Experimental bin-patch for HD4600 (mobile GT2)

Apple won’t update AppleIntelHD5000Graphics.kext anymore (GM state I believe) so it is time for us to figure out what is going on with the Mobile GT2 SKU’s that somehow don’t have QE/CI enabled so let’s give it a first go…

Step-1

First you go to the directory by entering:

cd /System/Library/Extensions/AppleIntelHD5000Graphics.kext/Contents/MacOS

Then you add the missing device-id (0x04168086) to the plist with:

sudo nano Info.plist

This is what it should look like:

<key>IOPCIPrimaryMatch</key>
<string>0x04168086 0x0d268086 0x0a268086 0x0a2e8086 0x0d228086 0x04128086 0x0a168086</string>

Now use Ctrl+O to save your changes and Ctrl+X to exit nano. The next logical step is to refresh the kernel cache with:

sudo kextcache -Boot -U /

Note: Clover users can inject the missing device-id from their config file.

Step-2

Patch the AppleIntelHD5000Graphics binary with one of the following terminal commands:

Then you run this terminal command:

sudo /usr/bin/perl -pi -e 's|\x3d\x86\x80\x12\x04\x74\x10\xeb\x5d|\x3d\x86\x80\x16\x04\x74\x10\xeb\x5d|g' AppleIntelHD5000Graphics

Note: This can be changed to a shorter variant when it works, and Clover users can use find and replace from their config file.

If the first one didn’t work (it should mind you) then try this one:

sudo /usr/bin/perl -pi -e 's|\x3d\x86\x80\x12\x04\x74\x10\xeb\x5d|\x3d\x86\x80\x12\x04\x74\x10\xeb\x4d|g' AppleIntelHD5000Graphics

The first bin-patch will change the desktop device-id (0x04128086) to that of your mobile device-id (0x04168086). The second bin-patch will change a jump address, to that of the Apple/Intel supported GT3 one.

Make sure to have a backup of the vanilla binary handy (make a backup) and do not run both commands without restoring the vanilla binary. And in case you need to patch the frame buffer data, please try version 2.9 of AppleIntelFramebufferAzul.sh The changes to the binary should get detected and trigger a rebuild of the kernel cache, but in case that fails for you, you enter:
sudo touch /System/Library/Extensions

Not working?

This is a first experimental bin-patch so yeah it may not work, but make sure to check the bottom of Intel HD4600 with full resolution. There’s a tip that may help you 😉

Update

The patch works (see comments) so let’s take it one step further. Like I said earlier, you can use a shorter variant because all you need to change is this:

-3d86801204 cmpl $0x4128086, %eax
+3d86801204 cmpl $0x4168086, %eax

Clover users can add some lines to their config to patch AppleIntelFramebufferAzul so that they don’t have to worry about it anymore. They could use this data:

Find pattern—:PYaAEgQ=
Replace patter-:PYaAFgQ=

But since I don’t use Clover… someone with Clover will have to verify and confirm this to be actually working first.

65 thoughts on “Experimental bin-patch for HD4600 (mobile GT2)

  1. I have a Intel E3-1225v3 CPU (Intel HD P4600, 0x8086 0x041a). It seems that the patch above does not work (Replace 04128086 with 041a8086 in AppleIntelHD5000Graphics.kext).
    AICPUPMI: MSR_CORE_THREAD_COUNT……(0x35) : 0x40004

      • This is not a mobile SKU, but I guess the patch should be the same except the device id part. I checked the kext and it is NOT loaded (automatically unloaded after system startup).

        kextstat | grep Intel
        38 0 0xffffff7f827d6000 0x1b000 0x1b000 com.insanelymac.driver.AppleIntelE1000e (3.1.0)

        I tried this patch on both 10.9.4 (Mavericks) and Yosemite DP7.

      • There are additional checks before it comes here:

        cmpl $0x4128086, %eax

        And if it doesn’t get there, then the device-id change won’t change anything for you.

      • What kind of checks? Could you share the idea how to patch it?

        I tried to patch it with:

        sudo perl -pi -e ‘s|\x86\x80\x12\x04|\x86\x80\x1a\x04|g’ AppleIntelHD5000Graphics
        sudo perl -pi -e ‘s|\x85\x80\x12\x04|\x85\x80\x1a\x04|g’ AppleIntelHD5000Graphics

        This will make AppleIntelHD5000Graphics loaded, but still no QE/CI

      • When I do that then I obviously first had to look at the code, and then I most likely also had some ideas. Now I don’t. This due to the lack of time I mentioned before.

