Add BlueToolFixup

[dhinakg]

BlueToolFixup forces BlueTool to skip attempting a firmware update, allowing for some Broadcom¹ chipsets² to work on Monterey. It also properly sets the transport.

As Monterey is a beta, this is still a work in progress, and may break. Changes in bluetoothd, BlueTool, or other parts of the Bluetooth stack may require more work for Bluetooth to continue working.

Reviewer notes:

• I almost certainly messed something up when adding the folder references to the SDK. Please review them
• README should probably be updated

User notes:

• Requires Lilu 1.5.4 (not released). Ensure other Lilu plugins are also updated.
• Do not use BrcmBluetoothInjector in Monterey. As detailed in [BrcmPatchRam] macOS Monterey BT issues bugtracker#1669, parts of the Bluetooth stack have changed from kernel-space to user-space. The kext that BrcmBluetoothInjector adds personalities for is now a dummy kext that attaches to IOResources (instead of the USB device) and does nothing. BrcmBluetoothInjector in Monterey will cause a stall. No replacement is needed as bluetoothd does not hardcode device IDs and instead uses the device class.
  • For multi-booting, set MaxKernel to 20.99.99.

Special thanks to @vit9696 for helping me track down the cause, find a fix, and integrate this into a Lilu plugin.

¹ BlueToolFixup solely patches BlueTool's firmware update check currently. More work appears to be needed for Intel Bluetooth.
² Not many have been tested currently, and not all features (Continuity) have been tested. This is obviously not required on cards pulled from a Mac, and on cards that are completely native and do not need BrcmPatchRAM (ie. BCM94360NG).

Technical Notes:

In Monterey, bluetoothd identifies and opens the Bluetooth IOUSBDevice. It will then send an XPC message to BlueTool, another daemon used for updating firmware, to run its internal script. In its internal script, BlueTool will attempt to update the firmware, if necessary. However, on non-native chipsets, BlueTool fails to find firmware for the chipset:

2021-06-10 19:33:57.527421+0100 0x35b      Default     0x0                  149    0    bluetoothd: [com.apple.bluetooth:Server.Core] Booting chipset
2021-06-10 19:33:57.527426+0100 0x35b      Default     0x0                  149    0    bluetoothd: [com.apple.bluetooth:Server.XPC] Creating XPCServiceConnection to com.apple.BlueTool
...
2021-06-10 19:33:57.527946+0100 0x35b      Default     0x0                  149    0    bluetoothd: [com.apple.bluetooth:Server.XPC] Opening connection to com.apple.BlueTool for UID 0
...
2021-06-10 19:33:57.544046+0100 0x6f1      Default     0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] Running xpcRunBuiltinScript
...
2021-06-10 19:33:57.546883+0100 0x6f1      Error       0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] getManufacturer could not find bootdata property
...
2021-06-10 19:33:57.553779+0100 0x6f1      Error       0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] No WiFi - Iteration 0
...
2021-06-10 19:33:58.058809+0100 0x6f1      Error       0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] Error - no firmware for this platform.  Looking for <private> (null) DEV
2021-06-10 19:33:58.058817+0100 0x6f1      Default     0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] <private> script attempt 1 of 1: result 10 execution time:513(MS)
2021-06-10 19:33:58.558993+0100 0x6f1      Default     0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] builtin script completed with result 10
2021-06-10 19:33:58.559031+0100 0x6f1      Default     0x0                  350    0    BlueTool: [com.apple.bluetooth:BlueTool] Completed handling of dictionary-xpc event
2021-06-10 19:33:58.559136+0100 0x35b      Error       0x0                  149    0    bluetoothd: [com.apple.bluetooth:Server.Core] Couldn't find a platform / chipset / firmware combination for the HW. Please file a bug with syslog, full ioreg output and result of `uname -a`.
2021-06-10 19:33:58.559137+0100 0x35b      Error       0x0                  149    0    bluetoothd: [com.apple.bluetooth:Server.Core] BlueTool failed to run boot script with result 10
...
2021-06-10 19:33:58.560254+0100 0x35b      Default     0x0                  149    0    bluetoothd: [com.apple.bluetooth:Server.Core] Notifying BT Firmware Crashed

BlueTool then return 10 as the result in the XPC reply back. bluetoothd terminates, as this is a non-zero value. launchd will then restart bluetoothd, and the cycle continues.

