Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ice lake boot screen glitch seems fixed by this small WhateverGreen patch #1805

Closed
kingo132 opened this issue Sep 28, 2021 · 9 comments
Closed
Labels
help wanted Extra attention is needed project:green

Comments

@kingo132
Copy link

Hi, WEG teams and other friends, yesterday @m0d16l14n1 send me his finding of the screen glitch when booting into the desktop with ice lake CPU.

He says it may be related to the DBuf error he saw in the boot log here.

image

So he wondered if we could bypass this error with some WEG patches.

image

I saw there're 3 conditions that can make it goes to DBuf error, they are

  1. v3
  2. ((unsigned int *)this + 64)
  3. ((_DWORD *)this + 37)

I tried to hook this function by WEG and printed these values

image

The result is here

image

As you can see in the screenshot, the value of v3 is first 0 and then 40 when boot, and I guess it was DBuf value. When it is 0, the DBuf error happens, and according to what @m0d16l14n1 says, the glitch happens.

image

You can see the DBuf error log is alongside with zero v3 value.

So I just made a small test, to hardcode that v3 value to always 40.

image

Some magic happens, the glitch seems gone, and some friends in Ice Lake gitter group tested it, the glitch is gone as well.

I think it's an interesting finding, but I have no knowledge about what happened, I even don't know what this DBuf is.

So I'm pushing this finding forward to ask if the WEG team or other friends could do a more robust patch based on this finding. Or at least asking for some clues about what happened and how to set a more reliable DBuf value.

Thanks to everyone who concern about this problem.

@kingo132
Copy link
Author

kingo132 commented Sep 29, 2021

I think it's better to hardcode that dbuf value here in the AppleIntelPlan::updateDBUF function.

image

And some more information, the first updateDBUF call happens when glitch happens, and the glitch disappeared immediately when the second call happens.

And I managed to get the call stack when the first and second updateDBUF call happens

This is the first call

panic(cpu 0 caller 0xffffff7f98b9e34a): WhateverGreen      igfx: @ my intend panic

