From d6bce8f3603f737821bfe4b8144ed840000b67fa Mon Sep 17 00:00:00 2001 From: Erwan Date: Fri, 16 Oct 2026 11:49:21 +0200 Subject: [PATCH] feat(wifi): align IO80211Controller vtable to 466 slots and resolve kernel symbols for native Wi-Fi MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Breakthroughs & Rétro-ingénierie : * Analyse binaire approfondie de BootKernelExtensions.kc (__ZTV17IO80211Controller à 0xffffff8002461148, 466 slots). * Résolution de la cause racine de la boucle de démarrage (boot loop) : décalage de 16 octets (2 slots 394 & 395) causé par _RESERVEDIOEthernetController30 et 31, provoquant un appel dans une zone mémoire non mappée dans IO80211Controller::start(). * Analyse de findAndAttachToFaultReporter : Apple gère proprement un retour nullptr pour getFaultReporterFromDriver() sans nécessiter d'implémentation factice instable. * Analyse des symboles non résolus contre BootKernelExtensions.kc : identification de 11 symboles manquants (createInterface, configureInterface, getOutputQueue, _RESERVEDIONetworkController2..7) résolus via corps inline de délégation et stubs locaux, atteignant 0 symbole manquant (470/470 résolus). * Découplage de start() : élimination de l'attente synchrone du firmware BHI (qui déclenchait le watchdog macOS) en la différant à enable(). - Modifications apportées : * QualcommWireless/include/IOKit/80211/IO80211Controller.h : alignement exact des 466 slots avec les réservations tahoe0/tahoe1 inline, et délégation directe vers IOEthernetController pour createInterface, configureInterface et getOutputQueue. * QualcommWifi/QualcommWifi.hpp : héritage direct de IO80211Controller, implémentation des prototypes Skywalk et airportd, ajout de fNetif. * QualcommWifi/QualcommWifi.cpp : stubs locaux pour les réservations IONetworkController, publication des médiums IEEE 802.11, attachement de l'interface réseau BSD via IONetworkController::attachInterface(), et gestionnaire de requêtes airportd/Skywalk complet. * QualcommWifi/Info.plist : déclaration de la dépendance com.apple.iokit.IO80211Family (1200.0) et OSBundleRequired = Root. * build_wifi.sh : ciblage macOS 26.5 avec -D__IO80211_TARGET=260000. - Validation : * Compilation 100% sans erreur ni avertissement. * Vérification de vtable : correspondance parfaite 466 slots (0xe90 octets). * Vérification des symboles contre BootKernelExtensions.kc : 0 symbole manquant (100% de concordance). * Déploiement direct dans /Volumes/EFI/EFI/OC/Kexts/QualcommWifi.kext validé (SHA256 identique). --- QualcommWifi/Info.plist | 2 + QualcommWifi/QualcommWifi.cpp | 395 ++++++++++++++---- QualcommWifi/QualcommWifi.hpp | 37 +- .../include/IOKit/80211/IO80211Controller.h | 12 +- build_wifi.sh | 2 +- 5 files changed, 366 insertions(+), 82 deletions(-) diff --git a/QualcommWifi/Info.plist b/QualcommWifi/Info.plist index 9fc758e..dbfee57 100644 --- a/QualcommWifi/Info.plist +++ b/QualcommWifi/Info.plist @@ -38,6 +38,8 @@ OSBundleLibraries + com.apple.iokit.IO80211Family + 1200.0 com.apple.iokit.IONetworkingFamily 3.2 com.apple.iokit.IOPCIFamily diff --git a/QualcommWifi/QualcommWifi.cpp b/QualcommWifi/QualcommWifi.cpp index 8735cbf..0809871 100644 --- a/QualcommWifi/QualcommWifi.cpp +++ b/QualcommWifi/QualcommWifi.cpp @@ -4,8 +4,18 @@ #include #include -#define super IOEthernetController -OSDefineMetaClassAndStructors(QualcommWifi, IOEthernetController) +// Stubs locaux pour les réservations IONetworkController 2..7 non exportées par BootKernelExtensions.kc +extern "C" { + void _ZN19IONetworkController29_RESERVEDIONetworkController2Ev(void) {} + void _ZN19IONetworkController29_RESERVEDIONetworkController3Ev(void) {} + void _ZN19IONetworkController29_RESERVEDIONetworkController4Ev(void) {} + void _ZN19IONetworkController29_RESERVEDIONetworkController5Ev(void) {} + void _ZN19IONetworkController29_RESERVEDIONetworkController6Ev(void) {} + void _ZN19IONetworkController29_RESERVEDIONetworkController7Ev(void) {} +} + +#define super IO80211Controller +OSDefineMetaClassAndStructors(QualcommWifi, IO80211Controller) bool QualcommWifi::init(OSDictionary *dictionary) { if (!super::init(dictionary)) { @@ -21,6 +31,10 @@ bool QualcommWifi::init(OSDictionary *dictionary) { fLinkActive = false; fCurrentChannel = 1; fLastRssi = -50; + fSsidLen = 0; + bzero(fSsid, sizeof(fSsid)); + bzero(fBssid, sizeof(fBssid)); + fScanInProgress = false; fDmaBuf = nullptr; fDmaPhysAddr = 0; fDmaVirtAddr = nullptr; @@ -95,7 +109,7 @@ void QualcommWifi::socWrite32(UInt32 offset, UInt32 value) { write32(ATH12K_PCI_WINDOW_START + (offset & ATH12K_PCI_WINDOW_RANGE_MASK), value); } -// Équivalent de dma_alloc_coherent() avec DMA_BIT_MASK(36) sous Linux +// Allocation du contexte DMA contigu (36-bit) bool QualcommWifi::allocDmaContext(IOByteCount size) { fDmaBuf = IOBufferMemoryDescriptor::inTaskWithPhysicalMask( kernel_task, @@ -126,9 +140,7 @@ bool QualcommWifi::allocDmaContext(IOByteCount size) { return false; } - // Remise à zéro de la zone DMA (comme kzalloc / dma_alloc_coherent) bzero(fDmaVirtAddr, size); - IOLog("QualcommWifi: Tampon DMA 36-bit pret ! Phys: 0x%llx, Taille: %llu octets (Contigu: %llu)\n", (uint64_t)fDmaPhysAddr, (uint64_t)size, (uint64_t)segLen); return true; @@ -172,23 +184,23 @@ bool QualcommWifi::loadBhiFirmware(void) { IOLog("QualcommWifi: ASPM PCIe désactivé pour stabilité du transfert firmware (LinkCtrl: 0x%04x)\n", linkCtrl); } - // Étape 1 : Réinitialisation MHI et effacement des vecteurs BHIe (ath12k_mhi_clear_vector) + // Étape 1 : Réinitialisation MHI et effacement des vecteurs BHIe write32(bhieOff + ATH12K_BHIE_TXVECDB, 0); write32(bhieOff + ATH12K_BHIE_TXVECSTATUS, 0); write32(bhieOff + ATH12K_BHIE_RXVECDB, 0); write32(bhieOff + ATH12K_BHIE_RXVECSTATUS, 0); - write32(ATH12K_MHI_MHICTRL, ATH12K_MHICTRL_RESET_MASK); // MHICTRL_RESET + write32(ATH12K_MHI_MHICTRL, ATH12K_MHICTRL_RESET_MASK); IODelay(10000); // 10 ms size_t fwSize = get_wcn7850_amss_size(); size_t sblSize = 0x80000; // 512 Ko pour le Secondary Boot Loader (SBL) if (fwSize < sblSize) { - IOLog("QualcommWifi: Erreur - Taille AMSS trop petite (%lu < 512 Ko)\n", fwSize); + IOLog("QualcommWifi: Erreur - Taille AMSS trop petite (%zu < 512 Ko)\n", fwSize); return false; } - IOLog("QualcommWifi: Initialisation du chargeur FBC 2-étapes (SBL: 512 Ko, Image totale: %lu octets)...\n", fwSize); + IOLog("QualcommWifi: Initialisation du chargeur FBC 2-étapes (SBL: 512 Ko, Image totale: %zu octets)...\n", fwSize); // Étape 2 : Allocation DMA contigu pour l'image AMSS complète IOBufferMemoryDescriptor *fwDma = IOBufferMemoryDescriptor::inTaskWithPhysicalMask( @@ -225,7 +237,6 @@ bool QualcommWifi::loadBhiFirmware(void) { write32(bhiOff + ATH12K_BHI_IMGADDR_HIGH, (UInt32)((phys >> 32) & 0xFFFFFFFF)); write32(bhiOff + ATH12K_BHI_IMGSIZE, (UInt32)sblSize); - // Déclenchement de la sonnette PBL avec Session ID = 1 (NON-NUL exigé par PBL) write32(bhiOff + ATH12K_BHI_IMGTXDB, 0x1); IOLog("QualcommWifi: Sonnette BHI_IMGTXDB déclenchée (Session ID = 1, SBL 512 Ko)...\n"); @@ -245,7 +256,7 @@ bool QualcommWifi::loadBhiFirmware(void) { setProperty("BHI_ErrorCode", err, 32); break; } - IODelay(1000); // 1 ms + IODelay(1000); timeoutMs--; } @@ -253,7 +264,6 @@ bool QualcommWifi::loadBhiFirmware(void) { setProperty("BHI_Status_Raw", bhiStatus, 32); setProperty("BHI_Status_State", (bhiStatus & ATH12K_BHI_STATUS_MASK) >> ATH12K_BHI_STATUS_SHIFT, 32); - // Attente de l'exécution du SBL (BHI_EXECENV == 1) et de la disponibilité MHI (READY) timeoutMs = 2000; UInt32 ee = 0; while (timeoutMs > 0) { @@ -272,13 +282,12 @@ bool QualcommWifi::loadBhiFirmware(void) { IOLog("QualcommWifi: SBL BHI terminé (Status=0x%08x, State=%u, ExecEnv=0x%x, SBL_Succes=%d)\n", bhiStatus, (bhiStatus & ATH12K_BHI_STATUS_MASK) >> ATH12K_BHI_STATUS_SHIFT, ee, sblSuccess); - // Étape 4 : Configuration des contextes MHI MMIO et transition vers M0 (mhi_ready_state_transition selon Linux ath12k) + // Étape 4 : Configuration des contextes MHI MMIO et transition vers M0 bool inM0 = false; bool amssSuccess = false; uint32_t processedEvents = 0; if (sblSuccess && fDmaPhysAddr != 0) { - // Attente de la confirmation READY dans MHISTATUS timeoutMs = 3000; while (timeoutMs > 0) { UInt32 mstat = read32(ATH12K_MHI_MHISTATUS); @@ -296,15 +305,13 @@ bool QualcommWifi::loadBhiFirmware(void) { uint64_t er0_ring_phys = fDmaPhysAddr + 0x4000; uint64_t er1_ring_phys = fDmaPhysAddr + 0x5000; - uint32_t cmd_ring_len = 64 * sizeof(struct mhi_ring_element); // 1024 octets (64 TREs) - uint32_t er0_ring_len = 32 * sizeof(struct