Iris Xe iGPU on Tiger Lake successfully loaded ICLLP Frambuffer and VRAM also recognizes 1536MB! + However, some issues.

[Mastachief]

I figure what you want are the actual bus ring register offsets in the BAR0 or BAR1 space that nblue could hook into.

 

I was able to locate them, but they change between Ubuntu reboots and the AI isnt giving much help on that front.

Edited December 4, 2024 by Mastachief

[jalavoui]

ida pro shows the ring register used for base setup more clearly

 

how gpuinfo() does the setup and hwcaps registers update ?

the initHardwareCaps() field values are also not very clear

 

 

 

can be modified to a struct

 

with

 

Edited December 5, 2024 by jalavoui

[Mastachief]

GPUinfo() is done before in the PCI configuration or MMIO reads,

 

the uVar1, iVar3 etc is calculated, im looking at ghidra, but not getting a good a de-compile on the binary.

[jalavoui]

create a generic struct in ghidra allows the decompile to name fields

 

so the decompile points to their address

 

generic fields

 

ghidra show some values maybe from other functions usage

 

guess ghidra trys to show some values but i know this highlight is a pointer to rcs string. as seen by ida pro

Edited December 5, 2024 by jalavoui

[jalavoui]

this will do for now - from bninja

 

000f0c60  kIGHwCsDesc:
000f0c60  00 01 00 00 00                                                                                   .....

