Author Topic: Resolution module patch for Core processors  (Read 13347 times)

0 Members and 1 Guest are viewing this topic.

dmazar

  • Member
  • Posts: 52
Resolution module patch for Core processors
« on: November 19, 2012, 10:44:23 AM »
Resolution module needs access to DRAM controller to unlock/lock video bios shadow area. Support for that stuck at Series 4 chipsets and older.

Intel moved DRAM controller to processor on newer systems (Core processors 1st, 2nd, 3rd gen), but it is still present on Pci bus 0, device 0, function 0 like before. PAM registers that control read/write permissions are still there, have the same function and work in the same way as before. They are just moved to different addresses: PAM0 - PAM6 are now at 80h - 86h.

Here is that patch (compiled bins included) for that + some minor fixes and verbose output (accessible with "bdmesg" from OSX).

Works fine on my Core i5-2300 and ATI 5670.

ErmaC

  • Resident
  • Posts: 134
Re: Resolution module patch for Core processors
« Reply #1 on: November 20, 2012, 10:51:32 PM »
Thx dmazar.
I merge it into my branch.

Fabio
P6T Deluxe v1 i7 940 Quadro Fx 5600
P6T SE i7 920 GeForce GT 240

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #2 on: November 22, 2012, 01:54:55 PM »
Just a note: I've written that this code supports Core 1st gen procs (core iX NNN), but this is not true. Added support is only for Sandy and Ivy Bridge. Will try to post solution for 1st gen procs when it proves to be working from Clover users.

And some explanation for new users ... to have it in one place:

- put Resolution.dylib to your Chameleon /Extra/Modules/ folder (create folder Modules if does not exists in Extra)
- restart into Chameleon and list available video resolutions (from menu or type "?video" at boot prompt)
- check if that added native monitor resolution to the list
- if no - well, it does not work. you can boot to OSX and check Chameleon's log with "bdmesg"

- if yes, then try to use new resolution:

/Extra/org.chameleon.Boot.plist - add your resolution
<key>Graphics Mode</key>
<string>1920x1080x32</string>
(change to your numbers)

/Extra/Themes/<your theme>/theme.plist: change screen_width, screen_height, boot_width and boot_height to new resolution, and eventually edit devices_max_visible to bigger number to make device menu selection wider if needed

orlian

  • Entrant
  • Posts: 5
Re: Resolution module patch for Core processors
« Reply #3 on: November 25, 2012, 08:31:12 AM »
I added a simple patch to add support for Core 1st Gen processor:

Code: [Select]
case 0x00468086:
type = CT_HD;
            verbose("HD Graphics.\n");
break;
It detects the graphics card, finds the vbios, finds the mode table, detects 37 entries, but does not interpret any modes.  The vbios dump for both Intel HD Graphics and Sandy Bridge Graphics have very similar mode tables, and obviously the SandyBridge mode tables are being interpreted properly for you. 