To skip the firmware update check, BlueTool checks for the existence of /etc/bluetool/SkipBluetoothAutomaticFirmwareUpdate. This could be manually created, but we replace it with /System/Library/CoreServices/boot.efi, so manually creating it is not needed, and so Bluetooth can work in recovery. Since boot.efi should always exist, the firmware update check will always be skipped, and since the existence of the file is checked, not the contents, there are no issues with replacing the original string with this.

However, for this to work properly, the transport must also be properly set (otherwise, the file will be ignored). To determine the transport, BlueTool (and also bluetoothd) looks for a transport-encoding property on a registry entry named either bluetooth or marconi-bt. The value of this property determines the transport: 0 for USB, 3 for UART, or 7 for PCIe. Therefore, we set transport-encoding to 00000000 (type data) and rename ourselves to bluetooth. BlueTool will then find our registry entry, get the transport, check for the existence of the skip firmware file, skip the firmware update, and then finish and reply with a result of 0 to bluetoothd. bluetoothd will then continue and Bluetooth should work.

Other notes:

• bluetoothd detects the chipset as an external dongle:

  2021-06-10 19:33:42.468260+0100 0x2eb      Default     0x0                  149    0    bluetoothd: [com.apple.bluetooth:Stack.UNKNOWN] Found external Bluetooth dongle -- setting chipset to THIRD_PARTY_DONGLE
  

  This can be overridden in NVRAM - set bluetoothHostControllerSwitchBehavior to never. However, this may break System Information and System Preferences.

• Turning off Bluetooth breaks Bluetooth (you cannot turn it back on). More research is needed to fix this.

[benbaker76]

dfu-util can be used to perform a dfu update in user-space.

It has been confirmed to work on hardware using Apple's own dfu files. Eg. For BCM943602CS with Product ID 0x8290:

sudo dfu-util -R -D /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources/20703_8290.dfu

BrcmPatchRAM supports zhx format which is just a zlib compressed version of dfu. There is a de-compressor available in BrcmPatchRAM/BrcmFirmwareStore.cpp.

Perhaps dfu-util can be integrated into BlueToolFixup to perform a dfu update?

[dhinakg]

dfu-util can be used to perform a dfu update in user-space.

It has been confirmed to work on hardware using Apple's own dfu files. Eg. For BCM943602CS with Product ID 0x8290:

sudo dfu-util -R -D /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources/20703_8290.dfu

BrcmPatchRAM supports zhx format which is just a zlib compressed version of dfu. There is a de-compressor available in BrcmPatchRAM/BrcmFirmwareStore.cpp.

Perhaps dfu-util can be integrated into BlueToolFixup to perform a dfu update?

Thanks for commenting - this is really my first delve into Bluetooth on hackintoshes (and I've barely scratched the surface), so I didn't know about this.

As far as I know, you can't call userspace binaries from kernelspace - so you wouldn't be able to run dfu-util from the kext, per se. However, I do see where you're going - we could theoretically make BlueTool upload the firmware of our choice instead. However, we do have some problems:

• Device IDs and firmware update file paths are hardcoded in BlueTool. We would have to get the device ID, and then force a code path and replace the file that it seeks.
• We can only do simple find & replace patches in userspace with Lilu on Big Sur+. So firmwares would have to be on disk somewhere, and the file path can't be very long.

Considering this, from my point of view I think it's more worthwhile to keep maintaining BrcmPatchRAM. Feel free to chime in with your thoughts.

