nVidia injection

fassl · April 10, 2010

Hey guys, i wanted to share the current stuff we know about the various properties mac nvidia efi drivers set to get the graphics card working properly in mac os x. Also if somebody can help disassembling those drivers you are welcome to help here if you want. And if you already know some bits please post them, so we can get this going as soon as possible. Also with 10.6.3 it seems the drivers got pickier from what i've read so far so i thought now is the best time to get into it.

First about display-cfg. It describes what type of screen is attached.

The last two bytes are made up as following:

If some condition (unknown yet, we thought it had to do with if a screen is attached to that output, which it had not) is met we get:

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: 0xFF
BYTE: 0xFF

If the unknown condition above is not met its build up as following regarding the type of screen attached.

For ANALOG:

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: 0xFF
BYTE: 0x00

For TV:

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: 0xFF
BYTE: 0x01

And for everything else like LVDS, TMDS and Display-Port

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: DCB Entry OR (guessing)
BYTE: 0x03

There is one display-cfg for each screen. Here an example (note we have to swap bytes to inject):

ANALOG

@0,display-cfg <00FFXX00>  XX = I2C Read Offset
@1,display-cfg <00FFXX01>  XX = I2C Read Offset

TV

@0,display-cfg <01FFXX00>  XX = I2C Read Offset
@1,display-cfg <01FFXX01>  XX = I2C Read Offset

ELSE

@0,display-cfg <03YYXX00>  XX = I2C Read Offset; YY = DCB ENTRY OR VALUE (guessing)
@1,display-cfg <03YYXX01>  XX = I2C Read Offset; YY = DCB ENTRY OR VALUE (guessing)

Now about NVCAP: It describes which outputs can be used simultaneously and the following:

BYTE: NVCAP_VERSION (hardcoded, goes from 0 to 5)
BYTE: HAS_CLAM_SHELL (lid)
BYTE: UNKNOWN (most built-in cards and MacPro 7300GT have that set to 1)
BYTE: UNKNOWN (most built-in cards have that set to 1. something about backlight?)
WORD: OUTPUT GROUP 3 (guessing, it describes what outputs are usable together with S-Video out)
WORD: OUTPUT GROUP 1 (describes what outputs are grouped to Display-A)
WORD: OUTPUT GROUP 2 (describes what outputs are grouped to Display-B)
BYTE:
BYTE:
BYTE:
BYTE:
BYTE: BUILT-IN (guessing, built-in cards apart from 7300GO (AppleTV) have this set to 1)
BYTE: UNKNOWN (hardcoded value)
BYTE: EDID_MANUFACTURER_RESERVED_TIMINGS (BYTE 0x25 of the primary screens EDID)
BYTE:
BYTE:
BYTE: UNKNOWN (MacBookPro 8600MGT (15") 128MB Vram has this set to 1)

About the Output groups, they are generated like following. It all depends on the DCB table in your video bios. You can find your DCB table by looking at offset 0x36 of a nvidia bios. You byte swap the word at 0x36, thats the address of the DCB table.

In the DCB table we have entries describing what type of connection can be used for a physical output, like ANALOG, ANALOG/DVI etc. Let's take an example DCB (iMac 7600GT).

DCB ENTRY 0: ANALOG
DCB ENTRY 1: LVDS
DCB ENTRY 2: TMDS
DCB ENTRY 3: TV

In this case we have LVDS at index 1 (so we set bit 1), it is always alone on an output group. So OUTPUT GROUP 1 would be

hex: 0x0002
binary: 0000 0000 0000 0010

All the other entries will be grouped to OUTPUT GROUP 2, so we have DCB ENTRY 0,2 and 3 (so we set bit 0,2 and 3) grouped which would be

0x000D
binary 0000 0000 0000 1101

As you can see we set bit X (X is the DCB ENTRY INDEX) to group an entry to an output group.

The same is done for OUTPUT GROUP 3, it's just generated when we have a TV entry in our DCB. It would be of big help if somebody with iMac 7600GT an tell us what outputs do work simultaneously with an S-Video adapter since iMac 7600GT is the only one having just the TV entry in this output group.

Now about NVMT: it describes the capabilities of the primary screen:

BYTE: NVMT_VERSION
BYTE: DISPLAY_TYPE (0 = ANALOG, 1 = TV, 3 = the rest)
BYTE: UNKNOWN
BYTE: UNKNOWN
WORD: EDID_MANUFACTURER
WORD: EDID_PRODUCT_CODE
WORD: SCREEN WIDTH
WORD: SCREEN HEIGHT
WORD: SCREEN WIDTH + SOME VALUE
WORD: SCREEN WIDTH + SOME VALUE
WORD: SCREEN WIDTH + SOME VALUE
WORD: ZEROED
WORD: SCREEN HEIGHT + SOME VALUE
WORD: SCREEN HEIGHT + SOME VALUE
WORD: SCREEN HEIGHT + SOME VALUE
WORD: ZEROED
DWORD: SOME VALUE * 10000
WORD:
BYTE:
BYTE:
--BYTE: 
BYTE:
BYTE:
7 DWORDS: ZEROED
BYTE: 0xFF HARDCODED
BYTE: 0xFF HARDCODED
6 BYTES: ZEROED
DWORD:
BYTE:
BYTE:
6 BYTES: ZEROED
BYTE:
BYTE:
BYTE:
BYTE:
--WORD: the --BYTE is this value >> 8
BYTE:
BYTE:

Looking at NVMT is quite a mess, too much is unknown yet. If somebody has any further info for instance how to calculate the screen width/height values please help.

