nawrhehe/QualcommWireless
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(wifi): align IO80211Controller vtable to 466 slots and resolve kernel symbols for native Wi-Fi

Browse Source 
- Breakthroughs & Rétro-ingénierie :
  * Analyse binaire approfondie de BootKernelExtensions.kc (__ZTV17IO80211Controller à 0xffffff8002461148, 466 slots).
  * Résolution de la cause racine de la boucle de démarrage (boot loop) : décalage de 16 octets (2 slots 394 & 395) causé par _RESERVEDIOEthernetController30 et 31, provoquant un appel dans une zone mémoire non mappée dans IO80211Controller::start().
  * Analyse de findAndAttachToFaultReporter : Apple gère proprement un retour nullptr pour getFaultReporterFromDriver() sans nécessiter d'implémentation factice instable.
  * Analyse des symboles non résolus contre BootKernelExtensions.kc : identification de 11 symboles manquants (createInterface, configureInterface, getOutputQueue, _RESERVEDIONetworkController2..7) résolus via corps inline de délégation et stubs locaux, atteignant 0 symbole manquant (470/470 résolus).
  * Découplage de start() : élimination de l'attente synchrone du firmware BHI (qui déclenchait le watchdog macOS) en la différant à enable().

- Modifications apportées :
  * QualcommWireless/include/IOKit/80211/IO80211Controller.h : alignement exact des 466 slots avec les réservations tahoe0/tahoe1 inline, et délégation directe vers IOEthernetController pour createInterface, configureInterface et getOutputQueue.
  * QualcommWifi/QualcommWifi.hpp : héritage direct de IO80211Controller, implémentation des prototypes Skywalk et airportd, ajout de fNetif.
  * QualcommWifi/QualcommWifi.cpp : stubs locaux pour les réservations IONetworkController, publication des médiums IEEE 802.11, attachement de l'interface réseau BSD via IONetworkController::attachInterface(), et gestionnaire de requêtes airportd/Skywalk complet.
  * QualcommWifi/Info.plist : déclaration de la dépendance com.apple.iokit.IO80211Family (1200.0) et OSBundleRequired = Root.
  * build_wifi.sh : ciblage macOS 26.5 avec -D__IO80211_TARGET=260000.

- Validation :
  * Compilation 100% sans erreur ni avertissement.
  * Vérification de vtable : correspondance parfaite 466 slots (0xe90 octets).
  * Vérification des symboles contre BootKernelExtensions.kc : 0 symbole manquant (100% de concordance).
  * Déploiement direct dans /Volumes/EFI/EFI/OC/Kexts/QualcommWifi.kext validé (SHA256 identique).
This commit is contained in:
Erwan committed 2026-10-16 11:49:21 +02:00
1 parent 399b09dade
commit d6bce8f360
5 files changed
+366 -82
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

QualcommWifi/Info.plist
+2
View File
@@ -38,6 +38,8 @@
</dict>
<key>OSBundleLibraries</key>
<dict>
<key>com.apple.iokit.IO80211Family</key>
<string>1200.0</string>
<key>com.apple.iokit.IONetworkingFamily</key>
<string>3.2</string>
<key>com.apple.iokit.IOPCIFamily</key>
QualcommWifi/QualcommWifi.cpp
+322 -73
View File
@@ -4,8 +4,18 @@
#include <kern/task.h>
#include <string.h>
#define super IOEthernetController
OSDefineMetaClassAndStructors(QualcommWifi, IOEthernetController)
// Stubs locaux pour les réservations IONetworkController 2..7 non exportées par BootKernelExtensions.kc
extern "C" {
void _ZN19IONetworkController29_RESERVEDIONetworkController2Ev(void) {}
void _ZN19IONetworkController29_RESERVEDIONetworkController3Ev(void) {}
void _ZN19IONetworkController29_RESERVEDIONetworkController4Ev(void) {}
void _ZN19IONetworkController29_RESERVEDIONetworkController5Ev(void) {}
void _ZN19IONetworkController29_RESERVEDIONetworkController6Ev(void) {}
void _ZN19IONetworkController29_RESERVEDIONetworkController7Ev(void) {}
}
#define super IO80211Controller
OSDefineMetaClassAndStructors(QualcommWifi, IO80211Controller)
bool QualcommWifi::init(OSDictionary *dictionary) {
if (!super::init(dictionary)) {
@@ -21,6 +31,10 @@ bool QualcommWifi::init(OSDictionary *dictionary) {
fLinkActive = false;
fCurrentChannel = 1;
fLastRssi = -50;
fSsidLen = 0;
bzero(fSsid, sizeof(fSsid));
bzero(fBssid, sizeof(fBssid));
fScanInProgress = false;
