[Acer PT14-51 Laptop] HowTo

[Stezza88]

I got this kp with last agdc patch plus the request (

{"__ZN20IntelFBClientControl11doAttributeEjPmmS0_S0_P25IOExternalMethodArguments",wrapFBClientDoAttribute, this->orgFBClientDoAttribute},

) toggling all pixelclock patches (kern_gen11 above)

 

com.apple.iokit.IOGraphicsFamily : __ZN13IOFramebuffer25extValidateDetailedTimingEP8OSObjectPvP25IOExternalMethodArguments + 0x57

 

Kernel-2024-11-23-204238.panic

Edited November 23, 2024 by Stezza88

[Stezza88]

One moment, but this you told me to use

{"__ZN20IntelFBClientControl11doAttributeEjPmmS0_S0_P25IOExternalMethodArguments",wrapFBClientDoAttribute, this->orgFBClientDoAttribute},

is a different call, it not resolve the kp I had on

"com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN20IntelFBClientControl24vendor_doDeviceAttributeEjPmmS0_S0_P25IOExternalMethodArguments + 0x9f"

 

Edited November 23, 2024 by Stezza88

[Stezza88]

Resuming:

 

it is

{"__ZN21AppleIntelFramebuffer19validateDisplayModeEiPPKNS_15ModeDescriptionEPPK29IODetailedTimingInformationV2", validateDisplayMode, this->ovalidateDisplayMode},

uint8_t Gen11::validateDisplayMode(void *that, int param_1,void *param_2, void *param_3){
	auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<const IODetailedTimingInformationV2 *>(param_3));
	if (displayTimingInfo!=nullptr) displayTimingInfo->pixelClock = 785400000;
	auto ret= FunctionCast(validateDisplayMode, callback->ovalidateDisplayMode)(that,param_1,param_2,param_3);
	return ret;
}

that make this kp at

__ZN20IntelFBClientControl24vendor_doDeviceAttributeEjPmmS0_S0_P25IOExternalMethodArguments

 

So, without it

I got a new kp at

com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN21AppleIntelFramebuffer19getPixelInformationEiiiP18IOPixelInformation + 0x131

kern_gen11.cppKernel-2024-11-23-212319.panic

Edited November 23, 2024 by Stezza88

[Stezza88]

1 hour ago, jalavoui said:

nice seems your learning todo better code

 

the vendor kp seems after call

doAttribute(this,param_1,param_2,param_3,param_4,param_5,param_6);

 

did you try to disable vendor_doDeviceAttribute()?

 

do you have the IMEI device enabled in ioreg? this patch is for dsdt.aml with device name HECI

 

disable uint32_t Gen11::validateDetailedTiming(void *that,void *param_1,unsigned long param_2)

cause inside you have 

iVar4 = maxSupportedDepths((IODetailedTimingInformationV2 *)this);

 

try patch

 

I read this by now.. one moment.. now I try this way too instead of mine..

 

I removed heci to imei, disabled validateDetailedTiming

and

I did a simple

void Gen11::SetupTimings(void *that, void *param_1, void *param_2, void *param_3, void *param_4){
	FunctionCast(setupDisplayTiming, callback->osetupDisplayTiming)(that,param_1,param_2, param_3, param_4);
}

but in ida pro is 3 params

AppleIntelBaseController::SetupTimings(AppleIntelFramebuffer *, AppleIntelDisplayPath *, IODetailedTimingInformationV2 const*, CRTCParams *)

at

__ZN24AppleIntelBaseController12SetupTimingsEP21AppleIntelFramebufferP21AppleIntelDisplayPathPK29IODetailedTimingInformationV2P10CRTCParams

now I look in ghidra before test

 

In ghidra i got so your is good

void __thiscall
AppleIntelBaseController::SetupTimings
          (undefined8 param_1_00,long param_2,undefined8 param_3_00,long param_4,long param_5)

Edited November 23, 2024 by Stezza88

[jalavoui]

try instead of ** call it with only *

i mean remove double pointer

 