mhi_ring_element); // 512 octets (32 TREs) selon ath12k WCN7850 - uint32_t er1_ring_len = 256 * sizeof(struct mhi_ring_element); // 4096 octets (256 TREs) + uint32_t cmd_ring_len = 64 * sizeof(struct mhi_ring_element); + uint32_t er0_ring_len = 32 * sizeof(struct mhi_ring_element); + uint32_t er1_ring_len = 256 * sizeof(struct mhi_ring_element); - // 1. Initialisation des 64 contextes de canaux (désactivés au départ) struct mhi_chan_ctxt *chan_ctxt = (struct mhi_chan_ctxt *)((uint8_t *)fDmaVirtAddr + 0x0000); bzero(chan_ctxt, 64 * sizeof(struct mhi_chan_ctxt)); - // 2. Initialisation du contexte d'anneau de commandes struct mhi_cmd_ctxt *cmd_ctxt = (struct mhi_cmd_ctxt *)((uint8_t *)fDmaVirtAddr + 0x2000); bzero(cmd_ctxt, sizeof(struct mhi_cmd_ctxt)); cmd_ctxt[0].rbase = OSSwapHostToLittleInt64(cmd_ring_phys); @@ -312,22 +319,19 @@ bool QualcommWifi::loadBhiFirmware(void) { cmd_ctxt[0].rp = OSSwapHostToLittleInt64(cmd_ring_phys); cmd_ctxt[0].wp = OSSwapHostToLittleInt64(cmd_ring_phys); - // 3. Initialisation des contextes d'anneau d'événements (2 anneaux selon WCN7850 ath12k) struct mhi_event_ctxt *evCtxt = (struct mhi_event_ctxt *)((uint8_t *)fDmaVirtAddr + 0x1000); bzero(evCtxt, 2 * sizeof(struct mhi_event_ctxt)); - // Event Ring 0: CTRL ring, 32 TREs evCtxt[0].intmod = 0; - evCtxt[0].ertype = OSSwapHostToLittleInt32(1); // MHI_ER_TYPE_VALID + evCtxt[0].ertype = OSSwapHostToLittleInt32(1); evCtxt[0].msivec = 0; evCtxt[0].rbase = OSSwapHostToLittleInt64(er0_ring_phys); evCtxt[0].rlen = OSSwapHostToLittleInt64(er0_ring_len); evCtxt[0].rp = OSSwapHostToLittleInt64(er0_ring_phys); evCtxt[0].wp = OSSwapHostToLittleInt64(er0_ring_phys); - // Event Ring 1: DATA ring, 256 TREs evCtxt[1].intmod = OSSwapHostToLittleInt32(1); - evCtxt[1].ertype = OSSwapHostToLittleInt32(1); // MHI_ER_TYPE_VALID + evCtxt[1].ertype = OSSwapHostToLittleInt32(1); evCtxt[1].msivec = 0; evCtxt[1].rbase = OSSwapHostToLittleInt64(er1_ring_phys); evCtxt[1].rlen = OSSwapHostToLittleInt64(er1_ring_len); @@ -338,7 +342,6 @@ bool QualcommWifi::loadBhiFirmware(void) { bzero((uint8_t *)fDmaVirtAddr + 0x4000, er0_ring_len); bzero((uint8_t *)fDmaVirtAddr + 0x5000, er1_ring_len); - // 4. Programmation des registres MMIO MHI write32(ATH12K_MHI_CCABAP_HIGHER, (UInt32)((chan_ctxt_phys >> 32) & 0xFFFFFFFF)); write32(ATH12K_MHI_CCABAP_LOWER, (UInt32)(chan_ctxt_phys & 0xFFFFFFFF)); write32(ATH12K_MHI_ECABAP_HIGHER, (UInt32)((er_ctxt_phys >> 32) & 0xFFFFFFFF)); @@ -346,23 +349,18 @@ bool QualcommWifi::loadBhiFirmware(void) { write32(ATH12K_MHI_CRCBAP_HIGHER, (UInt32)((cmd_ctxt_phys >> 32) & 0xFFFFFFFF)); write32(ATH12K_MHI_CRCBAP_LOWER, (UInt32)(cmd_ctxt_phys & 0xFFFFFFFF)); - // MHICFG (0x10): total_ev_rings = 2, hw_ev_rings = 0 (tous logiciels pour WCN7850) write32(ATH12K_MHI_MHICFG, (2 << 16) | (0 << 24)); - write32(ATH12K_MHI_MHICTRLBASE_HIGHER, 0); write32(ATH12K_MHI_MHICTRLBASE_LOWER, 0); write32(ATH12K_MHI_MHIDATABASE_HIGHER, 0); write32(ATH12K_MHI_MHIDATABASE_LOWER, 0); - write32(ATH12K_MHI_MHICTRLLIMIT_HIGHER, 0x0F); write32(ATH12K_MHI_MHICTRLLIMIT_LOWER, 0xFFFFFFFF); write32(ATH12K_MHI_MHIDATALIMIT_HIGHER, 0x0F); write32(ATH12K_MHI_MHIDATALIMIT_LOWER, 0xFFFFFFFF); - // 5. Armement des Event Ring Doorbells (ERDB) uint64_t er0_armed_wp = er0_ring_phys + er0_ring_len - sizeof(struct mhi_ring_element); evCtxt[0].wp = OSSwapHostToLittleInt64(er0_armed_wp); - uint64_t er1_armed_wp = er1_ring_phys + er1_ring_len - sizeof(struct mhi_ring_element); evCtxt[1].wp = OSSwapHostToLittleInt64(er1_armed_wp); @@ -370,16 +368,13 @@ bool QualcommWifi::loadBhiFirmware(void) { if (erdbOff != 0 && erdbOff < 0x200000) { write32(erdbOff + 4, (UInt32)((er0_armed_wp >> 32) & 0xFFFFFFFF)); write32(erdbOff + 0, (UInt32)(er0_armed_wp & 0xFFFFFFFF)); - write32(erdbOff + 8 + 4, (UInt32)((er1_armed_wp >> 32) & 0xFFFFFFFF)); write32(erdbOff + 8 + 0, (UInt32)(er1_armed_wp & 0xFFFFFFFF)); - IOLog("QualcommWifi: Event Ring Doorbells armées (ER0 @ 0x%08x WP=0x%llx, ER1 @ 0x%08x WP=0x%llx) !\n", erdbOff, er0_armed_wp, erdbOff + 8, er1_armed_wp); setProperty("ERDB_Offset", erdbOff, 32); } - // 6. Bascule vers l'état M0 UInt32 mhiCtrlVal = read32(ATH12K_MHI_MHICTRL); mhiCtrlVal &= ~(UInt32)ATH12K_MHICTRL_MHISTATE_MASK; mhiCtrlVal |= (ATH12K_MHI_STATE_M0 << ATH12K_MHICTRL_MHISTATE_SHIFT); @@ -387,8 +382,8 @@ bool QualcommWifi::loadBhiFirmware(void) { IOLog("QualcommWifi: Transition MHI vers M0 demandée (MHICTRL: 0x%08x)...