[zhen-zen]

Not sure why I got a kp during kext loading for both CI and manual build w/ latest Lilu. Quite weird.

Maybe it's better to separate it into a new project? https://github.com/acidanthera/SidecarFixup is a good base for that. You will need LILU_CUSTOM_IOKIT_INIT=1 set. Another dummy service named bluetooth should be also a solution.

After patching the BlueTool logic, it seems that boot time is still longer compared to native cards. Haven't check the log yet. And bluetoothd even matched to a USB camera (should be their issue).

[vit9696]

As for moving to a separate project, in my opinion, no. Too many of them already. I will let this one stay for a short while and then merge. If you attach the KP it may help.

[Pavo-IM]

dfu-util can be used to perform a dfu update in user-space.

It has been confirmed to work on hardware using Apple's own dfu files. Eg. For BCM943602CS with Product ID 0x8290:

sudo dfu-util -R -D /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources/20703_8290.dfu

BrcmPatchRAM supports zhx format which is just a zlib compressed version of dfu. There is a de-compressor available in BrcmPatchRAM/BrcmFirmwareStore.cpp.

Perhaps dfu-util can be integrated into BlueToolFixup to perform a dfu update?

@headkaze How does this work with Monterey when IOBluetoothFamily.kext has no Plugins folder inside it anymore?

[dhinakg]

Not sure why I got a kp during kext loading for both CI and manual build w/ latest Lilu. Quite weird.

Fixed in e97233a, I fixed it locally but then forgot to push my changes. 🤦

Maybe it's better to separate it into a new project? acidanthera/SidecarFixup is a good base for that. You will need LILU_CUSTOM_IOKIT_INIT=1 set. Another dummy service named bluetooth should be also a solution.

True, but frankly given that it appears that it only works for Broadcom so far, I don't think it's a big deal to just leave it here. The code is completely independent anyway so it can be used with other vendors.

After patching the BlueTool logic, it seems that boot time is still longer compared to native cards.

Make sure you don't have the injector enabled. Besides that, I don't see any reason for longer boot times.

@headkaze, it looks like I misinterpreted what you were saying. If you're referring to this dfu-util, it says it doesn't work on PatchRAM devices, so it wouldn't really be helpful. In that case, I don't think patching BlueTool will work either.

[majonez]

Thank you! It works with BCM20702A0 (ASUS BT-400).

[benbaker76]

@headkaze How does this work with Monterey when IOBluetoothFamily.kext has no Plugins folder inside it anymore?

I was just giving an example of how dfu-util can upload firmware. But as @dhinakg has mentioned this only works for non-PatchRAM devices anyway so it's useless.

@headkaze, it looks like I misinterpreted what you were saying. If you're referring to this dfu-util, it says it doesn't work on PatchRAM devices, so it wouldn't really be helpful. In that case, I don't think patching BlueTool will work either.

Yes you're right I forgot about that. So it makes more sense to port BrcmPatchRAM into a new user mode tool instead.

[stevezhengshiqi]

Thanks for this great work! Just a quick question, is there a suggested loading order for BlueToolFixup? Should it load prior to IntelBluetoothInjector.kext?

[dhinakg]

Thanks for this great work! Just a quick question, is there a suggested loading order for BlueToolFixup? Should it load prior to IntelBluetoothInjector.kext?

It does not depend on anything in BrcmPatchRAM - so anywhere under Lilu is fine. However, do not use IntelBluetoothInjector (for the same reasons as explained for BrcmBluetoothInjector above).

However, Intel has yet to work for anyone who has tested (as far as I know), so unless you're using this as a base for more research into fixing Bluetooth, it'll likely not be very helpful for you.

[stevezhengshiqi]

Sorry for mistype. What I really tried to say is Brcmfirmwaredata and brcmram3 kexts. Only god know why I typed IntelBluetooth. But you still answered clearly. Thank you so much

[antoniomcr96]

Sorry @dhinakg, for information only. Are you working on this point?