000f0c65  void* data_f0c65 = data_b0600 {"RCS"}
000f0c6d  void* data_f0c6d = data_b0604 {"Render"}
000f0c75  int32_t data_f0c75 = 0x2230
000f0c79  int32_t data_f0c79 = 0x2510
000f0c7d  int32_t data_f0c7d = 0x2550
000f0c81  int32_t data_f0c81 = 0x2234
000f0c85  int32_t data_f0c85 = 0x23a0
000f0c89  int32_t data_f0c89 = 0x2370
000f0c8d  int32_t data_f0c8d = 0xc5b0
000f0c91  int32_t data_f0c91 = 0xc5c0
000f0c95  int32_t data_f0c95 = 0x2080
000f0c99  int32_t data_f0c99 = 0x229c
000f0c9d  int32_t data_f0c9d = 0x20d0
000f0ca1  int32_t data_f0ca1 = 0x20b0
000f0ca5  int32_t data_f0ca5 = 0x20b4
000f0ca9  int32_t data_f0ca9 = 0x2358
000f0cad  int32_t data_f0cad = 0x2600
000f0cb1  int32_t data_f0cb1 = 0x0
000f0cb5  int32_t data_f0cb5 = 0x14000
000f0cb9  int32_t data_f0cb9 = 0x0
000f0cbd  int32_t data_f0cbd = 0x17
000f0cc1  int32_t data_f0cc1 = 0x18
000f0cc5  int32_t data_f0cc5 = 0x69677263
000f0cc9  int32_t data_f0cc9 = 0x69677266
000f0ccd  int32_t data_f0ccd = 0x69677265
000f0cd1  int32_t data_f0cd1 = 0xa278
000f0cd5  int32_t data_f0cd5 = 0xd84
000f0cd9  int32_t data_f0cd9 = 0x201
000f0cdd  char data_f0cdd = 0x0
000f0cde  void* data_f0cde = data_b060b {"CCS"}
000f0ce6  void* data_f0ce6 = data_b060f {"Compute"}
000f0cee  int32_t data_f0cee = 0x1a230
000f0cf2  int32_t data_f0cf2 = 0x1a510
000f0cf6  int32_t data_f0cf6 = 0x1a550
000f0cfa  int32_t data_f0cfa = 0x1a234
000f0cfe  int32_t data_f0cfe = 0x1a3a0
000f0d02  int32_t data_f0d02 = 0x1a370
000f0d06  int32_t data_f0d06 = 0xc5e0
000f0d0a  int32_t data_f0d0a = 0xc5e4
000f0d0e  int32_t data_f0d0e = 0x1a080
000f0d12  int32_t data_f0d12 = 0x1a29c
000f0d16  int32_t data_f0d16 = 0x1a0d0
000f0d1a  int32_t data_f0d1a = 0x1a0b0
000f0d1e  int32_t data_f0d1e = 0x1a0b4
000f0d22  int32_t data_f0d22 = 0x1a358
000f0d26  int32_t data_f0d26 = 0x1a600
000f0d2a  int32_t data_f0d2a = 0x0
000f0d2e  int32_t data_f0d2e = 0x14000
000f0d32  int32_t data_f0d32 = 0x18
000f0d36  int32_t data_f0d36 = 0x1f
000f0d3a  int32_t data_f0d3a = 0x8
000f0d3e  int32_t data_f0d3e = 0x69676363
000f0d42  int32_t data_f0d42 = 0x69676366
000f0d46  int32_t data_f0d46 = 0x69676365
000f0d4a  int32_t data_f0d4a = 0x0
000f0d4e  int32_t data_f0d4e = 0x0
000f0d52  int32_t data_f0d52 = 0x402
000f0d56  char data_f0d56 = 0x0
000f0d57  void* data_f0d57 = data_b0617 {"BCS"}
000f0d5f  void* data_f0d5f = data_b061b {"Blit"}
000f0d67  int32_t data_f0d67 = 0x22230
000f0d6b  int32_t data_f0d6b = 0x22510
000f0d6f  int32_t data_f0d6f = 0x22550
000f0d73  int32_t data_f0d73 = 0x22234
000f0d77  int32_t data_f0d77 = 0x223a0
000f0d7b  int32_t data_f0d7b = 0x22370
000f0d7f  int32_t data_f0d7f = 0xc5b4
000f0d83  int32_t data_f0d83 = 0xc5c4
000f0d87  int32_t data_f0d87 = 0x22080
000f0d8b  int32_t data_f0d8b = 0x2229c
000f0d8f  int32_t data_f0d8f = 0x220d0
000f0d93  int32_t data_f0d93 = 0x220b0
000f0d97  int32_t data_f0d97 = 0x220b4
000f0d9b  int32_t data_f0d9b = 0x22358
000f0d9f  int32_t data_f0d9f = 0x22600
000f0da3  int32_t data_f0da3 = 0x0
000f0da7  int32_t data_f0da7 = 0x2000
000f0dab  int32_t data_f0dab = 0x20
000f0daf  int32_t data_f0daf = 0x23
000f0db3  int32_t data_f0db3 = 0x4
000f0db7  int32_t data_f0db7 = 0x69676263
000f0dbb  int32_t data_f0dbb = 0x69676266
000f0dbf  int32_t data_f0dbf = 0x69676265
000f0dc3  int32_t data_f0dc3 = 0x0
000f0dc7  int32_t data_f0dc7 = 0x0
000f0dcb  int32_t data_f0dcb = 0x803
000f0dcf  char data_f0dcf = 0x0
000f0dd0  char const (* data_f0dd0)[0x5] = data_b0620 {"VCS0"}