Backtrace (CPU 0), Frame : Return Address
0xffffff8205c0b1d0 : 0xffffff8014f1966d mach_kernel : _handle_debugger_trap + 0x49d
0xffffff8205c0b220 : 0xffffff8015053dd5 mach_kernel : _kdp_i386_trap + 0x155
0xffffff8205c0b260 : 0xffffff801504595e mach_kernel : _kernel_trap + 0x4ee
0xffffff8205c0b2b0 : 0xffffff7f98b7b924 as.vit9696.VirtualSMC : __ZN18VirtualSMCProvider10kernelTrapI22x86_saved_state_1010_tEEvPT_Pm + 0x454
0xffffff8205c0b330 : 0xffffff8014ebfa40 mach_kernel : _return_from_trap + 0xe0
0xffffff8205c0b350 : 0xffffff8014f18d37 mach_kernel : _DebuggerTrapWithState + 0x17
0xffffff8205c0b450 : 0xffffff8014f19127 mach_kernel : _panic_trap_to_debugger + 0x227
0xffffff8205c0b4a0 : 0xffffff80156be38c mach_kernel : _panic + 0x54
0xffffff8205c0b510 : 0xffffff7f98b9e34a as.vit9696.WhateverGreen : __ZL31Wrap_AppleIntelPlane_updateDBUFPvxx + 0x3a
0xffffff8205c0b540 : 0xffffff7f9ae110e9 com.apple.driver.AppleIntelICLLPGraphicsFramebuffer : __ZN31AppleIntelFramebufferController10LightUpEDPEP21AppleIntelFramebufferP21AppleIntelDisplayPathPK29IODetailedTimingInformationV2 + 0xf3
0xffffff8205c0b590 : 0xffffff7f9ae10bd7 com.apple.driver.AppleIntelICLLPGraphicsFramebuffer : __ZN31AppleIntelFramebufferController9hwSetModeEP21AppleIntelFramebufferP21AppleIntelDisplayPathiPK29IODetailedTimingInformationV2 + 0x7a3
0xffffff8205c0b800 : 0xffffff7f9ae2b61d com.apple.driver.AppleIntelICLLPGraphicsFramebuffer : __ZN31AppleIntelFramebufferController9hwSetModeEP21AppleIntelFramebufferiPK29IODetailedTimingInformationV2 + 0x1bd
0xffffff8205c0b860 : 0xffffff7f9ade7594 com.apple.driver.AppleIntelICLLPGraphicsFramebuffer : __ZN21AppleIntelFramebuffer14setDisplayModeEii + 0x6ee
0xffffff8205c0b9a0 : 0xffffff7f9ac97a8f com.apple.iokit.IOGraphicsFamily : __ZN13IOFramebuffer16doSetDisplayModeEii + 0x12b
0xffffff8205c0ba30 : 0xffffff7f9ac978ec com.apple.iokit.IOGraphicsFamily : __ZN13IOFramebuffer17extSetDisplayModeEP8OSObjectPvP25IOExternalMethodArguments + 0x9a
0xffffff8205c0bac0 : 0xffffff801565029e mach_kernel : __ZN12IOUserClient14externalMethodEjP25IOExternalMethodArgumentsP24IOExternalMethodDispatchP8OSObjectPv + 0x1de
0xffffff8205c0bb10 : 0xffffff7f9ac9df98 com.apple.iokit.IOGraphicsFamily : __ZN23IOFramebufferUserClient14externalMethodEjP25IOExternalMethodArgumentsP24IOExternalMethodDispatchP8OSObjectPv + 0x74
0xffffff8205c0bb60 : 0xffffff80156594c3 mach_kernel : _is_io_connect_method + 0x223
0xffffff8205c0bca0 : 0xffffff8015002662 mach_kernel : _iokit_server_routine + 0x4e62
0xffffff8205c0bdb0 : 0xffffff8014f1f3e8 mach_kernel : _ipc_kobject_server + 0x238
0xffffff8205c0be10 : 0xffffff8014ef5d05 mach_kernel : _ipc_kmsg_send + 0x135
0xffffff8205c0be70 : 0xffffff8014f0cb22 mach_kernel : _mach_msg_overwrite_trap + 0x2d2
0xffffff8205c0bf00 : 0xffffff801502b0e5 mach_kernel : _mach_call_munger64 + 0x205
0xffffff8205c0bfa0 : 0xffffff8014ec0226 mach_kernel : _hndl_mach_scall64 + 0x16
      Kernel Extensions in backtrace:
         as.vit9696.WhateverGreen(1.4.5)[32586633-D554-3FED-A857-870C14CD8E1E]@0xffffff7f98b95000->0xffffff7f98c2ffff
            dependency: as.vit9696.Lilu(1.5.2)[37C5AEFB-3280-360A-887A-62A05F24BCF6]@0xffffff7f98ae5000
            dependency: com.apple.iokit.IOPCIFamily(2.9)[FC832CA8-B878-353C-A2C7-0DD74DCD87B4]@0xffffff7f95912000
         as.vit9696.VirtualSMC(1.1.9)[3B5840A3-EFD8-3F34-B9DA-9DDB414549B3]@0xffffff7f98b6c000->0xffffff7f98b92fff
            dependency: as.vit9696.Lilu(1.5.2)[37C5AEFB-3280-360A-887A-62A05F24BCF6]@0xffffff7f98ae5000
            dependency: com.apple.iokit.IOACPIFamily(1.4)[3190F139-CA5E-30B5-80AE-562EE8C4E13F]@0xffffff7f95909000
         com.apple.iokit.IOGraphicsFamily(576.1)[EBBE37CE-8102-3CDC-BDCD-909AE89E2ACB]@0xffffff7f9ac7b000->0xffffff7f9accbfff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[FC832CA8-B878-353C-A2C7-0DD74DCD87B4]@0xffffff7f95912000
         com.apple.driver.AppleIntelICLLPGraphicsFramebuffer(14.0.7)[C67DD829-D26B-3B95-BD02-4A64F399163B]@0xffffff7f9adbe000->0xffffff7f9b05cfff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[FC832CA8-B878-353C-A2C7-0DD74DCD87B4]@0xffffff7f95912000
            dependency: com.apple.iokit.IOACPIFamily(1.4)[3190F139-CA5E-30B5-80AE-562EE8C4E13F]@0xffffff7f95909000
            dependency: com.apple.iokit.IOAcceleratorFamily2(438.7.4)[3B4BCEB3-64B0-3785-9154-46B2EFB0623B]@0xffffff7f9acf0000
            dependency: com.apple.iokit.IOReportFamily(47)[C7F00600-CBD4-352B-801E-130C6C0D367A]@0xffffff7f95849000
            dependency: com.apple.AppleGraphicsDeviceControl(5.2.7)[1BE59708-687E-3E80-8A57-E9E4F08F9FC9]@0xffffff7f9adb4000
            dependency: com.apple.iokit.IOGraphicsFamily(576.1)[EBBE37CE-8102-3CDC-BDCD-909AE89E2ACB]@0xffffff7f9ac7b000