\n", mhiCtrlVal); } - // Étape 5 : Téléversement FBC complet du firmware via BHIe (mhi_download_amss_image sous SBL actif) - const size_t segSize = 0x80000; // Segments de 512 Ko (SZ_512K exigé par ath12k) + // Étape 5 : Téléversement FBC complet du firmware via BHIe + const size_t segSize = 0x80000; size_t numVecEntries = (fwSize + segSize - 1) / segSize; IOBufferMemoryDescriptor *vecDma = IOBufferMemoryDescriptor::inTaskWithPhysicalMask( @@ -406,7 +401,6 @@ bool QualcommWifi::loadBhiFirmware(void) { if (vecTable && vecPhys) { size_t curRem = fwSize; - for (size_t i = 0; i < numVecEntries; i++) { size_t chunk = (curRem > segSize) ? segSize : curRem; vecTable[i].dma_addr = OSSwapHostToLittleInt64((uint64_t)phys + (uint64_t)i * segSize); @@ -422,11 +416,10 @@ bool QualcommWifi::loadBhiFirmware(void) { write32(bhieOff + ATH12K_BHIE_TXVECSIZE, (UInt32)(numVecEntries * sizeof(struct bhi_vec_entry))); write32(bhieOff + ATH12K_BHIE_TXVECSTATUS, 0); - // Sonnette BHIe avec Sequence ID = 1 write32(bhieOff + ATH12K_BHIE_TXVECDB, 0x1); UInt32 bhieStatus = 0; - timeoutMs = 10000; // 10 secondes pour le transfert DMA complet de 6 Mo + timeoutMs = 10000; while (timeoutMs > 0) { bhieStatus = read32(bhieOff + ATH12K_BHIE_TXVECSTATUS); UInt32 bhieState = (bhieStatus & ATH12K_BHIE_TXVECSTATUS_STATUS_MASK) >> ATH12K_BHIE_TXVECSTATUS_STATUS_SHIFT; @@ -443,7 +436,7 @@ bool QualcommWifi::loadBhiFirmware(void) { setProperty("BHIE_Status_State", (bhieStatus & ATH12K_BHIE_TXVECSTATUS_STATUS_MASK) >> ATH12K_BHIE_TXVECSTATUS_STATUS_SHIFT, 32); IOLog("QualcommWifi: BHIe DMA terminé (Status=0x%08x) ! Dépouillement des événements MHI...\n", bhieStatus); - // Étape 6 : Dépouillement des événements MHI émis par SBL / AMSS sur l'anneau 0 + // Étape 6 : Dépouillement des événements MHI struct mhi_ring_element *erElements = (struct mhi_ring_element *)((uint8_t *)fDmaVirtAddr + 0x4000); timeoutMs = 5000; @@ -464,25 +457,11 @@ bool QualcommWifi::loadBhiFirmware(void) { IOLog("QualcommWifi: Événement MHI reçu #%u: Type=0x%02x, Code=0x%02x, PTR=0x%llx\n", processedEvents, evType, evCode, OSSwapLittleToHostInt64(el->ptr)); - char evKey[32]; - snprintf(evKey, sizeof(evKey), "MHI_Event_%u_Type", processedEvents); - setProperty(evKey, evType, 8); - snprintf(evKey, sizeof(evKey), "MHI_Event_%u_Code", processedEvents); - setProperty(evKey, evCode, 8); - snprintf(evKey, sizeof(evKey), "MHI_Event_%u_PTR", processedEvents); - setProperty(evKey, OSSwapLittleToHostInt64(el->ptr), 64); - - if (evType == ATH12K_MHI_PKT_TYPE_STATE_CHANGE_EVENT) { - IOLog("QualcommWifi: -> Notification changement d'état MHI: State=%u\n", evCode); - if (evCode == ATH12K_MHI_STATE_M0) { - inM0 = true; - } - } else if (evType == ATH12K_MHI_PKT_TYPE_EE_EVENT) { - IOLog("QualcommWifi: -> Notification environnement d'exécution (EE): 0x%x\n", evCode); + if (evType == ATH12K_MHI_PKT_TYPE_STATE_CHANGE_EVENT && evCode == ATH12K_MHI_STATE_M0) { + inM0 = true; + } else if (evType == ATH12K_MHI_PKT_TYPE_EE_EVENT && (evCode == ATH12K_MHI_EE_AMSS || evCode == ATH12K_MHI_EE_WFW)) { ee = evCode; - if (ee == ATH12K_MHI_EE_AMSS || ee == ATH12K_MHI_EE_WFW) { - amssSuccess = true; - } + amssSuccess = true; } processedEvents++; } @@ -526,8 +505,10 @@ bool QualcommWifi::loadBhiFirmware(void) { } bool QualcommWifi::start(IOService *provider) { + IOLog("QualcommWifi: Demarrage du pilote Wi-Fi natif (IO80211Controller)...\n"); + if (!super::start(provider)) { - IOLog("QualcommWifi: Erreur - Echec de IOEthernetController::start(provider) !\n"); + IOLog("QualcommWifi: Erreur - IO80211Controller::start(provider) a echoue !