Hacking the Intel HD Graphics frame buffer kext…

There is one thing that I’d like to see fixed, and soon, and that is the problem with the Intel HD Graphics hanging when it sleeps/wakes up.

I had looked at it months ago already, and quickly identified the problematic kext – AppleIntelSKLGraphicsFramebuffer.kext – and yesterday evening I used a good 30 minutes to nop/0x90 out some parts in the binary and the hang is gone.

Not only can I wake it up, but now I can also connect to it with screen-sharing/remote desktop. The latter did not work. Not without the modified bits, so this is good news. This also confirms that I am looking at the right spots.

The crappy part of the good news is that I have to find a good solution, one that works, and I think to have a good idea. Thanks to a not so good night of sleep – I probably kept working on it some time when I tried to sleep, because I woke up with a lightbulb moment. Yeah. Good news. New ideas!

Keep you posted😉

Two Port USB 3.1 GEN II PCI Express Card

Anyone else ordered a 2 Port USB 3.1 GEN II (10Gbps) PCI Express Card 1 USB Type C and 1 USB Type A Port (USB 3.1 A + C) from AliExpress.com?
2portusb31pciecard
Seem like they have one on sale for $26.99 in 19 hours from now. Ok. Let’s buy one and see what we get – they say that it works with OS X 10.6 and greater.

Update: Here is a first benchmark with a Sandisk 64GB USB3.1 type C flash drive.
orico_pa31-ac_sandisk64gb
I only installed the card and connected the SATA power cable to it. I did not modify anything. Worked out of the box, but this flash drive does not support 10Gbps. To test that I first need a new generation II device, which I do not have at the moment.

Update-2: I found some interesting lines in the log:

kernel: (kernel) 000003.592134 PEGP@00000000: AppleUSBXHCI::createPorts: port 1 unsupported protocol USB 03.01
kernel: (kernel) 000003.615236 PEGP@00000000: AppleUSBXHCI::createPorts: created port 1

kernel: (kernel) 000003.615527 PEGP@00000000: AppleUSBXHCI::createPorts: port 2 unsupported protocol USB 03.01
kernel: (kernel) 000003.615633 PEGP@00000000: AppleUSBXHCI::createPorts: created port 2

kernel: (kernel) 000003.615887 PEGP@00000000: AppleUSBXHCI::createPorts: created port 3
kernel: (kernel) 000003.616282 PEGP@00000000: AppleUSBXHCI::createPorts: created port 4

This is not good. Time for a tiny SSDT. Here is mine:

DefinitionBlock ("ssdt_usb-iMac171.aml", "SSDT", 2, "APPLE ", "Xhci", 0x00001000)
{
    External (_SB_.PCI0.PEG0, DeviceObj)
    External (_SB_.PCI0.PEG0.PEGP, DeviceObj)

    Scope (\_SB.PCI0.PEG0)
    {
        Scope (PEGP)
        {
            Name (_STA, Zero)  // _STA: Status
        }

        Device (XHC2)
        {
            Name (_ADR, Zero)  // _ADR: Address

            Device (RHUB)
            {
                Name (_ADR, Zero)
                Device (SSP1)
                {
                    Name (_ADR, One)
                    Name (_UPC, Package (0x04)
                    {
                        0xFF, 
                        0x09, 
                        Zero, 
                        Zero
                    })

                    Name (_PLD, Package (0x01)
                    {
                        Buffer (0x10)
                        {
                            /* 0000 */    0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
                            /* 0008 */    0x31, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
                        }
                    })

                    Method (_DSM, 4, NotSerialized)
                    {
                        If (LEqual (Arg2, Zero))
                        {
                            Return (Buffer (One)
                            {
                                0x03
                            })
                        }
                        Return (Package (0x02)
                        {
                            "UsbCPortNumber", 
                            One
                        })
                    }
                }

                Device (SSP2)
                {
                    Name (_ADR, 0x2)
                    Name (_UPC, Package (0x04)
                    {
                        0xFF,
                        0x09,
                        Zero,
                        Zero
                    })

                    Name (_PLD, Package (0x01)
                    {
                        Buffer (0x10)
                        {
                            /* 0000 */    0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                            /* 0008 */    0x31, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
                        }
                    })