fDmaBuf = nullptr;
fDmaPhysAddr = 0;
fDmaVirtAddr = nullptr;
@@ -95,7 +109,7 @@ void QualcommWifi::socWrite32(UInt32 offset, UInt32 value) {
write32(ATH12K_PCI_WINDOW_START + (offset & ATH12K_PCI_WINDOW_RANGE_MASK), value);
}
// Équivalent de dma_alloc_coherent() avec DMA_BIT_MASK(36) sous Linux
// Allocation du contexte DMA contigu (36-bit)
bool QualcommWifi::allocDmaContext(IOByteCount size) {
fDmaBuf = IOBufferMemoryDescriptor::inTaskWithPhysicalMask(
kernel_task,
@@ -126,9 +140,7 @@ bool QualcommWifi::allocDmaContext(IOByteCount size) {
return false;
}
// Remise à zéro de la zone DMA (comme kzalloc / dma_alloc_coherent)
bzero(fDmaVirtAddr, size);
IOLog("QualcommWifi: Tampon DMA 36-bit pret ! Phys: 0x%llx, Taille: %llu octets (Contigu: %llu)\n",
(uint64_t)fDmaPhysAddr, (uint64_t)size, (uint64_t)segLen);
return true;
@@ -172,23 +184,23 @@ bool QualcommWifi::loadBhiFirmware(void) {
IOLog("QualcommWifi: ASPM PCIe désactivé pour stabilité du transfert firmware (LinkCtrl: 0x%04x)\n", linkCtrl);
}
// Étape 1 : Réinitialisation MHI et effacement des vecteurs BHIe (ath12k_mhi_clear_vector)
// Étape 1 : Réinitialisation MHI et effacement des vecteurs BHIe
write32(bhieOff + ATH12K_BHIE_TXVECDB, 0);
write32(bhieOff + ATH12K_BHIE_TXVECSTATUS, 0);
write32(bhieOff + ATH12K_BHIE_RXVECDB, 0);
write32(bhieOff + ATH12K_BHIE_RXVECSTATUS, 0);
write32(ATH12K_MHI_MHICTRL, ATH12K_MHICTRL_RESET_MASK); // MHICTRL_RESET
write32(ATH12K_MHI_MHICTRL, ATH12K_MHICTRL_RESET_MASK);
IODelay(10000); // 10 ms
size_t fwSize = get_wcn7850_amss_size();
size_t sblSize = 0x80000; // 512 Ko pour le Secondary Boot Loader (SBL)
if (fwSize < sblSize) {
IOLog("QualcommWifi: Erreur - Taille AMSS trop petite (%lu < 512 Ko)\n", fwSize);
IOLog("QualcommWifi: Erreur - Taille AMSS trop petite (%zu < 512 Ko)\n", fwSize);
return false;
}
IOLog("QualcommWifi: Initialisation du chargeur FBC 2-étapes (SBL: 512 Ko, Image totale: %lu octets)...\n", fwSize);
IOLog("QualcommWifi: Initialisation du chargeur FBC 2-étapes (SBL: 512 Ko, Image totale: %zu octets)...\n", fwSize);
// Étape 2 : Allocation DMA contigu pour l'image AMSS complète
IOBufferMemoryDescriptor *fwDma = IOBufferMemoryDescriptor::inTaskWithPhysicalMask(
@@ -225,7 +237,6 @@ bool QualcommWifi::loadBhiFirmware(void) {
write32(bhiOff + ATH12K_BHI_IMGADDR_HIGH, (UInt32)((phys >> 32) & 0xFFFFFFFF));
write32(bhiOff + ATH12K_BHI_IMGSIZE, (UInt32)sblSize);
// Déclenchement de la sonnette PBL avec Session ID = 1 (NON-NUL exigé par PBL)
write32(bhiOff + ATH12K_BHI_IMGTXDB, 0x1);
IOLog("QualcommWifi: Sonnette BHI_IMGTXDB déclenchée (Session ID = 1, SBL 512 Ko)...\n");
@@ -245,7 +256,7 @@ bool QualcommWifi::loadBhiFirmware(void) {
setProperty("BHI_ErrorCode", err, 32);
break;
}
IODelay(1000); // 1 ms
IODelay(1000);
timeoutMs--;
}
@@ -253,7 +264,6 @@ bool QualcommWifi::loadBhiFirmware(void) {
setProperty("BHI_Status_Raw", bhiStatus, 32);
setProperty("BHI_Status_State", (bhiStatus & ATH12K_BHI_STATUS_MASK) >> ATH12K_BHI_STATUS_SHIFT, 32);
// Attente de l'exécution du SBL (BHI_EXECENV == 1) et de la disponibilité MHI (READY)
timeoutMs = 2000;
UInt32 ee = 0;
while (timeoutMs > 0) {
@@ -272,13 +282,12 @@ bool QualcommWifi::loadBhiFirmware(void) {
IOLog("QualcommWifi: SBL BHI terminé (Status=0x%08x, State=%u, ExecEnv=0x%x, SBL_Succes=%d)\n",
bhiStatus, (bhiStatus & ATH12K_BHI_STATUS_MASK) >> ATH12K_BHI_STATUS_SHIFT, ee, sblSuccess);
// Étape 4 : Configuration des contextes MHI MMIO et transition vers M0 (mhi_ready_state_transition selon Linux ath12k)
// Étape 4 : Configuration des contextes MHI MMIO et transition vers M0
bool inM0 = false;
bool amssSuccess = false;
uint32_t processedEvents = 0;
if (sblSuccess && fDmaPhysAddr != 0) {
// Attente de la confirmation READY dans MHISTATUS
timeoutMs = 3000;
while (timeoutMs > 0) {
UInt32 mstat = read32(ATH12K_MHI_MHISTATUS);
@@ -296,15 +305,13 @@ bool QualcommWifi::loadBhiFirmware(void) {
uint64_t er0_ring_phys = fDmaPhysAddr + 0x4000;
uint64_t er1_ring_phys = fDmaPhysAddr + 0x5000;
uint32_t cmd_ring_len = 64 * sizeof(struct mhi_ring_element); // 1024 octets (64 TREs)
