Hacking the Intel HD Graphics frame buffer kext…

There is one thing that I’d like to see fixed, and soon, and that is the problem with the Intel HD Graphics hanging when it sleeps/wakes up.

I had looked at it months ago already, and quickly identified the problematic kext – AppleIntelSKLGraphicsFramebuffer.kext – and yesterday evening I used a good 30 minutes to nop/0x90 out some parts in the binary and the hang is gone.

Not only can I wake it up, but now I can also connect to it with screen-sharing/remote desktop. The latter did not work. Not without the modified bits, so this is good news. This also confirms that I am looking at the right spots.

The crappy part of the good news is that I have to find a good solution, one that works, and I think to have a good idea. Thanks to a not so good night of sleep – I probably kept working on it some time when I tried to sleep, because I woke up with a lightbulb moment. Yeah. Good news. New ideas!

Keep you posted 😉

Advertisements

32 thoughts on “Hacking the Intel HD Graphics frame buffer kext…

  1. Good news.

    I use the mac-pixel-clock-patch-V2 to have the Full 4k Resolution on my external Display connectet to the DockingStation my HP 840G3 Skylake Notebook.

    My Problems at cold Start the external Display and internal Display needs 5-10 Min to reorganize (flicker as connect – disconnect)
    After this the Displays work fine.

    My next Problem. Sleep only don’t work with connect USB Device and the Notebook reboot after shutdown.

    Without connected USB Device ( USB Hub or Stick) everything works fine.

    System 10.11.6

    The allocation of all USB Port are right and fine.

  2. Do you think the sleep/wake issues with AMD graphics could be caused by a similar “bug”? At least the symptoms are quite similar…

    I’d gladly help testing anything, and I’m not afraid of using a disassembler or a hex editor either.

  3. Hi Piker, any news?
    Sitting here, with exactly same problem 🙂
    Everything else work fine, (h170, i5-6600, hd530)

    My Hack sleeps fine, but the sleep LED doesn’t blink, if I press a key to wake up the system (or the button), the system tries to wake, it takes 10 seconds, and turns completely off.

    Everything else with HD530 (thanks to your GFXtyle etc…) works perfect here.

    Just sitting and waiting till you refresh this blogpost 🙂

  4. Piker?
    Can you dig a little bit in multi display support for HD530?
    I mean at boot time, without the need of replug after login…

    Does AAPL,boot-display make any sense in HD530, or is this only needed for Dual-Graphic/Nvidia cards?

    Cheers 🙂

    • Did you modify the frame buffer data? This is the data for the 0x19120000:


      0000 0105 0900 0004 0000 8701
      0000 0204 0a00 0004 0000 8701
      0000 0306 0a00 0004 0000 8701

      Two of them are fixed to 0a00 for the pipe/port and 8701 for the connection, which is not going to work.

      • Thanks Piker 🙂

        I write down, the 2 options i’ve tryed:

        Original unmodified Framebuffer:
        1219 0000 0000 63F9 0700 0000
        0000 0103 0303 0000 2002 0000
        5001 0000 0060 6C05 0000 6C05
        0000 0000 0000 0000
        0000 FF00 0000 0100 0000 2000 (Internal Display)
        0000 0105 0900 0004 0000 8701 (DP)
        0000 0204 0A00 0004 0000 8701 (DP)
        0000 0306 0A00 0004 0000 8701 (DP)

        First option i’ve tryed:
        1219 0000 0000 63F9 0700 0000
        0000 0103 0303 0000 2002 0000
        5001 0000 0060 6C05 0000 6C05
        0000 0000 0000 0000
        0000 0306 0A00 0008 0000 8701 (Changed to HDMI)
        0000 0105 0900 0004 0000 8701 (DP)
        0000 0204 0A00 0004 0000 8701 (DP)
        0000 0306 0A00 0004 0000 8701 (DP) (Still here, but i think it's not used)

        Second option i’ve tryed:
        1219 0000 0000 63F9 0700 0000
        0000 0103 0403 0000 2002 0000 (Changed to 4 Framebuffers)
        5001 0000 0060 6C05 0000 6C05
        0000 0000 0000 0000
        0000 FF00 0000 0100 0000 2000 (Internal Display)
        0000 0105 0900 0004 0000 8701 (DP)
        0000 0204 0A00 0004 0000 8701 (DP)
        0000 0306 0A00 0008 0000 8701 (Changed to HDMI)

        My Hack has no Internal Display…
        Only 2 DP and 1 HDMI…

        Can post an example with what you mean with fixed pipe/port and connection?
        Sry for beeing stupid, but i don’t get what you mean 🙂

        At the moment of now, i’ve thinked that HD530 cant boot with 2 Displays connected…

        Thanks Piker again for your great help 🙂
        Cheers 🙂

      • Ive posted something before but it isnt applyed here:-)

        Ok, i don’t got how to calculate pipe and connector…

        The other values i know from your previous posts about the framebuffer…

        0000 0204 0a00 0004 0000 8701
        0204 = framebuffer 2 / port 4
        0a00 = pipe (i dont understand)
        0004 = displayport
        0000 =??
        8701 = connector (i dont understand too)

        The only thing I have done before is changing 0004 to 8 for hdmi…

        So im sorry for beeing stupid xD

  5. Hi Pike. This work you are doing on the intel HD Graphics, would it throw any insights into using nvidia dGPUs where Optimus is enabled?