BSD process name corresponding to current thread: WindowServer
Boot args: -v -igfxcdc -igfxdvmt keepsyms=1 debug=0x100 darkwake=0 dc6config=0 agdpmod=pikera msgbuf=1048576 igfxfw=2 chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
19H1419

Kernel version:
Darwin Kernel Version 19.6.0: Thu Sep 16 20:58:47 PDT 2021; root:xnu-6153.141.40.1~1/RELEASE_X86_64
Kernel UUID: 5B0A6F6D-8A91-3849-852C-66AFE0A3CED5
Kernel slide:     0x0000000014c00000
Kernel text base: 0xffffff8014e00000
__HIB  text base: 0xffffff8014d00000
System model name: MacBookAir9,1 (Mac-0CFF9C7C2B63DF8D)
System shutdown begun: NO
Panic diags file available: YES (0x0)

System uptime in nanoseconds: 46840649157

This is the second

panic(cpu 2 caller 0xffffff7f8f79e2ac): WhateverGreen      igfx: @ my intend panic

Backtrace (CPU 2), Frame : Return Address
0xffffff81ece9b970 : 0xffffff800bb1966d mach_kernel : _handle_debugger_trap + 0x49d
0xffffff81ece9b9c0 : 0xffffff800bc53dd5 mach_kernel : _kdp_i386_trap + 0x155
0xffffff81ece9ba00 : 0xffffff800bc4595e mach_kernel : _kernel_trap + 0x4ee
0xffffff81ece9ba50 : 0xffffff7f8f77b924 as.vit9696.VirtualSMC : __ZN18VirtualSMCProvider10kernelTrapI22x86_saved_state_1010_tEEvPT_Pm + 0x454
0xffffff81ece9bad0 : 0xffffff800babfa40 mach_kernel : _return_from_trap + 0xe0
0xffffff81ece9baf0 : 0xffffff800bb18d37 mach_kernel : _DebuggerTrapWithState + 0x17
0xffffff81ece9bbf0 : 0xffffff800bb19127 mach_kernel : _panic_trap_to_debugger + 0x227
0xffffff81ece9bc40 : 0xffffff800c2be38c mach_kernel : _panic + 0x54
0xffffff81ece9bcb0 : 0xffffff7f8f79e2ac as.vit9696.WhateverGreen : __ZL31Wrap_AppleIntelPlane_updateDBUFPvxx + 0x4c
0xffffff81ece9bce0 : 0xffffff7f91905e7a com.apple.driver.AppleIntelICLLPGraphicsFramebuffer : __ZN31AppleIntelFramebufferController19allocateDefaultDBUFEv + 0x358
0xffffff81ece9bd20 : 0xffffff7f8f79e46d as.vit9696.WhateverGreen : __ZL56Wrap_AppleIntelFramebufferController_allocateDefaultDBUFPv + 0x4d
0xffffff81ece9bd40 : 0xffffff7f918ff6d7 com.apple.driver.AppleIntelICLLPGraphicsFramebuffer : __ZN31AppleIntelFramebufferController18setupOptimizedDBUFEv + 0x267
0xffffff81ece9bdf0 : 0xffffff7f8f79e3a9 as.vit9696.WhateverGreen : __ZL55Wrap_AppleIntelFramebufferController_setupOptimizedDBUFPvP9IOService + 0x59
0xffffff81ece9be20 : 0xffffff800c22ebf9 mach_kernel : __ZN18IOTimerEventSource15timeoutSignaledEPvS0_ + 0x89
0xffffff81ece9be90 : 0xffffff800c22eb19 mach_kernel : __ZN18IOTimerEventSource17timeoutAndReleaseEPvS0_ + 0x99
0xffffff81ece9bec0 : 0xffffff800bb5b645 mach_kernel : _thread_call_delayed_timer + 0xec5
0xffffff81ece9bf40 : 0xffffff800bb5b171 mach_kernel : _thread_call_delayed_timer + 0x9f1
0xffffff81ece9bfa0 : 0xffffff800babf13e mach_kernel : _call_continuation + 0x2e
      Kernel Extensions in backtrace:
         as.vit9696.WhateverGreen(1.4.5)[C347F58F-9666-38C4-9E16-D9B2B2E901F3]@0xffffff7f8f795000->0xffffff7f8f82ffff
            dependency: as.vit9696.Lilu(1.5.2)[37C5AEFB-3280-360A-887A-62A05F24BCF6]@0xffffff7f8f6e5000
            dependency: com.apple.iokit.IOPCIFamily(2.9)[FC832CA8-B878-353C-A2C7-0DD74DCD87B4]@0xffffff7f8c512000
         as.vit9696.VirtualSMC(1.1.9)[3B5840A3-EFD8-3F34-B9DA-9DDB414549B3]@0xffffff7f8f76c000->0xffffff7f8f792fff
            dependency: as.vit9696.Lilu(1.5.2)[37C5AEFB-3280-360A-887A-62A05F24BCF6]@0xffffff7f8f6e5000
            dependency: com.apple.iokit.IOACPIFamily(1.4)[3190F139-CA5E-30B5-80AE-562EE8C4E13F]@0xffffff7f8c509000
         com.apple.driver.AppleIntelICLLPGraphicsFramebuffer(14.0.7)[C67DD829-D26B-3B95-BD02-4A64F399163B]@0xffffff7f918bb000->0xffffff7f91b59fff
            dependency: com.apple.iokit.IOPCIFamily(2.9)[FC832CA8-B878-353C-A2C7-0DD74DCD87B4]@0xffffff7f8c512000
            dependency: com.apple.iokit.IOACPIFamily(1.4)[3190F139-CA5E-30B5-80AE-562EE8C4E13F]@0xffffff7f8c509000
            dependency: com.apple.iokit.IOAcceleratorFamily2(438.7.4)[3B4BCEB3-64B0-3785-9154-46B2EFB0623B]@0xffffff7f917ed000
            dependency: com.apple.iokit.IOReportFamily(47)[C7F00600-CBD4-352B-801E-130C6C0D367A]@0xffffff7f8c449000
            dependency: com.apple.AppleGraphicsDeviceControl(5.2.7)[1BE59708-687E-3E80-8A57-E9E4F08F9FC9]@0xffffff7f918b1000
            dependency: com.apple.iokit.IOGraphicsFamily(576.1)[EBBE37CE-8102-3CDC-BDCD-909AE89E2ACB]@0xffffff7f9179c000