000f0dd8  char const (* data_f0dd8)[0x6] = data_b0625 {"Media"}
000f0de0  int32_t data_f0de0 = 0x1c0230
000f0de4  int32_t data_f0de4 = 0x1c0510
000f0de8  int32_t data_f0de8 = 0x1c0550
000f0dec  int32_t data_f0dec = 0x1c0234
000f0df0  int32_t data_f0df0 = 0x1c03a0
000f0df4  int32_t data_f0df4 = 0x1c0370
000f0df8  int32_t data_f0df8 = 0xc5b8
000f0dfc  int32_t data_f0dfc = 0xc5c8
000f0e00  int32_t data_f0e00 = 0x1c0080
000f0e04  int32_t data_f0e04 = 0x1c029c
000f0e08  int32_t data_f0e08 = 0x1c00d0
000f0e0c  int32_t data_f0e0c = 0x1c00b0
000f0e10  int32_t data_f0e10 = 0x1c00b4
000f0e14  int32_t data_f0e14 = 0x1c0358
000f0e18  int32_t data_f0e18 = 0x1c0600
000f0e1c  int32_t data_f0e1c = 0x1
000f0e20  int32_t data_f0e20 = 0x2000
000f0e24  int32_t data_f0e24 = 0x24
000f0e28  int32_t data_f0e28 = 0x2b
000f0e2c  int32_t data_f0e2c = 0x8
000f0e30  int32_t data_f0e30 = 0x69676330
000f0e34  int32_t data_f0e34 = 0x69676630
000f0e38  int32_t data_f0e38 = 0x69676530
000f0e3c  int32_t data_f0e3c = 0xa540
000f0e40  int32_t data_f0e40 = 0xd50
000f0e44  int32_t data_f0e44 = 0x1004
000f0e48  char data_f0e48 = 0x0
000f0e49  void* data_f0e49 = data_b062b {"VCS2"}
000f0e51  void* data_f0e51 = data_b0625 {"Media"}
000f0e59  int32_t data_f0e59 = 0x1d0230
000f0e5d  int32_t data_f0e5d = 0x1d0510
000f0e61  int32_t data_f0e61 = 0x1d0550
000f0e65  int32_t data_f0e65 = 0x1d0234
000f0e69  int32_t data_f0e69 = 0x1d03a0
000f0e6d  int32_t data_f0e6d = 0x1d0370
000f0e71  int32_t data_f0e71 = 0xc5b8
000f0e75  int32_t data_f0e75 = 0xc5c8
000f0e79  int32_t data_f0e79 = 0x1d0080
000f0e7d  int32_t data_f0e7d = 0x1d029c
000f0e81  int32_t data_f0e81 = 0x1d00d0
000f0e85  int32_t data_f0e85 = 0x1d00b0
000f0e89  int32_t data_f0e89 = 0x1d00b4
000f0e8d  int32_t data_f0e8d = 0x1d0358
000f0e91  int32_t data_f0e91 = 0x1d0600
000f0e95  int32_t data_f0e95 = 0x4
000f0e99  int32_t data_f0e99 = 0x2000
000f0e9d  int32_t data_f0e9d = 0x2c
000f0ea1  int32_t data_f0ea1 = 0x33
000f0ea5  int32_t data_f0ea5 = 0x8
000f0ea9  int32_t data_f0ea9 = 0x69676332
000f0ead  int32_t data_f0ead = 0x69676632
000f0eb1  int32_t data_f0eb1 = 0x69676532
000f0eb5  int32_t data_f0eb5 = 0xa548
000f0eb9  int32_t data_f0eb9 = 0xd58
000f0ebd  int32_t data_f0ebd = 0x2005
000f0ec1  char data_f0ec1 = 0x0
000f0ec2  void* data_f0ec2 = data_b0630 {"VECS0"}
000f0eca  void* data_f0eca = data_b0625 {"Media"}
000f0ed2  int32_t data_f0ed2 = 0x1c8230
000f0ed6  int32_t data_f0ed6 = 0x1c8510
000f0eda  int32_t data_f0eda = 0x1c8550
000f0ede  int32_t data_f0ede = 0x1c8234
000f0ee2  int32_t data_f0ee2 = 0x1c83a0
000f0ee6  int32_t data_f0ee6 = 0x1c8370
000f0eea  int32_t data_f0eea = 0xc5bc
000f0eee  int32_t data_f0eee = 0xc5cc
000f0ef2  int32_t data_f0ef2 = 0x1c8080
000f0ef6  int32_t data_f0ef6 = 0x1c829c
000f0efa  int32_t data_f0efa = 0x1c80d0
000f0efe  int32_t data_f0efe = 0x1c80b0
000f0f02  int32_t data_f0f02 = 0x1c80b4
000f0f06  int32_t data_f0f06 = 0x1c8358
000f0f0a  int32_t data_f0f0a = 0x1c8600
000f0f0e  int32_t data_f0f0e = 0x10000
000f0f12  int32_t data_f0f12 = 0x2000
000f0f16  int32_t data_f0f16 = 0x34
000f0f1a  int32_t data_f0f1a = 0x3b
000f0f1e  int32_t data_f0f1e = 0x8
000f0f22  int32_t data_f0f22 = 0x69676338
000f0f26  int32_t data_f0f26 = 0x69676638
000f0f2a  int32_t data_f0f2a = 0x69676538
000f0f2e  int32_t data_f0f2e = 0xa560
000f0f32  int32_t data_f0f32 = 0xd70
000f0f36  int32_t data_f0f36 = 0x0
000f0f3a  char data_f0f3a = 0x0