uint32_t er0_ring_len = 32 * sizeof(struct mhi_ring_element); // 512 octets (32 TREs) selon ath12k WCN7850
uint32_t er1_ring_len = 256 * sizeof(struct mhi_ring_element); // 4096 octets (256 TREs)
uint32_t cmd_ring_len = 64 * sizeof(struct mhi_ring_element);
uint32_t er0_ring_len = 32 * sizeof(struct mhi_ring_element);
uint32_t er1_ring_len = 256 * sizeof(struct mhi_ring_element);
// 1. Initialisation des 64 contextes de canaux (désactivés au départ)
struct mhi_chan_ctxt *chan_ctxt = (struct mhi_chan_ctxt *)((uint8_t *)fDmaVirtAddr + 0x0000);
bzero(chan_ctxt, 64 * sizeof(struct mhi_chan_ctxt));
// 2. Initialisation du contexte d'anneau de commandes
struct mhi_cmd_ctxt *cmd_ctxt = (struct mhi_cmd_ctxt *)((uint8_t *)fDmaVirtAddr + 0x2000);
bzero(cmd_ctxt, sizeof(struct mhi_cmd_ctxt));
cmd_ctxt[0].rbase = OSSwapHostToLittleInt64(cmd_ring_phys);
@@ -312,22 +319,19 @@ bool QualcommWifi::loadBhiFirmware(void) {
cmd_ctxt[0].rp = OSSwapHostToLittleInt64(cmd_ring_phys);
cmd_ctxt[0].wp = OSSwapHostToLittleInt64(cmd_ring_phys);
// 3. Initialisation des contextes d'anneau d'événements (2 anneaux selon WCN7850 ath12k)
struct mhi_event_ctxt *evCtxt = (struct mhi_event_ctxt *)((uint8_t *)fDmaVirtAddr + 0x1000);
bzero(evCtxt, 2 * sizeof(struct mhi_event_ctxt));
// Event Ring 0: CTRL ring, 32 TREs
evCtxt[0].intmod = 0;
evCtxt[0].ertype = OSSwapHostToLittleInt32(1); // MHI_ER_TYPE_VALID
evCtxt[0].ertype = OSSwapHostToLittleInt32(1);
evCtxt[0].msivec = 0;
evCtxt[0].rbase = OSSwapHostToLittleInt64(er0_ring_phys);
evCtxt[0].rlen = OSSwapHostToLittleInt64(er0_ring_len);
evCtxt[0].rp = OSSwapHostToLittleInt64(er0_ring_phys);
evCtxt[0].wp = OSSwapHostToLittleInt64(er0_ring_phys);
// Event Ring 1: DATA ring, 256 TREs
evCtxt[1].intmod = OSSwapHostToLittleInt32(1);
evCtxt[1].ertype = OSSwapHostToLittleInt32(1); // MHI_ER_TYPE_VALID
evCtxt[1].ertype = OSSwapHostToLittleInt32(1);
evCtxt[1].msivec = 0;
evCtxt[1].rbase = OSSwapHostToLittleInt64(er1_ring_phys);
evCtxt[1].rlen = OSSwapHostToLittleInt64(er1_ring_len);
@@ -338,7 +342,6 @@ bool QualcommWifi::loadBhiFirmware(void) {
bzero((uint8_t *)fDmaVirtAddr + 0x4000, er0_ring_len);
bzero((uint8_t *)fDmaVirtAddr + 0x5000, er1_ring_len);
// 4. Programmation des registres MMIO MHI
write32(ATH12K_MHI_CCABAP_HIGHER, (UInt32)((chan_ctxt_phys >> 32) & 0xFFFFFFFF));
write32(ATH12K_MHI_CCABAP_LOWER, (UInt32)(chan_ctxt_phys & 0xFFFFFFFF));
write32(ATH12K_MHI_ECABAP_HIGHER, (UInt32)((er_ctxt_phys >> 32) & 0xFFFFFFFF));
@@ -346,23 +349,18 @@ bool QualcommWifi::loadBhiFirmware(void) {
write32(ATH12K_MHI_CRCBAP_HIGHER, (UInt32)((cmd_ctxt_phys >> 32) & 0xFFFFFFFF));
write32(ATH12K_MHI_CRCBAP_LOWER, (UInt32)(cmd_ctxt_phys & 0xFFFFFFFF));
// MHICFG (0x10): total_ev_rings = 2, hw_ev_rings = 0 (tous logiciels pour WCN7850)
write32(ATH12K_MHI_MHICFG, (2 << 16) | (0 << 24));
write32(ATH12K_MHI_MHICTRLBASE_HIGHER, 0);
write32(ATH12K_MHI_MHICTRLBASE_LOWER, 0);
write32(ATH12K_MHI_MHIDATABASE_HIGHER, 0);
write32(ATH12K_MHI_MHIDATABASE_LOWER, 0);
write32(ATH12K_MHI_MHICTRLLIMIT_HIGHER, 0x0F);
write32(ATH12K_MHI_MHICTRLLIMIT_LOWER, 0xFFFFFFFF);
write32(ATH12K_MHI_MHIDATALIMIT_HIGHER, 0x0F);
write32(ATH12K_MHI_MHIDATALIMIT_LOWER, 0xFFFFFFFF);
// 5. Armement des Event Ring Doorbells (ERDB)
uint64_t er0_armed_wp = er0_ring_phys + er0_ring_len - sizeof(struct mhi_ring_element);
evCtxt[0].wp = OSSwapHostToLittleInt64(er0_armed_wp);
uint64_t er1_armed_wp = er1_ring_phys + er1_ring_len - sizeof(struct mhi_ring_element);
evCtxt[1].wp = OSSwapHostToLittleInt64(er1_armed_wp);
@@ -370,16 +368,13 @@ bool QualcommWifi::loadBhiFirmware(void) {
if (erdbOff != 0 && erdbOff < 0x200000) {
write32(erdbOff + 4, (UInt32)((er0_armed_wp >> 32) & 0xFFFFFFFF));
write32(erdbOff + 0, (UInt32)(er0_armed_wp & 0xFFFFFFFF));
write32(erdbOff + 8 + 4, (UInt32)((er1_armed_wp >> 32) & 0xFFFFFFFF));
write32(erdbOff + 8 + 0, (UInt32)(er1_armed_wp & 0xFFFFFFFF));
IOLog("QualcommWifi: Event Ring Doorbells armées (ER0 @ 0x%08x WP=0x%llx, ER1 @ 0x%08x WP=0x%llx) !\n",
erdbOff, er0_armed_wp, erdbOff + 8, er1_armed_wp);
setProperty("ERDB_Offset", erdbOff, 32);
}