BSD process name corresponding to current thread: kernel_task
Boot args: -v -igfxcdc -igfxdvmt keepsyms=1 debug=0x100 darkwake=0 dc6config=0 agdpmod=pikera msgbuf=1048576 igfxfw=2 chunklist-security-epoch=0 -chunklist-no-rev2-dev

Mac OS version:
19H1419

Kernel version:
Darwin Kernel Version 19.6.0: Thu Sep 16 20:58:47 PDT 2021; root:xnu-6153.141.40.1~1/RELEASE_X86_64
Kernel UUID: 5B0A6F6D-8A91-3849-852C-66AFE0A3CED5
Kernel slide:     0x000000000b800000
Kernel text base: 0xffffff800ba00000
__HIB  text base: 0xffffff800b900000
System model name: MacBookAir9,1 (Mac-0CFF9C7C2B63DF8D)
System shutdown begun: NO
Panic diags file available: YES (0x0)

System uptime in nanoseconds: 49221651681

As you can see, it has a lot of differences between the first and the second call stack.

It's interesting that the first call is trying to set the dbuf value and the system found it's not suitable itself, and then set the optimized dbuf value through the second call.

Here I attach the full boot log here.
bootlog.txt

@kingo132
Copy link
Author

kingo132 commented Sep 29, 2021

Another interesting finding, there are a lot of hardcoded dbuf values in the ice lake framebuffer too, when it's setting the optimized default value.

image

And I have an idea, at least we can call that AppleIntelFramebufferController::setupOptimizedDBU ourselves before the first updateDBUF call to make this patch more robust. Although I still don't know what this dbuf is.

@m0d16l14n1
Copy link

m0d16l14n1 commented Sep 29, 2021

Hello, @kingo132! Thank you again for opening the issue with your ideas and mainly that fix.

DBuf is display data buffer (according to some of Intel docs > https://01.org/sites/default/files/documentation/intel-gfx-prm-osrc-icllp-vol12-displayengine_0.pdf)

That's where I found that explanations and some more stuff about that.

Also just want to add some clarifications: here is the original (first) issue opened about that "glitch". Here you can find log with that "Failed to distribute cached..." and "Underrun..."