Intel HD Graphics VBIOS (first 0x300):
Code: [Select]
55 AA 05 00 80 E9 74 EC 30 30 30 30 30 30 30 30 30 30 30 30 D0 22 E9 E9 21 19 40 00 A0 0A 30 30 49 42 4D 20 56 47 41 20 43 6F 6D 70 61 74 69 62 6C 65 20 42 49 4F 53 2E 20 03 5A 00 6A 00 78 00 8B C0 50 43 49 52 86 80 46 00 00 00 18 00 00 00 00 03 80 00 00 00 00 80 00 00 5A 03 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 74 00 00 C0 00 00 00 00 00 00 00 00 1A 00 23 03 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 44 48 F0 04 00 00 03 44 48 F0 04 00 02 0C 44 48 F0 04 00 04 30 44 48 F0 04 00 06 C0 44 49 F0 04 00 00 03 44 49 F0 04 00 02 0C 44 4A F0 04 00 02 0C 44 4A F0 04 00 04 30 44 4A F0 04 00 06 C0 44 49 F0 04 00 04 30 44 49 F0 04 00 06 C0 44 4A F0 04 00 00 03 44 4B F0 04 00 00 03 44 4B F0 04 00 02 0C 44 4B F0 04 00 04 30 04 4C F0 04 00 00 03 04 4C F0 04 00 02 0C 04 4C F0 04 00 04 30 04 4C F0 04 00 06 C0 04 4D F0 04 00 00 03 04 4D F0 04 00 02 0C 30 08 30 02 03 32 08 54 02 06 34 08 78 02 09 38 08 9C 02 0F 3A 08 C0 02 12 3C 08 D2 02 15 41 10 30 02 04 43 10 54 02 07 45 10 78 02 0A 49 10 9C 02 10 4B 10 C0 02 13 4D 10 D2 02 16 50 20 30 02 05 52 20 54 02 08 54 20 78 02 0B 58 20 9C 02 11 5A 20 C0 02 14 5C 20 D2 02 17 60 08 B5 11 00 61 10 B5 11 00 62 20 B5 11 00 63 08 CF 11 00 64 10 CF 11 00 65 20 CF 11 00 66 08 E9 11 00 67 10 E9 11 00 68 20 E9 11 00 69 08 03 12 00 6A 10 03 12 00 6B 20 03 12 00 6C 08 1D 12 00 6D 10 1D 12 00 6E 20 1D 12 00 6F 08 37 12 00 70 10 37 12 00 71 20 37 12 00 7D 08 78 02 00 7E 10 78 02 00 7F 20 78 02 00 FF D6 09 80 A0 20 E0 2D 10 10 60 A2 00 00 00 00 00 00 18 10 0B D0 B4 20 90 31 10 12 6C D2 00 00 00 00 00 00 1C 01 1D 00 72 51 D0 1E 20 6E 28 55 00 C4 8E 21 00 00 1E D6 09 80 90 20 E0 1D 10 08 60 22 00 00 00 00 08 08 18 B6 0D 80 C8 20 E0 14 10 10 40 13 00 00 00 00 00 00 18 A0 0F 20 00 31 58 1C 20 28 80 14 00 00 00 00 00 00 1E 56 13 20 00 31 58 19 20 10 50 13 00 00 00 00 00 00 1E 64 19 00 40 41 00 26 30 18 88 36 00 00 00 00 00 00 18 C3 1E 00 20 41 00 20 30 10 60 13 00 00 00 00 00 00 1E 30 2A 00 98 51 00 2A 40 30 70 13 00 00 00 00 00 00 1E BC 34 00 98 51 00 2A 40 10 90 13 00 00 00 00 00 00 1E 48 3F 40 30 62 B0 32 40 40 C0 13 00 00 00 00 00 00 1E 68 5B 80 A8 72 A0 3C 50 80 D0 13 00 00 00 00 00 00 1C FE FF CE 10 00 11 00 FB FF 00 45 F0 04 00 00 08 FF FF FE FF C4 01 01 02 0F 03 00 04 0E FE FF CE 00 00 01 00 03 84 03 00 04 00 05 00 06 05 07 0F 10 01 11 00 FB FF 00 45 F0 04 00 00 08 FF FF 0C 01 08 00 00 00 00 01 00 02 02 01 00 04 04 01 00 05 02 05 00 08 01 08 00 07 02Sandy Bridge Graphics VBIOS (first 0x300):
Code: [Select]
55 AA 72 E9 68 DA 30 30 30 30 30 30 30 30 30 30 30 30 1F 23 E9 31 22 4F 40 00 C0 0A 30 30 49 42 4D 20 56 47 41 20 43 6F 6D 70 61 74 69 62 6C 65 20 42 49 4F 53 2E 20 03 74 00 84 00 92 00 8B C0 50 43 49 52 86 80 02 01 1C 00 1C 00 03 00 00 03 80 00 00 00 00 80 80 00 00 00 00 00 02 01 12 01 22 01 0A 01 52 01 5A 01 62 01 6A 01 72 01 82 01 00 00 74 03 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 8E 00 00 C0 00 00 00 00 00 00 00 00 1A 00 3D 03 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 44 48 F0 04 00 00 03 44 48 F0 04 00 02 0C 44 48 F0 04 00 04 30 44 48 F0 04 00 06 C0 44 49 F0 04 00 00 03 44 49 F0 04 00 02 0C 44 4A F0 04 00 02 0C 44 4A F0 04 00 04 30 44 4A F0 04 00 06 C0 44 49 F0 04 00 04 30 44 49 F0 04 00 06 C0 44 4A F0 04 00 00 03 44 4B F0 04 00 00 03 44 4B F0 04 00 02 0C 44 4B F0 04 00 04 30 04 4C F0 04 00 00 03 04 4C F0 04 00 02 0C 04 4C F0 04 00 04 30 04 4C F0 04 00 06 C0 04 4D F0 04 00 00 03 04 4D F0 04 00 02 0C 30 08 4A 02 03 32 08 6E 02 06 34 08 92 02 09 38 08 B6 02 0F 3A 08 DA 02 12 3C 08 EC 02 15 41 10 4A 02 04 43 10 6E 02 07 45 10 92 02 0A 49 10 B6 02 10 4B 10 DA 02 13 4D 10 EC 02 16 50 20 4A 02 05 52 20 6E 02 08 54 20 92 02 0B 58 20 B6 02 11 5A 20 DA 02 14 5C 20 EC 02 17 60 08 35 11 00 61 10 35 11 00 62 20 35 11 00 63 08 4F 11 00 64 10 4F 11 00 65 20 4F 11 00 66 08 69 11 00 67 10 69 11 00 68 20 69 11 00 69 08 83 11 00 6A 10 83 11 00 6B 20 83 11 00 6C 08 9D 11 00 6D 10 9D 11 00 6E 20 9D 11 00 6F 08 B7 11 00 70 10 B7 11 00 71 20 B7 11 00 7D 08 92 02 00 7E 10 92 02 00 7F 20 92 02 00 FF D6 09 80 A0 20 E0 2D 10 10 60 A2 00 00 00 00 00 00 18 10 0B D0 B4 20 90 31 10 12 6C D2 00 00 00 00 00 00 1C 01 1D 00 72 51 D0 1E 20 6E 28 55 00 C4 8E 21 00 00 1E D6 09 80 90 20 E0 1D 10 08 60 22 00 00 00 00 08 08 18 B6 0D 80 C8 20 E0 14 10 10 40 13 00 00 00 00 00 00 18 A0 0F 20 00 31 58 1C 20 28 80 14 00 00 00 00 00 00 1E 56 13 20 00 31 58 19 20 10 50 13 00 00 00 00 00 00 1E 64 19 00 40 41 00 26 30 18 88 36 00 00 00 00 00 00 18 C3 1E 00 20 41 00 20 30 10 60 13 00 00 00 00 00 00 1E 30 2A 00 98 51 00 2A 40 30 70 13 00 00 00 00 00 00 1E BC 34 00 98 51 00 2A 40 10 90 13 00 00 00 00 00 00 1E 48 3F 40 30 62 B0 32 40 40 C0 13 00 00 00 00 00 00 1E 68 5B 80 A8 72 A0 3C 50 80 D0 13 00 00 00 00 00 00 1C FE FF CE 10 00 11 00 FB FF 00 45 F0 04 00 00 08 FF FF FE FF C4 01 01 02 0F 03 00 04 0E FE FF CE 00 00 01 00 02 00 03 00 04 00 05 00 06 05 07 0F 10 01 11 00 FB FF 00 45 F0 04 00 00 08 FF FF 0C 01 08
@dmazar Do you have any hints on interpreting the modes correctly so it can get to the exciting mode insertion part?