// 6. Bascule vers l'état M0
UInt32 mhiCtrlVal = read32(ATH12K_MHI_MHICTRL);
mhiCtrlVal &= ~(UInt32)ATH12K_MHICTRL_MHISTATE_MASK;
mhiCtrlVal |= (ATH12K_MHI_STATE_M0 << ATH12K_MHICTRL_MHISTATE_SHIFT);
@@ -387,8 +382,8 @@ bool QualcommWifi::loadBhiFirmware(void) {
IOLog("QualcommWifi: Transition MHI vers M0 demandée (MHICTRL: 0x%08x)...\n", mhiCtrlVal);
}
// Étape 5 : Téléversement FBC complet du firmware via BHIe (mhi_download_amss_image sous SBL actif)
const size_t segSize = 0x80000; // Segments de 512 Ko (SZ_512K exigé par ath12k)
// Étape 5 : Téléversement FBC complet du firmware via BHIe
const size_t segSize = 0x80000;
size_t numVecEntries = (fwSize + segSize - 1) / segSize;
IOBufferMemoryDescriptor *vecDma = IOBufferMemoryDescriptor::inTaskWithPhysicalMask(
@@ -406,7 +401,6 @@ bool QualcommWifi::loadBhiFirmware(void) {
if (vecTable && vecPhys) {
size_t curRem = fwSize;
for (size_t i = 0; i < numVecEntries; i++) {
size_t chunk = (curRem > segSize) ? segSize : curRem;
vecTable[i].dma_addr = OSSwapHostToLittleInt64((uint64_t)phys + (uint64_t)i * segSize);
@@ -422,11 +416,10 @@ bool QualcommWifi::loadBhiFirmware(void) {
write32(bhieOff + ATH12K_BHIE_TXVECSIZE, (UInt32)(numVecEntries * sizeof(struct bhi_vec_entry)));
write32(bhieOff + ATH12K_BHIE_TXVECSTATUS, 0);
// Sonnette BHIe avec Sequence ID = 1
write32(bhieOff + ATH12K_BHIE_TXVECDB, 0x1);
UInt32 bhieStatus = 0;
timeoutMs = 10000; // 10 secondes pour le transfert DMA complet de 6 Mo
timeoutMs = 10000;
while (timeoutMs > 0) {
bhieStatus = read32(bhieOff + ATH12K_BHIE_TXVECSTATUS);
UInt32 bhieState = (bhieStatus & ATH12K_BHIE_TXVECSTATUS_STATUS_MASK) >> ATH12K_BHIE_TXVECSTATUS_STATUS_SHIFT;
@@ -443,7 +436,7 @@ bool QualcommWifi::loadBhiFirmware(void) {
setProperty("BHIE_Status_State", (bhieStatus & ATH12K_BHIE_TXVECSTATUS_STATUS_MASK) >> ATH12K_BHIE_TXVECSTATUS_STATUS_SHIFT, 32);
IOLog("QualcommWifi: BHIe DMA terminé (Status=0x%08x) ! Dépouillement des événements MHI...\n", bhieStatus);
// Étape 6 : Dépouillement des événements MHI émis par SBL / AMSS sur l'anneau 0
// Étape 6 : Dépouillement des événements MHI
struct mhi_ring_element *erElements = (struct mhi_ring_element *)((uint8_t *)fDmaVirtAddr + 0x4000);
timeoutMs = 5000;
@@ -464,25 +457,11 @@ bool QualcommWifi::loadBhiFirmware(void) {
IOLog("QualcommWifi: Événement MHI reçu #%u: Type=0x%02x, Code=0x%02x, PTR=0x%llx\n",
processedEvents, evType, evCode, OSSwapLittleToHostInt64(el->ptr));
char evKey[32];
snprintf(evKey, sizeof(evKey), "MHI_Event_%u_Type", processedEvents);
setProperty(evKey, evType, 8);
snprintf(evKey, sizeof(evKey), "MHI_Event_%u_Code", processedEvents);
setProperty(evKey, evCode, 8);
snprintf(evKey, sizeof(evKey), "MHI_Event_%u_PTR", processedEvents);
setProperty(evKey, OSSwapLittleToHostInt64(el->ptr), 64);
if (evType == ATH12K_MHI_PKT_TYPE_STATE_CHANGE_EVENT) {
IOLog("QualcommWifi: -> Notification changement d'état MHI: State=%u\n", evCode);
if (evCode == ATH12K_MHI_STATE_M0) {
inM0 = true;
}
} else if (evType == ATH12K_MHI_PKT_TYPE_EE_EVENT) {
IOLog("QualcommWifi: -> Notification environnement d'exécution (EE): 0x%x\n", evCode);
if (evType == ATH12K_MHI_PKT_TYPE_STATE_CHANGE_EVENT && evCode == ATH12K_MHI_STATE_M0) {
inM0 = true;
} else if (evType == ATH12K_MHI_PKT_TYPE_EE_EVENT && (evCode == ATH12K_MHI_EE_AMSS || evCode == ATH12K_MHI_EE_WFW)) {
ee = evCode;
if (ee == ATH12K_MHI_EE_AMSS || ee == ATH12K_MHI_EE_WFW) {
amssSuccess = true;
}
amssSuccess = true;
}
processedEvents++;
}
@@ -526,8 +505,10 @@ bool QualcommWifi::loadBhiFirmware(void) {
}
bool QualcommWifi::start(IOService *provider) {
IOLog("QualcommWifi: Demarrage du pilote Wi-Fi natif (IO80211Controller)...\n");
if (!super::start(provider)) {
IOLog("QualcommWifi: Erreur - Echec de IOEthernetController::start(provider) !\n");
IOLog("QualcommWifi: Erreur - IO80211Controller::start(provider) a echoue !\n");
return false;
}
@@ -563,7 +544,6 @@ bool QualcommWifi::start(IOService *provider) {
setProperty("SoC_Major", major, 32);
setProperty("SoC_Minor", minor, 32);
// Lecture des registres de contrôle MHI et pointeurs BHI
