Jump to content

nVidia injection


  • Please log in to reply
8 replies to this topic

#1
fassl

fassl

    InsanelyMac Legend

  • Retired
  • 623 posts
Hey guys, i wanted to share the current stuff we know about the various properties mac nvidia efi drivers set to get the graphics card working properly in mac os x. Also if somebody can help disassembling those drivers you are welcome to help here if you want. And if you already know some bits please post them, so we can get this going as soon as possible. Also with 10.6.3 it seems the drivers got pickier from what i've read so far so i thought now is the best time to get into it.

First about display-cfg. It describes what type of screen is attached.

The last two bytes are made up as following:
If some condition (unknown yet, we thought it had to do with if a screen is attached to that output, which it had not) is met we get:

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: 0xFF
BYTE: 0xFF

If the unknown condition above is not met its build up as following regarding the type of screen attached.

For ANALOG:

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: 0xFF
BYTE: 0x00

For TV:

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: 0xFF
BYTE: 0x01

And for everything else like LVDS, TMDS and Display-Port

BYTE: Display-Number
BYTE: I2C Read Offset
BYTE: DCB Entry OR (guessing)
BYTE: 0x03

There is one display-cfg for each screen. Here an example (note we have to swap bytes to inject):

ANALOG
@0,display-cfg <00FFXX00>  XX = I2C Read Offset
@1,display-cfg <00FFXX01>  XX = I2C Read Offset
TV
@0,display-cfg <01FFXX00>  XX = I2C Read Offset
@1,display-cfg <01FFXX01>  XX = I2C Read Offset
ELSE
@0,display-cfg <03YYXX00>  XX = I2C Read Offset; YY = DCB ENTRY OR VALUE (guessing)
@1,display-cfg <03YYXX01>  XX = I2C Read Offset; YY = DCB ENTRY OR VALUE (guessing)


Now about NVCAP: It describes which outputs can be used simultaneously and the following:

BYTE: NVCAP_VERSION (hardcoded, goes from 0 to 5)
BYTE: HAS_CLAM_SHELL (lid)
BYTE: UNKNOWN (most built-in cards and MacPro 7300GT have that set to 1)
BYTE: UNKNOWN (most built-in cards have that set to 1. something about backlight?)
WORD: OUTPUT GROUP 3 (guessing, it describes what outputs are usable together with S-Video out)
WORD: OUTPUT GROUP 1 (describes what outputs are grouped to Display-A)
WORD: OUTPUT GROUP 2 (describes what outputs are grouped to Display-B)
BYTE:
BYTE:
BYTE:
BYTE:
BYTE: BUILT-IN (guessing, built-in cards apart from 7300GO (AppleTV) have this set to 1)
BYTE: UNKNOWN (hardcoded value)
BYTE: EDID_MANUFACTURER_RESERVED_TIMINGS (BYTE 0x25 of the primary screens EDID)
BYTE:
BYTE:
BYTE: UNKNOWN (MacBookPro 8600MGT (15") 128MB Vram has this set to 1)

About the Output groups, they are generated like following. It all depends on the DCB table in your video bios. You can find your DCB table by looking at offset 0x36 of a nvidia bios. You byte swap the word at 0x36, thats the address of the DCB table.

In the DCB table we have entries describing what type of connection can be used for a physical output, like ANALOG, ANALOG/DVI etc. Let's take an example DCB (iMac 7600GT).

DCB ENTRY 0: ANALOG
DCB ENTRY 1: LVDS
DCB ENTRY 2: TMDS
DCB ENTRY 3: TV

In this case we have LVDS at index 1 (so we set bit 1), it is always alone on an output group. So OUTPUT GROUP 1 would be
hex: 0x0002
binary: 0000 0000 0000 0010

All the other entries will be grouped to OUTPUT GROUP 2, so we have DCB ENTRY 0,2 and 3 (so we set bit 0,2 and 3) grouped which would be
0x000D
binary 0000 0000 0000 1101

As you can see we set bit X (X is the DCB ENTRY INDEX) to group an entry to an output group.

The same is done for OUTPUT GROUP 3, it's just generated when we have a TV entry in our DCB. It would be of big help if somebody with iMac 7600GT an tell us what outputs do work simultaneously with an S-Video adapter since iMac 7600GT is the only one having just the TV entry in this output group.


