[Acer PT14-51 Laptop] HowTo

[Stezza88]

Now, with only

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",releaseDoorbell},
{"__ZN24AppleIntelBaseController15enableVDDForAuxEP14AppleIntelPort", releaseDoorbell},

Got "pipe0 not enabled" message instead of calculated pixel clock and boot with black screen and square mouse

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 5910 ][hwCRTCToIODetailedTi] FB0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 5925 ][hwCRTCToIODetailedTi] Pipe0 not enabled
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod] Current:
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  active h=0, v=0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scaled h=0, v=0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  pixelClock 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scalerFlags 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  signalConfig 0

x.log kern_gen11.cpp

Edited November 20 by Stezza88

[Stezza88]

Black screen with square mouse is the thing that must be resolved.. it's the common problem

[Stezza88]

I've understand that this (it contains useful register for adl - they are in my linux sys log)

{"__ZN24AppleIntelBaseController16hwUpdateRegCacheEP21AppleIntelFramebufferP21AppleIntelDisplayPath",releaseDoorbell},

enable my pipe0

 

but this

{"__ZN24AppleIntelBaseController35hwCRTCToIODetailedTimingInformationEP21AppleIntelFramebufferP29IODetailedTimingInformationV2", releaseDoorbell},

give to me wrong calculated pixelclock so i think that instead of the doorbell should be better to implement the method.

 

I've tryed to implement it but it doesn't work like

void AppleIntelhwCRTCToIODetailedTimingInformation(void *that, int64_t param1){
	functioncast .. (that, param1)
}

maybe i'm no good

Edited November 21 by Stezza88

[Stezza88]

If you help me to understand how to implement this method, i guess i have good logs @jalavoui

It is needed to calculate right pixelclock, scale etc , and it do by itself (instead of your crt patch)

{"__ZN24AppleIntelBaseController35hwCRTCToIODetailedTimingInformationEP21AppleIntelFramebufferP29IODetailedTimingInformationV2", AppleIntelhwCRTCToIODetailedTimingInformation, this-> oAppleIntelhwCRTCToIODetailedTimingInformation},

?? AppleIntelhwCRTCToIODetailedTimingInformation(void *that, ?? param1){
	FunctionCast .. (that, param1)
}

Edited November 21 by Stezza88

[jalavoui]

that function is fine

 

try latest nblue. i've added pg panic disable calls

Edited November 21 by jalavoui

[Stezza88]

Got this, Fan overheating and no logs.. seems a kp without report

 

Edited November 21 by Stezza88

[jalavoui]

add the agdc function pixel patch. it's somewhere in this thread. check also patches maybe you need check  f19 and f13b

test firmware registers

get nblue again i updated production code

Edited November 21 by jalavoui

[Stezza88]

I think it fails at pg set ... but ok

[Stezza88]

same result

kern_gen11.cpp

[jalavoui]

remove those f6 patches...

the firmware aux call is used 2x in hwInitializeCState()

don't patch firmware if that doesnt help

 

try disable f19

here's the agdc function pixel patch -> wrapConnectionProbe()

 

 

check extra card ids in nblue info.plist - i keep changing the file as i test it

got any kp log file ?

[Stezza88]

Nothing to do.. no logs and no kp report.. hang with fan overheating and vertical bars.. have tried to patch and unpatch fw, nothing changes, agdp pixelpatch (wrapConnectionProbe).. nothing to do.. it hangs for pg bad set i guess.. f19 patch is necessary for my system, i discovered so far..