                    Method (_DSM, 4, NotSerialized)
                    {
                        If (LEqual (Arg2, Zero))
                        {
                            Return (Buffer (One)
                            {
                                0x03
                            })
                        }
                        Return (Package (0x02)
                        {
                            "UsbCPortNumber",
                            0x02
                        })
                    }
                }

                Device (HS01)
                {
                    Name (_ADR, 0x03)
                    Name (_UPC, Package (0x04)
                    {
                        0xFF, 
                        0x09, 
                        Zero, 
                        Zero
                    })

                    Name (_PLD, Package (0x01)
                    {
                        Buffer (0x10)
                        {
                            /* 0000 */    0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
                            /* 0008 */    0x31, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
                        }
                    })
                }

                Device (HS02)
                {
                    Name (_ADR, 0x04)
                    Name (_UPC, Package (0x04)
                    {
                        0xFF,
                        0x09,
                        Zero,
                        Zero
                    })

                    Name (_PLD, Package (0x01)
                    {
                        Buffer (0x10)
                        {
                            /* 0000 */    0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                            /* 0008 */    0x31, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
                        }
                    })
                }
            }
        }
    }
}

I may want/need to change my initial SSDT later on, but at least the errors are gone now.

Also. Note that my card is installed in the first/primary slot (PEG0) of the motherboard, but your card may – most likely – use another slot. In short; don’t forget to change the device name😉

Flashing Power LED…

I am looking for people with a Skylake build with a flashing power LED in sleep state. Do you have a flashing power LED, then please comment here what motherboard/processor/GPU you have. Please also link to your ACPI files.

Thanks!

Properly Formatted Properties…

Some time last week I replied to telepati and mentioned that some of the device properties were broken in his setup.

The Problem

Sometimes you want (property name) Data <“desired text”> instead of (property name) Data <646573697265642074657874>. This is possible. If you know how to do it. I do as can be seen on the following screenshots:
properlyformattedproperties

properlyinjectedtextstringproperties
Anyway. I happen to have a little script for it that I like to share with you today. Here it is:

!/bin/bash

#
# Script (str2base64.sh) to convert a string to base64 data in a way that it can be
# used for properties as text instead of hex data.
#
#
# Version 1.1 - Copyright (c) 2013-2016 by Pike R. Alpha
#

#
# Get input from user.
#

read -p "Enter string to convert: " string

#
# Convert to postscript format.
#

data=$(echo -n "${string}"|xxd -ps|tr -d '\n')

#
# Add "00" to the data and convert it to base64 data.
#

echo -n "${data}00"|xxd -r -p|base64

You can get this script, which I called str2base64.sh, from my Github repository. Run it. Fix your property string data like a pro. This way you won’t have to scratch your head when you see those funny hex characters😉

