Contribute
Register

Bluetooth (BrcmPatchRAM) Problems - BCM43142A0 - Stuck in "MINIDRIVER complete" state - OC-0.6.4 Big Sur-11.1

Status
Not open for further replies.
Joined
Apr 24, 2018
Messages
11
Motherboard
HP Laptop 15-ay542tu
CPU
i3 6006U
Graphics
Intel HD 520 [Skylake GT2]
So I am having problems with bluetooth on my hack. (Everything else working fine.) (Dual booted with linux.)
I am using BrcmPatchRAM (acidanthera v 2.5.5). And any help is much appreciated.
First off bluetooth is working perfectly in Linux. Now on Linux when I restart my machine and upon restart, if I directly go to Mac the bluetooth is working in Mac too. It connects to all my devices & headphones and everything is good.

But here is my problem. So if I boot into Mac directly from a powered off state, the bluetooth won't work. And in every other case it works. Like;

1). Powered Off state --boot-into--> MacOS -> bluetooth not working
2). Powered Off state --boot-into--> Linux --restart-into--> MacOS -> bluetooth working
3). Powered Off state --boot-into--> Linux --restart-into--> MacOS --restart-into--> MacOS --restart-into--> MacOS -> bluetooth working
4). So on, as long as it doesn't power off completely.
If powers off, then back to one.

P.S. On every boot, kextstat shows BrcmPatchRAM3.kext is loaded, but BrcmBluetoothInjector.kext is never shown in kextstat. I have also already made a USBMap.
P.S.2. And I know this is not a hardware issue, coz if I only use linux without macOS, it works no matter what.
P.S.3. And when I say the bluetooth is not working, this is what happens:
(a). The bluetooth device is being detected by Hackintool, but it says FW not loaded. And the Bluetooth Preferences won't even open. And the boot takes quite a bit longer than normal time. I attached a verbose boot log image. (But kextstat shows BrcmPatchRAM kexts loaded.)
(b). And on the later boot (shut-down. boot again), the bluetooth usb won't even be detected by Hackintool or any other. (But the boot time is faster than (a).) At this point even after restarting into linux, lsusb also doesn't show this device. After force powering off my Linux (long press power button), and then rebooting into linux, the bluetooth is back to normal.
(c). And then everything is back to the beginning and the cycle continues.
Update: OK. lol. I just disabled BrcmPatchRAM3 and BrcmFirmwareStore (only enabled BrcmBluetoothInjector) and booted into linux and rebooted back into macOS. And the bluetooth still works fine. Meaning the firmware that linux uploaded into the device, is still in the device and can be used on Mac, even after reboot.

