[Acer PT14-51 Laptop] HowTo

[jalavoui]

add the agdc function pixel patch. it's somewhere in this thread. check also patches maybe you need check  f19 and f13b

test firmware registers

get nblue again i updated production code

Edited November 21, 2024 by jalavoui

[Stezza88]

I think it fails at pg set ... but ok

[Stezza88]

same result

kern_gen11.cpp

[jalavoui]

remove those f6 patches...

the firmware aux call is used 2x in hwInitializeCState()

don't patch firmware if that doesnt help

 

try disable f19

here's the agdc function pixel patch -> wrapConnectionProbe()

 

 

check extra card ids in nblue info.plist - i keep changing the file as i test it

got any kp log file ?

[Stezza88]

Nothing to do.. no logs and no kp report.. hang with fan overheating and vertical bars.. have tried to patch and unpatch fw, nothing changes, agdp pixelpatch (wrapConnectionProbe).. nothing to do.. it hangs for pg bad set i guess.. f19 patch is necessary for my system, i discovered so far..

 

kern_gen11.cpp

Edited November 21, 2024 by Stezza88

[Stezza88]

I think there could be a problem of nvram.. now i clean It before every test to be sure or maybe disable patch f20

Edited November 21, 2024 by Stezza88

[jalavoui]

added remaining card family ids to nblue - no need to mess with info.plist

 

check what you can do with it

Edited November 21, 2024 by jalavoui

[Stezza88]

With this version quite new (it is from yesterday), I got right values.. and I save it in my folders

(AppleIntelTGLGraphicsFramebuffer)[IGFB][DEBUG][PORT][AppleIntelPort.cpp:237][getBuiltInPort] Built-in PortIndex = 0, DDI = 0

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 6001 ][hwCRTCToIODetailedTi] pixelClock = 787400000
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 6096 ][hwCRTCToIODetailedTi] return
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod] Current:
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  active h=2560, v=1600
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scaled h=0, v=0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  pixelClock 787400000
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scalerFlags 0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  signalConfig 0

 

 

NootedBlue-master-3.zip x.log.zip

Edited November 22, 2024 by Stezza88

[Stezza88]

Applying f16 patch I get this, so the f16 patch won't work in my system

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][PORT][AppleIntelPort.cpp:233 ][getBuiltInPort] Built-in port not found

x.log.zip

Edited November 22, 2024 by Stezza88

[Stezza88]

19 hours ago, Stezza88 said:

Got this, Fan overheating and no logs.. seems a kp without report

 

 

With latest version i got this, now I tell you what is what it makes it

Edited November 22, 2024 by Stezza88

[Stezza88]

I found my problem in latest version! @jalavoui It is this request implemented in this way that make me crash

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",hwSetPowerWellStatePG, this->ohwSetPowerWellStatePG},

Because replacing it with

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",releaseDoorbell},

got good logs and boot in black screen with square mouse

Edited November 22, 2024 by Stezza88

[jalavoui]

try add this to your code

 

IOReturn Gen11::wrapConnectionProbe() {
	IOReturn retVal = FunctionCast(wrapConnectionProbe, callback->orgConnectionProbe)( );
	
	IOService *s= (IOService*)ccont;
	auto fbTimingRange = OSDynamicCast(OSData, s->getProperty(kIOFBTimingRangeKey));
	if (fbTimingRange) {
		auto displayTimingRange = const_cast<IODisplayTimingRangeV1 *>(reinterpret_cast<const IODisplayTimingRangeV1 *>(fbTimingRange->getBytesNoCopy()));
		//displayTimingRange->maxPixelClock = 787400000;
        displayTimingRange->pixelClock = 787400000;
        //displayTimingRange->minPixelClock = 787400000;
	} else {
	}

	return retVal;
}

you can also try same logic on this function. get IODetailedTimingInformationV2 definition from wg code

 

then check this function void hwCRTCToIODetailedTimingInformation (void *that,void *param_1,          IODetailedTimingInformationV2 *param_2)

 

and in this function: AppleIntelFramebuffer::validateDetailedTiming() there's a IODetailedTimingInformationV2 var that can be changed

 

note that other functions also use this value so a patch might be need. here parm2 is from AppleIntelDisplayPath *param_2 var

 

check this function values also

 

fast value checking with kp msg. this value is used in other places

uint8_t Gen11::maxSupportedDepths(void *param_1) {
	auto ret = FunctionCast(maxSupportedDepths, callback->omaxSupportedDepths)(param_1);
	PANIC_COND(1==1, "nblue","maxSupportedDepths %x",ret);
	return ret;
}

 

your goal now is find the right spot to apply the fix.

 

from logs we can see this value is fine - so no need to change it

 

looking at the checks inject the value here maybe fixs all

try this patch in 

AppleIntelFramebuffer::validateDetailedTiming

find

0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

replace
0x41, 0xc7, 0x45, 0x44, 0x40, 0xc5, 0xee, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

 

with code something like this. assuming validateDetailedTiming-maxdepth doesn't break it

getMember<uint32_t>(param_1, 0x44) = 0x2EEEC540;

 

Edited November 22, 2024 by jalavoui

[Stezza88]

- Ok, i try this patch first of all

find 0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

replace 0x41, 0xc7, 0x45, 0x44, 0x40, 0xc5, 0xee, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

and set the wrapconnectionprobe...

and set hwSetPowerWellStatePGEbj like this 

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",hwSetPowerWellStatePG, this->ohwSetPowerWellStatePG},

and make a test.

 

- Then, if it not worked, i try to make the checks you told me.. because "your goal now is find the right spot to apply the fix." cit

But... this kind of function for value checking

uint8_t Gen11::maxSupportedDepths(void *param_1) {
	auto ret = FunctionCast(maxSupportedDepths, callback->omaxSupportedDepths)(param_1);
	PANIC_COND(1==1, "nblue","maxSupportedDepths %x",ret);
	return ret;
}

where i call it? It is called automatically or i must put the call to this function somewhere.. and where is this somewhere 😛

Or, i just make something like this?

{" ??? ", maxSupportedDepths, this->omaxSupportedDepths},

Edited November 22, 2024 by Stezza88

[jalavoui]

nvm maxSupportedDepths() was just and idea. you add the function name to the main list where other functions are if you wanna play with it

 

the linux value for your pixel is not the same as mac os

 

785 400 000 not mac os 787 400 000

 

so the patch change to

785 400 000 = 0x2ED040C0

0x41, 0xc7, 0x45, 0x44, 0xc0, 0x40, 0xd0, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

Edited November 22, 2024 by jalavoui

[Stezza88]

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj", maxSupportedDepths, this->omaxSupportedDepths},

I attach it to this, for example?

Edited November 22, 2024 by Stezza88

[jalavoui]

yes that's the way to call it

 

now that we have the right pixel value try find where it needs tobe replaced

 

this mean getCurrentDisplayMod() is returning wrong pixel value

Edited November 22, 2024 by jalavoui

[Stezza88]

And.. for the wrapconnectionprobe you told me, I got this

 

No member named 'pixelClock' in 'IODisplayTimingRangeV1'

 

The members are maxPixelClock, minPixelClock

[jalavoui]

with pixel 785 400 000 = 0x2ED040C0

 

nvm we just need to fix current value the function is hwCRTCToIODetailedTimingInformation()

 

this should do it

 

1st patch at

 hwCRTCToIODetailedTimingInformation()

 

find
0x48, 0x0f, 0xaf, 0xc3, 0x31, 0xd2, 0x48, 0xf7, 0xf1, 0x48, 0x89, 0xc1, 0x49, 0x89, 0x47, 0x28, 0x45, 0x84, 0xed, 0x74, 0x2b
rep
0x48, 0xc7, 0xc0, 0xc0, 0x40, 0xd0, 0x2e, 0x90, 0x90, 0x66, 0x48, 0x90, 0x49, 0x89, 0x47, 0x28, 0x45, 0x84, 0xed, 0xeb, 0x2b

 

2nd patch at

 

AppleIntelFramebuffer::validateDetailedTiming

find

0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

replace

0x41, 0xc7, 0x45, 0x44, 0xc0, 0x40, 0xd0, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0

 

check it but i think it is correct

also read above - there might be other functions that need fixing

 

you're right about IODisplayTimingRangeV1 - my bad

wg code is here for agdc

+

 

this function also need a patch

 

header

static uint8_t SetupDPSSTTimings(

  void *that,void *param_1,

  void *param_2,void *param_3);

mach_vm_address_t oSetupDPSSTTimings {};

 

cpp part

{"__ZN24AppleIntelBaseController17SetupDPSSTTimingsEP21AppleIntelFramebufferP21AppleIntelDisplayPathP10CRTCParams",SetupDPSSTTimings, this->oSetupDPSSTTimings},

 

uint8_t Gen11::SetupDPSSTTimings(

  void *that,void *param_1,

  void *param_2,void *param_3)

{

getMember<unsigned long>(param_2, 0x118) = 0x2ED040C0;

return FunctionCast(SetupDPSSTTimings, callback->oSetupDPSSTTimings)(that,param_1,param_2,param_3);

}

 

gonna let you do some work

gl

Edited November 22, 2024 by jalavoui

[Stezza88]

With your 2 patches doesn't boot (I've first tried with 

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj",releaseDoorbell},

 to see logs.)

 

But logs are interrupted at half so... it crashes without kp report

x.log

Edited November 22, 2024 by Stezza88

[jalavoui]

try all those thins on a nblue that doesnt hang (use the hacks you created)

some patches might be wrong hope you can figure it out

Edited November 22, 2024 by jalavoui

[Stezza88]

Always half log..

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY][AppleIntelFB.cpp:1626 ][validateDetailedTimi]   FB0: Online:1 Mode:0 Depth:1 Active:2560x1600 Scaled:785400000x0 PixelClock:285600000 ScalerFlags:0 SignalConfig:0 Requested pixel encoding 1 Colorimetry 1

we changed the AppleIntelFramebuffer::validateDetailedTiming scaled value from 0x0 to 78540000x0 with your patch, not the current pixel clock value

 

static const uint8_t f6a[]= { 0x41, 0x83, 0x7d, 0x44, 0x00, 0x74, 0x1c, 0x48, 0xff, 0x05, 0xbe, 0x97, 0x10, 0x00, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0};

static const uint8_t r6a[]= { 0x41, 0xc7, 0x45, 0x44, 0xc0, 0x40, 0xd0, 0x2e, 0xeb, 0x0c, 0x90, 0x90, 0x90, 0x90, 0x41, 0x8b, 0x45, 0x48, 0x85, 0xc0};

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY][AppleIntelFB.cpp:1830][getTimingInfoForDisp] return -536870206

I try to make this patches but can't understand the logic of how you manipulate the replace bytes... i need more experience that i don't have.. for example i've understand that 0x90 is a no operation but nothing more..

x.log kern_gen11.cpp kern_gen11.hpp

Edited November 22, 2024 by Stezza88

[jalavoui]

right let me try to fix that

 

 

remove the patch and do it with a function. local_78=0x44 seems right but better test it cause the intellog seems to use more vars in the msg

so just try fix it

 

uint32_t Gen11::validateDetailedTiming

          (void *that,void *param_1,unsigned long long param_2)

{

    getMember<uint32_t>(param_1, 0x44) = 0x2ED040C0;

    return FunctionCast(validateDetailedTiming, callback->ovalidateDetailedTiming)(that,param_1,param_2);

}

 

 

 

Edited November 22, 2024 by jalavoui

[jalavoui]

nvm i tested and the value is not 0x44 

it is 0x54

 

fixt it in the code above

uint32_t Gen11::validateDetailedTiming

          (void *that,void *param_1,unsigned long long param_2)

{

    getMember<uint32_t>(param_1, 0x54) = 0x2ED040C0;

    return FunctionCast(validateDetailedTiming, callback->ovalidateDetailedTiming)(that,param_1,param_2);

}

 

the SetupDPSSTTimings() is working fine

 

this better keep with a byte patch

unless you find some mathematician todo the correct calcs for you

Edited November 22, 2024 by jalavoui

[Stezza88]

(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 6001 ][hwCRTCToIODetailedTi] pixelClock = 550000
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelController.cpp : 6096 ][hwCRTCToIODetailedTi] return
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod] Current:
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  active h=2560, v=1600
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  scaled h=0, v=0
(AppleIntelTGLGraphicsFramebuffer) [IGFB][DEBUG][DISPLAY   ][AppleIntelFB.cpp         : 2675 ][getCurrentDisplayMod]  pixelClock 550000

also patch 1 fails

 

find
0x48, 0x0f, 0xaf, 0xc3, 0x31, 0xd2, 0x48, 0xf7, 0xf1, 0x48, 0x89, 0xc1, 0x49, 0x89, 0x47, 0x28, 0x45, 0x84, 0xed, 0x74, 0x2b
rep
0x48, 0xc7, 0xc0, 0xc0, 0x40, 0xd0, 0x2e, 0x90, 0x90, 0x66, 0x48, 0x90, 0x49, 0x89, 0x47, 0x28, 0x45, 0x84, 0xed, 0xeb, 0x2b

 

.. and maybe are needed others patch

x.log

Edited November 22, 2024 by Stezza88

[jalavoui]

yep it's in the wrong place

 

 

try this. might crash in the intelog line

find

0x48, 0x69, 0xc2, 0x50, 0xc3, 0x00, 0x00, 0x49, 0x89, 0x47, 0x28, 0xbf, 0x08, 0x00, 0x00, 0x00, 0xbe, 0x06, 0x00, 0x00, 0x00, 0xe8, 0x9e, 0x81, 0x01, 0x00, 0x84, 0xc0, 0x74, 0x3a

rep

0x48, 0xc7, 0xc0, 0xc0, 0x40, 0xd0, 0x2e, 0x49, 0x89, 0x47, 0x28, 0xbf, 0x08, 0x00, 0x00, 0x00, 0xbe, 0x06, 0x00, 0x00, 0x00, 0xe8, 0x9e, 0x81, 0x01, 0x00, 0x84, 0xc0, 0x90, 0x90

Edited November 23, 2024 by jalavoui