 

kern_gen11.cpp

Edited November 21 by Stezza88

[Stezza88]

I think there could be a problem of nvram.. now i clean It before every test to be sure or maybe disable patch f20

Edited November 21 by Stezza88

[jalavoui]

added remaining card family ids to nblue - no need to mess with info.plist

 

check what you can do with it

Edited November 21 by jalavoui

[Stezza88]

With this version quite new (it is from yesterday), I got right values.. and I save it in my folders

(AppleIntelTGLGraphicsFramebuffer)[IGFB][DEBUG][PORT][AppleIntelPort.cpp:237][getBuiltInPort] Built-in PortIndex = 0, DDI = 0

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 6001 ][hwCRTCToIODetailedTi] pixelClock = 787400000
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 6096 ][hwCRTCToIODetailedTi] return
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod] Current:
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  active h=2560, v=1600
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scaled h=0, v=0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  pixelClock 787400000
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scalerFlags 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  signalConfig 0

 

 

NootedBlue-master-3.zip x.log.zip

Edited November 22 by Stezza88

[Stezza88]

Applying f16 patch I get this, so the f16 patch won't work in my system

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][PORT][AppleIntelPort.cpp:233 ][getBuiltInPort] Built-in port not found

x.log.zip

Edited November 22 by Stezza88

[Stezza88]

19 hours ago, Stezza88 said:

Got this, Fan overheating and no logs.. seems a kp without report

 

 

With latest version i got this, now I tell you what is what it makes it

Edited November 22 by Stezza88

[Stezza88]

I found my problem in latest version! @jalavoui It is this request implemented in this way that make me crash

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",hwSetPowerWellStatePG, this->ohwSetPowerWellStatePG},

Because replacing it with

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",releaseDoorbell},

got good logs and boot in black screen with square mouse

Edited November 22 by Stezza88

[jalavoui]

try add this to your code

 

IOReturn Gen11::wrapConnectionProbe() {
	IOReturn retVal = FunctionCast(wrapConnectionProbe, callback->orgConnectionProbe)( );
	
	IOService *s= (IOService*)ccont;
	auto fbTimingRange = OSDynamicCast(OSData, s->getProperty(kIOFBTimingRangeKey));
	if (fbTimingRange) {
		auto displayTimingRange = const_cast<IODisplayTimingRangeV1 *>(reinterpret_cast<const IODisplayTimingRangeV1 *>(fbTimingRange->getBytesNoCopy()));
		//displayTimingRange->maxPixelClock = 787400000;
        displayTimingRange->pixelClock = 787400000;
        //displayTimingRange->minPixelClock = 787400000;
	} else {
	}

	return retVal;
}

you can also try same logic on this function. get IODetailedTimingInformationV2 definition from wg code

 

then check this function void hwCRTCToIODetailedTimingInformation (void *that,void *param_1,          IODetailedTimingInformationV2 *param_2)

 

and in this function: AppleIntelFramebuffer::validateDetailedTiming() there's a IODetailedTimingInformationV2 var that can be changed

 

note that other functions also use this value so a patch might be need. here parm2 is from AppleIntelDisplayPath *param_2 var

 

check this function values also

 

fast value checking with kp msg. this value is used in other places

uint8_t Gen11::maxSupportedDepths(void *param_1) {
	auto ret = FunctionCast(maxSupportedDepths, callback->omaxSupportedDepths)(param_1);
	PANIC_COND(1==1, "nblue","maxSupportedDepths %x",ret);
	return ret;
}

 

your goal now is find the right spot to apply the fix.

 

from logs we can see this value is fine - so no need to change it

 

looking at the checks inject the value here maybe fixs all

try this patch in 

AppleIntelFramebuffer::validateDetailedTiming

find

0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

replace
0x41, 0xc7, 0x45, 0x44, 0x40, 0xc5, 0xee, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

 

with code something like this. assuming validateDetailedTiming-maxdepth doesn't break it

getMember<uint32_t>(param_1, 0x44) = 0x2EEEC540;

 

Edited November 22 by jalavoui

[Stezza88]

- Ok, i try this patch first of all

find 0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

replace 0x41, 0xc7, 0x45, 0x44, 0x40, 0xc5, 0xee, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

and set the wrapconnectionprobe...

and set hwSetPowerWellStatePGEbj like this 

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",hwSetPowerWellStatePG, this->ohwSetPowerWellStatePG},

and make a test.