Update 2: After looking a bit into the debug logs, looks like BrcmPatchRAM gets stuck in "Mini-driver complete" stage. I tried initial delay values (in boot-args) like bpr_initialdelay=50 and bpr_initialdelay=250 and bpr_initialdelay=300 and bpr_initialdelay=800 and bpr_initialdelay=10000. No luck.
Code:
Timestamp                       (process)[PID] 
2020-12-31 17:37:22.917453+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::init(OSDictionary*)> BrcmPatchRAM: init
2020-12-31 17:37:22.928873+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::probe(IOService*, int*)> BrcmPatchRAM: probe
2020-12-31 17:37:22.934397+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::probe(IOService*, int*)> BrcmPatchRAM: Version 2.5.5 starting on OS X Darwin 20.2.
2020-12-31 17:37:22.941441+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::probe(IOService*, int*)> BrcmPatchRAM: Device doesn't support handshake.
2020-12-31 17:37:23.446463+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::start(IOService*)> BrcmPatchRAM: Firmware store start
2020-12-31 17:37:23.453731+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::getFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: getFirmware
2020-12-31 17:37:23.460231+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: loadFirmware from disk data BCM43142A0_001.001.011.0311.0329_v4425
2020-12-31 17:37:23.469256+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmwareFile(char const*, char const*)> BrcmPatchRAM: OSKextRequestResource: 00000000
2020-12-31 17:37:24.268841+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::requestResourceCallback(unsigned int, int, void const*, unsigned int, void*)> BrcmPatchRAM: OSKextRequestResource Callback: dc008006.
2020-12-31 17:37:24.268923+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmwareFile(char const*, char const*)> BrcmPatchRAM: OSKextRequestResource: 00000000
2020-12-31 17:37:27.419673+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::requestResourceCallback(unsigned int, int, void const*, unsigned int, void*)> BrcmPatchRAM: OSKextRequestResource Callback: dc008006.
2020-12-31 17:37:27.431664+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmwareFile(char const*, char const*)> BrcmPatchRAM: OSKextRequestResource: 00000000
2020-12-31 17:37:27.504271+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::requestResourceCallback(unsigned int, int, void const*, unsigned int, void*)> BrcmPatchRAM: OSKextRequestResource Callback: 23737 bytes of data.
2020-12-31 17:37:27.517860+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmwareFile(char const*, char const*)> BrcmPatchRAM: Loaded firmware "BCM43142A0_001.001.011.0311.0329_v4425.zhx" from resources.
2020-12-31 17:37:27.533100+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: Decompressed firmware (23737 bytes --> 58772 bytes).
2020-12-31 17:37:27.547018+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: Firmware SHA1: 2be14cb48b7fbdf821c1b6e8b84bbcfcb5d35768
2020-12-31 17:37:27.561343+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::loadFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: Firmware is valid IntelHex firmware.
2020-12-31 17:37:27.574724+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::start(IOService*)> BrcmPatchRAM: start
2020-12-31 17:37:27.586678+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::setPowerState(unsigned long, IOService*)> BrcmPatchRAM: setPowerState: which = 0x1
2020-12-31 17:37:27.586693+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::printDeviceInfo()> BrcmPatchRAM: [0a5c:216d]: USB [441CA8B03372 v274] "BCM43142A0" by "Broadcom Corp"
2020-12-31 17:37:27.586699+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::setConfiguration(int)> BrcmPatchRAM: [0a5c:216d]: Available composite configurations: 1.
2020-12-31 17:37:27.628546+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::setConfiguration(int)> BrcmPatchRAM: [0a5c:216d]: Set device configuration to configuration index 0 successfully.
2020-12-31 17:37:27.643413+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBDeviceShim::findFirstInterface(USBInterfaceShim*)> BrcmPatchRAM: USBDeviceShim::findFirstInterface
2020-12-31 17:37:27.656637+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBDeviceShim::findFirstInterface(USBInterfaceShim*)> BrcmPatchRAM: getValidatedInterface returns <private>
2020-12-31 17:37:27.669704+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::findInterface(USBInterfaceShim*)> BrcmPatchRAM: [0a5c:216d]: Interface 0 (class ff, subclass 01, protocol 01) located.
2020-12-31 17:37:27.683981+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::uploadFirmware()> BrcmPatchRAM: set configuration and interface opened
2020-12-31 17:37:27.696706+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: findPipe: direction = 1, type = 3
2020-12-31 17:37:27.709125+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: endpoint found: epDirection = 1, epType = 3
2020-12-31 17:37:27.721779+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: found matching endpoint
2020-12-31 17:37:27.733700+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: findPipe: direction = 0, type = 2
2020-12-31 17:37:27.745616+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: endpoint found: epDirection = 1, epType = 3
2020-12-31 17:37:27.757973+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: endpoint found: epDirection = 1, epType = 2
2020-12-31 17:37:27.770153+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: endpoint found: epDirection = 0, epType = 2
2020-12-31 17:37:27.782037+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`USBInterfaceShim::findPipe(USBPipeShim*, unsigned char, unsigned char)> BrcmPatchRAM: found matching endpoint
2020-12-31 17:37:27.793511+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::uploadFirmware()> BrcmPatchRAM: got pipes
2020-12-31 17:37:27.855435+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::performUpgrade()> BrcmPatchRAM: [0a5c:216d]: State "Unknown" --> "PreInitialize".
2020-12-31 17:37:27.867337+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::hciParseResponse(void*, unsigned short, void*, unsigned char*)> BrcmPatchRAM: [0a5c:216d]: RESET complete (status: 0x00, length: 4 bytes).
2020-12-31 17:37:27.877650+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::performUpgrade()> BrcmPatchRAM: [0a5c:216d]: State "PreInitialize" --> "Initialize".
2020-12-31 17:37:28.188389+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::hciParseResponse(void*, unsigned short, void*, unsigned char*)> BrcmPatchRAM: [0a5c:216d]: READ VERBOSE CONFIG complete (status: 0x00, length: 10 bytes).
2020-12-31 17:37:28.199253+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::hciParseResponse(void*, unsigned short, void*, unsigned char*)> BrcmPatchRAM: [0a5c:216d]: Firmware version: v4096.
2020-12-31 17:37:28.207986+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::performUpgrade()> BrcmPatchRAM: [0a5c:216d]: State "Initialize" --> "Firmware version".
2020-12-31 17:37:28.217335+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::getFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: getFirmware
2020-12-31 17:37:28.224813+0530  localhost kernel[0]: (BrcmFirmwareRepo) <BrcmFirmwareRepo`BrcmFirmwareStore::getFirmware(unsigned short, unsigned short, OSString*)> BrcmPatchRAM: Retrieved cached firmware for "BCM43142A0_001.001.011.0311.0329_v4425".
2020-12-31 17:37:28.235301+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::hciParseResponse(void*, unsigned short, void*, unsigned char*)> BrcmPatchRAM: [0a5c:216d]: DOWNLOAD MINIDRIVER complete (status: 0x00, length: 4 bytes).
2020-12-31 17:37:28.245614+0530  localhost kernel[0]: (BrcmPatchRAM3) <BrcmPatchRAM3`BrcmPatchRAM3::performUpgrade()> BrcmPatchRAM: [0a5c:216d]: State "Firmware version" --> "Mini-driver complete".