AppleIntelFramebuffer::validateDisplayMode
          (AppleIntelFramebuffer *this,int param_1,ModeDescription *param_2,
          IODetailedTimingInformationV2 *param_3)

 

doubt that helps

 

 

ghidra gives better args

void
AppleIntelBaseController::SetupTimings
          (AppleIntelBaseController *this,AppleIntelFramebuffer *param_1,
          AppleIntelDisplayPath *param_2,IODetailedTimingInformationV2 *param_3,CRTCParams *param_4)

 

var to change is IODetailedTimingInformationV2 *param_3

 

so it stays

 

void Gen11::SetupTimings(void *that, void *param_1, void *param_2, void *param_3, void *param_4){

    auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<const IODetailedTimingInformationV2 *>(param_3));

    if (displayTimingInfo!=nullptr) displayTimingInfo->pixelClock = 785400000;

    FunctionCast(setupDisplayTiming, callback->osetupDisplayTiming)(that,param_1,param_2, param_3, param_4);

}

 

the IMEI device is enabled on my system

 

if you remove all pixel and agdc functions + new patches does it gives a full log ? 

better start this way

then try reenable patches/functions if it doesnt give kp

you need tobe sure the base version is stable so you can try new patches. do you need f19 and f13b patches for stable version?

Edited November 23, 2024 by jalavoui

[Stezza88]

I'm restarting the resume : with this conf it boot with black screen and square mouse

kern_gen11.cpp

 

Adding

{"__ZN21AppleIntelFramebuffer18maxSupportedDepthsEPK29IODetailedTimingInformationV2", maxSupportedDepths, this->omaxSupportedDepths},
{"__ZN21AppleIntelFramebuffer17validateModeDepthEPK29IODetailedTimingInformationV2j", validateModeDepth, this->ovalidateModeDepth},

got kp com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN21AppleIntelFramebuffer19getPixelInformationEiiiP18IOPixelInformation + 0x131

 

Adding

{"__ZN21AppleIntelFramebuffer19validateDisplayModeEiPPKNS_15ModeDescriptionEPPK29IODetailedTimingInformationV2", validateDisplayMode, this->ovalidateDisplayMode},

got kp "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN20IntelFBClientControl24vendor_doDeviceAttributeEjPmmS0_S0_P25IOExternalMethodArguments + 0x9f"

 

1 hour ago, jalavoui said:

try instead of ** call it with only *

I already changed it to single pointer

 

Good log started at 22:46:37.072433+0100

x.log.zip

Edited November 23, 2024 by Stezza88

[Stezza88]

Implementing the method like you said in last post

{"__ZN21AppleIntelFramebuffer18setupDisplayTimingEPK29IODetailedTimingInformationV2PS0_", setupDisplayTiming, this->osetupDisplayTiming},

void Gen11::setupDisplayTiming(void *that, void *param_1, void *param_2, void *param_3, void *param_4){
	auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<const IODetailedTimingInformationV2 *>(param_3));
	if (displayTimingInfo!=nullptr) displayTimingInfo->pixelClock = 785400000;
	FunctionCast(setupDisplayTiming, callback->osetupDisplayTiming)(that,param_1,param_2, param_3, param_4);
}

got kp at "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN21AppleIntelFramebuffer14setDisplayModeEii + 0x5c5"

Kernel-2024-11-23-230243.panic

 

Implementing it like this

{"__ZN21AppleIntelFramebuffer18setupDisplayTimingEPK29IODetailedTimingInformationV2PS0_", setupDisplayTiming, this->osetupDisplayTiming},

void Gen11::setupDisplayTiming (void *that,void *param_1, void *param_2){
    auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<const IODetailedTimingInformationV2 *>(param_2));
    if (displayTimingInfo!=nullptr) displayTimingInfo->pixelClock = 785400000;
	FunctionCast(setupDisplayTiming, callback->osetupDisplayTiming)(that,param_1,param_2);
}

got no kp

 

I think that these two methods are from two different requests

 

Ghidra tells to me

__ZN24AppleIntelBaseController12SetupTimingsEP21AppleIntelFramebufferP21AppleIntelDisplayPathPK29IODetailedTimingInformationV2P10CRTCParams