  2. Hi piker, can we use FakeID GFX0 to 0x04128086 instead of injecting 0x04168086 to info.plist and using the first patch? And how about ig-platform-id, does it matter?

    • I don’t use Clover and I don’t know what FakeID GFX0 is/does, or how good it works, but by all means give it a try and see if that works for you.

      About injecting the platform-id property: You should use a frame buffer that matches you hardware, With or without changes to it.

      • It change the device id and vendor id (0x04168086) to other values, like you inject “device-id” and “vendor-id” in DSDT. I will find some laptops to try, thanks for your response.

  3. i have done the steps above you mentioned with the 1st patch, i got a full resolution(1920x1080p) with blury dock and top menu but, i lost my camera and FaceTime
    i appreciate your work and time i really like your work and experience, now what i should do pikeralpha!

  4. last weekend i got full CI/QE 1920×1080 on 4200U has 4400HD 0x0A168086
    matched plat id to my plat ULT GT2 and CI/QE worked
    ig-platform-id
    0x0A160000

    i noticed most patches(or dsdt patches) mobile GT2 users are using are for the GT3’s; also
    it gets tricky because the letters U and M fidentified on cpu affect the plat id’s for the gpu

    my vanilla kext has
    0x00908086 0x00918086 0x00928086 0x0c268086 0x0c168086 0x0c068086 0x0c228086 0x0d268086 0x0a268086 0x0a168086 0x04268086 0x04168086 0x04068086 0x0d228086 0x04128086 0x0a2e8086

    i am using clover and in it looks like you have to put the real id in the fake id slots or it patches the item as 0x0 and clover doesn’t create ig-platform-id key in the config that has to be manually added under Graphics ..

    • The (experimental) patch here is for Yosemite (DP7) and not for the kext that you are using (OS X 10.9.4 aka Mavericks) because it should all just for with Mavericks.

      Thanks for the heads up about using the real device-id as “fake id”. Which makes absolutely no sense to me. I’m glad that I don’t use Clover, because “fake” here means “fake” and “real”.. well “real” of course.

    • Sorry for my mistake.
      After patching both AppleintelFramebufferAzul and AppleintelHD5000Graphics of DP8
      it still works for Mobile HD4600 (04168086)

  5. Hello Piker, great job with this patch. Almost everything is working as charm, I have only one problem that I hope you could help me fix it.

    As I said everything works ok only when rebooting the laptop until OS X is loaded again nothing is displayed one the screen, not even the BIOS POST screen. Could you please help me fix this problem.

    Does the HDMI work using this patch? For me when connecting the external monitor via HDMI the image freezes and it does not recover even if I unplug the cable. Any suggestions for this?

    Thanks

    • Ok so a cold boot works, but a warm boot (reboot) fails. What frame buffer data (id) are you using? Is that a patched one or the default one?

      What happens when you use boot arguments -addcam13 or -addcam15?

      Note: These change the frame buffer data (byte 0x5f is change from 0x00 to 0x01 and a long value starting at byte offset 0x60 from 0x00000400 to 0x00000000) so please give them a try and see if they help.

      About your HDMI question. I don’t have a notebook as hack, so I have no idea.

      • the frame buffer is 0x04160000 and the frame buffer data is:
        000481f0: 0000 1604 0003 0303 0000 0010 0000 8001 (256 MB BIOS-allocated memory, 24 MB frame buffer memory)
        00048200: 0000 f000 0000 0040 9914 0000 9914 0000 (15 MB cursor bytes, 1024 MB VRAM, BCL freq. 5273 Hz, max. BCL PWM 5273 Hz)
        00048210: 0000 0000 0000 0000 0000 0800 0200 0000 (port 0, LVDS connector)
        00048220: 3000 0000 0105 0900 0100 0000 0400 0000 (port 5, VGA connector)
        00048230: 0204 1200 0008 0000 8700 0000 ff00 1400 (port 6, HDMI connector / port unused …
        00048240: 0400 0000 4000 0000 0400 0000 0000 0700 eDP connector)
        00048250: 0400 0000 0000 0000 0000 0000 0000 0000

        Is a patched frame buffer.

        What happens when you use boot arguments -addcam13 or -addcam15? … I’m using clover boot loader. Are this compatible with clover?

      • Why do you allocate 256 MB memory? To me that is a waste of memory as it won’t be used.

        The -addcam13 and addcam15 boot arguments are, well boot arguments so they have nothing to do Clover so yes they can be used.