  6. Hello,
    I have problems getting dual monitors working on HD530. They worked on El Capitan by hot plug the second monitor after boot, but on Sierra the system hangs (both monitors become dark, thy system is unresponsive).
    I tried different AGDP disabling methods but nothing is working. Now for the weird part, they worked after I fresh installed Sierra, but only for about 2 boots. Then they suddenly stopped working.

    Do you have any idea how to fix this?

    I was not able to find anything relevant in the logs. Nothing except this:

    Heaviest stack for the main thread of the target process:
    10 start + 1 (libdyld.dylib + 21077) [0x7fff9d72e255]
    10 ??? (WindowServer + 3550) [0x105aafdde]
    10 SLXServer + 3843 (SkyLight + 2064039) [0x7fff99c15ea7]
    10 CGXRunOneServicesPass + 356 (SkyLight + 2058188) [0x7fff99c147cc]
    10 run_one_server_pass + 933 (SkyLight + 2059318) [0x7fff99c14c36]
    10 post_port_data + 251 (SkyLight + 2060113) [0x7fff99c14f51]
    10 displayNotification(unsigned int, mach_msg_header_t*, void*) + 518 (CoreDisplay + 295865) [0x7fff881093b9]
    10 IODispatchCalloutFromCFMessage + 308 (IOKit + 23367) [0x7fff8a135b47]
    10 IOFBInterestCallback(void*, unsigned int, unsigned int, void*) + 138 (CoreDisplay + 32934) [0x7fff880c90a6]
    10 IOConnectCallMethod + 256 (IOKit + 26133) [0x7fff8a136615]
    10 io_connect_method + 375 (IOKit + 528249) [0x7fff8a1b0f79]
    10 mach_msg_trap + 10 (libsystem_kernel.dylib + 74634) [0x7fff9d85538a]
    *10 hndl_mach_scall64 + 22 (kernel + 671590) [0xffffff80002a3f66]
    *10 mach_call_munger64 + 430 (kernel + 2039726) [0xffffff80003f1fae]
    *10 mach_msg_overwrite_trap + 327 (kernel + 951191) [0xffffff80002e8397]
    *10 ipc_kmsg_send + 225 (kernel + 868321) [0xffffff80002d3fe1]
    *10 ipc_kobject_server + 412 (kernel + 1012604) [0xffffff80002f737c]
    *10 ??? (kernel + 1856280) [0xffffff80003c5318]
    *10 is_io_connect_method + 497 (kernel + 7266817) [0xffffff80008ee201]
    *10 IOUserClient::externalMethod(unsigned int, IOExternalMethodArguments*, IOExternalMethodDispatch*, OSObject*, void*) + 465 (kernel + 7229921) [0xffffff80008e51e1]
    *10 IOFramebuffer::extProcessConnectionChange() + 544 (IOGraphicsFamily + 67712) [0xffffff7f810f3880]
    *10 IOFramebuffer::processConnectChange(unsigned int) + 121 (IOGraphicsFamily + 66591) [0xffffff7f810f341f]
    *10 IOFramebuffer::suspend(bool) + 149 (IOGraphicsFamily + 64599) [0xffffff7f810f2c57]
    *10 IOFramebuffer::deliverFramebufferNotification(int, void*) + 181 (IOGraphicsFamily + 56685) [0xffffff7f810f0d6d]
    *10 IOAccelDisplayPipe2::display_change_handler(void*, IOFramebuffer*, int, void*) + 179 (IOAcceleratorFamily2 + 215449) [0xffffff7f82c2c999]
    *10 IOAccelDisplayMachine2::display_mode_will_change(unsigned int) + 244 (IOAcceleratorFamily2 + 40806) [0xffffff7f82c01f66]
    *10 IOAccelDisplayPipe2::displayModeWillChange() + 14 (IOAcceleratorFamily2 + 225266) [0xffffff7f82c2eff2]
    *10 IOAccelDisplayPipe2::finishTransactionQueue() + 47 (IOAcceleratorFamily2 + 217239) [0xffffff7f82c2d097]
    *10 IOCommandGate::runAction(int (*)(OSObject*, void*, void*, void*, void*), void*, void*, void*, void*) + 314 (kernel + 7075866) [0xffffff80008bf81a]
    *10 IOAccelDisplayPipe2::transaction_queue_idle_gated() + 205 (IOAcceleratorFamily2 + 236165) [0xffffff7f82c31a85]
    *10 commandSleep(IOCommandGate*, void*, void*, bool, bool, bool, unsigned long long) + 68 (IOAcceleratorFamily2 + 235045) [0xffffff7f82c31625]
    *10 commandSleep1010(IOCommandGate*, void*, unsigned long long) + 9 (IOAcceleratorFamily2 + 242489) [0xffffff7f82c33339]
    *10 commandSleepDeadline(IOCommandGate*, void*, unsigned long long) + 23 (IOAcceleratorFamily2 + 242657) [0xffffff7f82c333e1]
    *10 IOEventSource::sleepGate(void*, unsigned long long, unsigned int) + 83 (kernel + 7070387) [0xffffff80008be2b3]
    *10 IOWorkLoop::sleepGate(void*, unsigned long long, unsigned int) + 126 (kernel + 7065278) [0xffffff80008bcebe]
    *10 lck_mtx_sleep_deadline + 147 (kernel + 1050003) [0xffffff8000300593]
    *10 thread_block_reason + 222 (kernel + 1091198) [0xffffff800030a67e]
    *10 ??? (kernel + 1095771) [0xffffff800030b85b]
    *10 machine_switch_context + 206 (kernel + 2102462) [0xffffff80004014be]

