tahoe 黑苹果 intel 蓝牙 panic

曦子 2025-09-13 • 0.9分钟 • 0.3千字

升级 taheo 后，Apple 移除了 AppleHDA.kext 的支持, 黑苹果成了哑巴, 考虑自己音响、耳机都支持蓝牙, 曲线救国, 先用蓝牙顶替下。

我之前用的博通，自从博通需要 OCLP 后我就买了个 ax210, 参考 nvme 转网卡设备.

准备工作

kext:

IntelBluetoothFirmware.kext
IntelBTPatcher.kext
BlueToolFixup.kext

⚠️Important
注意不要变更 kext 加载顺序

需要变更的配置 nvram.7C436110-AB2A-4BBB-A880-FE41995C9F82 添加以下配置:

key: bluetoothExternalDongleFailed, value: 00
key: bluetoothInternalControllerInfo, value: 0000000000000000000000000000

⚠️Important
注意, 如果你不是 ax210, 那变更的配置不太一样, 可以搜索下对应的配置.

panic

如果你使用上述配置能正常使用蓝牙就不用往下看了, 我遇到了开机 panic:

panic(cpu 6 caller 0xffffff800dec1f66): IOGMD: not wired for the IODMACommand com.apple.IOMemoryDescriptor.cpp:3430
Panicked task 0xffffff95ca4bfb70: 566 threads: pid 0: kernel_task
Backtrace (CPU 6), panicked thread: 0xffffff90fdb770c8, Frame : Return Address
0xfffffff9d5d1f530 : 0xffffff800d7574e1 mach_kernel : _handle_debugger_trap + 0x431
0xfffffff9d5d1f580 : 0xffffff800d8d29b6 mach_kernel : _kdp_i386_trap + 0x126
0xfffffff9d5d1f5c0 : 0xffffff800d8c1bbc mach_kernel : _kernel_trap + 0x75c
0xfffffff9d5d1f680 : 0xffffff800d6eb971 mach_kernel : _return_from_trap + 0xc1
0xfffffff9d5d1f6a0 : 0xffffff800d7578b7 mach_kernel : _DebuggerTrapWithState + 0x67
0xfffffff9d5d1f7a0 : 0xffffff800d756f36 mach_kernel : _panic_trap_to_debugger + 0x206
0xfffffff9d5d1f810 : 0xffffff800df88c3d mach_kernel : _panic + 0x81
0xfffffff9d5d1f900 : 0xffffff800dec1f66 mach_kernel : __ZNK25IOGeneralMemoryDescriptor19dmaCommandOperationEjPvj + 0x886
0xfffffff9d5d1f970 : 0xffffff800dec2168 mach_kernel : __ZN25IOGeneralMemoryDescriptor18getPhysicalSegmentEyPyj + 0x1c8
0xfffffff9d5d1fa40 : 0xffffff800debe16c mach_kernel : __ZN18IOMemoryDescriptor9readBytesEyPvy + 0x10c
0xfffffff9d5d1faa0 : 0xffffff80121e592e com.zxystd.IntelBTPatcher : __ZL17asyncIOCompletionPvS_ij + 0x55
0xfffffff9d5d1faf0 : 0xffffff80100e91c1 com.apple.iokit.IOUSBHostFamily : __ZN17AppleUSBIORequest8completeEv + 0x103b
0xfffffff9d5d1fce0 : 0xffffff800f1c67c9 com.apple.driver.usb.AppleUSBCommon : __ZN24AppleUSBRequestCompleter20completeRequestQueueEP11queue_entry + 0x453
0xfffffff9d5d1fef0 : 0xffffff800f1c635a com.apple.driver.usb.AppleUSBCommon : __ZN24AppleUSBRequestCompleter12checkForWorkEv + 0x132
0xfffffff9d5d1ff20 : 0xffffff800deadb9e mach_kernel : __ZN10IOWorkLoop15runEventSourcesEv + 0xee
0xfffffff9d5d1ff60 : 0xffffff800dead1f7 mach_kernel : __ZN10IOWorkLoop10threadMainEv + 0x47
0xfffffff9d5d1ffa0 : 0xffffff800d6eb19e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         com.apple.driver.usb.AppleUSBCommon(1.0)[D8546E8C-0851-3268-B287-A683D865104C]com.apple.0xffffff800f1c4000-com.apple.driver.0xffffff800f1c7fff
         com.apple.iokit.IOUSBHostFamily(1.2)[4B47FA80-5F04-3867-9F18-2B8E0325A1A6]com.apple.0xffffff8010098000-com.apple.driver.0xffffff801010bfff
            dependency: com.apple.driver.AppleBusPowerController(1.0)[799AD970-C90F-3A5A-9863-FC6DE5CCA11D]com.apple.0xffffff800eb80000-com.apple.driver.0xffffff800eb83fff
            dependency: com.apple.driver.AppleMobileFileIntegrity(1.0.5)[F2BB098C-F753-3E7B-89C5-FDFAF7A6827B]com.apple.0xffffff800eeb6000-com.apple.driver.0xffffff800eef2fff
            dependency: com.apple.driver.AppleSMC(3.1.9)[AEEE7BBA-3EC1-3E3D-8DD5-B819AC2F0647]com.apple.0xffffff800efb0000-com.apple.driver.0xffffff800efc9fff
            dependency: com.apple.driver.usb.AppleUSBCommon(1.0)[D8546E8C-0851-3268-B287-A683D865104C]com.apple.0xffffff800f1c4000-com.apple.driver.0xffffff800f1c7fff
            dependency: com.apple.driver.AppleUSBHostMergeProperties(1.2)[A225E2B1-17CF-370C-83E7-C5573EF5B9E2]com.apple.0xffffff8010168000-com.apple.driver.0xffffff8010168fff
            dependency: com.apple.iokit.IOACPIFamily(1.4)[92300B3C-CEE9-347B-BD16-AF794958AD53]com.apple.0xffffff800f7dc000-com.apple.driver.0xffffff800f7ddfff
         com.zxystd.IntelBTPatcher(2.5)[B4EA6DBC-E3C8-317A-B35F-6907682E6485]com.apple.0xffffff80121e4000-com.apple.driver.0xffffff80121edfff
            dependency: as.vit9696.Lilu(1.7.1)[AE004BE7-2FA9-36BF-AC0A-D40FCCA10FCE]com.apple.0xffffff80113e2000-com.apple.driver.0xffffff801140dfff
            dependency: com.apple.iokit.IOUSBHostFamily(1.2)[4B47FA80-5F04-3867-9F18-2B8E0325A1A6]com.apple.0xffffff8010098000-com.apple.driver.0xffffff801010bfff