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
/* AppleIntelBaseController::SetupTimings(AppleIntelFramebuffer*, AppleIntelDisplayPath*,
   IODetailedTimingInformationV2 const*, CRTCParams*) */

void __thiscall
AppleIntelBaseController::SetupTimings
          (undefined8 param_1_00,long param_2,undefined8 param_3_00,long param_4,long param_5)

so i think it has only that + 3 params

Edited November 23, 2024 by Stezza88

[jalavoui]

you found a bug this as 3 params only.

nice fix

 

 

if all is working guess only question is

validateDisplayMode()

correct declaration

bninja doesnt help

vs

 

so i solve this using wg code

 

static IOReturn validateDisplayMode(IOService *framebuffer, uint32_t mode, void const **modeDescription, IODetailedTimingInformationV2 **timing) {

 

 

 

 

also add code to change pixel inside this

 

 

 

Edited November 23, 2024 by jalavoui

[jalavoui]

yes the names are similiar SetupTimings (5 params) and setupDisplayTiming (3 params)

 

check wg code i just posted. you can use void instead of typed names like ioservice, etc)

 

IOReturn validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, void **timing)

Edited November 23, 2024 by jalavoui

[Stezza88]

@jalavoui

Implemented like this

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, void **timing){
	auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<IODetailedTimingInformationV2 *>(timing));
	if (displayTimingInfo!=nullptr) displayTimingInfo->pixelClock = 785400000;
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	return ret;
}

got kp at "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN20IntelFBClientControl24vendor_doDeviceAttributeEjPmmS0_S0_P25IOExternalMethodArguments + 0x9f" like always

Kernel-2024-11-24-001723.panic

Edited November 23, 2024 by Stezza88

[jalavoui]

try double pointer call at 

auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<IODetailedTimingInformationV2 *>(timing));

 

or just disable for now the pixel var displayTimingInfo to check if the function call works - means parameters are well defined

 

nblue as code to load adlp firmware. 

Edited November 23, 2024 by jalavoui

[Stezza88]

Disabling

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, void **timing){
	//auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 *>(reinterpret_cast<IODetailedTimingInformationV2 *>(timing));
	//if (displayTimingInfo!=nullptr) displayTimingInfo->pixelClock = 785400000;
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	return ret;
}

it boot always black screen and square mouse, so the call it works..

 

Now, I try this

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, void **timing){
	auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));
	if (displayTimingInfo!=nullptr) (*displayTimingInfo)->pixelClock = 785400000;
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	return ret;
}

 

[jalavoui]

can you try call

 

with this check to skip if pw=pg2 ?

 

void Gen11::hwSetPowerWellStatePG(void *that,bool param_1,uint param_2)
{
getMember<void *>(that, 0x78) = ccont;
if (((param_2 & 8 != 0) return;
FunctionCast(hwSetPowerWellStatePG, callback->ohwSetPowerWellStatePG)(that,param_1,param_2);
}

 

[Stezza88]

BTW, got kp at "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN24AppleIntelBaseController13GetLinkConfigEP16AGDCLinkConfig_tS1_ + 0x492"

 

Kernel-2024-11-24-010949.panic

 

now try this

void Gen11::hwSetPowerWellStatePG(void *that,bool param_1,uint param_2)
{
	getMember<void *>(that, 0x78) = ccont;
	if((param_2 & 8) != 0) return;
	FunctionCast(hwSetPowerWellStatePG, callback->ohwSetPowerWellStatePG)(that,param_1,param_2);
}

Edited November 24, 2024 by Stezza88

[jalavoui]

AppleGraphicsDeviceControl doesnt like you. maybe cause you patched agdc call with bytes at enablecontroller ?