MacBookPro13,1 device-properties

Some of you may want to have this kind of data, so here it is:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PciRoot(0x0)/Pci(0x1c,0x4)/Pci(0x0,0x0)/Pci(0x0,0x0)/Pci(0x0,0x0)</key>
	<dict>
		<key>TBTDPLowToHigh</key>
		<data>
		AQAAAA==
		</data>
		<key>TBTFlags</key>
		<data>
		AQAAAA==
		</data>
		<key>ThunderboltConfig</key>
		<data>
		AAL//wQABAIBABAABAICAAUABAIBABIABAICAAIAAQA=
		</data>
		<key>ThunderboltDROM</key>
		<data>
		IwAMkZU2SQEACptg+gFeAAEADAABAAiBgAKAAAAACIKQAYAAAAAIg4AEgAEA
		AAiEkAOAAQAACIUAAAAAAAADhiADh4ACyAWJUAAABYpQAAACyw0BQXBwbGUg
		SW5jLgAMAk1hY2ludG9zaAA=
		</data>
		<key>ThunderboltUUID</key>
		<data>
		mMXy78Caelu3mBXl2TmnxA==
		</data>
		<key>linkDetails</key>
		<data>
		CAAAAAMAAAA=
		</data>
		<key>pathcr</key>
		<data>
		BAAAAAAAAAAAAAcAEAAQAAUAAAAAAAAAAAAHABAAEAABAAAABQAOAA4AAAAA
		AAAAAgAAAAAAAAAAAAIAAgABAAMAAAAAAAAAAAAHAAIAAQA=
		</data>
		<key>sscOffset</key>
		<data>
		AAc=
		</data>
	</dict>
	<key>PciRoot(0x0)/Pci(0x1f,0x3)</key>
	<dict>
		<key>MaximumBootBeepVolume</key>
		<data>
		8Q==
		</data>
		<key>MaximumBootBeepVolumeAlt</key>
		<data>
		8Q==
		</data>
		<key>PinConfigurations</key>
		<data>
		MJCrAAABpqAQARCQEQEQkCBAKwA=
		</data>
		<key>layout-id</key>
		<data>
		MwAAAA==
		</data>
		<key>multiEQDevicePresence</key>
		<data>
		DAABAA==
		</data>
	</dict>
	<key>PciRoot(0x0)/Pci(0x2,0x0)</key>
	<dict>
		<key>AAPL,Gfx324</key>
		<data>
		AQAAAA==
		</data>
		<key>AAPL,GfxYTile</key>
		<data>
		AQAAAA==
		</data>
		<key>AAPL,ig-platform-id</key>
		<data>
		AgAmGQ==
		</data>
		<key>AAPL00,PanelCycleDelay</key>
		<data>
		+gAAAA==
		</data>
		<key>AAPL00,PanelPowerDown</key>
		<data>
		PAAAAA==
		</data>
		<key>AAPL00,PanelPowerOff</key>
		<data>
		EQAAAA==
		</data>
		<key>AAPL00,PanelPowerOn</key>
		<data>
		GQEAAA==
		</data>
		<key>AAPL00,PanelPowerUp</key>
		<data>
		MAAAAA==
		</data>
		<key>graphic-options</key>
		<data>
		DAAAAA==
		</data>
		<key>saved-config</key>
		<data>
		RwAAAAAAAAAAAAAAAAAAAAAAAwACACYZAGwFaQUAAAAAAAAAAAAAAAAAAAAA
		AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQEBAAYQNKACA0AAAAAAAAAA
		AAKQbIoPAApABlAAAAAuAAAACAAgACAACABACwgHWgAAAAAAAAAAAAAAAAAA
		AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
		</data>
	</dict>
</dict>
</plist>

AAPL properties for Skylake Graphics (fixing graphic glitches)

I’m on my way to my seat in a friends pub. Joining some locals to watch the F1 race in Mexico, but I want you to note this (updated):

AAPL,ig-platform-id Data <02002619>
AAPL,Gfx324 Data <01000000>
AAPL,GfxYTile Data <01000000> (Glitch Fix)
AAPL00,PanelPowerUp Data <30000000>
AAPL00,PanelPowerOn Data <19010000>
AAPL00,PanelPowerOff Data <11000000>
AAPL00,PanelPowerDown Data <3c000000>
AAPL00,PanelCycleDelay Data <fa000000>

I found this in the Skylake EG2 Graphics Driver (File GUID: 7AF77F94-4C38-4FF1-8CCD-3E084F2FFEC0) inside the MacBookPro13,1 firmware. You can find it yourself with the following steps:

1.) Download Build 16B2657 from the appStore
2.) Right-click on it and select Show Package Content
3.) Open InstallESD.dmg in Contents -> SharedSupport
4.) Go to Packages -> EFIPayloads
5.) Extract MBP131_0205_B02_LOCKED.fd
6.) Launch UEFITool and open the file and click on “Intel Image”.
7.) Search for “AAPL00” (Text) and click OK
8.) Double-click a result
9.) Right-click on the PE32 image section and select Hex view…

Edit: Now you know where to find them😉

This may be the chicken with the golden egg!

Later!

Update: Data added from MacBookPro13,1 (thanks to conradolpz).

device-colors Data <00020000 a09d9d00 00000000 00000000>
board-rev Data <14>

Update-2: Turns out that the AAPL,GfxYTile property is the one that we were looking for. Set this property, either from a (tiny) SSDT (see comments) or otherwise, and the graphic glitches should be solved.

Update-3: Property AAPL,Gfx324 is no longer there in the latest drivers.