P.S. > that patch was tested on 5 different laptops with IceLake on a board

@kingo132
Copy link
Author

After some more tests, I think I can only get this dirty patch to live along with.

image

However, it works, if not, find your correct dbuf value in the boot log, hardcode that value yourself, and then it should work.

This knowledge about all these intel panels or igfx or dbuf has beyond my ability. I will look into this later when I have time.

@Lorys89
Copy link

Lorys89 commented Sep 29, 2021

the fix works great on my dell icl 💪💪
great job guys

video_2021-09-29_08-46-25.mp4

m0d16l14n1 added a commit to m0d16l14n1/Hasee-KingBook-X57S1 that referenced this issue Sep 29, 2021
1) Updated OC to latest master version (pre-0.7.4) + OpenLinuxBoot.efi

2) Added FeatureUnlock.kext to get my iPad mini 4 working with Sidecar

3) Updated most kexts to latest/master versions

4) Updated WhateverGreen.kext (with experimental patch to fix Ice Lake "10 seconds black screen after boot" bug). You can find details here: acidanthera/bugtracker#1805

5) Re-done some quirks in "Booter" section, still trying to get hibernation working. At least for now i only need 2 quirks to stable boot my hackintosh

6) Added some useful SSDTs (DARWIN.aml + ADP1.aml and some changes in LID.aml) to bring back "acwake" and "lidwake" to pmset settings (without that tables there are no such options in "pmset -g live" for example).

7) Maybe something more...
@vit9696
Copy link
Contributor

vit9696 commented Sep 30, 2021

+36 value comes from __ZN15AppleIntelPlane19updateRegisterCacheEv, which takes it from a register in __ZN15AppleIntelPlane4initE9IGPlaneID (a2 is plane index here):

    v4 = (unsigned int)((a2 / 5) << 12);
    v5 = (unsigned int)((a2 % 5) << 8)
    v5 + v4 + 0x7027C;

Need to check out what this register is and fix it, in my opinion, rather than try to to simulate correct value. CC @0xFireWolf.

@vit9696
Copy link
Contributor

vit9696 commented Sep 30, 2021

Defined here in Linux actually. Should have docs on 01.org.

@vit9696 vit9696 added help wanted Extra attention is needed project:green labels Sep 30, 2021
@0xFireWolf
Copy link

Those values define the position for the plane buffer.
The actual register address is determined by the plane identifier (and pipe number as well?).
Here is the function prototype.

void AppleIntelPlane::updateDBUF(AppleIntelPlane* this, UInt32 start, UInt32 end)
{
    // Field at 0x10C (UInt32) stores the raw value of the plane buffer config register
    // Bit 0 - 10 encode the start position;
    // Bit 16 - 26 encode the end position.
    // The rest bits are reserved.
    this->field_0x10c = start & 0x7FF | (end << 16) & 0x7FF;

    // Field at 0x90 (UInt32) stores the start position
    this->field_0x90 = start;

    // Field at 0x94 (UInt32) stores the end position
    this->field_0x94 = end;

    // This function will configure the register and returns void
    AppleIntelPlane::setupPlanarSurfaceDBUF(this);
}

AppleIntelPlane::setupPlanarSurfaceDBUF() checks whether either start or end is 0.
If so, it prints the error saying that internal cached DBuf values are not set.

As vit9696 mentioned above, those three member fields (at 0x90, 0x94, 0x10C) are initially set by AppleIntelPlane::updateRegisterCache(). However, as you can see, calling the function AppleIntelPlane::updateDBUF() will overwrite those cached values, and that function has three callers AppleIntelFramebufferController::allocateDefaultDBUF(), AppleIntelFramebufferController::setupOptimizedDBUF(), and AppleIntelFramebuferrController::LightUpEDP().

LightUpEDP() is fine, because it just passes the cached values (Fields at 0x90 and 0x94) to updateDBUF(). The initial call of updateRegisterCache() should also be fine, otherwise your builtin display would not be working when you boot your laptop. As such, the other two callers are suspicious, as they may pass zeros to the update function.

That being said, the root cause is somewhat deeper. Congratulation on your progress. : )
However, I think your current hard-code approach may have a side effect on external displays, as all planes will use the same buffer position [40, 1023].

@vit9696
Copy link
Contributor

vit9696 commented Oct 2, 2021

Resolved by acidanthera/WhateverGreen#92.

@vit9696 vit9696 closed this as completed Oct 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed project:green
Development

No branches or pull requests

5 participants