\n"); return false; } @@ -563,7 +544,6 @@ bool QualcommWifi::start(IOService *provider) { setProperty("SoC_Major", major, 32); setProperty("SoC_Minor", minor, 32); - // Lecture des registres de contrôle MHI et pointeurs BHI UInt32 mhiStatus = read32(ATH12K_MHI_MHISTATUS); UInt32 mhiCtrl = read32(ATH12K_MHI_MHICTRL); UInt32 bhiOff = read32(ATH12K_MHI_BHIOFF); @@ -605,37 +585,44 @@ bool QualcommWifi::start(IOService *provider) { fMacAddress.bytes[0], fMacAddress.bytes[1], fMacAddress.bytes[2], fMacAddress.bytes[3], fMacAddress.bytes[4], fMacAddress.bytes[5]); - // Configuration et publication des médias supportés (Auto / 1Gbps) - OSDictionary *mediumDict = OSDictionary::withCapacity(1); + // Propriétés Wi-Fi AirPort pour macOS et airportd + setProperty("IO80211AirPort", true); + setProperty("AirPort", true); + setProperty("IO80211Locale", "ETSI"); + setProperty("IO80211CountryCode", "FR"); + setProperty("IO80211ScanCache", true); + setProperty("IO80211RadioState", (UInt64)1, 32); + + // Configuration et publication des médiums réseau (IEEE 802.11) + OSDictionary *mediumDict = OSDictionary::withCapacity(2); if (mediumDict) { - IONetworkMedium *medium = IONetworkMedium::medium(kIOMediumEthernetAuto, 1000000000ULL); + IONetworkMedium *medium = IONetworkMedium::medium(kIOMediumIEEE80211, 54000000); if (medium) { IONetworkMedium::addMedium(mediumDict, medium); publishMediumDictionary(mediumDict); + setCurrentMedium(medium); setSelectedMedium(medium); medium->release(); } mediumDict->release(); } - // Attachement de l'interface réseau native (IOEthernetInterface) - if (attachInterface((IONetworkInterface **)&fNetif, true)) { - IOLog("QualcommWifi: Interface reseau (IOEthernetInterface) attachee avec succes !\n"); - setProperty("Network_Interface_Attached", true); + if (!IONetworkController::attachInterface((IONetworkInterface **)&fNetif, true)) { + IOLog("QualcommWifi: Attention - Echec attachement interface reseau BSD.\n"); } else { - IOLog("QualcommWifi: Echec de attachInterface IOEthernetInterface.\n"); - setProperty("Network_Interface_Attached", false); + IOLog("QualcommWifi: Interface reseau attachee avec succes (enX) !\n"); } registerService(); + IOLog("QualcommWifi: Pilote Wi-Fi natif demarre avec succes !\n"); return true; } void QualcommWifi::stop(IOService *provider) { - IOLog("QualcommWifi: Arret du pilote, liberation interface reseau, MSI, DMA et BAR0.\n"); + IOLog("QualcommWifi: Arret du pilote Wi-Fi natif, liberation MSI, DMA et BAR0.\n"); if (fNetif) { - detachInterface(fNetif); + IONetworkController::detachInterface(fNetif); OSSafeReleaseNULL(fNetif); } @@ -648,7 +635,6 @@ void QualcommWifi::stop(IOService *provider) { OSSafeReleaseNULL(fInterruptSource); } - // Déverrouillage et libération du tampon DMA avant la fermeture PCIe freeDmaContext(); fBar0Virt = nullptr; @@ -674,7 +660,6 @@ IOReturn QualcommWifi::enable(IONetworkInterface *netif) { IOLog("QualcommWifi: Interface reseau activee par macOS.\n"); if (!fFirmwareLoaded) { - // Allocation du tampon DMA 36-bit pour les anneaux MHI / BHI if (allocDmaContext(ATH12K_DMA_TEST_RING_SIZE)) { setProperty("DMA_PhysAddr", (uint64_t)fDmaPhysAddr, 64); @@ -700,7 +685,6 @@ IOReturn QualcommWifi::enable(IONetworkInterface *netif) { } } - // Chargement du firmware radio AMSS via le protocole BHI if (loadBhiFirmware()) { fFirmwareLoaded = true; } @@ -724,3 +708,268 @@ UInt32 QualcommWifi::outputPacket(mbuf_t m, void *param) { } return kIOReturnOutputDropped; } + +void QualcommWifi::dataLinkLayerAttachComplete(void) { + IOLog("QualcommWifi: dataLinkLayerAttachComplete (Skywalk Tahoe).\n"); +} + +IOReturn QualcommWifi::handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) { + return (IOReturn)handleApple80211Request((unsigned int)req_type, isSet ? 1 : 0, req_data); +} + +IOReturn QualcommWifi::getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) { + return (IOReturn)handleApple80211Request(APPLE80211_IOC_DRIVER_VERSION, 0, vd); +} + +IOReturn QualcommWifi::getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) { + return (IOReturn)handleApple80211Request(APPLE80211_IOC_HARDWARE_VERSION, 0, vd); +} + +IOReturn QualcommWifi::getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) { + return (IOReturn)handleApple80211Request(APPLE80211_IOC_CARD_CAPABILITIES, 0, cap); +} + +IOReturn QualcommWifi::getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) { + return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, -1, pwr); +} + +IOReturn QualcommWifi::setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) { + int val = (pwr && pwr->power_state[0]) ? 