Now about NVMT: it describes the capabilities of the primary screen:

BYTE: NVMT_VERSION
BYTE: DISPLAY_TYPE (0 = ANALOG, 1 = TV, 3 = the rest)
BYTE: UNKNOWN
BYTE: UNKNOWN
WORD: EDID_MANUFACTURER
WORD: EDID_PRODUCT_CODE
WORD: SCREEN WIDTH
WORD: SCREEN HEIGHT
WORD: SCREEN WIDTH + SOME VALUE
WORD: SCREEN WIDTH + SOME VALUE
WORD: SCREEN WIDTH + SOME VALUE
WORD: ZEROED
WORD: SCREEN HEIGHT + SOME VALUE
WORD: SCREEN HEIGHT + SOME VALUE
WORD: SCREEN HEIGHT + SOME VALUE
WORD: ZEROED
DWORD: SOME VALUE * 10000
WORD:
BYTE:
BYTE:
--BYTE: 
BYTE:
BYTE:
7 DWORDS: ZEROED
BYTE: 0xFF HARDCODED
BYTE: 0xFF HARDCODED
6 BYTES: ZEROED
DWORD:
BYTE:
BYTE:
6 BYTES: ZEROED
BYTE:
BYTE:
BYTE:
BYTE:
--WORD: the --BYTE is this value >> 8
BYTE:
BYTE:

Looking at NVMT is quite a mess, too much is unknown yet. If somebody has any further info for instance how to calculate the screen width/height values please help.


NVDA,Features:

according to 8800GT Efi driver it is:

SUBSYSTEM_ID << 16 | 0x02FF

built-in

injected when the card is built-in. To check with: REGISTER STRAP_INFO_2 & 0x10

device-type

"NVDA,Parent" (HARDCODED)

Ext_Present

injected when there is a second screen available at boot.

@X,built-in, @X,use-backlight-blanking

injected when the attached screen is fixed and not removable (LVDS)

@0,AAPL,boot-display

injected for the primary screen

@X,backlight-control

injected with the value of AAPL,backlight-control

@0,name

"NVDA,Display-A" (HARDCODED)

@1,name

"NVDA,Display-B" (HARDCODED)

@X,device-type

"display" (HARDCODED)

@X,compatible

"NVDA,NVMac" (HARDCODED)


As you see there is still much left to investigate, if somebody has some hints or wants to help you are welcome to join this thread here. Also for easing your investigation i created a small app (based on the great work of the guys at nouveau project) attached at this thread. Note it just parses the bios, it can't save any changes you make.

Also if you happen to have real macs, it would be great if you can provide us an ioreg dump and your nVidia bios.

Attached File  NvidiaInfo.zip   128.65KB   1478 downloads

greets fassl

#2
kirasir

kirasir

    InsanelyMac Protégé

  • Members
  • PipPip
  • 83 posts
  • Gender:Male
  • Location:St. Petersburg
to be continued?

#3
spookFX

spookFX

    InsanelyMac Protégé

  • Members
  • Pip
  • 9 posts

to be continued?


Good question! This project sounds like it may do something great, I hope it continues. Maybe also post some instructions as to how you want us to get the BIOS off the card, as I have so far been unsuccessful and have tried at least 3 different methods.

Thanks

#4
fassl

fassl

    InsanelyMac Legend

  • Retired
  • 623 posts
Yeah, good question, i dont have the time anymore yet im not that good at reversing, maybe someone else can find the unknown bits or correct the info above.

About vbios dumping, if you are talking about a hackmac you can use NVEnabler, it dumps your vbios into the IORegistry and you can see it with "ioreg -lw0 | grep vbios". Actually it should also be possible to load NVEnabler on a running real mac and then issue the ioreg command mentioned above.

greets

#5
kirasir

kirasir

    InsanelyMac Protégé

  • Members
  • PipPip
  • 83 posts
  • Gender:Male
  • Location:St. Petersburg
Using NVEnabler completely bad idea, only DSDT.

#6
fassl

fassl

    InsanelyMac Legend

  • Retired
  • 623 posts
If you are talking about video bios dumping, im not sure if you can get it through DSDT from any card, i guess the corresponding function will just work for laptops which hold the video bios in their bios.

#7
kirasir

kirasir

    InsanelyMac Protégé

  • Members
  • PipPip
  • 83 posts
  • Gender:Male
  • Location:St. Petersburg
What is the meaning of obtaining BIOS graphics card? Why is it needed? And so the system sees.
(Извини за машинный перевод, по-английски плохо понимаю). :(
On netbooks and laptops bios pulled out through the DSDT.

#8
jlvaio

jlvaio

    InsanelyMac Geek

  • Members
  • PipPipPipPip
  • 220 posts
hi fassl
i m vaio user i have installed atmonitor and it gave me more than ioreg explorer

and i see that when graphic enabler =yes 10.5.8 kalyway:


| +-o NVDA,Display-A@0 <class IORegistryEntry:IOService:IOPlatformDevice:IONDRVDevice, registered, matched, active, busy 0, retain 10>
| | | | | {
| | | | | "width" = <00000000>
| | | | | "height" = <00000000>
so i think internal screen loads but with 0000000 size what do you think about this?

could that explain the problem?

