BrcmPatchRAM2 for 10.15 Catalina (Broadcom bluetooth firmware upload)

[headkaze]

I'm just going to run through some of the changes I made to RehabMan's BrcmPatchRAM project for it to function in macOS Catalina. I don't really have time to go any further with it but hopefully my research and testing can help get an official working version out.

 

I'm using BrcmFirmwareData.kext, BrcmPatchRAM2.kext and BrcmBluetoothInjector.kext and place them inside EFI/CLOVER/kexts/Other

 

BrcmBluetoothInjector.kext was not required on previous macOS releases but is on Catalina because of the following missing IOCatalogue methods:

 

kxld[com.no-one.BrcmPatchRAM2]: The following symbols are unresolved for this kext:
kxld[com.no-one.BrcmPatchRAM2]: IOCatalogue::addDrivers(OSArray*, bool)
kxld[com.no-one.BrcmPatchRAM2]: IOCatalogue::removeDrivers(OSDictionary*, bool)
kxld[com.no-one.BrcmPatchRAM2]: IOCatalogue::startMatching(OSDictionary*)

 

Since these methods are no longer available they must be removed from the project. The easiest way to do this is to comment out publishPersonality() and publishResourcePersonality() methods from BrcmPatchRAM.cpp / BrcmPatchRAM.h. Also remove all calls to these methods in BrcmPatchRAM.cpp.

 

The next issue is dealing with the 0xe00002c2 error when reading and writing to the BRCM hardware. Starting with BrcmPatchRAM::continuousRead() and BrcmPatchRAM::readCompletion() we need to add an kIODirectionIn option.

 

ie.

mReadBuffer = IOBufferMemoryDescriptor::inTaskWithOptions(kernel_task, kIODirectionIn, 0x200);

IOReturn result = mReadBuffer->prepare(kIODirectionIn);

IOReturn result = me->mReadBuffer->complete(kIODirectionIn);

Next in BrcmPatchRAM::bulkWrite we need to add kIODirectionOut options.

if (IOMemoryDescriptor* buffer = IOMemoryDescriptor::withAddress((void*)data, length, kIODirectionOut))

if ((result = buffer->prepare(kIODirectionOut)) == kIOReturnSuccess)

if ((result = buffer->complete(kIODirectionOut)) != kIOReturnSuccess)

 

Now that we don't have IOCatalogue::addDrivers, IOCatalogue::removeDrivers and IOCatalogue::startMatching methods to switch from using the uploader driver to native macOS driver we have to use BrcmBluetoothInjector.kext instead.

 

So my Bluetooth device is a BCM20702A0 with VendorID 0x0A5C and ProductID 0x216F (Dell DW1560 4352+20702 M.2) located in internal USB port HS14. So I'll use it as an example for the following modifications.

 

In BrcmPatchRAM2-Info.plist we need the following entry. Note the addition of the IOProbeScore. When the kext is loaded it will call BrcmPatchRAM::probe which will update the firmware and return NULL and then the BrcmBluetoothInjector.kext should load instead.

        <key>0a5c_216f</key>
        <dict>
            <key>CFBundleIdentifier</key>
            <string>com.no-one.$(PRODUCT_NAME:rfc1034identifier)</string>
            <key>DisplayName</key>
            <string>DW1560 Bluetooth 4.0 LE</string>
            <key>FirmwareKey</key>
            <string>BCM20702A1_001.002.014.1443.1572_v5668</string>
            <key>IOClass</key>
            <string>BrcmPatchRAM2</string>
            <key>IOMatchCategory</key>
            <string>BrcmPatchRAM2</string>
            <key>IOProviderClass</key>
            <string>IOUSBHostDevice</string>
            <key>IOProbeScore</key>
            <integer>4000</integer>
            <key>idProduct</key>
            <integer>8559</integer>
            <key>idVendor</key>
            <integer>2652</integer>
        </dict>

 

In BrcmBluetoothInjector-Info.plist we need the following entry. Note again the addition of the IOProbeScore. We want the BrcmBluetoothInjector.kext to load the macOS kext after the firmware has been uploaded to the hardware. Since BrcmBluetoothInjector.kext has not been updated in a long time you may need to add your hardware manually to the plist. Note that your Bluetooth device VendorID / ProductID is not the same as your WiFi hardware and will not show up in your PCI list. You will need to look at the USB ports to get this info.

        <key>0a5c_216f</key>
        <dict>
            <key>CFBundleIdentifier</key>
            <string>com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport</string>
            <key>IOClass</key>
            <string>BroadcomBluetoothHostControllerUSBTransport</string>
            <key>IOProviderClass</key>
            <string>IOUSBHostDevice</string>
            <key>IOProbeScore</key>
            <integer>3000</integer>
            <key>idProduct</key>
            <integer>8559</integer>
            <key>idVendor</key>
            <integer>2652</integer>
        </dict>

 

You will know the firmware is uploaded when its version in About This Mac->System Report...->Bluetooth shows something like:

 Firmware Version:    v14 c5668

If it shows 4096 then the upload has failed.