here's the code

 

or in this mode

 

and the other refs for kIGHwCsDesc

 

Edited December 5, 2024 by jalavoui

[jalavoui]

freq calc 24 000 000 = 0x16E3600

 

 

Edited December 5, 2024 by jalavoui

[jalavoui]

creating structures

 

 

data is formated as this

 

refs change to

[Mastachief]

I enabled applvt-d and disabled the "DisableIOMapper" quirk.

I had to drop the DMAR tables though and feed ACPI with the memory reserved regions removed.

[jalavoui]

i'm trying to make better struct

 

struct ring {
			char* id;
			char* classs;
			uint32_t RING_ELSP;
			uint32_t RING_EXECLIST_SQ_CONTENTS;
			uint32_t RING_EXECLIST_CONTROL;
			uint32_t EL_OFFSET_STATUS;
			uint32_t EL_OFFSET_STATUS_PTR;
			uint32_t EL_OFFSET_STATUS_BUF;
			uint32_t field8_0x28;
			uint32_t field9_0x2c;
			uint32_t RING_HWS_PGA;
			uint32_t RING_MODE_GEN7;
			uint32_t RING_RESET_CTL;
			uint32_t RING_EIR;
			uint32_t RING_EMR;
			uint32_t RING_TIMESTAMP;
			uint32_t GEN8_RING_CS_GPR;
			uint32_t executionUnitCountnt;
			uint32_t Contextsize;
			uint32_t field19_0x54;
			uint32_t field20_0x58;
			uint32_t field21_0x5c;
			char field22_0x60[0x4];
			char field23_0x64[0x4];
			char field24_0x68[0x4];
			uint32_t FORCEWAKE;
			uint32_t FORCEWAKE_ACK;
			uint32_t flags;
			bool field28_0x78;
	};

	struct IGHwCsDesc {
		char kIGHwCsDesc;
		char field1_0x1;
		char field2_0x2;
		char field3_0x3;
		char field4_0x4;
		struct ring rings[6];
	};