1 : 0; + return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, val, pwr); +} + +IOReturn QualcommWifi::getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) { + return (IOReturn)handleApple80211Request(APPLE80211_IOC_COUNTRY_CODE, 0, cc); +} + +SInt32 QualcommWifi::handleApple80211Request(unsigned int req_type, int req_val, void* req_data) { + switch (req_type) { + case APPLE80211_IOC_CARD_CAPABILITIES: { + apple80211_capability_data *cap = (apple80211_capability_data *)req_data; + if (cap) { + bzero(cap, sizeof(*cap)); + cap->version = APPLE80211_VERSION; + #define SET_CAP(c) (cap->capabilities[(c) / 8] |= (1 << ((c) % 8))) + SET_CAP(APPLE80211_CAP_WEP); + SET_CAP(APPLE80211_CAP_TKIP); + SET_CAP(APPLE80211_CAP_AES_CCM); + SET_CAP(APPLE80211_CAP_WPA1); + SET_CAP(APPLE80211_CAP_WPA2); + SET_CAP(APPLE80211_CAP_WPA); + SET_CAP(APPLE80211_CAP_SHORT_GI_20MHZ); + SET_CAP(APPLE80211_CAP_SHORT_GI_40MHZ); + SET_CAP(APPLE80211_CAP_BURST); + SET_CAP(APPLE80211_CAP_WME); + SET_CAP(APPLE80211_CAP_PMGT); + SET_CAP(APPLE80211_CAP_SHPREAMBLE); + SET_CAP(APPLE80211_CAP_SHSLOT); + #undef SET_CAP + return 0; + } + break; + } + case APPLE80211_IOC_STATE: { + apple80211_state_data *state = (apple80211_state_data *)req_data; + if (state) { + state->version = APPLE80211_VERSION; + state->state = fLinkActive ? APPLE80211_S_RUN : APPLE80211_S_INIT; + return 0; + } + break; + } + case APPLE80211_IOC_PHY_MODE: { + apple80211_phymode_data *pm = (apple80211_phymode_data *)req_data; + if (pm) { + pm->version = APPLE80211_VERSION; + pm->phy_mode = APPLE80211_MODE_11AX; + pm->active_phy_mode = APPLE80211_MODE_11AX; + return 0; + } + break; + } + case APPLE80211_IOC_OP_MODE: { + apple80211_opmode_data *om = (apple80211_opmode_data *)req_data; + if (om) { + om->version = APPLE80211_VERSION; + om->op_mode = APPLE80211_M_STA; + return 0; + } + break; + } + case APPLE80211_IOC_CHANNEL: { + apple80211_channel_data *cd = (apple80211_channel_data *)req_data; + if (cd) { + if (req_val == 1 && cd->channel.channel > 0) { + fCurrentChannel = (UInt16)cd->channel.channel; + IOLog("QualcommWifi: Changement de canal Wi-Fi vers %u\n", fCurrentChannel); + } + cd->version = APPLE80211_VERSION; + cd->channel.version = APPLE80211_VERSION; + cd->channel.channel = fCurrentChannel > 0 ? fCurrentChannel : 1; + cd->channel.flags = (cd->channel.channel <= 14) ? (APPLE80211_C_FLAG_2GHZ | APPLE80211_C_FLAG_20MHZ) : (APPLE80211_C_FLAG_5GHZ | APPLE80211_C_FLAG_80MHZ); + return 0; + } + break; + } + case APPLE80211_IOC_TXPOWER: { + apple80211_txpower_data *tx = (apple80211_txpower_data *)req_data; + if (tx) { + tx->version = APPLE80211_VERSION; + tx->txpower_unit = APPLE80211_UNIT_DBM; + tx->txpower = 20; // 20 dBm (100 mW) + return 0; + } + break; + } + case APPLE80211_IOC_PROTMODE: + case APPLE80211_IOC_POWERSAVE: + case APPLE80211_IOC_SCANCACHE_CLEAR: { + return 0; + } + case APPLE80211_IOC_RSSI: { + apple80211_rssi_data *rd = (apple80211_rssi_data *)req_data; + if (rd) { + rd->version = APPLE80211_VERSION; + rd->num_radios = 1; + rd->rssi_unit = APPLE80211_UNIT_DBM; + rd->rssi[0] = fLastRssi ? fLastRssi : -50; + rd->aggregate_rssi = rd->rssi[0]; + return 0; + } + break; + } + case APPLE80211_IOC_NOISE: { + apple80211_noise_data *nd = (apple80211_noise_data *)req_data; + if (nd) { + nd->version = APPLE80211_VERSION; + nd->num_radios = 1; + nd->noise_unit = APPLE80211_UNIT_DBM; + nd->noise[0] = -95; + nd->aggregate_noise = -95; + return 0; + } + break; + } + case APPLE80211_IOC_SSID: { + apple80211_ssid_data *sd = (apple80211_ssid_data *)req_data; + if (sd) { + sd->version = APPLE80211_VERSION; + sd->ssid_len = fSsidLen; + memcpy(sd->ssid_bytes, fSsid, fSsidLen); + return 0; + } + break; + } + case APPLE80211_IOC_BSSID: { + apple80211_bssid_data *bd = (apple80211_bssid_data *)req_data; + if (bd) { + bd->version = APPLE80211_VERSION; + memcpy(bd->bssid.octet, fBssid, 6); + return 0; + } + break; + } + case APPLE80211_IOC_RATE: { + apple80211_rate_data *rate = (apple80211_rate_data *)req_data; + if (rate) { + rate->version = APPLE80211_VERSION; + rate->num_radios = 1; + rate->rate[0] = 1200; + return 0; + } + break; + } + case APPLE80211_IOC_SUPPORTED_CHANNELS: { + apple80211_sup_channel_data *sc = (apple80211_sup_channel_data *)req_data; + if (sc) { + sc->version = APPLE80211_VERSION; + static const UInt16 chs[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, + 36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 149, 153, 157, 161, 165 }; + sc->num_channels = sizeof(chs)/sizeof(chs[0]); + for (int i = 0; i < sc->num_channels; i++) { + sc->supported_channels[i].version = APPLE80211_VERSION; + sc->supported_channels[i].channel = chs[i]; + sc->supported_channels[i].flags = (chs[i] <= 14) ? (APPLE80211_C_FLAG_2GHZ | APPLE80211_C_FLAG_20MHZ) : (APPLE80211_C_FLAG_5GHZ | APPLE80211_C_FLAG_80MHZ); + } + return 0; + } + break; + } + case APPLE80211_IOC_SCAN_REQ: + case APPLE80211_IOC_SCAN_REQ_MULTIPLE: { + IOLog("QualcommWifi: Requete de scan Wi-Fi recue depuis airportd !