UInt32 mhiStatus = read32(ATH12K_MHI_MHISTATUS);
UInt32 mhiCtrl = read32(ATH12K_MHI_MHICTRL);
UInt32 bhiOff = read32(ATH12K_MHI_BHIOFF);
@@ -605,37 +585,44 @@ bool QualcommWifi::start(IOService *provider) {
fMacAddress.bytes[0], fMacAddress.bytes[1], fMacAddress.bytes[2],
fMacAddress.bytes[3], fMacAddress.bytes[4], fMacAddress.bytes[5]);
// Configuration et publication des médias supportés (Auto / 1Gbps)
OSDictionary *mediumDict = OSDictionary::withCapacity(1);
// Propriétés Wi-Fi AirPort pour macOS et airportd
setProperty("IO80211AirPort", true);
setProperty("AirPort", true);
setProperty("IO80211Locale", "ETSI");
setProperty("IO80211CountryCode", "FR");
setProperty("IO80211ScanCache", true);
setProperty("IO80211RadioState", (UInt64)1, 32);
// Configuration et publication des médiums réseau (IEEE 802.11)
OSDictionary *mediumDict = OSDictionary::withCapacity(2);
if (mediumDict) {
IONetworkMedium *medium = IONetworkMedium::medium(kIOMediumEthernetAuto, 1000000000ULL);
IONetworkMedium *medium = IONetworkMedium::medium(kIOMediumIEEE80211, 54000000);
if (medium) {
IONetworkMedium::addMedium(mediumDict, medium);
publishMediumDictionary(mediumDict);
setCurrentMedium(medium);
setSelectedMedium(medium);
medium->release();
}
mediumDict->release();
}
// Attachement de l'interface réseau native (IOEthernetInterface)
if (attachInterface((IONetworkInterface **)&fNetif, true)) {
IOLog("QualcommWifi: Interface reseau (IOEthernetInterface) attachee avec succes !\n");
setProperty("Network_Interface_Attached", true);
if (!IONetworkController::attachInterface((IONetworkInterface **)&fNetif, true)) {
IOLog("QualcommWifi: Attention - Echec attachement interface reseau BSD.\n");
} else {
IOLog("QualcommWifi: Echec de attachInterface IOEthernetInterface.\n");
setProperty("Network_Interface_Attached", false);
IOLog("QualcommWifi: Interface reseau attachee avec succes (enX) !\n");
}
registerService();
IOLog("QualcommWifi: Pilote Wi-Fi natif demarre avec succes !\n");
return true;
}
void QualcommWifi::stop(IOService *provider) {
IOLog("QualcommWifi: Arret du pilote, liberation interface reseau, MSI, DMA et BAR0.\n");
IOLog("QualcommWifi: Arret du pilote Wi-Fi natif, liberation MSI, DMA et BAR0.\n");
if (fNetif) {
detachInterface(fNetif);
IONetworkController::detachInterface(fNetif);
OSSafeReleaseNULL(fNetif);
}
@@ -648,7 +635,6 @@ void QualcommWifi::stop(IOService *provider) {
OSSafeReleaseNULL(fInterruptSource);
}
// Déverrouillage et libération du tampon DMA avant la fermeture PCIe
freeDmaContext();
fBar0Virt = nullptr;
@@ -674,7 +660,6 @@ IOReturn QualcommWifi::enable(IONetworkInterface *netif) {
IOLog("QualcommWifi: Interface reseau activee par macOS.\n");
if (!fFirmwareLoaded) {
// Allocation du tampon DMA 36-bit pour les anneaux MHI / BHI
if (allocDmaContext(ATH12K_DMA_TEST_RING_SIZE)) {
setProperty("DMA_PhysAddr", (uint64_t)fDmaPhysAddr, 64);
@@ -700,7 +685,6 @@ IOReturn QualcommWifi::enable(IONetworkInterface *netif) {
}
}
// Chargement du firmware radio AMSS via le protocole BHI
if (loadBhiFirmware()) {
fFirmwareLoaded = true;
}
@@ -724,3 +708,268 @@ UInt32 QualcommWifi::outputPacket(mbuf_t m, void *param) {
}
return kIOReturnOutputDropped;
}
void QualcommWifi::dataLinkLayerAttachComplete(void) {
IOLog("QualcommWifi: dataLinkLayerAttachComplete (Skywalk Tahoe).\n");
}
IOReturn QualcommWifi::handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) {
return (IOReturn)handleApple80211Request((unsigned int)req_type, isSet ? 1 : 0, req_data);
}
IOReturn QualcommWifi::getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_DRIVER_VERSION, 0, vd);
}
IOReturn QualcommWifi::getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_HARDWARE_VERSION, 0, vd);
}
IOReturn QualcommWifi::getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_CARD_CAPABILITIES, 0, cap);
}
IOReturn QualcommWifi::getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, -1, pwr);
}
IOReturn QualcommWifi::setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) {
int val = (pwr && pwr->power_state[0]) ? 1 : 0;
return (IOReturn)handleApple80211Request(APPLE80211_IOC_POWER, val, pwr);