      • I have the same problem as Vlad had. A cold boot and sleep/wake works well, just restart fails. And I have found that the reboot process is not interupted indeed, just screen displays nothing at early boot, then If I don’t force a shutdown, after a while the screen will be lighten at the second stage of the OS X boot (when the progress bar appears). Could you please give me some help? Thanks.

      • I don’t see anything in Vlad’s posts here about having issues with rebooting. Or did I miss something?

        Anyway. Reboot may fail due to many different reasons. Some can be solved with the kelp of a reboot/shutdown kext, but have you checked your log files for abnormal messages and errors?

  6. Ok.

    Some more informations: this not showing of startup process is due to the fact in clover i set the resolution to 1024×768 to avoid scramble screen during boot.
    Here are some images:

    http://1drv.ms/1mvFCW5
    http://1drv.ms/1mvFwhh

    If let the resolution to be the default one (13… x 768) everything works ok.

    PS.

    could you please give me some info about how you frame buffer patch works: what are the correct steps to enable HDMI using a patches?

    • Ok. That is a mangled Apple logo (variables wrongly initialised). Search (I don’t have a link handy) for the IOGraphicsFamily.kext binary patch over at insanelymac.com because I think that it will workaround this problem. I think it was something like: “Can be have the Apple logo back” or something like that.

  7. For Clover users:

    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600</string>
    	<key>Find</key>
    	<data>
    	PYaAEgQ=
    	</data>
    	<key>Name</key>
    	<string>AppleIntelHD5000Graphics</string>
    	<key>Replace</key>
    	<data>
    	PYaAFgQ=
    	</data>
    </dict>
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600 Azul</string>
    	<key>Find</key>
    	<data>
    	PYaAEgR1
    	</data>
    	<key>Name</key>
    	<string>AppleIntelFramebufferAzul</string>
    	<key>Replace</key>
    	<data>
    	PYaAFgR1
    	</data>
    </dict>
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600 InfoPatch</string>
    	<key>Find</key>
    	<string>0x04128086</string>
    	<key>InfoPlistPatch</key>
    	<string>Yes</string>
    	<key>Name</key>
    	<string>AppleIntelHD5000Graphics</string>
    	<key>Replace</key>
    	<string>0x04168086</string>
    </dict>
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600 InfoPatch Azul</string>
    	<key>Find</key>
    	<string>0x04128086</string>
    	<key>InfoPlistPatch</key>
    	<string>Yes</string>
    	<key>Name</key>
    	<string>AppleIntelFramebufferAzul</string>
    	<key>Replace</key>
    	<string>0x04168086</string>
    </dict>
    
    2th try:
    
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600</string>
    	<key>Find</key>
    	<data>
    	PYaAEgQ=
    	</data>
    	<key>Name</key>
    	<string>AppleIntelHD5000Graphics</string>
    	<key>Replace</key>
    	<data>
    	PYaAFgQ=
    	</data>
    </dict>
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600 Azul</string>
    	<key>Find</key>
    	<data>
    	PYaAEgR1
    	</data>
    	<key>Name</key>
    	<string>AppleIntelFramebufferAzul</string>
    	<key>Replace</key>
    	<data>
    	PYaAFgR1
    	</data>
    </dict>
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600 InfoPatch</string>
    	<key>Find</key>
    	<string>0x04128086</string>
    	<key>InfoPlistPatch</key>
    	<string>Yes</string>
    	<key>Name</key>
    	<string>AppleIntelHD5000Graphics</string>
    	<key>Replace</key>
    	<string>0x04168086</string>
    </dict>
    <dict>
    	<key>Comment</key>
    	<string>QECI HD4600 InfoPatch Azul</string>
    	<key>Find</key>
    	<string>0x04128086</string>
    	<key>InfoPlistPatch</key>
    	<string>Yes</string>
    	<key>Name</key>
    	<string>AppleIntelFramebufferAzul</string>
    	<key>Replace</key>
    	<string>0x04168086</string>
    </dict>

    Edit by Pike: I had to fix the XML format (wordpress editor sucks).

    • I’m having difficulty getting this to work. Debug is telling me the binary patch is applied 1 time, but the info.plist patch is always “not applied”. Is it something to do with the cache? I’ve tried forcing the kext to load but it doesn’t ever seem to make it load. Is there something else i need to do?

      • If you used Ctrl+O to save the changed plist and Ctrl+X to exit nano, then the plist should be fine. And yes. A kernel cache refresh is indeed the next logical step to do. Which wasn’t mentioned in this specific blog post, but I fixed that. Thanks!

    • Yosemite comes with:

      AppleIntelHD5000Graphics.kext
      AppleIntelHD5000GraphicsGLDriver.bundle
      AppleIntelHD5000GraphicsVADriver.bundle

      So in case you don’t have them, then something is wrong.

