Removing USB Port Limit on macOS 26 #63
Description
XhciPortLimit
Enable XhciPortLimit:
Open OpenCore’s config.plist, go to Kernel -> Quirks, find XhciPortLimit, and set it to True. OpenCore will apply a patch to the AppleUSBXHCIPCI driver at boot time to allow more than 15 ports.
⸻
Removing USB Port Limit on macOS 26
This limitation stems from macOS’s XHCI driver, which restricts each controller to a maximum of 15 USB ports.
⸻
Tutorial Overview
1. Load the macOS kernel cache (BootKernelExtensions.kc) using IDA Pro and analyze the com.apple.driver.usb.AppleUSBXHCI driver.
2. Locate the instruction controlling the USB port limit (e.g., cmp reg, 0Fh) and change 0Fh to 3Fh (i.e., increase from 15 ports to 63).
3. Similarly, modify the relevant functions in IOUSBHostFamily to loosen verification.
4. Convert these changes into binary patches (patched bytes).
⸻
Required Tools
• IDA Pro: Download Link
Follow the usage instructions provided with the software for installation.
⸻
I. Locating the Driver File
1. Open Finder → Go to Folder… → /System/Library/KernelCollections
2. Copy BootKernelExtensions.kc to the desktop.
⸻
II. Common Operations Demonstration
Loading Driver from Kernel Collection
Use com.apple.driver.usb.AppleUSBXHCI as an example.
• Drag BootKernelExtensions.kc into the IDA Pro window.
• Choose “Apple XNU kernelcache for X86_64 (single kext)”
• Locate com.apple.driver.usb.AppleUSBXHCI in the list.
• Wait until the bottom left shows “idle” indicating loading is complete.
Function Search
• Right-click → Quick filter
• Enter the desired function name in the search box.
Toggle Between Text and Graph View
• Press Spacebar
Search for Values
• Menu → Search → Immediate value…
• Enter value, check Find all occurrences
Edit Instruction
• Example: Modify cmp instruction, change 0Fh to 3Fh
• Right-click 0Fh → Choose Assemble...
• In the popup, change 0Fh to 3Fh → Press Enter
• Modified instruction will be highlighted.
⸻
Convert to Patch Code
• Menu: Edit → Patch program → Patched bytes
• A new tab shows all modified instructions
Example (Patch Construction):
Let:
• A = Two instructions before the modified one:
44 89 F3
E9 6A 01 00 00
• B = Modified instruction:
41 83 FE 3F
• C = Two instructions after:
0F 83 7C 08 00 00
41 8D 5E 01
• D = Original instruction (before patch):
41 83 FE 0F
Search Pattern (A + D + C):
4489F3E9 6A010000 4183FE0F 0F837C08 0000418D 5E01
Replace Pattern (A + B + C):
4489F3E9 6A010000 4183FE3F 0F837C08 0000418D 5E01
⸻
III. Patch for com.apple.driver.usb.AppleUSBXHCI
1. Load com.apple.driver.usb.AppleUSBXHCI driver
2. Locate:
• AppleUSBXHCI::createPort(StandardUSBXHCI::StandardUSBXHCIProtocolCapability *, unsigned int, unsigned int)
• Search for value 0x0F
• From the “Occurrences of value 0xF” tab, locate function createPortEPN
• Modify 0Fh to 3Fh
3. Locate:
• AppleUSBXHCI::createPorts(void)
• Search 0x0F and locate relevant cmp instruction
• Modify 0Fh to 40h
After both are patched, close and reopen the software.
⸻
IV. Patch for com.apple.iokit.IOUSBHostFamily
Locate:
• AppleUSBHostPort::setPortLocation(AppleUSBHostPort * this, unsigned int)
• Search for 0x0F
• For cmp instructions: change 0Fh to 40h
• All others: change to 3Fh
Convert all four patches above into patch codes and restart the software.