Airport TakeOff - kext enabler for Broadcom Wifi

[the-darkvoid]

Recently I did some research if it was possible to enable the BCM94352Z WiFi / Bluetooth combo card as Airport Extreme in OS X without using any Clover patches

This would lead to a more upgrade safe situation as no OS X system files have to be patched.
To do this a technique is used where AppleMergeUsbNub is (ab)used to inject properties into IOPCIDevice based devices.

For the matching IOPCIDevice it merges the following properties:

• AAPL,slot-name Airport
• revision-id 03 00 00 00
• subsystem-id 34 01 00 00
• subsystem-vendor-id 6b 01 00 00

For AirPort_Brcm4360:

• APChipRev 3
• APFeatures 1
• APTAPD 1
• IOLocale Worldwide
• IOVendor Apple (This makes the device appear as Apple Airport Extreme)

For AirPort_Brcm4360_Interface:

• IO80211CountryCode US (Change card country code to enable 5ghz channels)
• IO80211Locale FCC (Change card locale to enable 5ghz channels)
• IOBuiltin true

I have not been able to test if 5ghz channels are properly enabled with this method.
Hopefully someone can test and confirm this?

Otherwise by looking at the AirPort_Brcm4360 patch, the right IOReg properties can be determined.

Repository is here:
https://github.com/the-darkvoid/AirportTakeOff

Latest release can be found here:
https://github.com/the-darkvoid/AirportTakeOff/releases

 

[Skvo]

For AirPort_Brcm4360_Interface:

• IO80211CountryCode US (Change card country code to enable 5ghz channels)
• IO80211Locale FCC (Change card locale to enable 5ghz channels)
• IOBuiltin true

I have not been able to test if 5ghz channels are properly enabled with this method.
Hopefully someone can test and confirm this?

I tested. BCM94352HMB with XT country.

Interface Inject - does not work. 5GHz channels absence.
Screenshot in attach.


P.S.
Driver get Country Code directly from EEPROM. According to this value is a list of available channels.
After that, put this code into IOREG.

Change values IO80211CountryCode and IO80211Locale in IOReg - affects only the display in the System Profiler.
This is a cosmetic fix for Profiler. On driver operation is not affected.

Binary patch for activate 5GHz - required.

 

[the-darkvoid]

skvo,

Its technically possible to intercept calls to the IOPCIDevice and change their return value.
This could allow us to update values returned from the IO space on the fly.

What calls are used to determine the country list? ioReadX or configReadX on IOPCIDevice?

(This technique I used is described here: https://github.com/the-darkvoid/IntelHDMobileGraphics)