      • Yes, but it is hidden.

        Edit: Oh wait. You want to know if the HD5000 kexts can be found in the BaseSystem.dmg Not there. See Packages for the DMGs you are looking for.

      • Actually I got the acceleration enabled by injecting ig-platform-id in clover without modding any kexts. However in Yosemite after the display ‘turn off'(the backlight is still on) after I click on touchpad and wake it up, the aceeleration seems to be going off, as screen starts tearing and the clock starts going at two seconds refresh, but transparency is still on. In Mavericks the screen simply remains black and only a mouse can be seen. I have tried darkwake=0 to no avail. Any idea what is the cause of this? Should I try another ig-platform-id? How do I choose the right one? What does each of the bits in the id mean? Thank you.

  8. Hi Pike, can you edit my post again for XML Code? Or ask me how i need to write it? The older Patch doesn’t worked, because i forgot to Patch Azul, now its working! Here is a full tested and working patch for Clover HD4600 Mobile. For Yosemite GM, GM 2:

    Cheers 🙂

    Edit by Pike: I have updated your previous post (29 September 2014) with the new XML data.

    Thank you for your contribution!

  9. Pike,

    I have been using your HD4600 Mobile -> Desktop patch for a while now and it works great.
    However when launching certain programs (Airmail 2 being main culprit), I found that the app will hang and a lot of CVMCompiler crashes will happen in the log.

    The crash log file gives an idea why this is happening:
    Application Specific Information:
    Assertion failed: (gIcbeDylib != NULL), function loadIcbeDylib, file /SourceCache/GPUDriversIntel/GPUDriversIntel-10.0.86/Common/CLPlugin/Intel/igil/cvms_plugin/igil_cvms_plugin.cpp, line 209.

    Disassembly shows the following:
    loc_2949: ; CODE XREF: loadIcbeDylib(uint)+4Bj
    cmp edi, 0A268085h
    jg short loc_295B
    cmp edi, 4128086h ; Intel Haswell Desktop (GT2)
    jnz short execute_load
    jmp short load_HD5000

    load_HD5000: ; CODE XREF: loadIcbeDylib(uint)+82j
    ; loadIcbeDylib(uint)+92j …
    lea rdi, aSystemLibrar_5 ; “/System/Library/Extensions/AppleIntelHD”…
    jmp short loc_2933

    execute_load: ; CODE XREF: loadIcbeDylib(uint)+19j
    ; loadIcbeDylib(uint)+2Ej …
    mov rdi, cs:__ZL10gIcbeDylib ; handle
    loc_2995: ; CODE XREF: loadIcbeDylib(uint)+70j
    test rdi, rdi
    jz loc_2A9F
    lea rsi, aRegister ; “Register”
    call _dlsym

    So the problem is that the libCLVMIGILPlugin.dylib also checks if its dealing with a desktop HD4600 and also needs patching.

    Patching 81 FF 86 80 12 04 75 35 with 81 FF 86 80 12 04 90 90 will force matching to HD5000 iCBE.dylib and the crashes are gone (And OpenGL / OpenCL acceleration enabled).

    • Excellent. You are the first person to inform me about this, and thus I had no idea what was going on so on behalf of all Haswell mobile users: Thank you very much for figuring this out, and sharing it with us!

      • Maybe there is some way doing it without patching the .dylib, but from the kext instead.
        After all the loadIcbeDylib(unsigned int) call has a parameter passed.

        I will try and spend some time to see if the parameter is the device ID (which I expect) and then where its coming from. Changing the original device ID return function (hopefully in the kext) would be the best.

      • Yes. The ‘device-id’ in (rdi) is the only argument. I think to remember that it also does something with AppleIntelHD4000GraphicsGLDriver.bundle or AppleIntelHD5000GraphicsGLDriver.bundle based on the given device-id but you’ll have to check that yourself.

      • The device ID is read from IOPCIDevice using IOPCIDevice::extendedConfigRead32.
        Now I noticed that the function IOPCIDevice::extendedConfigWrite32 is existing.

        Would it be possible to write a wrapper/start-up kext for the Intel HD4600 Mobile, which updates the device ID in the PCI memory space on boot-up? Subsequently the device would be Intel HD4600 Desktop for all future checks.

        If such a thing can be done, it would mean no further patching required. However my kext development skills (OS X for that matter) are zilch.

        Any idea on this?