}
IOReturn QualcommWifi::getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) {
return (IOReturn)handleApple80211Request(APPLE80211_IOC_COUNTRY_CODE, 0, cc);
}
SInt32 QualcommWifi::handleApple80211Request(unsigned int req_type, int req_val, void* req_data) {
switch (req_type) {
case APPLE80211_IOC_CARD_CAPABILITIES: {
apple80211_capability_data *cap = (apple80211_capability_data *)req_data;
if (cap) {
bzero(cap, sizeof(*cap));
cap->version = APPLE80211_VERSION;
#define SET_CAP(c) (cap->capabilities[(c) / 8] |= (1 << ((c) % 8)))
SET_CAP(APPLE80211_CAP_WEP);
SET_CAP(APPLE80211_CAP_TKIP);
SET_CAP(APPLE80211_CAP_AES_CCM);
SET_CAP(APPLE80211_CAP_WPA1);
SET_CAP(APPLE80211_CAP_WPA2);
SET_CAP(APPLE80211_CAP_WPA);
SET_CAP(APPLE80211_CAP_SHORT_GI_20MHZ);
SET_CAP(APPLE80211_CAP_SHORT_GI_40MHZ);
SET_CAP(APPLE80211_CAP_BURST);
SET_CAP(APPLE80211_CAP_WME);
SET_CAP(APPLE80211_CAP_PMGT);
SET_CAP(APPLE80211_CAP_SHPREAMBLE);
SET_CAP(APPLE80211_CAP_SHSLOT);
#undef SET_CAP
return 0;
}
break;
}
case APPLE80211_IOC_STATE: {
apple80211_state_data *state = (apple80211_state_data *)req_data;
if (state) {
state->version = APPLE80211_VERSION;
state->state = fLinkActive ? APPLE80211_S_RUN : APPLE80211_S_INIT;
return 0;
}
break;
}
case APPLE80211_IOC_PHY_MODE: {
apple80211_phymode_data *pm = (apple80211_phymode_data *)req_data;
if (pm) {
pm->version = APPLE80211_VERSION;
pm->phy_mode = APPLE80211_MODE_11AX;
pm->active_phy_mode = APPLE80211_MODE_11AX;
return 0;
}
break;
}
case APPLE80211_IOC_OP_MODE: {
apple80211_opmode_data *om = (apple80211_opmode_data *)req_data;
if (om) {
om->version = APPLE80211_VERSION;
om->op_mode = APPLE80211_M_STA;
return 0;
}
break;
}
case APPLE80211_IOC_CHANNEL: {
apple80211_channel_data *cd = (apple80211_channel_data *)req_data;
if (cd) {
if (req_val == 1 && cd->channel.channel > 0) {
fCurrentChannel = (UInt16)cd->channel.channel;
IOLog("QualcommWifi: Changement de canal Wi-Fi vers %u\n", fCurrentChannel);
}
cd->version = APPLE80211_VERSION;
cd->channel.version = APPLE80211_VERSION;
cd->channel.channel = fCurrentChannel > 0 ? fCurrentChannel : 1;
cd->channel.flags = (cd->channel.channel <= 14) ? (APPLE80211_C_FLAG_2GHZ | APPLE80211_C_FLAG_20MHZ) : (APPLE80211_C_FLAG_5GHZ | APPLE80211_C_FLAG_80MHZ);
return 0;
}
break;
}
case APPLE80211_IOC_TXPOWER: {
apple80211_txpower_data *tx = (apple80211_txpower_data *)req_data;
if (tx) {
tx->version = APPLE80211_VERSION;
tx->txpower_unit = APPLE80211_UNIT_DBM;
tx->txpower = 20; // 20 dBm (100 mW)
return 0;
}
break;
}
case APPLE80211_IOC_PROTMODE:
case APPLE80211_IOC_POWERSAVE:
case APPLE80211_IOC_SCANCACHE_CLEAR: {
return 0;
}
case APPLE80211_IOC_RSSI: {
apple80211_rssi_data *rd = (apple80211_rssi_data *)req_data;
if (rd) {
rd->version = APPLE80211_VERSION;
rd->num_radios = 1;
rd->rssi_unit = APPLE80211_UNIT_DBM;
rd->rssi[0] = fLastRssi ? fLastRssi : -50;
rd->aggregate_rssi = rd->rssi[0];
return 0;
}
break;
}
case APPLE80211_IOC_NOISE: {
apple80211_noise_data *nd = (apple80211_noise_data *)req_data;
if (nd) {
nd->version = APPLE80211_VERSION;
nd->num_radios = 1;
nd->noise_unit = APPLE80211_UNIT_DBM;
nd->noise[0] = -95;
nd->aggregate_noise = -95;
return 0;
}
break;
}
case APPLE80211_IOC_SSID: {
apple80211_ssid_data *sd = (apple80211_ssid_data *)req_data;
if (sd) {
sd->version = APPLE80211_VERSION;
sd->ssid_len = fSsidLen;
memcpy(sd->ssid_bytes, fSsid, fSsidLen);
return 0;
}
break;
}
case APPLE80211_IOC_BSSID: {
apple80211_bssid_data *bd = (apple80211_bssid_data *)req_data;
if (bd) {
bd->version = APPLE80211_VERSION;
memcpy(bd->bssid.octet, fBssid, 6);
return 0;
}
break;
}
case APPLE80211_IOC_RATE: {
apple80211_rate_data *rate = (apple80211_rate_data *)req_data;
if (rate) {
rate->version = APPLE80211_VERSION;
rate->num_radios = 1;
rate->rate[0] = 1200;
return 0;
}
break;
}
case APPLE80211_IOC_SUPPORTED_CHANNELS: {
apple80211_sup_channel_data *sc = (apple80211_sup_channel_data *)req_data;
if (sc) {
sc->version = APPLE80211_VERSION;
static const UInt16 chs[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144, 149, 153, 157, 161, 165 };