Turning off Bluetooth breaks Bluetooth (you cannot turn it back on). More research is needed to fix this.

Thanks for all your work

[ecklf]

No luck with AzureWave BCM94352HMB on Monterey beta 2

Using: brcmfx-driver=2 and x86legacy as SecureBootModel

Lilu (1.5.4 release)
AirportBrcmFixup
BlueToolFixup
BrcmPatchRAM3
BrcmFirmwareData

Also tried setting MaxKernel 20.99.99

[Edwardwich]

after update ti beta 10 bluetooth not work
IOReg.zip

[buyddy]

Does anyone have BCM94352Z chipset working with Bluetooth? I installed the BlueToolFixup but it seems that the firmware is not loaded. System Info is showing:

Bluetooth Controller:
Address: NULL
State: Off
Chipset: BCM_4350C2
Discoverable: Off
Firmware Version: v0 c0
Product ID: 0x0001
Supported services: 0x382039 < HFP AVRCP A2DP HID Braille AACP GATT Serial >
Transport: UART
Vendor ID: 0x004C (Apple)

[Juan-VC-gh]

Does anyone have BCM94352Z chipset working with Bluetooth? I installed the BlueToolFixup but it seems that the firmware is not loaded. System Info is showing:

Bluetooth Controller: Address: NULL State: Off Chipset: BCM_4350C2 Discoverable: Off Firmware Version: v0 c0 Product ID: 0x0001 Supported services: 0x382039 < HFP AVRCP A2DP HID Braille AACP GATT Serial > Transport: UART Vendor ID: 0x004C (Apple)

Exact same report here.
Loading kexts in the following order:

1. BlueToolFixup
2. BrcmFirmwareData
3. BrcmPatchRAM3

[Juan-VC-gh]

Does anyone have BCM94352Z chipset working with Bluetooth? I installed the BlueToolFixup but it seems that the firmware is not loaded. System Info is showing:
Bluetooth Controller: Address: NULL State: Off Chipset: BCM_4350C2 Discoverable: Off Firmware Version: v0 c0 Product ID: 0x0001 Supported services: 0x382039 < HFP AVRCP A2DP HID Braille AACP GATT Serial > Transport: UART Vendor ID: 0x004C (Apple)

Exact same report here. Loading kexts in the following order:

1. BlueToolFixup
2. BrcmFirmwareData
3. BrcmPatchRAM3

Alright, found the issue has been fixed. For @buyddy, checking this PR the vendor check is an issue and a BrcmPatchRAM release 2.6.1 is planned for the next few days to deal with maniacs who want Monterey from day one as @vit9696 replied. Which is your case and mine.

TLDR: Use this early BrcmPatchRAM3 2.6.1 release for now

Bluetooth seems to need some more work but at least makes the BCM94352Z usable now

[eos1d3]

I had same problem with BCM_4350C2. 2.6.1 fixes the issue!

PS: Sorry to report again, after powering off and left some hours. I turned on the machine again and Bluetooth is still on, but it can't find any device.

PPS: Another release works: https://github.com/dortania/build-repo/releases/download/BrcmPatchRAM-44c3025/BrcmPatchRAM-2.6.1-RELEASE.zip

[regisbs44]

I had problems with only bluetooth with BCM943224PCIEBT2 using 2.6.1.
Wifi works, but bluetooth not works on Monterey. When using Big Sur both wifi and bluetooth works.

[agussuratno]

I had problems with only bluetooth with BCM943224PCIEBT2 using 2.6.1. Wifi works, but bluetooth not works on Monterey. When using Big Sur both wifi and bluetooth works.

Same case as what I'm experiencing. Even for the same case, making bluetooth in windows is not active. I hope to be active again in the future

[Thireus]

BlueToolFixup v2.6.1 fixes the Bluetooth availability, I can now connect my Airpods Pro, but it is unusable. After 1 minute of music playback the audio gets more and more distorted until it just dies with crackling noises. Anybody experiencing this issue?

Bluetooth Chipset: 0b05:1868 - ASUSTek Computer, Inc. (Qualcomm Atheros QCA61x4A Bluetooth 4.1)

[rainshang]

after using 2.6.1, my iPhone and MBP can AirDrop files to my hackintosh, however, it even can't find the MBP (Apple ID not logged in) or send files to iPhone... and once I turn off bluetooth, I can't turn on it anymore.

[dhinakg]

acidanthera/bugtracker#1821

[protocold]

Thank you! It works with BCM20702A0 (ASUS BT-400).

I just tried 2.6.1 with BT-400 on Monterey 12.0.1 with OC and it didnt work...

I added these under kernel section of the config.plist:
BlueToolFixup
BrcmFirmwareData
BrcmPatchRAM3

I am using a real MacBookPro7,1 with internal usb physically disabled.

what do I have to do to troubleshoot this?

[tuxymac]

Thank you! It works with BCM20702A0 (ASUS BT-400).

what did you exaclty use to make i work?

[Thireus]

BlueToolFixup v2.6.1 fixes the Bluetooth availability, I can now connect my Airpods Pro, but it is unusable. After 1 minute of music playback the audio gets more and more distorted until it just dies with crackling noises. Anybody experiencing this issue?

Bluetooth Chipset: 0b05:1868 - Qualcomm Atheros QCA61x4A Bluetooth 4.1

Update:

I found a trick to make the Airpods somehow work (although the audio isn't that great as there are subtle crackles from time to time). Basically all I have to do is:

1. Connect the Airpods and play some music... wait for the sound to become all crackled and inaudible (happens after 1min).
2. Wait 5 minutes while the airpods are still connected (and while there is no audio because it died in step 1.)
3. Switch from ANC to Transparency, then back to ANC
4. Audio is restored automatically when switching mode
5. If audio fails again after 1min, repeat step 3. (one more time should be enough to bring stability)
6. Audio should be stable for hours, subtle crackles may occur occasionally, but nothing compared to the first time they connect

The trick only works while the Airpods are connected. Upon disconnect the steps 1 to 6 need to be repeated again.

Update 2:
Running OpenCore 0.7.8 with all the kexts upgraded on macOS 12.2.1, the issue is gone. :)

[wmjlxl]

BlueToolFixup v2.6.1 fixes the Bluetooth availability, I can now connect my Airpods Pro, but it is unusable. After 1 minute of music playback the audio gets more and more distorted until it just dies with crackling noises. Anybody experiencing this issue?
Bluetooth Chipset: 0b05:1868 - Qualcomm Atheros QCA61x4A Bluetooth 4.1

Update:

I found a trick to make the Airpods somehow work (although the audio isn't that great as there are subtle crackles from time to time). Basically all I have to do is:

1. Connect the Airpods and play some music... wait for the sound to become all crackled and inaudible (happens after 1min).
2. Wait 5 minutes while the airpods are still connected (and while there is no audio because it died in step 1.)
3. Switch from ANC to Transparency, then back to ANC
4. Audio is restored automatically when switching mode
5. If audio fails again after 1min, repeat step 3. (one more time should be enough to bring stability)
6. Audio should be stable for hours, subtle crackles may occur occasionally, but nothing compared to the first time they connect

The trick only works while the Airpods are connected. Upon disconnect the steps 1 to 6 need to be repeated again.

thanks man, i am using bcn943602cdp also has the same problem while connecting to airpods pro.
any new solution for this issue?

thanks

[Thireus]

BlueToolFixup v2.6.1 fixes the Bluetooth availability, I can now connect my Airpods Pro, but it is unusable. After 1 minute of music playback the audio gets more and more distorted until it just dies with crackling noises. Anybody experiencing this issue?
Bluetooth Chipset: 0b05:1868 - Qualcomm Atheros QCA61x4A Bluetooth 4.1

