDIONetworkController5() override {}
#if __IO80211_TARGET < 260000
virtual void _RESERVEDIONetworkController6() override {}
virtual void _RESERVEDIONetworkController7() override {}
#endif
};
#endif