NVDA,Features:

according to 8800GT Efi driver it is:

SUBSYSTEM_ID << 16 | 0x02FF

built-in

injected when the card is built-in. To check with: REGISTER STRAP_INFO_2 & 0x10

device-type

"NVDA,Parent" (HARDCODED)

Ext_Present

injected when there is a second screen available at boot.

@X,built-in, @X,use-backlight-blanking

injected when the attached screen is fixed and not removable (LVDS)

@0,AAPL,boot-display

injected for the primary screen

@X,backlight-control

injected with the value of AAPL,backlight-control

@0,name

"NVDA,Display-A" (HARDCODED)

@1,name

"NVDA,Display-B" (HARDCODED)

@X,device-type

"display" (HARDCODED)

@X,compatible

"NVDA,NVMac" (HARDCODED)

As you see there is still much left to investigate, if somebody has some hints or wants to help you are welcome to join this thread here. Also for easing your investigation i created a small app (based on the great work of the guys at nouveau project) attached at this thread. Note it just parses the bios, it can't save any changes you make.

Also if you happen to have real macs, it would be great if you can provide us an ioreg dump and your nVidia bios.

NvidiaInfo.zip

greets fassl

kirasir · June 13, 2010

to be continued?

spookFX · June 13, 2010

to be continued?

Good question! This project sounds like it may do something great, I hope it continues. Maybe also post some instructions as to how you want us to get the BIOS off the card, as I have so far been unsuccessful and have tried at least 3 different methods.

Thanks

fassl · June 15, 2010

Yeah, good question, i dont have the time anymore yet im not that good at reversing, maybe someone else can find the unknown bits or correct the info above.

About vbios dumping, if you are talking about a hackmac you can use NVEnabler, it dumps your vbios into the IORegistry and you can see it with "ioreg -lw0 | grep vbios". Actually it should also be possible to load NVEnabler on a running real mac and then issue the ioreg command mentioned above.

greets

kirasir · June 19, 2010

Using NVEnabler completely bad idea, only DSDT.

fassl · June 20, 2010

If you are talking about video bios dumping, im not sure if you can get it through DSDT from any card, i guess the corresponding function will just work for laptops which hold the video bios in their bios.

kirasir · June 21, 2010

What is the meaning of obtaining BIOS graphics card? Why is it needed? And so the system sees.

(Извини за машинный перевод, по-английски плохо понимаю).

On netbooks and laptops bios pulled out through the DSDT.

jlvaio · February 3, 2011

hi fassl

i m vaio user i have installed atmonitor and it gave me more than ioreg explorer

and i see that when graphic enabler =yes 10.5.8 kalyway:

| +-o NVDA,Display-A@0 <class IORegistryEntry:IOService:IOPlatformDevice:IONDRVDevice, registered, matched, active, busy 0, retain 10>

| | | | | {

so i think internal screen loads but with 0000000 size what do you think about this?

could that explain the problem?

ioreg_jlvaio_before_and_after.rar

RobertX · April 5, 2011

...from NvidiaInfo .app

Opening /Users/applescruffs/Downloads/G96.zip

Reading file content

Initializing

This is not a valid VBIOS

cannot alloc memory

There were errors

Opening /Users/applescruffs/Downloads/G96.bin

Reading file content

Initializing

Seeking for PCIR header

PCIR Head found at offset 0x1f0

BIT BIOS found

feature bit 0x0000

TMDS table revision 2.0 not currently supported

impelmentation 0x0640 chipset 0x641 nvarch 0x40 twoheads yes

0xb9b6

Found Display Configuration Block version 4.0

I2cc 0xba51 recordl 8

Raw DCB entry 0: 02000300 00000028

i2c index:0, port_type:0x05, read:0x00, write:0x00

Raw DCB entry 1: 01000302 00020030

i2c index:0, port_type:0x05, read:0x00, write:0x00

Raw DCB entry 2: 04011310 00000028

i2c index:1, port_type:0x05, read:0x01, write:0x01

Raw DCB entry 3: 010223f1 00c0c080

ROM LEN fc00

Parsing VBIOS init table 0 at offset 0xD2B9

0xD2B9: ------ Executing following commands ------

0xD2B9: [ (0x7A) - INIT_ZM_REG ]

0xD317: Init table command not found: 0xE8

Parsing VBIOS init table 1 at offset 0xD72D

0xD72D: ------ Executing following commands ------

0xD72D: [ (0x8F) - INIT_RAM_RESTRICT_ZM_REG_GROUP ]

0xD789: Init table command not found: 0x22

Parsing VBIOS init table 2 at offset 0xE77D

0xE77D: ------ Executing following commands ------

0xE77D: [ (0x7A) - INIT_ZM_REG ]