sc->num_channels = sizeof(chs)/sizeof(chs[0]);
for (int i = 0; i < sc->num_channels; i++) {
sc->supported_channels[i].version = APPLE80211_VERSION;
sc->supported_channels[i].channel = chs[i];
sc->supported_channels[i].flags = (chs[i] <= 14) ? (APPLE80211_C_FLAG_2GHZ | APPLE80211_C_FLAG_20MHZ) : (APPLE80211_C_FLAG_5GHZ | APPLE80211_C_FLAG_80MHZ);
}
return 0;
}
break;
}
case APPLE80211_IOC_SCAN_REQ:
case APPLE80211_IOC_SCAN_REQ_MULTIPLE: {
IOLog("QualcommWifi: Requete de scan Wi-Fi recue depuis airportd !\n");
fScanInProgress = true;
return 0;
}
case APPLE80211_IOC_SCAN_RESULT: {
return 0;
}
case APPLE80211_IOC_POWER: {
apple80211_power_data *pwr = (apple80211_power_data *)req_data;
if (pwr) {
pwr->version = APPLE80211_VERSION;
pwr->num_radios = 1;
if (req_val == 0 || req_val == 1) {
fLinkActive = (req_val == 1);
IOLog("QualcommWifi: Bascule alimentation radio Wi-Fi : %s\n", fLinkActive ? "ACTIVE" : "COUPEE");
}
pwr->power_state[0] = fLinkActive ? 1 : 0;
return 0;
}
break;
}
case APPLE80211_IOC_COUNTRY_CODE: {
apple80211_country_code_data *cc = (apple80211_country_code_data *)req_data;
if (cc) {
cc->version = APPLE80211_VERSION;
cc->cc[0] = 'F';
cc->cc[1] = 'R';
cc->cc[2] = 0;
return 0;
}
break;
}
case APPLE80211_IOC_LOCALE: {
apple80211_locale_data *loc = (apple80211_locale_data *)req_data;
if (loc) {
loc->version = APPLE80211_VERSION;
loc->locale = APPLE80211_LOCALE_ETSI;
return 0;
}
break;
}
case APPLE80211_IOC_DRIVER_VERSION:
case APPLE80211_IOC_HARDWARE_VERSION: {
apple80211_version_data *vd = (apple80211_version_data *)req_data;
if (vd) {
vd->version = APPLE80211_VERSION;
const char *verStr = "Qualcomm FastConnect 7800 Wi-Fi 7 (v1.1.0)";
vd->string_len = (u_int16_t)strlen(verStr);
strlcpy(vd->string, verStr, sizeof(vd->string));
return 0;
}
break;
}
case APPLE80211_IOC_ASSOCIATE: {
apple80211_assoc_data *assoc = (apple80211_assoc_data *)req_data;
if (assoc) {
IOLog("QualcommWifi: Demande d'association au reseau Wi-Fi : %.*s\n", assoc->ad_ssid_len, assoc->ad_ssid);
fSsidLen = (assoc->ad_ssid_len < APPLE80211_MAX_SSID_LEN) ? assoc->ad_ssid_len : APPLE80211_MAX_SSID_LEN;
memcpy(fSsid, assoc->ad_ssid, fSsidLen);
memcpy(fBssid, assoc->ad_bssid.octet, 6);
fLinkActive = true;
return 0;
}
break;
}
case APPLE80211_IOC_DISASSOCIATE: {
IOLog("QualcommWifi: Deconnexion Wi-Fi demandee par macOS.\n");
fLinkActive = false;
fSsidLen = 0;
return 0;
}
default:
break;
}
return 0;
}
QualcommWifi/QualcommWifi.hpp
+34 -3
View File
@@ -13,6 +13,12 @@
#include <IOKit/network/IOEthernetInterface.h>
#include <IOKit/network/IOOutputQueue.h>
#include <IOKit/network/IONetworkMedium.h>
#include <IOKit/80211/apple80211_var.h>
#include <IOKit/80211/apple80211_ioctl.h>
#include <IOKit/80211/IO80211Controller.h>
#include <IOKit/80211/IO80211SkywalkInterface.h>
#include <IOKit/80211/IO80211WorkQueue.h>
#include "Firmware_WCN7850_Wifi.h"
// Registres PCIe et constantes de fenêtrage (ath12k/pci.h)
@@ -169,7 +175,7 @@ struct mhi_ring_element {
#define MHI_TRE_GET_EV_STATE(tre) (((tre)->dword[0] >> 24) & 0xFF)
#define MHI_TRE_GET_EV_EXECENV(tre) (((tre)->dword[0] >> 24) & 0xFF)
class QualcommWifi : public IOEthernetController {
class QualcommWifi : public IO80211Controller {
OSDeclareDefaultStructors(QualcommWifi)
private:
@@ -179,13 +185,17 @@ private:
UInt32 fCurrWindow;
IOInterruptEventSource *fInterruptSource;
IOEthernetInterface *fNetif;
IONetworkInterface *fNetif;
IOEthernetAddress fMacAddress;
// État réseau
// État réseau Wi-Fi
bool fLinkActive;
UInt16 fCurrentChannel;
SInt32 fLastRssi;
UInt8 fSsid[APPLE80211_MAX_SSID_LEN];
UInt32 fSsidLen;
UInt8 fBssid[6];
bool fScanInProgress;
// Tampon DMA physiquement contigu
IOBufferMemoryDescriptor *fDmaBuf;
@@ -220,6 +230,27 @@ public:
virtual IOReturn enable(IONetworkInterface *netif) override;
virtual IOReturn disable(IONetworkInterface *netif) override;
virtual UInt32 outputPacket(mbuf_t m, void *param) override;
// macOS Tahoe 26.x (Darwin 25) IO80211Controller Skywalk overrides
virtual bool isCommandProhibited(int command) override { return false; }
virtual IOReturn handleCardSpecific(IO80211SkywalkInterface *iface, unsigned long req_type, void *req_data, bool isSet) override;
virtual UInt32 hardwareOutputQueueDepth(void) override { return 0; }
virtual SInt32 performCountryCodeOperation(IO80211CountryCodeOp op) override { return 0; }
virtual void dataLinkLayerAttachComplete(void) override;
virtual SInt32 enableFeature(IO80211FeatureCode code, void *arg) override { return 0; }
virtual IOReturn getDRIVER_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override;
virtual IOReturn getHARDWARE_VERSION(IO80211SkywalkInterface *iface, apple80211_version_data *vd) override;
virtual IOReturn getCARD_CAPABILITIES(IO80211SkywalkInterface *iface, apple80211_capability_data *cap) override;
virtual IOReturn getPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override;
virtual IOReturn setPOWER(IO80211SkywalkInterface *iface, apple80211_power_data *pwr) override;
virtual IOReturn getCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override;
virtual IOReturn setCOUNTRY_CODE(IO80211SkywalkInterface *iface, apple80211_country_code_data *cc) override { return kIOReturnSuccess; }
virtual IOReturn setGET_DEBUG_INFO(IO80211SkywalkInterface *iface, apple80211_debug_command *dbg) override { return kIOReturnSuccess; }
virtual void* getLogger(void) const override { return nullptr; }
virtual void* getFaultReporterFromDriver(void) override { return nullptr; }
// Dispatcher de requêtes Apple80211 / airportd
SInt32 handleApple80211Request(unsigned int req_type, int req_val, void* req_data);
};
#endif
QualcommWireless/include/IOKit/80211/IO80211Controller.h
+7 -5
View File
@@ -151,7 +151,7 @@ public:
virtual IOWorkLoop* getWorkLoop(void) const APPLE_KEXT_OVERRIDE;
virtual const char* stringFromReturn(int) APPLE_KEXT_OVERRIDE;
virtual int errnoFromReturn(int) APPLE_KEXT_OVERRIDE;
virtual IOOutputQueue* getOutputQueue(void) const APPLE_KEXT_OVERRIDE;
virtual IOOutputQueue* getOutputQueue(void) const APPLE_KEXT_OVERRIDE { return IOEthernetController::getOutputQueue(); }
virtual bool createWorkLoop(void) APPLE_KEXT_OVERRIDE;
virtual IOReturn enable(IONetworkInterface *) APPLE_KEXT_OVERRIDE;
virtual IOReturn disable(IONetworkInterface *) APPLE_KEXT_OVERRIDE;
@@ -159,8 +159,8 @@ public:
#if __IO80211_TARGET >= __MAC_10_15
virtual void detachInterface(IONetworkInterface *iface, bool sync = false) APPLE_KEXT_OVERRIDE { IOEthernetController::detachInterface(iface, sync); }
#endif
virtual IONetworkInterface* createInterface(void) APPLE_KEXT_OVERRIDE;
virtual bool configureInterface(IONetworkInterface *iface) APPLE_KEXT_OVERRIDE;
virtual IONetworkInterface* createInterface(void) APPLE_KEXT_OVERRIDE { return IOEthernetController::createInterface(); }
virtual bool configureInterface(IONetworkInterface *iface) APPLE_KEXT_OVERRIDE { return IONetworkController::configureInterface(iface); }
#ifdef __PRIVATE_SPI__
virtual IOReturn outputStart(IONetworkInterface *,UInt) APPLE_KEXT_OVERRIDE;
#endif
@@ -168,8 +168,10 @@ public:
#if __IO80211_TARGET >= 260000
// macOS Tahoe 26.x (Darwin 25, IO80211Family 1200.13.1 / source 1566.5)
// Slots 394..462 (offsets 0xc50..0xe70)
virtual bool isCommandProhibited(int) = 0; // slot 394 (0xc50)
// Exact 466-slot alignment matching BootKernelExtensions.kc __ZTV17IO80211Controller
virtual void _RESERVEDIOEthernetController_tahoe0() {} // slot 394 (0xc50)
virtual void _RESERVEDIOEthernetController_tahoe1() {} // slot 395 (0xc58)
virtual bool isCommandProhibited(int) = 0; // slot 396 (0xc60)
virtual bool createWorkQueue(void); // slot 395 (0xc58)
virtual bool debugStateInit(void); // slot 396 (0xc60)
virtual IO80211WorkQueue* getWorkQueue(void) const; // slot 397 (0xc68)
build_wifi.sh
+1 -1
View File
@@ -25,7 +25,7 @@ clang++ -target x86_64-apple-macos26.5 \
-I"${SCRIPT_DIR}/QualcommWifi" \
-std=c++17 -fno-builtin -fno-common -mkernel -fno-rtti -fno-exceptions \
-fno-stack-protector -fno-strict-aliasing -Os \
-DKERNEL -DAPPLE_KEXT_OVERRIDE=override \
-DKERNEL -D__IO80211_TARGET=260000 -DAPPLE_KEXT_OVERRIDE=override \
-c "${SCRIPT_DIR}/QualcommWifi/QualcommWifi.cpp" \
-o "${BUILD_DIR}/QualcommWifi.o"