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #4 on: November 26, 2012, 12:05:24 PM »
Sorry, but I'm not sure that I understand your patch. Here some info how I see it:

There are two issues with this vbios patching:
1. unlock vbios - you must unlock vbios shadow area (0xC.0000 - 0xD.0000) for writing in order to be able to change vbios in RAM
2. patch vbios in RAM - change some existing mode with data suitable for your monitor

I do not know much about point 2, but know something about point 1. Original code was not able to unlock vbios on newer systems. I have added patch to enable that for Sandy and Ivy Bridge procs. First gen. Core procs are a bit more complicated.

We found some solution when doing the same thing in Clover boot manager. We found out that desktop Core i3,5,7 XXX procs (I call them 1st gen) contain System Address Decoder (SAS) PCI device (part of proc), available at Bus ff or 7f or 3f, Device 0, Func 1, and that SAS device contains PAM registers at 40h-46h for unlocking legacy shadowed areas.

Code for that is attached, but warning: this code is not tested. Compiles fine, but I do not have such proc and can not test if it works from Chameleon.

Includes also solution for LGA-2011 socket procs, where SAS is at Bus X, Dev 12, Func 6 and PAm regs are also at  40h-46h. And X for bus can be found by reading Bus 0, Dev 5, Func 0, reg CPUBUSNO at 108h, bits 15:8.

Regarding mobile Core 1st gen procs - I could not find in their documentation how to access those PAM registers for unlocking vbios, so this thing is unknown.