然后在 z 大的 repo 发现了相关 issues, 使用里面的 kext 仍然 panic, 不知道有没有网友成功。

不过看 panic 信息应该是 DMA 的问题.

  panic(cpu 6 caller 0xffffff800dec1f66): "IOGMD: not wired for the IODMACommand"
  0xfffffff9d5d1faa0 : 0xffffff80121e592e com.zxystd.IntelBTPatcher : __ZL17asyncIOCompletion

IOGMD: not wired for the IODMACommand - IOGeneralMemoryDescriptor 没有为 DMA 操作正确”连线”
崩溃发生在 asyncIOCompletion 函数中
调用栈显示：readBytes → getPhysicalSegment → dmaCommandOperation → panic

检查 IntelBluetoothFirmware 源码, 稍微调整了下:

if (data == nullptr) {
        if (descriptor != nullptr) {
            bool needsComplete = false;
            bool shouldRead = true;

            if (getKernelVersion() >= KernelVersion::Sequoia) {
                if (descriptor->prepare(kIODirectionOut) == kIOReturnSuccess) {
                    needsComplete = true;
                } else {
                    // If prepare fails in Sequoia, skip reading to avoid panic
                    shouldRead = false;
                }
            }

            if (shouldRead && descriptor->getLength() > 0) {
                descriptor->readBytes(0, hciBuf, min(descriptor->getLength(), MAX_HCI_BUF_LEN));
                hdrLen = (uint32_t)min(descriptor->getLength(), MAX_HCI_BUF_LEN);
            }

            if (needsComplete) {
                descriptor->complete(kIODirectionOut);
            }
        }
}

编译后开机不再 panic, 具体可以看这里, 我把编译后的 kext 上传了.

成功加载 kext, 驱动蓝牙.

信号断断续续

一开始我也遇到了声音断断续续, 也怀疑是驱动的问题, 后来发现是信号的问题, 如果是 pcie 这种网卡, 尽量插天线, 我插天线后顺畅很多。

遗留问题:

偶尔卡顿以下
AirPods Pro 卡顿, 但我的音响和 bose 都正常.