 

I will attach my compiled versions for people to help test. I'm not 100% sure if this is method is going to work so I'd appreciate feedback on it.

 

Downloads (acidanthera)

Edited October 17, 2019 by headkaze

[Gummy]

It works nicely!

[anonymous writer]

Also for me and my DW-1560. Thank you very much for your work. 

 

[polyzargone]

Works fine too!

 

 

Thanks a lot!

[artur_pt]

hello

 

here work good, no problems

 

 

thanks

 

good hack

 

[parma60]

Worked fine for my HP 250 bcm943602baed. Thanks!

 

Edited June 17, 2019 by parma60
Worked fine for my HP 250 bcm943602baed. Thanks!

[eng_redaesm]

Now works fine thanks . but can't connect or find any bluetooth devices

[artur_pt]

hello

 

can't make it working with OC

 

 

thanks

[fivos1996]

Worked for my Lenovo-branded BCM94352Z. Thanks!

[headkaze]

On 6/16/2019 at 12:53 PM, artur_pt said:

can't make it working with OC

What is the PID/VID of your hardware?

[artur_pt]

1 hour ago, headkaze said:

What is the PID/VID of your hardware?

 

hello

 

3404_13d3

 

thanks

[headkaze]

As requested I've added the source to the first post.

Edited June 19, 2019 by headkaze

[fromdetroit7]

headkaze, can you please add 21ff_0a5c as well?

[thetwoangels]

It works very well, thanks for the great work you do and help us to the least we know how to continue to enjoy this great operating system.

Successfully modified BrcmBluetoothInjector-Info.plist and BrcmPatchRAM2-Info.plist for BCM943602BAED

 

 

 

Edited June 20, 2019 by thetwoangels

[mengls]

i'm sorry,but it just doesn't work properly on my laptop with 1820a(BL Id is 0a5c_6412),when I patched the kexts and reboot after rebuild kextcache,it got stucked with the picture below.Anyone can help me out?Glad for any advice,thanks!

[bronxteck]

the BT module does not want to let the specified firmware load into it. try loading another OS and confirm the hardware works properly.

[123456789323]

Thx @headkaze, works well with my Dell DW 1830!

 

 

[headkaze]

On 6/20/2019 at 2:53 AM, mengls said:

I patched the kexts and reboot after rebuild kextcache

This method does not involve patching any kexts and you do not need to rebuild kextcache as you should be copying the kexts to EFI/CLOVER/kexts/Other.

[alpha.delta]

I need Patch for DW1510 BCM94322HM8L.

[Andrw0380]

Hello @headkaze thanks for your work! I have an issue with my DW-1560 0x216f BCM20702A0. Basically this morning I booted up Catalina on a cold boot and the system took awhile to boot and when it did, I had no BT or WiFi. I had the latest Clover applied with your kexts applied to Clover/kexts/Other. I went back to just using the BrcmBluetoothInjector.kext from the one I found on the preRelease forum which didn't have this issue, but on a cold boot, I have to boot into Windows to get BT to detect any devices so it is a tradeoff.

 

Please let me know if you need anything else to help.

[headkaze]

1 hour ago, Andrw0380 said:

Please let me know if you need anything else to help.

I'm not the author of this driver (darkvoid and RehabMan are). All I did was make some modifications so they will compile and run on Catalina.

 

If these drivers worked on Mojave for you they will most likely work on Catalina. Other than adding any missing VID/PID's I am not likely to be much help.

 

The only other suggestion I can make is to compile the BrcmFirmwareRepo.kext and install them to /Library/Extensions. Apparently this is necessary for some people. Read the instructions on Github for more information.

Edited June 22, 2019 by headkaze

[headkaze]

For anyone who wants to try using BrcmFirmwareRepo.kext (along with BrcmPatchRAM2.kext) and installing into /Library/Extensions I've attached all the binaries to the first post (BrcmPatchRAM_Catalina_All.zip)

 

NOTE: You may need to run Gatekeeper-RW-SSD.command before you install them.

Edited June 22, 2019 by headkaze

[Andrw0380]

17 hours ago, headkaze said:

I'm not the author of this driver (darkvoid and RehabMan are). All I did was make some modifications so they will compile and run on Catalina.

 

If these drivers worked on Mojave for you they will most likely work on Catalina. Other than adding any missing VID/PID's I am not likely to be much help.

 

The only other suggestion I can make is to compile the BrcmFirmwareRepo.kext and install them to /Library/Extensions. Apparently this is necessary for some people. Read the instructions on Github for more information.

Thanks for the suggestion. I realized you were not the author I was just mentioning as didn't have the issue with Rehabman's repo on Mojave. Also wanted to ask you if this commit is added to your source? https://github.com/RehabMan/OS-X-BrcmPatchRAM/pull/68 as this helped a few people when awake from sleep on Mojave including myself. Thanks again for your work on this and other projects!

[headkaze]

19 minutes ago, Andrw0380 said:

 Also wanted to ask you if this commit is added to your source?

I added the change and re-uploaded.

[meiyong]

This is my Bluetooth information. Help me add it. Thank you

This is my Bluetooth information. Help me add it. Thank you