Update:
I found a trick to make the Airpods somehow work (although the audio isn't that great as there are subtle crackles from time to time). Basically all I have to do is:

1. Connect the Airpods and play some music... wait for the sound to become all crackled and inaudible (happens after 1min).
2. Wait 5 minutes while the airpods are still connected (and while there is no audio because it died in step 1.)
3. Switch from ANC to Transparency, then back to ANC
4. Audio is restored automatically when switching mode
5. If audio fails again after 1min, repeat step 3. (one more time should be enough to bring stability)
6. Audio should be stable for hours, subtle crackles may occur occasionally, but nothing compared to the first time they connect

The trick only works while the Airpods are connected. Upon disconnect the steps 1 to 6 need to be repeated again.

thanks man, i am using bcn943602cdp also has the same problem while connecting to airpods pro. any new solution for this issue?

thanks

No new solution unfortunately. I pretty much stopped using my Airpods, even the solution I give isn't good - it's really hard to stabilize the audio (sometimes it just takes forever), then from time to time you can hear some crackling, and if you play different audio sources at once the problem sometimes comes back on its own. :(

The new Apple kext (or maybe the kext patch) just doesn't work properly for our bluetooth hardware. The problem seems to be audio desynchronization/delay slowly introduced when audio is played, something is not ticking right. I'm suspecting it could be triggered from RAM or CPU speed, but I haven't verified it, but that is not the core of the issue, the core of the issue is just the new kext(s).

I think you are the first person to ever report having that same issue.

[wmjlxl]

i tried both of my airpods 2 and airpods pro. all have the same issue.
if apple doest want to fix this problem, may be i will resinstall big sur i/o montery.

[laflier]

BlueToolFixup.kext 2.6.1 is working for me in Monterey 12.2 with OC 0.7.7 on a GA-Z170X Designare with an ASUS BT400 USB adapter. Completely stable with AirPods Pro. All I did was drag in the one kext and add it to my config.plist and it worked after rebooting.

[Thireus]

i tried both of my airpods 2 and airpods pro. all have the same issue. if apple doest want to fix this problem, may be i will resinstall big sur i/o montery.

Hey @wmjlxl, you should try to upgrade to OpenCore to 0.7.8 and upgrade all your kexts. I just did, I'm on macOS 12.2.1 and it seems the issue is now gone (I'm using the latest BlueToolFixup.kext too). :)

Don't ask me what was originally causing the issue, because I have no clue. :|

[Theherozxzx]

Good evening
I have a problem with my bluetooth. I have a ryzen 7 5800x, b550 asus, and my wifi/bluetooth card is an intel ax210, i put the airport 2.1 and the wifi is working perfectly. I put IntelBluetoothFirmware 2.1 and Bluetoolfixup.kext 2.61, bluetooth is recognized by the mac, but it does not activate. I'm using Monterey 12.4, I've seen some reports that bluetooth stopped working after upgrading to that version.

Anyone going through the same situation?

in the system information appears:
Bluetooth controller:
Address: NULL
Status: Disabled
Chipset: BCM_4350C2
Visible: Disabled
Firmware Version: v0 c0
Product ID: 0x0001
Compatible Services: 0x382039 < HFP AVRCP A2DP HID Braille AACP GATT Serial >
Transport: USB
Dealer ID: 0x004C (Apple)

[mengshilim]

System: T480s with BCM94352z (This one is a Lenovo branded unit with A key which I then cut a slot to make A+E).
Works with 2.6.6. AirPods Pro works etc.

My only issue that is that I cannot toggle on the Bluetooth if I toggle it off. Requires a reboot. Sleep and wake does not toggle it back on but if it always one, sleep wake is not an issue.

Can this be fixed?

[striper201]

I faced the same problem on my Macbook Air with Monterey 12.6.6 and BCM94360CS2 onboard. I turned off bluetooth and now can't turn it on. Wi-fi is ok. Removing card and boot laptop without it has no luck. I don't know what to do. Is any sense in replacing module?