data makes more sense

#define RENDER_RING_BASE 0x02000

#define BLT_RING_BASE 0x22000

struct IGHwCsDesc kIGHwCsDesc = 
{
    char kIGHwCsDesc = 0x0
    char field1_0x1 = 0x1
    char field2_0x2 = 0x0
    char field3_0x3 = 0x0
    char field4_0x4 = 0x0
    struct ring rings[0x6] = 
    {
        [0x0] = 
        {
            char* id = data_91600 {"RCS"}
            char* classs = data_91604 {"Render"}
            uint32_t RING_ELSP = 0x2230
            uint32_t RING_EXECLIST_SQ_CONTENTS = 0x2510
            uint32_t RING_EXECLIST_CONTROL = 0x2550
            uint32_t EL_OFFSET_STATUS = 0x2234
            uint32_t EL_OFFSET_STATUS_PTR = 0x23a0
            uint32_t EL_OFFSET_STATUS_BUF = 0x2370
            uint32_t field8_0x28 = 0xc5b0
            uint32_t field9_0x2c = 0xc5c0
            uint32_t RING_HWS_PGA = 0x2080
            uint32_t RING_MODE_GEN7 = 0x229c
            uint32_t RING_RESET_CTL = 0x20d0
            uint32_t RING_EIR = 0x20b0
            uint32_t RING_EMR = 0x20b4
            uint32_t RING_TIMESTAMP = 0x2358
            uint32_t GEN8_RING_CS_GPR = 0x2600
            uint32_t executionUnitCountnt = 0x0
            uint32_t Contextsize = 0x14000
            uint32_t field19_0x54 = 0x0
            uint32_t field20_0x58 = 0x17
            uint32_t field21_0x5c = 0x18
            char field22_0x60[0x4] = "crgi"
            char field23_0x64[0x4] = "frgi"
            char field24_0x68[0x4] = "ergi"
            uint32_t FORCEWAKE = 0xa278
            uint32_t FORCEWAKE_ACK = 0xd84
            uint32_t flags = 0x201
            bool field28_0x78 = false
        }
        [0x1] = 
        {
            char* id = data_9160b {"CCS"}
            char* classs = data_9160f {"Compute"}
            uint32_t RING_ELSP = 0x1a230
            uint32_t RING_EXECLIST_SQ_CONTENTS = 0x1a510
            uint32_t RING_EXECLIST_CONTROL = 0x1a550
            uint32_t EL_OFFSET_STATUS = 0x1a234
            uint32_t EL_OFFSET_STATUS_PTR = 0x1a3a0
            uint32_t EL_OFFSET_STATUS_BUF = 0x1a370
            uint32_t field8_0x28 = 0xc5e0
            uint32_t field9_0x2c = 0xc5e4
            uint32_t RING_HWS_PGA = 0x1a080
            uint32_t RING_MODE_GEN7 = 0x1a29c
            uint32_t RING_RESET_CTL = 0x1a0d0
            uint32_t RING_EIR = 0x1a0b0
            uint32_t RING_EMR = 0x1a0b4
            uint32_t RING_TIMESTAMP = 0x1a358
            uint32_t GEN8_RING_CS_GPR = 0x1a600
            uint32_t executionUnitCountnt = 0x0
            uint32_t Contextsize = 0x14000
            uint32_t field19_0x54 = 0x18
            uint32_t field20_0x58 = 0x1f
            uint32_t field21_0x5c = 0x8
            char field22_0x60[0x4] = "ccgi"
            char field23_0x64[0x4] = "fcgi"
            char field24_0x68[0x4] = "ecgi"
            uint32_t FORCEWAKE = 0x0
            uint32_t FORCEWAKE_ACK = 0x0
            uint32_t flags = 0x402
            bool field28_0x78 = false
        }
        [0x2] = 
        {
            char* id = data_91617 {"BCS"}
            char* classs = data_9161b {"Blit"}
            uint32_t RING_ELSP = 0x22230
            uint32_t RING_EXECLIST_SQ_CONTENTS = 0x22510
            uint32_t RING_EXECLIST_CONTROL = 0x22550
            uint32_t EL_OFFSET_STATUS = 0x22234
            uint32_t EL_OFFSET_STATUS_PTR = 0x223a0
            uint32_t EL_OFFSET_STATUS_BUF = 0x22370
            uint32_t field8_0x28 = 0xc5b4
            uint32_t field9_0x2c = 0xc5c4
            uint32_t RING_HWS_PGA = 0x22080
            uint32_t RING_MODE_GEN7 = 0x2229c
            uint32_t RING_RESET_CTL = 0x220d0
            uint32_t RING_EIR = 0x220b0
            uint32_t RING_EMR = 0x220b4
            uint32_t RING_TIMESTAMP = 0x22358
            uint32_t GEN8_RING_CS_GPR = 0x22600
            uint32_t executionUnitCountnt = 0x0
            uint32_t Contextsize = 0x2000
            uint32_t field19_0x54 = 0x20
            uint32_t field20_0x58 = 0x23
            uint32_t field21_0x5c = 0x4
            char field22_0x60[0x4] = "cbgi"
            char field23_0x64[0x4] = "fbgi"
            char field24_0x68[0x4] = "ebgi"
            uint32_t FORCEWAKE = 0x0