\n"); + fScanInProgress = true; + return 0; + } + case APPLE80211_IOC_SCAN_RESULT: { + return 0; + } + case APPLE80211_IOC_POWER: { + apple80211_power_data *pwr = (apple80211_power_data *)req_data; + if (pwr) { + pwr->version = APPLE80211_VERSION; + pwr->num_radios = 1; + if (req_val == 0 || req_val == 1) { + fLinkActive = (req_val == 1); + IOLog("QualcommWifi: Bascule alimentation radio Wi-Fi : %s\n", fLinkActive ? "ACTIVE" : "COUPEE"); + } + pwr->power_state[0] = fLinkActive ? 1 : 0; + return 0; + } + break; + } + case APPLE80211_IOC_COUNTRY_CODE: { + apple80211_country_code_data *cc = (apple80211_country_code_data *)req_data; + if (cc) { + cc->version = APPLE80211_VERSION; + cc->cc[0] = 'F'; + cc->cc[1] = 'R'; + cc->cc[2] = 0; + return 0; + } + break; + } + case APPLE80211_IOC_LOCALE: { + apple80211_locale_data *loc = (apple80211_locale_data *)req_data; + if (loc) { + loc->version = APPLE80211_VERSION; + loc->locale = APPLE80211_LOCALE_ETSI; + return 0; + } + break; + } + case APPLE80211_IOC_DRIVER_VERSION: + case APPLE80211_IOC_HARDWARE_VERSION: { + apple80211_version_data *vd = (apple80211_version_data *)req_data; + if (vd) { + vd->version = APPLE80211_VERSION; + const char *verStr = "Qualcomm FastConnect 7800 Wi-Fi 7 (v1.1.0)"; + vd->string_len = (u_int16_t)strlen(verStr); + strlcpy(vd->string, verStr, sizeof(vd->string)); + return 0; + } + break; + } + case APPLE80211_IOC_ASSOCIATE: { + apple80211_assoc_data *assoc = (apple80211_assoc_data *)req_data; + if (assoc) { + IOLog("QualcommWifi: Demande d'association au reseau Wi-Fi : %.*s\n", assoc->ad_ssid_len, assoc->ad_ssid); + fSsidLen = (assoc->ad_ssid_len < APPLE80211_MAX_SSID_LEN) ? assoc->ad_ssid_len : APPLE80211_MAX_SSID_LEN; + memcpy(fSsid, assoc->ad_ssid, fSsidLen); + memcpy(fBssid, assoc->ad_bssid.octet, 6); + fLinkActive = true; + return 0; + } + break; + } + case APPLE80211_IOC_DISASSOCIATE: { + IOLog("QualcommWifi: Deconnexion Wi-Fi demandee par macOS.\n"); + fLinkActive = false; + fSsidLen = 0; + return 0; + } + default: + break; + } + return 0; +} diff --git a/QualcommWifi/QualcommWifi.hpp b/QualcommWifi/QualcommWifi.hpp index a9d5cd0..2dc5843 100644 --- a/QualcommWifi/QualcommWifi.hpp +++ b/QualcommWifi/QualcommWifi.hpp @@ -13,6 +13,12 @@ #include #include #include + +#include +#include +#include +#include +#include #include "Firmware_WCN7850_Wifi.h" // Registres PCIe et constantes de fenêtrage (ath12k/pci.h) @@ -169,7 +175,7 @@ struct mhi_ring_element { #define MHI_TRE_GET_EV_STATE(tre) (((tre)->dword[0] >> 24) & 0xFF) #define MHI_TRE_GET_EV_EXECENV(tre) (((tre)->dword[0] >> 24) & 0xFF) -class QualcommWifi : public IOEthernetController { +class QualcommWifi : public IO80211Controller { OSDeclareDefaultStructors(QualcommWifi) private: @@ -179,13 +185,17 @@ private: UInt32 fCurrWindow; IOInterruptEventSource *fInterruptSource; - IOEthernetInterface *fNetif; + IONetworkInterface *fNetif; IOEthernetAddress fMacAddress; - // État réseau + // État réseau Wi-Fi bool fLinkActive; UInt16 fCurrentChannel; SInt32 fLastRssi; + UInt8 fSsid[APPLE80211_MAX_SSID_LEN]; + UInt32 fSsidLen; + UInt8 fBssid[6]; + bool fScanInProgress; // Tampon DMA physiquement contigu IOBufferMemoryDescriptor *fDmaBuf; @@ -220,6 +230,27 @@ public: virtual IOReturn enable(IONetworkInterface *netif) override; virtual IOReturn disable(IONetworkInterface *netif) override; virtual UInt32 outputPacket(mbuf_t m, void *param) override; + + // macOS Tahoe 26.x (Darwin 25) IO80211Controller Skywalk overrides + virtual bool isCommandProhibited(int command) override { return false; } + virtual IOReturn handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) override; + virtual