Anyway, this attached Resolution module should print some debug which can be accessed later from OSX with bdmesg. Like this:
Code: [Select]
Resolution:
 Parse Edid: descriptor block 0 is timing descriptor Best mode: 1920x1080x32
 core proc 2nd, 3rd gen identified
 Detected chipset/proc id (DRAM controller): 01008086
 VBios: ATI, BT_ATI_2
 vbios unlocked
 Patching: BT_ATI_2 Parse Edid: descriptor block 0 is timing descriptor
 Edid detailed timing descriptor found: 1920x1080
 vbios mode 0 patched!
It will test if vbios is really unlocked by trying to change it and will print "vbios unlocked" if this part is done.

That's the best I can do. I can help with this point 1. unlock vbios, but can not help with point 2.
« Last Edit: December 04, 2012, 10:05:34 AM by dmazar »

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #5 on: November 26, 2012, 12:22:02 PM »
If somebody has Mobile Core 1st gen proc, try dumping PCI devices from Windows (RWEverything, http://rweverything.com Access -> PCI -> Save All) and we can try to find PAM registers in there.

orlian

  • Entrant
  • Posts: 5
Re: Resolution module patch for Core processors
« Reply #6 on: November 27, 2012, 09:22:17 PM »
@dmazar Thank you for the new patches.  I tried the patched module you uploaded:
Code: [Select]
bdmesg | grep -A10 Resolution
Read HFS+ file: [hd(0,2)/Extra/modules/Resolution.dylib] 26568 bytes.
Module 'Resolution.dylib' by 'Unknown' Loaded.
Description:
Version: 0
Compat:  0
Resolution:
 Parse Edid: descriptor block 0 is timing descriptor Best mode: 1440x900x32
 core proc identified
 Detected chipset/proc id (DRAM controller): 00448086
 VBios: Other, mode_table: 0x, mode_table_size: 0x27 - unknown
Best mode: 1440x900x32

I am working towards getting the mode table recognized.  Without recognizing the mode table, I do not even get to the point where it tries to unlock the vbios.

If anyone with HD3000 Graphics can post their mode table address output (i.e. what address the mode table starts on), I can probably update the search algorithm to find the mode table in the HD (arrandale / first gen core iXXX ) vbios.  I can visually compare the vbios in hex mode at the right address.

Code: [Select]
539c539
< verbose(", mode_table: 0x%p", map->mode_table);
---
> verbose(", mode_table: 0x%X", map->mode_table);

This tiny patch fixes a typo which prevents the mode table address from being displayed.  It is supposed to show the address of the table:
Code: [Select]
VBios: Other, mode_table: 0xC0136, mode_table_size: 0x27 - unknown
The machine I am working on has a core i520M processor.  I tried running RWEverything, but keep getting an instant BSOD when I run it.  I will work on finding a version that doesn't crash.

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #7 on: November 28, 2012, 10:08:46 AM »
Few things:

1. BUG: There is a bug in the code I posted: file 915resolution.c, function get_chipset(), line 232:
for (i = 0; i < sizeof(bus); i++)
should be:
for (i = 0; i < sizeof(buses); i++)
EDIT: reposted new attachment with fix

2. In your case log says "core proc identified" which looks like device SAS is found and that unlocking of vbios would work in your case. But, as you said, your code did not reach unlock_vbios() yet so we can not be 100% sure.

Wish you good luck with modes table.
« Last Edit: December 04, 2012, 10:06:51 AM by dmazar »

iridiumflare

  • Entrant
  • Posts: 2
Re: Resolution module patch for Core processors
« Reply #8 on: December 01, 2012, 08:19:23 PM »
I have an i3 350M processor for testing, case helps.

orlian

  • Entrant
  • Posts: 5
Re: Resolution module patch for Core processors
« Reply #9 on: December 03, 2012, 04:09:39 PM »
I haven't gotten very far with the modes table.

In the VBIOS there is a table that points to lines that describe the different VESA modes.