Attached Files



#9
RobertX

RobertX

    InSanelyMac Maverick

  • Members
  • PipPipPipPipPipPipPip
  • 534 posts
  • Gender:Not Telling
...from NvidiaInfo .app
Opening /Users/applescruffs/Downloads/G96.zip
Reading file content
Initializing
This is not a valid VBIOS
cannot alloc memory
There were errors
Opening /Users/applescruffs/Downloads/G96.bin
Reading file content
Initializing
Seeking for PCIR header
PCIR Head found at offset 0x1f0
BIT BIOS found
feature bit 0x0000
TMDS table revision 2.0 not currently supported
impelmentation 0x0640 chipset 0x641 nvarch 0x40 twoheads yes
0xb9b6
Found Display Configuration Block version 4.0
I2cc 0xba51 recordl 8

Raw DCB entry 0: 02000300 00000028
i2c index:0, port_type:0x05, read:0x00, write:0x00
Raw DCB entry 1: 01000302 00020030
i2c index:0, port_type:0x05, read:0x00, write:0x00
Raw DCB entry 2: 04011310 00000028
i2c index:1, port_type:0x05, read:0x01, write:0x01
Raw DCB entry 3: 010223f1 00c0c080
ROM LEN fc00
Parsing VBIOS init table 0 at offset 0xD2B9
0xD2B9: ------ Executing following commands ------
0xD2B9: [ (0x7A) - INIT_ZM_REG ]
0xD317: Init table command not found: 0xE8
Parsing VBIOS init table 1 at offset 0xD72D
0xD72D: ------ Executing following commands ------
0xD72D: [ (0x8F) - INIT_RAM_RESTRICT_ZM_REG_GROUP ]
0xD789: Init table command not found: 0x22
Parsing VBIOS init table 2 at offset 0xE77D
0xE77D: ------ Executing following commands ------
0xE77D: [ (0x7A) - INIT_ZM_REG ]
0xE7DB: Init table command not found: 0x80
Parsing VBIOS init table 3 at offset 0xE89E
0xE89E: ------ Executing following commands ------
0xE89E: [ (0x5B) - INIT_SUB_DIRECT ]
0xE8F6: [ (0x7A) - INIT_ZM_REG ]
0xE954: Init table command not found: 0x00
Parsing VBIOS init table 4 at offset 0xEB1B
0xEB1B: ------ Executing following commands ------
0xEB1B: [ (0x71) - INIT_DONE ]
0xEB71: [ (0x71) - INIT_DONE ]
0xEBC7: Init table command not found: 0x01
PLL Table Version 0x30 offset 0xb3c6
Loading PLL limits for register 0x00000001
RAW pll.vco1.minfreq: 0x1ce9
RAW pll.vco1.maxfreq: 0x0002
RAW pll.vco2.minfreq: 0x8001
RAW pll.vco2.maxfreq: 0xffff04
RAW pll.vco1.min_inputfreq: 0x00ff
RAW pll.vco1.max_inputfreq: 0xffff
RAW pll.vco2.min_inputfreq: 0xaa55
RAW pll.vco2.max_inputfreq: 0xb800
pll.vco1.minfreq: 7401000
pll.vco1.maxfreq: 2000
pll.vco2.minfreq: 32769000
pll.vco2.maxfreq: 65535000
pll.vco1.min_inputfreq: 255000
pll.vco1.max_inputfreq: 65535000
pll.vco2.min_inputfreq: 43605000
pll.vco2.max_inputfreq: 47104000
pll.vco1.min_n: 70
pll.vco1.max_n: 117
pll.vco1.min_m: 44
pll.vco1.max_m: 102
pll.vco2.min_n: 193
pll.vco2.max_n: 232
pll.vco2.min_m: 20
pll.vco2.max_m: 36
pll.max_log2p: 116
pll.log2p_bias: 60
pll.refclk: 1273724586


i have the 9400 GT PCI version.... can't get TVout thru s-video ....i use NVEnabler 64.kext but no tv display.....any secrets hiding in this info?(it does work otherwise...QE/Rotation... res change is iffy on 10.6.7 but fine on 10.5.8)anyone?
Attached File  G96.zip   41.31KB   77 downloads here is the bios if that helps...thx in advance





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

© 2014 InsanelyMac  |   News  |   Forum  |   Downloads  |   OSx86 Wiki  |   Mac Netbook  |   PHP hosting by CatN  |   Designed by Ed Gain  |   Logo by irfan  |   Privacy Policy