            uint32_t FORCEWAKE_ACK = 0x0
            uint32_t flags = 0x803
            bool field28_0x78 = false
        }
        [0x3] = 
        {
            char* id = data_91620 {"VCS0"}
            char* classs = data_91625 {"Media"}
            uint32_t RING_ELSP = 0x1c0230
            uint32_t RING_EXECLIST_SQ_CONTENTS = 0x1c0510
            uint32_t RING_EXECLIST_CONTROL = 0x1c0550
            uint32_t EL_OFFSET_STATUS = 0x1c0234
            uint32_t EL_OFFSET_STATUS_PTR = 0x1c03a0
            uint32_t EL_OFFSET_STATUS_BUF = 0x1c0370
            uint32_t field8_0x28 = 0xc5b8
            uint32_t field9_0x2c = 0xc5c8
            uint32_t RING_HWS_PGA = 0x1c0080
            uint32_t RING_MODE_GEN7 = 0x1c029c
            uint32_t RING_RESET_CTL = 0x1c00d0
            uint32_t RING_EIR = 0x1c00b0
            uint32_t RING_EMR = 0x1c00b4
            uint32_t RING_TIMESTAMP = 0x1c0358
            uint32_t GEN8_RING_CS_GPR = 0x1c0600
            uint32_t executionUnitCountnt = 0x1
            uint32_t Contextsize = 0x2000
            uint32_t field19_0x54 = 0x24
            uint32_t field20_0x58 = 0x2b
            uint32_t field21_0x5c = 0x8
            char field22_0x60[0x4] = "0cgi"
            char field23_0x64[0x4] = "0fgi"
            char field24_0x68[0x4] = "0egi"
            uint32_t FORCEWAKE = 0xa540
            uint32_t FORCEWAKE_ACK = 0xd50
            uint32_t flags = 0x1004
            bool field28_0x78 = false
        }
        [0x4] = 
        {
            char* id = data_9162b {"VCS2"}
            char* classs = data_91625 {"Media"}
            uint32_t RING_ELSP = 0x1d0230
            uint32_t RING_EXECLIST_SQ_CONTENTS = 0x1d0510
            uint32_t RING_EXECLIST_CONTROL = 0x1d0550
            uint32_t EL_OFFSET_STATUS = 0x1d0234
            uint32_t EL_OFFSET_STATUS_PTR = 0x1d03a0
            uint32_t EL_OFFSET_STATUS_BUF = 0x1d0370
            uint32_t field8_0x28 = 0xc5b8
            uint32_t field9_0x2c = 0xc5c8
            uint32_t RING_HWS_PGA = 0x1d0080
            uint32_t RING_MODE_GEN7 = 0x1d029c
            uint32_t RING_RESET_CTL = 0x1d00d0
            uint32_t RING_EIR = 0x1d00b0
            uint32_t RING_EMR = 0x1d00b4
            uint32_t RING_TIMESTAMP = 0x1d0358
            uint32_t GEN8_RING_CS_GPR = 0x1d0600
            uint32_t executionUnitCountnt = 0x4
            uint32_t Contextsize = 0x2000
            uint32_t field19_0x54 = 0x2c
            uint32_t field20_0x58 = 0x33
            uint32_t field21_0x5c = 0x8
            char field22_0x60[0x4] = "2cgi"
            char field23_0x64[0x4] = "2fgi"
            char field24_0x68[0x4] = "2egi"
            uint32_t FORCEWAKE = 0xa548
            uint32_t FORCEWAKE_ACK = 0xd58
            uint32_t flags = 0x2005
            bool field28_0x78 = false
        }
        [0x5] = 
        {
            char* id = data_91630 {"VECS0"}
            char* classs = data_91625 {"Media"}
            uint32_t RING_ELSP = 0x1c8230
            uint32_t RING_EXECLIST_SQ_CONTENTS = 0x1c8510
            uint32_t RING_EXECLIST_CONTROL = 0x1c8550
            uint32_t EL_OFFSET_STATUS = 0x1c8234
            uint32_t EL_OFFSET_STATUS_PTR = 0x1c83a0
            uint32_t EL_OFFSET_STATUS_BUF = 0x1c8370
            uint32_t field8_0x28 = 0xc5bc
            uint32_t field9_0x2c = 0xc5cc
            uint32_t RING_HWS_PGA = 0x1c8080
            uint32_t RING_MODE_GEN7 = 0x1c829c
            uint32_t RING_RESET_CTL = 0x1c80d0
            uint32_t RING_EIR = 0x1c80b0
            uint32_t RING_EMR = 0x1c80b4
            uint32_t RING_TIMESTAMP = 0x1c8358
            uint32_t GEN8_RING_CS_GPR = 0x1c8600
            uint32_t executionUnitCountnt = 0x10000
            uint32_t Contextsize = 0x2000
            uint32_t field19_0x54 = 0x34
            uint32_t field20_0x58 = 0x3b
            uint32_t field21_0x5c = 0x8
            char field22_0x60[0x4] = "8cgi"
            char field23_0x64[0x4] = "8fgi"
            char field24_0x68[0x4] = "8egi"
            uint32_t FORCEWAKE = 0xa560
            uint32_t FORCEWAKE_ACK = 0xd70
            uint32_t flags = 0xb1000000
            bool field28_0x78 = true
        }
    }
}

 

Edited December 8, 2024 by jalavoui

[Mastachief]

You're testing TGL graphics with SLE right? You keep leaving the IDs enabled under the TGL section in the info.plist in nblue master, those are some interesting structures.

[jalavoui]

yep in sle. i always change the info.plist depending om test

 

this struct as lots of repetitions (11) across the binary global data vars

 

 

with the struct passed to bninja the cross refs make more sense

 

 

linux calcs

 

Edited December 8, 2024 by jalavoui

[jalavoui]

to further help the Kernel_Mac.gpuRestart got this values - to help understand global ring var values

 

so this ring configuration

 

is done using kIGHwCsDesc data (for BIT shift ) - resulting in update hwcaps field

 

initial hang in BLT (blit3d) ring is still unsolved

 

Edited December 18, 2024 by jalavoui

[jalavoui]

struct OSInfo __packed
{
    int64_t id;
    char* model;
    int32_t ports_conf;
    int64_t shmem;
    int32_t mem;
    char connector[0x9][0x18];
    int32_t flags;
    int32_t field_100;
    int64_t field_108;
    int64_t field_110;
    int64_t field_118;
    int64_t field_120;
    int64_t field_128;
    int64_t field_130;
    int64_t field_138;
    int64_t field_140;
    int64_t field_148;
    int64_t field_150;
    int64_t field_158;
    int64_t field_160;
    int64_t field_168;
    int64_t field_170;
    int64_t field_178;
    int64_t field_180;
    int64_t field_188;
    int64_t field_190;
    int64_t field_198;
    int64_t field_1a0;
    int64_t field_1a8;
    int64_t field_1b0;
    int64_t flag2;
    int64_t flag3;
};

 

strucuture is applied to pointer of _gPlatformInformationList. size is 0x1c0

 

Edited December 16, 2024 by jalavoui

[Mastachief]

Backlight Code is in AppleMCCSControl.kext, IOGPUFamily.kext & IOGraphicsFamily.kext.

 

IOGPUFamily.kext & IOGraphicsFamily.kext maybe decides which Metal Device gets to run?

 

Just did a dump to get some values on Sonoma, does darwin dumper not work anymore?

 

DarwinDumper_3.1.1_2024.12.17_14.25.54_MacBookAir9,1_Dell_X64_Unknown_23H222_becoolio.zip

 

 

Edited December 17, 2024 by Mastachief

[Mastachief]

to further help the panic logs got this values - to help understand global ring var values
 

so this ring configuration

 
is done using kIGHwCsDesc data (for BIT shift ) - resulting in update hwcaps field

 
initial hang in BLT (blit3d) ring is still unsolved
 

Panic log?

[jalavoui]

masta we need to understand how the ring works + related code

 

anything that unlocks the acelerator from this stage is wlc

[Visual Ehrmanntraut]

sku 2 is device id ff20,9a40,9a48 vendor id 8086
sku 1 is device id dead vendor id beef

idk if that helps you

[Mastachief]

No graphics driver though, mostly iokit stuff, its on github too.......