      • The device-id is a read-only property, but you can change:

        UInt32 IOPCIDevice::extendedConfigRead32( IOByteCount offset )
        {
        	if (!configAccess(false)) return (0xFFFFFFFF);
            IOPCIAddressSpace _space = space;
            _space.es.registerNumExtended = (offset >> 8);
            return (configRead32(_space, offset));
        }

        in IOPCIDevice.cpp and recompile it.

  10. Hi Pike,

    I’m running OS X on my Lenovo Y510P (which has mobile Intel HD4600) and I have both your patch and the one by “darkvoid” for OpenCl which generally gives very good performance.

    However, I discovered a problem regarding display sleep. Any action that set display to sleep (via hot corners for example) results in these problems when display return on:

    1. Restart is not functioning (system halt with display off but fan and light are on). Shutdown works fine though.
    2. Graphics are partially distorted like reverting to 16-bit colors in certain areas. It’s very noticeable in launchpad and while playing videos. Can’t be fixed unless system is turned off/on again (no restart as point 1 states). This screenshot (http://s14.postimg.org/r5n874vup/IMAG0369.jpg) shows the problem.

    This display sleep/wake issue affects the system sleep/wake as well since it’s part of the process. I wonder why no one have reported this before because it’s reproducible on other Y510P machines (I wouldn’t say systems with HD4600 mobile)

    Regards,
    Ahmed

  11. Hi Pike,
    I’ve patched according to your instructions but in system information it shows the nvram of my intro HD 4600 to 1536MB but in extensions i see that appleintelhd5000graphics.kext is not loaded. could this be the cause why the screen flickers and qe/ci is not enabled

  12. Hey Pike, hope you can offer some guidance. I have a device with an Intel HD4200 (0x0a1e8086). I’ve gotten Yosemite to recognise the device with 1576MB VRAM with these instructions (but by using Clover’s injection/kext patching) and the ig-platform-id 0x0d220003. This is the only ID that allows me to boot properly, all others (listed in your AppleIntelFramebufferAzul.sh) give instant reboot after loading the FramebufferAzul kext or give a blinking screen with momentary glimpses of the desktop.

    However I am unable to get QE working. Are there any checks in the graphics kexts that could be causing QE to be disabled? Intel brands this card internally as GT2 ULT E Mobile which is very similar to the 4400 (GT2 ULT Mobile) and the 0x0A2E (GT3 ULT E Mobile) which are both supported natively by the Yosemite kexts which makes me think that there should be a way to get QE working on this card.

    A copy of my IOReg is at https://www.dropbox.com/s/kb2qnznfyxviobg/Alexandre’s Mac Pro.ioreg?dl=0 if it helps.

    Thanks in advance for reading.

  13. Thanks for the reply 🙂 I’ve tried replacing 0x0a1e8086 over all device IDs that are natively supported by the Yosemite Azul kext (including 0xa168086). They all give the same result: native 1920×1080 and CI enabled but no QE Do you think there are any checks that the kexts are performing that might be disabling QE?

    • Ok, but only change one ID at a time. Not all of them at the same time. Also. Make sure that the kernel cache is refreshed properly (when used) otherwise it won’t ever work. I say this because I checked your IOREG and I can’t find your device-id (0x0a1e8086) under GFX0/AppleIntelAzulController/IOPCIPrimaryMatch. Wait! Why are you injecting a device-id 0412 (desktop id) instead of using the original one?

      You should also change the name of Device (GFX0) in your DSDT (and other ACPI tables) to IGPU.

    • Ok, but only change one ID at a time. Not all of them at the same time. Also. Make sure that the kernel cache is refreshed properly (when used) otherwise it won’t ever work. I say this because I checked your IOREG and I can’t find your device-id (0x0a1e8086) under GFX0/AppleIntelAzulController/IOPCIPrimaryMatch. Wait! Why are you injecting a device-id 0412 (desktop id) instead of using the original one?

      You should also change the name of Device (GFX0) in your DSDT (and other ACPI tables) to IGPU.

      • I’ve injected the Fake ID using Clover. It’s pretty much equivalent to putting 0x0a1e8086 in the Info.plists. The ID is just masked so you don’t have to patch the kext. Clover does all the patching itself. I’ve tried both ways (injecting a fake ID and editing in the IDs into Info.plist) with the same results.

        I’ll try changing GFX0 to IGPU and get back to you.

      • I don’t think so. The device-id I see is 0x0412 and that is not the correct (factory) one (0x0a16). I mean. When you replace 0x0a168086 with 0x0a1e8086… then how is that supposed to work with a changed device-id? They won’t match.

Leave a reply to Rama Cancel reply