Update 3: SOLVED IT!! See comment below.

Laptop : HP 15-ay542tu
Processor: i3 6006u (Skylake Mobile)
Bluetooth Card: BCM43142A0 [ven-id : dev-id = 0x0A5C : 0x216D] (Wifi + bluetooth combo card)
BrcmPatchRAM version: 2.5.5 (acidanthera)
Opencore version : 0.6.4-debug
macOS version : 11.1 stable (20C69)
 

Attachments

  • config.plist
    31.5 KB · Views: 146
  • Verbose log snapshot on longer boot.jpg
    Verbose log snapshot on longer boot.jpg
    5.1 MB · Views: 159
  • opencore-debug-log.txt
    256 KB · Views: 171
  • debug_log_ss.png
    debug_log_ss.png
    318.7 KB · Views: 153
Last edited:
I too observed that firmware patching no longer worked after I upgraded to Big Sur. It all seems to go well until it tries to write the firmware. Same Kext was working nicely in the previous macOS version.

Since it never receives the END_OF_RECORD event it looks like the problem is here:

BrcmPatchRam3.cpp:815
Code:
// If this IOSleep is not issued, the device is not ready to receive
// the firmware instructions and we will deadlock due to lack of
// responses.
IOSleep(mInitialDelay);

which can be set using bpr_initialdelay (as you tried). In my case, a value of 500 worked, the default (100) didn't work anymore.

You could check using nvram -p if the argument really mad it to your boot-args.

Code:
$ nvram -p | grep boot-args
boot-args    bpr_initialdelay=500 keepsyms=1 swd_panic=1
 
Last edited:
Hey @pechspilz thanks for the reply. TBH, I never knew BrcmPatchRAM would work on my device. So I never used this on another Mac version before. Hence the long post and discovery. But I was checking through the info.plist and my device is there, so I wanted to try. Right now, I removed every patchram kext other than bluetoothinjector and I am always warm-booting from Linux. But if it ever goes to sleep then gone.
Anyway, are you saying it now works on your Big Sur after the 500 delay? Or, are you saying it used to work before with the 500 delay and now its not?

PS. I checked the nvram already. It does make it to boot-args.
 
SOLVED IT!! After giving up for so long. Just changed two lines in source code, and rebuilt it. Everything works perfectly now. No sleep problems also.

In the following code I changed the bulkwrite to hcicommand.

I.e., two changes in acidanthera/BrcmPatchRAM/BrcmPatchRAM/BrcmPatchRAM3.cpp at line-822 & line-833 (Refer to torvalds/linux/drivers/bluetooth/btbcm.c line-206)
Code:
           case kMiniDriverComplete:
                // Should never happen, but semantically causes a leak.
                OSSafeReleaseNULL(iterator);
                // Write firmware data to bulk pipe
                iterator = OSCollectionIterator::withCollection(instructions);
                
                if (!iterator) {
                    mDeviceState = kUpdateAborted;
                    continue;
                }
                // If this IOSleep is not issued, the device is not ready to receive
                // the firmware instructions and we will deadlock due to lack of
                // responses.
                IOSleep(mInitialDelay);
                
                // Write first instruction to trigger response
                if ((data = OSDynamicCast(OSData, iterator->getNextObject()))){
                    //changed from bulkWrite
                    hciCommand((void*)(data->getBytesNoCopy()), data->getLength());
                }
                break;
                
            case kInstructionWrite:
                // should never happen, but would cause a crash
                if (!iterator) {
                    mDeviceState = kUpdateAborted;
                    continue;
                }
                
                if ((data = OSDynamicCast(OSData, iterator->getNextObject()))) {
                    //changed from bulkWrite
                    hciCommand((void*)(data->getBytesNoCopy()), data->getLength());
                } else {
                    // Firmware data fully written
                    if (hciCommand(&HCI_VSC_END_OF_RECORD, sizeof(HCI_VSC_END_OF_RECORD)) != kIOReturnSuccess) {
                        DebugLog("HCI_VSC_END_OF_RECORD failed, aborting.");
                        mDeviceState = kUpdateAborted;
                        continue;
                    }
                }
                break;
 
Hello man! I have Same combo card, can you help me with that? Because i watch your topic, but dont understand how to fix that 0_o Or if you can send me a working kext for bcm43142a0?
 
