完美解决SNB核显HD3000QE/CI花屏、巨卡问题！自定义FB接口

Customize interface of AppleIntelSNBGraphicsFB.kext，make your HD3000 perfect！

Some prerequisites: Installation of OSX Developer tools (if you need to lookup a PlatformInformationList that has not already been done by someone else)Understanding of hex editingAbility to troubleshoot by looking at ioregistry
As of the 10.7 developer preview code, the intel driver uses Smboardproduct (aka board-id in the ioregistry) to determine the display connectors that are available via the Intel HD 3000 graphics hardware. Actually there's also AAPL,snb-platform-id in the ioregistry that achieves the same result, but I'm going to ignore that for now.

Older code (10.6 including the 2011 MBP sandy bridge update) seems to strictly rely upon the os-info ioregistry entry for this information. I have not, and probably won't, look into editing os-info to change connector information.

With a 10.7 based version of AppleIntelSNBGraphicsFB.kext, the code uses the board-id as an index into the PlatformInformationList[] table. This table is pretty handy, and looks like:
CODE
/* 12 byte connectorinfo */
typedef struct {
       char byte0;
       char byte1; /* i2cid? */
       char unused[2];
       uint32       connectortype;    /* The connector type, see below */
       char byte[4];
} connectorinfo_t;

/* 60 byte total */
typedef struct {
    char byte0; /* Presence? */
    char byte1; /* For display pipe max connector index? */
    char byte2; /* Usable Connector count */
    char byte3; /* Appears unused */
    char byte[8];
    connectorinfo_t connectors[4];
} PlatformInformationList_type;

PlatformInformationList_type PlatformInformationList[8];

where integers are represented in intel little-endian byte order, and bit 0 is the LSB.
In English, there are 8 tables in the list, each 60 bytes long. Each 60 byte table entry starts with a 12 byte header, followed by 4 connector information blocks. The connector information blocks are each 12 bytes long.

The connectorytype field appears to use the same codes as the ATI driver, where the only used values used by the driver thus far are:

#define CONNECTORTYPE_LVDS 0x00000002 /* Ie internal Low Voltage display, such as laptop */
#define CONNECTORTYPE_DP 0x00000400 /* Displayport */
#define CONNECTORTYPE_HDMI 0x00000800

If you don't set your board-id to a recognized value, a default connector table is instead taken from the address PlatformInformationDefault. THe default table only has 1 usable connector so this is likely to give you reduced functionality.

Setting SMboardproduct to various sandy bridge board-ids defines the index into PlatformInformationList[]. Interestingly only indexes 0 thru 5 are currently allowed (even though there are two more table entries...) In any case, for the purpose of this note, we'll use index 0 by setting the board-id to the MacBookPro8,1 value. In smbios.plist: CODE
        SMboardproduct
        Mac-94245B3640C91C81


Unfortunately all 8 table entries use an LVDS connector for the first value, and the driver seems to malfunction if you have nothing plugged into this port. In my case I would see the kernel log fill up with errors about a stuck ring:
CODE
kernel[0]: WaitForStamp: Overflowed waiting for stamp 0x2f3 on Main ring: called from
...
kernel[0]: Looks like Main ring is stuck waiting on an event
kernel[0]: After attempt to clear wait condition = 0x00003001 no longer waiting
And it would get re-stuck every 5 seconds or so. More importantly this would make the graphics unusably slow unless I unplugged the display for > 5 seconds first. At that point the stuck ring problem would "heal"... Using a dual-head setup also seems to avoid this problem. 

However, rather than hot-plugging the graphics display upon every boot, one can instead modify the above table to avoid this problem.

First we find the PlatformInformationList table. In the example below I'm using DP4:
CODE
% cd /System/Library/Extensions/AppleIntelSNBGraphicsFB.kext/Contents/MacOS
% nm -arch x86_64 AppleIntelSNBGraphicsFB | grep 'D _PlatformInformationList'
00000000000295f0 D _PlatformInformationList
% lipo -detailed_info AppleIntelSNBGraphicsFB
Fat header in: AppleIntelSNBGraphicsFB
fat_magic 0xcafebabe
nfat_arch 2
architecture x86_64
    cputype CPU_TYPE_X86_64
    cpusubtype CPU_SUBTYPE_X86_64_ALL
    offset 4096
    size 283008
    align 2^12 (4096)
architecture i386
    cputype CPU_TYPE_I386
    cpusubtype CPU_SUBTYPE_I386_ALL
    offset 290816
    size 293092
    align 2^12 (4096)
%
So now we know the disk address for this table is:
0x295f0+4096=173552
Since there are 8 tables of 60 bytes, we could dump 8*60=480 bytes to see all 8 tables. