appleintelwifi / adapter

Kext providing initial support for Intel wireless devices

adapter

Please note: this project is now unsupported. Please go to itlwm if you would like a supported kext.

Purpose

This is a kext which aims to provide support for Intel wireless devices on MacOS. It is intended to provide similar support with MacOS as a native AirPort device (via the IO80211Controller private IOKit class).

This kext does not function yet. Do NOT install this into Clover, or /S/L/E. You WILL ruin your system.

Supported devices

Card Name	PCI ID	Supported	Planned Support	Relevant Threads
Intel(R) Dual Band Wireless AC 3160	8086:08B4, 8086:0B83	No (LMAC scanning)	Yes
Intel(R) Dual Band Wireless AC 3165	8086:3165, 8086:3166	No (LMAC scanning)	Yes	device-logs#6
Intel(R) Dual Band Wireless AC 3168	8086:24FB	Unknown (CNVi card)	Unknown	device-logs#8
Intel(R) Dual Band Wireless AC 4165	8086:24F5, 8086:24F6	Unknown (similar to 8xxx series)	Unknown
Intel(R) Dual Band Wireless AC 7260	8086:08B1	Yes (confirmed)	Yes
Intel(R) Dual Band Wireless N 7260	8086:08B2	Unconfirmed	Unknown
Intel(R) Dual Band Wireless AC 7265	8086:095A, 8086:095B	Unconfirmed	Unknown	device-logs#12
Intel(R) Wireless N 7265	8086:095A, 8086:095B	Unconfirmed	Unknown
Intel(R) Dual Band Wireless AC 8260	8086:24F3	Yes (confirmed)	Yes	device-logs#7 device-logs#11 device-logs#13
Intel(R) Dual Band Wireless AC 8265	8086:24F3, 8086:24FD	Yes (confirmed)	Yes	device-logs#9
Intel(R) Dual Band Wireless AC 8275	8086:24FD	Yes (confirmed)	Yes
Intel(R) Dual Band Wireless-AC 9162	Unknown	Unknown (CNVi card)	Unknown
Intel(R) Dual Band Wireless-AC 9260	8086:2526, 8086:0000 8086:0010, 8086:0014 8086:0018, 8086:0210 8086:0214, 8086:4010 8086:8014, 8086:a014	Support varies	Yes
Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)	8086:2526, 1a56:1550	Unknown (rebrand)	Unknown
Intel(R) Dual Band Wireless-AC 9270	8086:1410, 8086:1610	Unknown	Unknown
Intel(R) Dual Band Wireless-AC 9461	8086:0060, 8086:0064 8086:0260, 8086:0264	Unknown (CNVi card?)	Unknown
Intel(R) Dual Band Wireless-AC 9462	8086:00a0, 8086:00a4 8086:02a0, 8086:02a4 8086:40a4, 8086:42a4	Unknown (CNVi card?)	Unknown	device-logs#14
Intel(R) Dual Band Wireless-AC 9560	8086:0030, 8086:0034 8086:0038, 8086:003c 8086:0230, 8086:0234 8086:0238, 8086:023c 8086:2030, 8086:2034 8086:4030, 8086:4034 8086:4234	Mixed results (some are CNVi, some are PCIe)	Yes	device-logs#1
Killer(R) Wireless-AC 1550s Wireless Network Adapter	1a56:1551	Unknown (rebrand)	Unknown
Killer(R) Wireless-AC 1550i Wireless Network Adapter	1a56:1552	Unknown (rebrand)	Unknown
Intel(R) Dual Band Wireless-AC 19560	8086:1030	Unknown (gigabit card?)	Unknown

If your card is not listed here (or does not have an open issue), please open an issue here: https://github.com/AppleIntelWifi/device-logs

NOTE: AX-series cards are currently NOT supported, and are very likely to never be supported.

Build instructions

./scripts/build.sh && ./scripts/load.sh

Credits

Apple for making macOS, and all of the gloriousawful APIs that I use

@zxystd for writing the initial base code for this kext

Intel for the cheap wireless devices

@acidanthera for the CI configuration

@comex for this amazing gist which contains several structs I didn't want to RE

@rpeshkov for paving the way initially with IntelWifi/Black80211

adapter's Issues

Intel 9462, weird freeze

For some reason, the first time I loaded the latest version it was working way better then it did yesterday (before the latest changes), but after that - I load the kext, go to system preferences, and when I press on anything wi-fi related my laptop just freezes completely.

来支持下大佬，目前没有intelwifi驱动的消息都懒得去远景了

楼主你要是有更新，我们还能拿到最新的包吗？

Proper state-handling

A major issue I keep finding is: how do we handle 802.11 well? Taking examples from other 802.11 stacks, there's a transport layer and a hardware abstraction layer, as well as a higher level 802.11 layer.

Should we model our driver after these? How should we do such?

Code beautification

This entire kext is a mix between C and C++. Unifying a lot of the loose functions such as:

adapter/AppleIntelWifiAdapter/mvm/IWLMvmMac.cpp

Lines 11 to 16 in 86dfded

	int iwl_legacy_config_umac_scan(IWLMvmDriver* drv) {
	IWL_ERR(0, "legacy config not implemented");
	return -1;
	}
	int iwl_config_umac_scan(IWLMvmDriver* drv) {

would help significantly for further development.

Missing Info.plist error

The kext builds succesfully in both the scripts and in XCode, but I cannot get the kext to load anymore. Whenever the script (or I manually) run sudo kextload AppleIntelWifiAdapterV2.kext, I get an error in the log stating that it could not find the Info.plist. Looking in the kext though, there is an Info.plist in the correct place.

Other kexts that I build are able to be loaded and ran, so this confuses me, and was wondering if you've come across this too.

Parsing 802.11 frames

Do we need to do this? Is there any way we can directly pass these to Apple80211?

Kext loads but no networks appear when searching

Kext loads perfectly fine but when i try to search for networks, nothing appears.
Wireless card: Intel AC-3165.
Hackintosh: Lenovo 530s-15ikb.
macOS ver: macOS 10.15.4
If i can help with something for solving this problem (extra files or something) i'm here! :)

Does not show all wireless networks

Very much a quality of life thing.. but not all networks will immediately be shown within the selector.

As well, no 5Ghz channels are shown.... (perhaps this is because it's a passive scan?)

"airport" utility does not understand kIOReturnBusy

How can we make the airport utility understand when we're busy scanning for wireless networks?

Maybe we need to make more people foucs on this excellent project

Come on～

Massive tx issue

INFO: Rx interrupt
INFO: Queue: cc7520b8
INFO: Q 0: HW = 32, SW = 31 (total: 256, used: 0, free: 1)
INFO: Q 0: cmd at offset 0: SCD_QUEUE_CFG (01.1d, seq 0x1f)
INFO: Clearing HCMD_ACTIVE for command SCD_QUEUE_CFG
INFO: Q 0: RB end marker at offset 64
ERR: rx failed
INFO: command response.
INFO: enable interrupt
INFO: Attempting to send sync command SCD_QUEUE_CFG
INFO: Setting HCMD_ACTIVE for command SCD_QUEUE_CFG
ERR: No space in command queue <-- SHOULD NEVER HAPPEN
ERR: Error sending SCD_QUEUE_CFG: enqueue_hcmd failed: -28
ERR: Could not enable tx queue 2 (error -28)
INFO: DEVICE_ENABLED bit was set and is now cleared
INFO: Stopping TX DMA channels
INFO: Stopping Rx dma channels
INFO: Stop card, put in low power state
INFO: Init card's basic functions
INFO: finishNicInit
INFO: stop master
INFO: Enabling rfkill interrupt
INFO: prepareCardHW

Somehow we're not restocking our command queue? Is this expected behavior?

Scan does not return a response

adapter/AppleIntelWifiAdapter/mvm/IWLMvmMac.cpp

Line 390 in 39d763b

err = drv->sendCmd(&hcmd);

This command NEVER receives a response. It gets sent to the firmware, however, we never receive a response from the uMAC subsystem.
Is this potentially related to:

• incorrect hardware configuration
• missing several initialization phases
• incorrect sta from adding aux sta?
• aux sta config fail?

Needs more investigation.

clarify between pointers allocated via allocatePacket and IOAlloc

We’re having some massive issues with freeing memory (as often we will mix up memory allocated via allocatePacket and IOAlloc)- we sadly cannot call IOFree on both types as they are both vastly different and cannot be freed directly as we’re doing. Perhaps we should add a header to each block we allocate and distinguish between memory allocated via allocatePacket and IOAlloc and free accordingly?

Implement MSI-X

MSI-X is undocumented (unfortunately), but it IS supported within MacOS through the IOPCIFamily (and several drivers are aware of it). Currently, we patched it out because of no knowledge of MSI-X even existing (or, really, working), however, adding it in should be a priority.

intel wifi 9560ac dualband log.txt

kext build and load with Hackintool. But not connected wifi to networks...
log.txt

Intel(R) Dual Band Wireless AC 3160

I can turn on/off wifi but I can't scan wifi and connect.
My log: log.txt

Switching from IOMalloc to a custom allocator

We should really begin the switch from IOMalloc to something that uses OSAlloc (with the tag).
It'll eventually help with overall memory usage (and help us track unfreed buffers)

Accessing m_pDevice within IOCTLs

adapter/AppleIntelWifiAdapter/AppleIntelWifi_iokit.cpp

Line 429 in 84517d8

if(drv->m_pDevice->umac_scanning) {

This one line fails, even after it's been set by the driver in the IWLMvmDriver::enableDevice() function. Am I missing something here?
It's called by AppleIntelWifiAdapterV2::apple80211Request(), which is in turn called through the ioctl mechanism within the xnu kernel... yet I seemingly cannot reference any class variables. I feel like I'm glossing over a significant issue here...

Bluetooth coex problem

Whenever we are doing uMAC scanning, it seems to disrupt bluetooth connectivity.
Some general questions:

• Is this because we don't setup BT_COEX as soon as possible?
• Is this an issue with HOW we set up BT_COEX?
• Is this an issue in other drivers?

Kext can't load

Describe the bug
https://intelwifi.0xcc.pw/
Downloaded relalease kext from here and tried to load it via kextload but the error says it can't load it.
So are you aware of this sir? Becuase 6 days ago you have said you're fixing something is it related and this will be fixed too?

By the way how do I build the kext myself?I don't know I have xcode installed but I don't know how.

Thank you so much for your priceless efforts.

Implement full umac/lmac scanning

Capabilities are not properly reflected in the wireless panel

IOKit does not know if a channel is:

• 802.11n
• 802.11g
• 802.11b
  As such, it automatically defaults to 802.11g (which it shouldn't..)

Security audit

Historically, there have been significant kernel exploits (IOSurface, etc). If this is a serious development effort, then there should be a serious effort in vetting major portions of this kext.
Some major things to look out for:

• Do we memcpy() to a user-controlled length anywhere?
• Do we ever reference a pointer which has already been freed?

Would love some input on this.

Scanning results take a long time to return back to users

Is this the fault of the scan cache?
There are DEFINITELY some good ways to optimize this and make it more efficient...
but why aren't they working?

Unable to load due to missing symbols

Describe the bug
Kext fails to load on MacOS 10.15.4 due to unresolved symbols.

How to reproduce
Download from website or build from source, run sudo kextload $KEXTNAME. Get this error:

Kext with invalid signature (-67050) allowed: <OSKext 0x7fc4b3527c60 [0x7fff8ba058c0]> { URL = "file:///Users/bin/code/adapter/build/Build/Products/Debug/AppleIntelWifiAdapterV2.kext/", ID = "com.apple.AppleIntelWifiAdapterV2" }
Code Signing Failure: code signature is invalid
Disabling KextAudit: SIP is off
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: The following symbols are unresolved for this kext:
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: 	__Z11initTimeoutP10IOWorkLoop
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: 	__Z14releaseTimeoutv
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: 	__ZN8CTimeout9metaClassE
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: 	__ZN8CTimeoutC1Ev
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: 	__fCommandGate
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: 	__fWorkloop
(kernel) Can't load kext com.apple.AppleIntelWifiAdapterV2 - link failed.
(kernel) Failed to load executable for kext com.apple.AppleIntelWifiAdapterV2.
(kernel) Kext com.apple.AppleIntelWifiAdapterV2 failed to load (0xdc008016).
(kernel) Failed to load kext com.apple.AppleIntelWifiAdapterV2 (error 0xdc008016).
Failed to load /Users/bin/code/adapter/build/Build/Products/Debug/AppleIntelWifiAdapterV2.kext - (libkern/kext) link error.
Check library declarations for your kext with kextlibs(8).

Expected behavior
Have the kext load.

Wireless card name
Intel 9260

Kext failed to load - (libkern/kext) link error

kextutil output:

Kext with invalid signatured (-67050) allowed: <OSKext 0x7f806140c6f0 [0x7fff9832a8e0]> { URL = "file:///Users/superusr/Desktop/AppleIntelWifiAdapterV2.kext/", ID = "com.apple.AppleIntelWifiAdapterV2" }
Code Signing Failure: code signature is invalid
Disabling KextAudit: SIP is off
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: The super class vtable '__ZTV8OSObject' for vtable '__ZTV12IWLMvmDriver' is out of date. Make sure your kext has been built against the correct headers.
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: The super class vtable '__ZTV8OSObject' for vtable '__ZTV13IWLCachedScan' is out of date. Make sure your kext has been built against the correct headers.
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: The super class vtable '__ZTV17IO80211Controller' for vtable '__ZTV23AppleIntelWifiAdapterV2' is out of date. Make sure your kext has been built against the correct headers.
(kernel) kxld[com.apple.AppleIntelWifiAdapterV2]: The super class vtable '__ZTV8OSObject' for vtable '__ZTV8CTimeout' is out of date. Make sure your kext has been built against the correct headers.
(kernel) Can't load kext com.apple.AppleIntelWifiAdapterV2 - link failed.
(kernel) Failed to load executable for kext com.apple.AppleIntelWifiAdapterV2.
(kernel) Kext com.apple.AppleIntelWifiAdapterV2 failed to load (0xdc008016).
(kernel) Failed to load kext com.apple.AppleIntelWifiAdapterV2 (error 0xdc008016).
Failed to load /Users/superusr/Desktop/AppleIntelWifiAdapterV2.kext - (libkern/kext) link error.

Intel 9462, umac (?)

Not sure if that belongs to here, but:
Is that supposed to say "umac: no" and then scan umac?

something is definitely wrong (I don't know if it related to umac really, my knowledge is very limited in this subject), because it does find all networks it should (which is a first for me with this card on macOS 🎉), but it only shows up in the log, not in the interface (search for " 2020-04-06 16:41:15.846844+0300 0x2985e " in the log)
log.txt

Edit: Also, it doesn't look like it scans for all channels and I don't know if this is expected behaviour / I'm just wrong.

Edit 2: Forgot to add that this are the results using ./build-ci.sh , as ./build.sh is giving me only 1-2 networks in the interface, but none of them actually appears in the log...

No definition for `initTimeout`, `releaseTimeout`, etc.

After the latest commit, the kext won't load since there's no definition for functions initTimeout(IOWorkloop *workloop), releaseTimeout() at timeout.h. Also, external variables _fCommandGate and _fWorkLoop are not defined.

allocate_dma_buf can crash the entire system

I've only experienced this on a VM, but I've noticed that certain times allocate_dma_buf will conflict with another driver and can cause a full crash.

Any Guide or Documentation how could I load the kext?

I find it very difficult to find the guide to load the kext . I am not that technically informed in the hackintosh community (Mostly Linux and WIndows poweruser) so It would be good to make a word or two about installation of the kext. script command would be even nicer. That will surely help with installing the kext on more hackintoshes and thus more logs and more issues are found the better it would be to shove some light into those areas.
BTW could someone point out how do I install the kext.

!! DO NOT CREATE ISSUES ABOUT CARD SUPPORT HERE !!

If you are concerned about your card being supported, or if you are trying to provide a log for your card that I have not EXPLICITLY asked for within an issue, PLEASE create an issue with your log file as an ATTACHMENT here.

Disregarding these instructions will lead to your comment being deleted, or your issue being closed. I cannot stress this ENOUGH

To-do list

Hi there,

Nice work on the progress you've made! I installed this with a 9260 device and it gets detected as a wireless device. It can't find or connect to any networks yet though but it's the best kext I've installed so far.

I was wondering if you had a todo list of things that need doing. I've never worked in this area but I'm willing to try as I have a vested interest in getting it working

Feel free to close this when you've read it. Thanks!

Investigate use of Apple80211 rather then implementing IEEE80211

Apple80211 is already a full fledged supplicant providing the state machine functionality we're desiring after. If this is intended to be a drop in replacement, and provide AirPort functionality, we should REALLY use the RSNSupplicant rather then dealing with the nightmare that is implementing a full 802.11 stack into the driver.

Firmware Upload fails after rebooting from Windows

Windows leaves the card in a bad state. Rebooting from Windows into Linux seems to work, so something might be missing something when initializing the card.
Doing a shutdown then boot up seems to fix this.

Kext won't load macOS 10.15.4 (19E287)

Tried using the scripts in the folder to load the kext and have tried using kextload but get "failed to load - (libkern/kext) not found.
AC 3160, macOS 10.15.4 (19E287)
Not sure if this is the right place for this issue will remove if needed.
log.txt

load.sh have a error

Describe the bug
./scripts/load.sh: line 10: .unload.sh: command not found

How to reproduce
./scripts/build.sh && ./scripts/load.sh

Deal with methods

1.Edit load.sh
2.Change '(.unload.sh | true)' to '(./scripts/unload.sh | true)

regression: iwl_mvm_has_ultra_hb_channel not detected correctly by driver

iwl_mvm_has_ultra_hb_channel is part of the allocation sequence for adding phy contexts- a special case must be added for 8xxx series devices to bypass this check, but apply it to 9xxx series devices. I'm seeing context initialization failures from this one change.

building problem

AppleIntelWifiAdapterV2.kext.zip

how to get file.kext?

i dont see a kext file in my download folder

Security Algorithm of networks is by default set to WEP

Hello,
Every networks found is recognized by the kernel extension as WEP secured networks.
Exemple of a WPA2-PSK (AES) network

Good luck about doing this driver 👍

Hardware:
Intel AC-8260
Xiaomi Mi Air 13.3

Logs:
log.txt

Note about issue #19 5G networks is now visible and network detection is really fast.

Switch from scanning every single channel to directed scans (for channels)

Licensing

A major to-do: add in the licensing information for the sources which we have used. It’s a small, but legal hurdle we should jump through

Promoting community involvement

How do we promote community involvement? I would REALLY enjoy more eyes reviewing over the code in this repo. The device-logs is a hub of activity, but I wish there were more pull requests and help with code.

Documenting functions and discoveries

There is a significant lack of information out in the public about Apple's 802.11 stack (and, moreover, creating a wireless driver FOR such). We should start documenting all of our work (and our previous work), to make it easy to understand for others who may eventually come along.

Card does not respond after sleeping laptop/device

If you set your device to sleep and then wake up, the card does not respond.
Likely need to do something to tell the card to wake up?

Edit: Here is a partial log showing scans before and after sleeping - the first failed scan is at 12:28.42
Log.txt
We never get an interrupt back from the card.

IE is not parsed by Apple80211

For some reason, the IE is not parsed by this library. Some main thoughts/suspicions:

• are we free()‘ing too early?
• does the asr_age field play into this?
• does endian matter??
• is the IE shorter then expected?
• does the IOCTL IE play any effect on this?

With the scan cache, the first thought is immediately knocked away because we permanently (well, not permanently after we hit a threshold of 50 networks and have to start dropping the oldest networks) keep the backing mbuf around and all pointers to its internal data contents SHOULD remain valid (but this needs validation).

As well: setting asr_age causes an immediate page fault. I don’t know why. However, the code path does not require that asr_age is set, shown by that WEP is set means that it doesn’t matter.. however... WEP being set means that the IE is being parsed (at least initially), but is bailing out. Perhaps it’s just too short?

Would love to have more eyes on this.

i would like to help

hey,

i love the idea of the project and i see the benefit of it if we can get it to work.
Are you still interested in working on the project, if so you can contact me on discord or send me a mail.
Discord : arag0re#7003
Mail: [email protected]

best regards
Anton

Switch to using the ICT table for reading interrupts

I’m not quite sure if this was fully implemented. It was a bodge from the beginning, but the ICT table highly speeds up the (admittedly, already critical) interrupt service routines by providing a single point to index into. Might be good to look into later.

Add IOMACAddress for changing mac

IOKitPersonalities

IOMACAddress DATA ( MACADDRESS)

Start to free mbufs/pages

adapter/AppleIntelWifiAdapter/trans/IWLTransportRx.cpp

Lines 1449 to 1471 in d66ed5c

	if(page_stolen) {
	IWL_ERR(0, "page stolen, free here\n");
	//mbuf_freem(rxb->page);
	rxb->page = NULL;
	}
	if(rxb->page != NULL) {
	IWL_ERR(0, "rx failed\n");
	IOMbufNaturalMemoryCursor* cursor = IOMbufNaturalMemoryCursor::withSpecification(PAGE_SIZE, 1);
	int err = cursor->getPhysicalSegments(rxb->page, &rxb->vec, 1);
	if(err == 0) {
	IWL_ERR(0, "LEAK PAGE\n");
	rxb->page = NULL;
	iwl_pcie_rx_reuse_rbd(trans, rxb, rxq, emergency);
	} else {
	rxb->page_dma = rxb->vec.location;
	TAILQ_INSERT_TAIL(&rxq->rx_free, rxb, list);
	rxq->free_count++;
	}
	} else {
	iwl_pcie_rx_reuse_rbd(trans, rxb, rxq, emergency);
	}

Investigate whether we can actually free these pages? If so, free and ensure that we're not leaking memory everywhere