  7. Yes, I patch connector types and enable 4 displays.

    01050900 00040000 87010000 -> 01050900 00080000 87010000
    02040a00 00040000 87010000 -> 02040b00 00020000 87010000
    01030303 -> 01030403
    And I use your board-ix patch as well. Do you have dual monitors working corectly?

    • What you did is not enough. You only changed the connector info, and only for two monitors. Also. 01030403 should be 01030404 for four monitors.

      p.s. I currently do not have a hack handy and thus I myself cannot do any testing myself.

      • Thanks for your anwser. You say that changing connector info is not enough, what else should I change? I also changed 0a00 to 0b00 for the DVI (framebuffer@2) port.
        But I still don’t understand why sometimes it works then it stops working without changing anything.

      • There is also 8701 and 8703. Other frame buffers use c701 and c703. The one for eDP is using 9800 (from the top of my head so make sure you check this yourself).

        And don’t forget to touch the Extensions folder after you have patched a kext binary or plist.

  8. PIKER!!
    I have sleep perfectly working!

    It didn’t worked before, ask me what you need!!!
    Normal HD530 (1912) i5-6600 without custom dsdt only with clover patching and some dsdt injectors…
    Maybe its Sierra 10.12.2 what fixed this but anyway, latest changes I did:

    Modify Bios (unlock some settings like csr lock / xhci handoff / ehci handoff update gop driver etc… with ubu and amibcp 5.1.0.14) and adjusted the unlocked bios settings… like enabled handoff, disabled completely sata controller (im using nvme ssd only) disabled csr lock… etc…

    edited AppleIntelSKLGraphicsFramebuffer:
    from:
    0000FF00 00000100 00002000 00000105 09000004 00008701 00000204 0A000004 00008701 00000306 0A000004 00008701
    to:
    00000105 09000004 00008701 00000204 0A000004 00008701 00000306 0B000008 00008703 0000FF00 00000100 00002000

    If you need anything, i can send files and describe all what you want.

    Last thing i need to get working is 2 Displays at boot time… without that replugging crap…
    and custom xhci injector, like i do with my ux301la ultrabook… to get every port perfect working…

    Hope we can get sometime dualdisplay working at boot 🙂

    PS: Im not using any boot arguments, or anything else special.
    And like i said, my skylake pc with the (HD530) doesnt worked before (sleep)…
    i got on wake no display, and the pc rebooted after 5-10 seconds…

    So i definitive fixed it somehow 🙂

    Cheers 🙂

    • Edit: Piker, i was too fast, it works but not always, sometimes sleep and wake works perfekt, i can wake with usb mouse/keyboard, doesnt matter, its perfect.

      But sometimes it tryes to wake, i get no graphic output and the pc reboots itself after 10 seconds, need to check logs…

      My pc doesnt blink (i mean the power led) its off, if the pc sleeps…

      However, if i can help somehow ask me:-)

      But more important for me is 2 displays at boot:-)) still didnt found out how to do this:-)

      Cheers 🙂

  9. Maybe this similar bug being fixed in Linux will help?

    https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1559308

    https://git.launchpad.net/~tjaalton/ubuntu/+source/linux/+git/xenial/diff/ubuntu/i915/intel_dp.c?id=9f9a75ba617818c3551e66d32ff976a4b45d5a94&id2=f2fabda809b56e12bcb2a729feb0fcc86ddab230

    Perhaps a bug in AppleIntelFramebufferController::SetupOptimalLaneCount ?

    Whatever it is, the bug only occurs after boot, either hot-plugging a display or wake from sleep. Which means it is something that is done on a change rather than on initialization.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s