 

- Then, if it not worked, i try to make the checks you told me.. because "your goal now is find the right spot to apply the fix." cit

But... this kind of function for value checking

uint8_t Gen11::maxSupportedDepths(void *param_1) {
	auto ret = FunctionCast(maxSupportedDepths, callback->omaxSupportedDepths)(param_1);
	PANIC_COND(1==1, "nblue","maxSupportedDepths %x",ret);
	return ret;
}

where i call it? It is called automatically or i must put the call to this function somewhere.. and where is this somewhere 😛

Or, i just make something like this?

{" ??? ", maxSupportedDepths, this->omaxSupportedDepths},

Edited November 22 by Stezza88

[jalavoui]

nvm maxSupportedDepths() was just and idea. you add the function name to the main list where other functions are if you wanna play with it

 

the linux value for your pixel is not the same as mac os

 

785 400 000 not mac os 787 400 000

 

so the patch change to

785 400 000 = 0x2ED040C0

0x41, 0xc7, 0x45, 0x44, 0xc0, 0x40, 0xd0, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

Edited November 22 by jalavoui

[Stezza88]

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj", maxSupportedDepths, this->omaxSupportedDepths},

I attach it to this, for example?

Edited November 22 by Stezza88

[jalavoui]

yes that's the way to call it

 

now that we have the right pixel value try find where it needs tobe replaced

 

this mean getCurrentDisplayMod() is returning wrong pixel value

Edited November 22 by jalavoui

[Stezza88]

And.. for the wrapconnectionprobe you told me, I got this

 

No member named 'pixelClock' in 'IODisplayTimingRangeV1'

 

The members are maxPixelClock, minPixelClock

[jalavoui]

with pixel 785 400 000 = 0x2ED040C0

 

nvm we just need to fix current value the function is hwCRTCToIODetailedTimingInformation()

 

this should do it

 

1st patch at

 hwCRTCToIODetailedTimingInformation()

 

find
0x48, 0x0f, 0xaf, 0xc3, 0x31, 0xd2, 0x48, 0xf7, 0xf1, 0x48, 0x89, 0xc1, 0x49, 0x89, 0x47, 0x28, 0x45, 0x84, 0xed, 0x74, 0x2b
rep
0x48, 0xc7, 0xc0, 0xc0, 0x40, 0xd0, 0x2e, 0x90, 0x90, 0x66, 0x48, 0x90, 0x49, 0x89, 0x47, 0x28, 0x45, 0x84, 0xed, 0xeb, 0x2b

 

2nd patch at

 

AppleIntelFramebuffer::validateDetailedTiming

find

0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

replace

0x41, 0xc7, 0x45, 0x44, 0xc0, 0x40, 0xd0, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

 

check it but i think it is correct

also read above - there might be other functions that need fixing

 

you're right about IODisplayTimingRangeV1 - my bad

wg code is here for agdc

+

 

this function also need a patch

 

header

static uint8_t SetupDPSSTTimings(

  void *that,void *param_1,

  void *param_2,void *param_3);

mach_vm_address_t oSetupDPSSTTimings {};

 

cpp part

{"__ZN24AppleIntelBaseController17SetupDPSSTTimingsEP21AppleIntelFramebufferP21AppleIntelDisplayPathP10CRTCParams",SetupDPSSTTimings, this->oSetupDPSSTTimings},

 

uint8_t Gen11::SetupDPSSTTimings(

  void *that,void *param_1,

  void *param_2,void *param_3)

{

getMember<unsigned long>(param_2, 0x118) = 0x2ED040C0;

return FunctionCast(SetupDPSSTTimings, callback->oSetupDPSSTTimings)(that,param_1,param_2,param_3);

}

 

gonna let you do some work

gl

Edited November 22 by jalavoui

[Stezza88]

With your 2 patches doesn't boot (I've first tried with 

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",releaseDoorbell},

 to see logs.)

 

But logs are interrupted at half so... it crashes without kp report

x.log

Edited November 22 by Stezza88