 

also check if you still need to disable this code

cause here the lcd-powerstate is changed

Edited November 24, 2024 by jalavoui

[Stezza88]

6 minutes ago, Stezza88 said:

void Gen11::hwSetPowerWellStatePG(void *that,bool param_1,uint param_2)
{
	getMember<void *>(that, 0x78) = ccont;
	if((param_2 & 8) != 0) return;
	FunctionCast(hwSetPowerWellStatePG, callback->ohwSetPowerWellStatePG)(that,param_1,param_2);
}

 

It doesn't skip, got vertical bars

Edited November 24, 2024 by Stezza88

[jalavoui]

your link panic is here. after this call

 

 

means the function call is bugged. wrong parameters type or pointers  in function?

 

if the hwSetPowerWellStatePG() fix doesnt kp keep it. cause the remaining code of the function is now working

 

the firmware hang at hwConfigureCustomAUX() need tobe fixed. gonna updated nblue to call by default. try test with adl code maybe

 

the linkconfig and others calls pass zero to modedescript and a pointer to iodetailedtimmg so

try this

 

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, void **timing){

if (modeDescription!=nullptr) {

auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));

if (displayTimingInfo!=nullptr) (*displayTimingInfo)->pixelClock = 785400000;

}

auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing); return ret; }

Edited November 24, 2024 by jalavoui

[Stezza88]

12 minutes ago, jalavoui said:

if the hwSetPowerWellStatePG() fix doesnt kp keep it.

 

hwSetPowerWellStatePG() fix did a kp with vertical bars

[jalavoui]

ok you can disable and try to fix later with this logic -check kernel panic log line

 

found the bug of validateDisplayMode here

the value is passed at function call end

 

 

 

so the patch as tobe at function end

 

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, void **timing){

 

auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);

 

if (timing != (IODetailedTimingInformationV2 **)0x0) {

auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));

 (*displayTimingInfo)->pixelClock = 785400000; // not sure if  (*displayTimingInfo) works maybe just displayTimingInfo

}

 

return ret;

 

}

Edited November 24, 2024 by jalavoui

[Stezza88]

36 minutes ago, jalavoui said:

ok you can disable and try to fix later with this logic -check kernel panic log line

 

Kp with no report

Edited November 24, 2024 by Stezza88

[Stezza88]

It doesn't give errors only like this

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, IODetailedTimingInformationV2 **timing){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	if (timing != (IODetailedTimingInformationV2 **)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));
		(*displayTimingInfo)->pixelClock = 785400000;
	}
	return ret;
}

is possible?

[Stezza88]

IOReturn Gen11::validateDisplayMode(void *framebuffer, uint32_t mode, void const **modeDescription, IODetailedTimingInformationV2 **timing){
	auto ret =FunctionCast(validateDisplayMode,callback->ovalidateDisplayMode)(framebuffer,mode,modeDescription,timing);
	if (timing != (IODetailedTimingInformationV2 **)0x0) {
		auto displayTimingInfo = const_cast<IODetailedTimingInformationV2 **>(reinterpret_cast<IODetailedTimingInformationV2 **>(timing));
		(*displayTimingInfo)->pixelClock = 785400000;
	}
	return ret;
}

Same kp "com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer : __ZN24AppleIntelBaseController13GetLinkConfigEP16AGDCLinkConfig_tS1_ + 0x492"

 

If I put

displayTimingInfo->pixelClock = 785400000;

got error at compilation "Member reference base type 'IODetailedTimingInformationV2 *' is not a structure or union"

Edited November 24, 2024 by Stezza88

[jalavoui]

k so previous fix works. if it doesnt just disable the code

 

got a hang at hwConfigureCustomAUX() gonna disable it by default in nblue

 

try check the vdd function i posted earlier

 

 

guess option is disable pixel code inside. if it panics then disable the call

validateDisplayMode()

Edited November 24, 2024 by jalavoui

[Stezza88]

14 minutes ago, jalavoui said:

try check the vdd function i posted earlier

 

Nice quest .. what do u mean for vdd fun?

 

14 minutes ago, jalavoui said:

k so previous fix works.

 

It doesn't work, got kp with no report

Edited November 24, 2024 by Stezza88

[Stezza88]

22 minutes ago, jalavoui said:

try check the vdd function i posted earlier

 

I already toggled the skip, now Is enabled vdd

Edited November 24, 2024 by Stezza88