Last edited:
Hello man! I have Same combo card, can you help me with that? Because i watch your topic, but dont understand how to fix that 0_o Or if you can send me a working kext for bcm43142a0?
Yeah sure @puvellz. Did you get to solve your problem?

  • firstly did you try out the acidanthera/brcmpatchram kext trio. Use the debug version. You can inject them through your boot loader or /L/E. If injecting through boot loader, the order is BrcmFirmwareData then BrcmPatchRam3 then BrcmBluetoothInjector. (If injecting through /L/E, use BrcmFirmwareRepo instead of BrcmFirmwareData.)
  • If that doesn't work, try looking at the logs, and see what is happening. You can try this command log show --debug --last boot | grep -i brcm. Or look in Hackintool, logs sections, and filter for "brcm".
  • Now if it is getting stuck at 'mini-driver complete' stage, (It is not actually getting stuck at mini-driver complete stage. It is writing instructions, but it is not getting back the end-of-record), then you can try recompiling the sourcecode with this change, or I will just give you my kext.
 
Yeah sure @puvellz. Did you get to solve your problem?

  • firstly did you try out the acidanthera/brcmpatchram kext trio. Use the debug version. You can inject them through your boot loader or /L/E. If injecting through boot loader, the order is BrcmFirmwareData then BrcmPatchRam3 then BrcmBluetoothInjector. (If injecting through /L/E, use BrcmFirmwareRepo instead of BrcmFirmwareData.)
  • If that doesn't work, try looking at the logs, and see what is happening. You can try this command log show --debug --last boot | grep -i brcm. Or look in Hackintool, logs sections, and filter for "brcm".
  • Now if it is getting stuck at 'mini-driver complete' stage, (It is not actually getting stuck at mini-driver complete stage. It is writing instructions, but it is not getting back the end-of-record), then you can try recompiling the sourcecode with this change, or I will just give you my kext.
best to keep the kexts in EFI partition
 
SOLVED IT!! After giving up for so long. Just changed two lines in source code, and rebuilt it. Everything works perfectly now. No sleep problems also.

In the following code I changed the bulkwrite to hcicommand.

I.e., two changes in acidanthera/BrcmPatchRAM/BrcmPatchRAM/BrcmPatchRAM3.cpp at line-822 & line-833 (Refer to torvalds/linux/drivers/bluetooth/btbcm.c line-206)
Code:
           case kMiniDriverComplete:
                // Should never happen, but semantically causes a leak.
                OSSafeReleaseNULL(iterator);
                // Write firmware data to bulk pipe
                iterator = OSCollectionIterator::withCollection(instructions);
               
                if (!iterator) {
                    mDeviceState = kUpdateAborted;
                    continue;
                }
                // If this IOSleep is not issued, the device is not ready to receive
                // the firmware instructions and we will deadlock due to lack of
                // responses.
                IOSleep(mInitialDelay);
               
                // Write first instruction to trigger response
                if ((data = OSDynamicCast(OSData, iterator->getNextObject()))){
                    //changed from bulkWrite
                    hciCommand((void*)(data->getBytesNoCopy()), data->getLength());
                }
                break;
               
            case kInstructionWrite:
                // should never happen, but would cause a crash
                if (!iterator) {
                    mDeviceState = kUpdateAborted;
                    continue;
                }
               
                if ((data = OSDynamicCast(OSData, iterator->getNextObject()))) {
                    //changed from bulkWrite
                    hciCommand((void*)(data->getBytesNoCopy()), data->getLength());
                } else {
                    // Firmware data fully written
                    if (hciCommand(&HCI_VSC_END_OF_RECORD, sizeof(HCI_VSC_END_OF_RECORD)) != kIOReturnSuccess) {
                        DebugLog("HCI_VSC_END_OF_RECORD failed, aborting.");
                        mDeviceState = kUpdateAborted;
                        continue;
                    }
                }
                break;
can anyone just give me the kext that is getting bluetooth to work
 
can anyone just give me the kext that is getting bluetooth to work
Awwww. Here is my rebuilt kext after those above changes. Mind that you still need BrcmBluetoothInjector + BrcmFirmwareRepo (or BrcmFirmwareData) (Get those from here). Btw I am injecting these three from /L/E and no problems.
 

Attachments

  • mybrcmpatchram.kext.zip
    21.5 KB · Views: 167
i know it's a old post,but if you guys are there can anyone please tell me is it possible to activate 43142A0(0a5c : 216c) with out a a dual boot in my case second os is windows and to activate bluetooth first i need boot into windows!can't it be independent?
 
Status
Not open for further replies.
Back
Top