UInt32 hardwareOutputQueueDepth(void) override { return 0; } + virtual SInt32 performCountryCodeOperation(IO80211CountryCodeOp op) override { return 0; } + virtual void dataLinkLayerAttachComplete(void) override; + virtual SInt32 enableFeature(IO80211FeatureCode code, void *arg) override { return 0; } + virtual IOReturn getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override; + virtual IOReturn getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override; + virtual IOReturn getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) override; + virtual IOReturn getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override; + virtual IOReturn setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override; + virtual IOReturn getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override; + virtual IOReturn setCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override { return kIOReturnSuccess; } + virtual IOReturn setGET_DEBUG_INFO(IO80211SkywalkInterface *iface, apple80211_debug_command *dbg) override { return kIOReturnSuccess; } + virtual void* getLogger(void) const override { return nullptr; } + virtual void* getFaultReporterFromDriver(void) override { return nullptr; } + + // Dispatcher de requêtes Apple80211 / airportd + SInt32 handleApple80211Request(unsigned int req_type, int req_val, void* req_data); }; #endif diff --git a/QualcommWireless/include/IOKit/80211/IO80211Controller.h b/QualcommWireless/include/IOKit/80211/IO80211Controller.h index b118743..958836b 100644 --- a/QualcommWireless/include/IOKit/80211/IO80211Controller.h +++ b/QualcommWireless/include/IOKit/80211/IO80211Controller.h @@ -151,7 +151,7 @@ public: virtual IOWorkLoop* getWorkLoop(void) const APPLE_KEXT_OVERRIDE; virtual const char* stringFromReturn(int) APPLE_KEXT_OVERRIDE; virtual int errnoFromReturn(int) APPLE_KEXT_OVERRIDE; - virtual IOOutputQueue* getOutputQueue(void) const APPLE_KEXT_OVERRIDE; + virtual IOOutputQueue* getOutputQueue(void) const APPLE_KEXT_OVERRIDE { return IOEthernetController::getOutputQueue(); } virtual bool createWorkLoop(void) APPLE_KEXT_OVERRIDE; virtual IOReturn enable(IONetworkInterface *) APPLE_KEXT_OVERRIDE; virtual IOReturn disable(IONetworkInterface *) APPLE_KEXT_OVERRIDE; @@ -159,8 +159,8 @@ public: #if __IO80211_TARGET >= __MAC_10_15 virtual void detachInterface(IONetworkInterface *iface, bool sync = false) APPLE_KEXT_OVERRIDE { IOEthernetController::detachInterface(iface, sync); } #endif - virtual IONetworkInterface* createInterface(void) APPLE_KEXT_OVERRIDE; - virtual bool configureInterface(IONetworkInterface *iface) APPLE_KEXT_OVERRIDE; + virtual IONetworkInterface* createInterface(void) APPLE_KEXT_OVERRIDE { return IOEthernetController::createInterface(); } + virtual bool configureInterface(IONetworkInterface *iface) APPLE_KEXT_OVERRIDE { return IONetworkController::configureInterface(iface); } #ifdef __PRIVATE_SPI__ virtual IOReturn outputStart(IONetworkInterface *,UInt) APPLE_KEXT_OVERRIDE; #endif @@ -168,8 +168,10 @@ public: #if __IO80211_TARGET >= 260000 // macOS Tahoe 26.x (Darwin 25, IO80211Family 1200.13.1 / source 1566.5) - // Slots 394..462 (offsets 0xc50..0xe70) - virtual bool isCommandProhibited(int) = 0; // slot 394 (0xc50) + // Exact 466-slot alignment matching BootKernelExtensions.kc __ZTV17IO80211Controller + virtual void _RESERVEDIOEthernetController_tahoe0() {} // slot 394 (0xc50) + virtual void _RESERVEDIOEthernetController_tahoe1() {} // slot 395 (0xc58) + virtual bool isCommandProhibited(int) = 0; // slot 396 (0xc60) virtual bool createWorkQueue(void); // slot 395 (0xc58) virtual bool debugStateInit(void); // slot 396 (0xc60) virtual IO80211WorkQueue* getWorkQueue(void) const; // slot 397 (0xc68) diff --git a/build_wifi.sh b/build_wifi.sh index 73967d2..bc70787 100755 --- a/build_wifi.sh +++ b/build_wifi.sh @@ -25,7 +25,7 @@ clang++ -target x86_64-apple-macos26.5 \ -I"${SCRIPT_DIR}/QualcommWifi" \ -std=c++17 -fno-builtin -fno-common -mkernel -fno-rtti -fno-exceptions \ -fno-stack-protector -fno-strict-aliasing -Os \ - -DKERNEL -DAPPLE_KEXT_OVERRIDE=override \ + -DKERNEL -D__IO80211_TARGET=260000 -DAPPLE_KEXT_OVERRIDE=override \ -c "${SCRIPT_DIR}/QualcommWifi/QualcommWifi.cpp" \ -o "${BUILD_DIR}/QualcommWifi.o"