 

Also, I installed a pair of Dual Channel Memory Yesterday. 2 x 16GB - Samsung M471A2K43DB1-CWE

 

My i5-1135G7 iGPU is already Iris Xe Graphics - 9A49 compared to the intel UHD Branding on other 11th+ Gen CPUs, those newer iGPU's require the dual channel memory to activate the Iris Xe Graphics.

 

Edited January 14, 2025 by Mastachief

[Mastachief]

Latest Bootlog is attached. this one has more info.

 

bootlog.log

[jalavoui]

you have StolenMemorySize = 67108864 

i change my limit of 64k to 128 in bios cause production version complains about it

but guess only matters when loading the acelerator

 

the blt3d panic is avoid with this calls

 

but ofc there are other issues that prevent the acelerator to work. hope someone find something

 

as for double channel memory, idk if that will be an issue but linux does handle it.

 

Edited January 18, 2025 by jalavoui

[Mastachief]

I am looking through, I need to analyze the other files, "blit" symbols in the following;

 

AppleIntelTGLGraphics_kext.txt

 

also used 160mb instead of 128mb

 

246.194497]: handle_revert_to_snapshot:8007: disk2s4 On next mount, volume will revert to snapshot 'com.apple.bless.9AE7796C-C557-4C05-A2D3-0B742405520D' w/snap xid 77522
[  246.194505]: nx_global_extent_manipulation_unlock:5852: disk2 nx_global_extent_manipulation_unlock(0, 1), (0, 0, 1, 1)
[  246.227893]: Sandbox apply: mdworker_shared[362] <bytes>Sandbox apply: mdworker_shared[363] <bytes>Sandbox apply: mdworker_shared[364] <bytes>Sandbox apply: mdworker_shared[365] <bytes>apfs_stop_bg_work:883: disk2s4 Volume Roar is unmounting, stop any bg work
[  246.800033]: apfs_log_op_with_proc:3091: disk2s4 unmounting volume Roar, requested by: com.apple.MobileSoftwareUpdate. (pid 331); parent: launchd (pid 1)
[  246.800043]: apfs_vfsop_unmount:3221: disk2s4 waiting for purgatory cleaner to finish
[  246.800107]: authapfs_seal_restore:578: disk2s4 broken in xid: 77460, fsroot tree xid: 77521
[  246.800253]: apfs_vfsop_unmount:3567: disk2 nx_num_vols_mounted is 5
[  246.800258]: apfs: total mem allocated: 167974601 (160 mb);

 

Edited January 16, 2025 by Mastachief

[Visual Ehrmanntraut]

Hello, I haven't been on this thread for a while. I see you guys are still struggling with this. I have also struggled recently with Hackintosh dev, but me and a colleague managed to do this instead which is not Hackintosh but it's similar spirit to Hackintosh:
 

 

an even bigger punch to Apple than Hackintosh itself.

(if you need help with the RE for the TGL, I can help, but you need to tell me what exactly you want me to look at.)

[jalavoui]

i think we need more devs with the hardware to try "unlock" this acelerator stage.

 

The acelerator trys to config the gpu, rings + change some settings in getGPUInfo() and initHardwareCaps() but will hang on the BCS ring everytime. nblue "hacks" the blt3d init a bit to avoid a kp.

 

Assuming this hangs are not related to metal driver kexts and bundles it must be possible to fix this.

 

For tgl i'm following linux (no gpu firmware loading). for adl linux loads some gpu firmware files but guess nobody researching adl.

 

i do hope this is just a matter of correct driver setup. but so far no progress.

[benmacfreak]

if only i knew what was exactly needed to 'unlock' the accelerated graphics jala, as i say i have the UHD xe graphics, so im one of the most unlucky of us..

[Mastachief]

OKay, Im just putting some information here in case i forget, inside of AppleGraphicsPowerManagement.kext,

 

MacBookPro16,2 - Mac-5F9802EFE386AA28

 

MacBookAir9,1 - Mac-0CFF9C7C2B63DF8D