In this example located at address 0x11B5 in my VBIOS this line describes the resolution 768x480: 
Code: [Select]
03 FF 00 03 E0 01 07 3C 40 0B 00 C0 30 E0 14 10 18 48 36 00 58 DE 00 00 00 00

0300=768  01e0=480
  00 03      E0 01
Code: [Select]
11CF:  03 FF C0 03 58 02 07 3C C8 11 C0 00 31 58 18 20 20 60 36 00 58 DE 10 00 00 00
900x600 0x11CF  03c0=960  0258=600
Code: [Select]
11E9:  03 FF 00 05 20 03 07 3C 9E 20 00 90 51 20 1F 30 48 80 36 00 00 00 00 00 00 04 00
1280X800 0x11E9  0500=1280  0320=800

The number of bits per pixel (how many colours displayed) is in the index that points to this mode line, so we don't have to look for that information.  I have tried overwriting the resolution part with different numbers, but that just invalidated the mode line and it shows up as empty. i.e. thanks to @dmazar's patches we can modify the vbios on the fly.  I just need to find out what values to patch!

If anyone reading this can decipher what all the extra bits in the mode line mean,

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #10 on: December 04, 2012, 10:13:15 AM »
Just an info about nvidia patching: current code can handle some older cards I think, but not newer ones. pene made some nice work with newer nvidia cards and decumented it here:
http://www.projectosx.com/forum/index.php?showtopic=2304&st=2911&p=22683&#entry22683

iridiumflare

  • Entrant
  • Posts: 2
Re: Resolution module patch for Core processors
« Reply #11 on: December 10, 2012, 04:01:01 PM »
If somebody has Mobile Core 1st gen proc, try dumping PCI devices from Windows (RWEverything, http://rweverything.com Access -> PCI -> Save All) and we can try to find PAM registers in there.

here: http://db.tt/pHAeFoOj

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #12 on: December 11, 2012, 10:49:43 AM »
Thanks. I can see that you have device 8086:2D01 at PCI bus ff, device 0, func 1 which should be System Address Decoder (SAS), and it looks like PAM registers are at 0x40 address:
40=10 41=11 42=11 43=11 44=11
in it's standard form. It looks to me that posted Resolution code would unlock video bios for patching just fine.

But that's just one part of the problem. The second part is actual vbios patch. Resolution code should patch with success most ATI cards (if EDID from monitor is available through BIOS). It may work for some older NVIDIA cards, but newer NVIDIA would require that someone adds patching described by pene (link in previous post). And about Intel builtin video - I do not know.

orlian

  • Entrant
  • Posts: 5
Re: Resolution module patch for Core processors
« Reply #13 on: December 17, 2012, 03:09:07 PM »
I have successfully patched my Intel HD vbios to reflect the mode I wanted thanks to the work of dmazar (and others).

I ended up manually overwriting a DTD modeline in my Intel Ironlake vbios to match that of the LCD panel in the notebook.  Intel stores the modes as DTD.  I used a program called "DTD Calculator" decode the mode lines in the vbios.  I simply replaced one of the modes that I could choose from with the mode I wanted and it worked.

I got the DTD hint from this forum: http://norhazlan.blogspot.fr/2009/11/how-to-get-1920x1080-full-hd-resolution.html

Here is the relevant code I added:
Code: [Select]
map = open_vbios(CT_UNKNOWN);
// if(map)
{
unlock_vbios(map);
            char* bytes = (char *)VBIOS_START;
            int patchlocation = 0x0254;
            verbose("Addr: %X Before patch: %x - ", patchlocation, bytes[patchlocation] );
            bytes[patchlocation] = 0x8A;
            verbose("after patch: %x \n", bytes[patchlocation++] );
            bytes[patchlocation++] = 0x25;
            bytes[patchlocation++] = 0xA0;
            bytes[patchlocation++] = 0x20;
            bytes[patchlocation++] = 0x51;
            bytes[patchlocation++] = 0x84;
            bytes[patchlocation++] = 0x1A;
            bytes[patchlocation++] = 0x30;
            bytes[patchlocation++] = 0x30;
            bytes[patchlocation++] = 0x40;
            bytes[patchlocation++] = 0x36;
            bytes[patchlocation++] = 0x00;
            bytes[patchlocation++] = 0x30;
            bytes[patchlocation++] = 0xBE;
            bytes[patchlocation++] = 0x10;
            bytes[patchlocation++] = 0x00;
            bytes[patchlocation++] = 0x00;
            bytes[patchlocation++] = 0x1E;
It started as a one byte patch and then obviously grew from there...

In an ideal world we would be able to patch the vbios using the same sort of system that clover uses for patching kexts.

My patch is only really useful for this one computer, but it shows that you could patch your own computers vbios and get full resolution.

dmazar

  • Member
  • Posts: 52
Re: Resolution module patch for Core processors
« Reply #14 on: December 18, 2012, 02:40:21 PM »
Nice.  :)