0xE7DB: Init table command not found: 0x80

Parsing VBIOS init table 3 at offset 0xE89E

0xE89E: ------ Executing following commands ------

0xE89E: [ (0x5B) - INIT_SUB_DIRECT ]

0xE8F6: [ (0x7A) - INIT_ZM_REG ]

0xE954: Init table command not found: 0x00

Parsing VBIOS init table 4 at offset 0xEB1B

0xEB1B: ------ Executing following commands ------

0xEB1B: [ (0x71) - INIT_DONE ]

0xEB71: [ (0x71) - INIT_DONE ]

0xEBC7: Init table command not found: 0x01

PLL Table Version 0x30 offset 0xb3c6

Loading PLL limits for register 0x00000001

RAW pll.vco1.minfreq: 0x1ce9

RAW pll.vco1.maxfreq: 0x0002

RAW pll.vco2.minfreq: 0x8001

RAW pll.vco2.maxfreq: 0xffff04

RAW pll.vco1.min_inputfreq: 0x00ff

RAW pll.vco1.max_inputfreq: 0xffff

RAW pll.vco2.min_inputfreq: 0xaa55

RAW pll.vco2.max_inputfreq: 0xb800

pll.vco1.minfreq: 7401000

pll.vco1.maxfreq: 2000

pll.vco2.minfreq: 32769000

pll.vco2.maxfreq: 65535000

pll.vco1.min_inputfreq: 255000

pll.vco1.max_inputfreq: 65535000

pll.vco2.min_inputfreq: 43605000

pll.vco2.max_inputfreq: 47104000

pll.vco1.min_n: 70

pll.vco1.max_n: 117

pll.vco1.min_m: 44

pll.vco1.max_m: 102

pll.vco2.min_n: 193

pll.vco2.max_n: 232

pll.vco2.min_m: 20

pll.vco2.max_m: 36

pll.max_log2p: 116

pll.log2p_bias: 60

pll.refclk: 1273724586

i have the 9400 GT PCI version.... can't get TVout thru s-video ....i use NVEnabler 64.kext but no tv display.....any secrets hiding in this info?(it does work otherwise...QE/Rotation... res change is iffy on 10.6.7 but fine on 10.5.8)anyone?

G96.zip here is the bios if that helps...thx in advance

night199uk · July 21, 2015

Old post, but I thought I'd share some info...

NVMT contains the Nvidia Mode TImings for the active display mode. You can look at GTF/CEA spec or look at the XFree86 modelines utility to understand the values.

The NVIDIA graphics driver calculates a list of 'Heads' (using the valid head values for each DCB entry in the DCB). This is an index into each Head per card.

AppleGraphicsPolicy will loop through each head and pull the EDID from the display attached to each head.

It calculates the mode timings by picking the best mode from the EDID & card modes.

AGP then tries to set that mode into the display (using the NVIDIA Mac EFI driver) - if setting the display mode is successful then that display is picked as the boot display and the Head index (as above) and the NVMT are written into the io-reg table. ISTR Boot-Display is only written into the active card. If no active displays are found on the primary card AGP will loop to the next card, etc.

Slice · July 21, 2015

Old post, but I thought I'd share some info...

NVMT contains the Nvidia Mode TImings for the active display mode. You can look at GTF/CEA spec or look at the XFree86 modelines utility to understand the values.

The NVIDIA graphics driver calculates a list of 'Heads' (using the valid head values for each DCB entry in the DCB). This is an index into each Head per card.

AppleGraphicsPolicy will loop through each head and pull the EDID from the display attached to each head.

It calculates the mode timings by picking the best mode from the EDID & card modes.

AGP then tries to set that mode into the display (using the NVIDIA Mac EFI driver) - if setting the display mode is successful then that display is picked as the boot display and the Head index (as above) and the NVMT are written into the io-reg table. ISTR Boot-Display is only written into the active card. If no active displays are found on the primary card AGP will loop to the next card, etc.

So NVMT is created by system and needs no to be injected?

night199uk · July 21, 2015

AppleGraphicsPolicy.EFI called the card UEFI VBIOS for e.g. GTX680 Mac.

NVMT & boot-display are injected by the UEFI VBIOS on the card itself after mode setting.

So it should be injected by Clover or Ozmosis using the values of the current video mode after mode setting.

It is similar to an XFree86 modeline:

http://www.arachnoid.com/modelines/

# 640x480 @ 60.00 Hz (GTF) hsync: 29.82 kHz; pclk: 23.86 MHz
Modeline "640x480_60.00" 23.86 640 656 720 800 480 481 484 497 -HSync +Vsync

DuongTHVN · May 13, 2016

something not true :

here is offical document by Nviida:

ftp://download.nvidia.com/open-gpu-doc/DCB/1/DCB-4.0-Specification.html

connectertype has change...... ?

DuongTHVN · June 6, 2017

About NVMT i have a caculator here

but some block - i don't know what is mean.

NVMT of MBP get from here 2.plist.zip

nVidia injection

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites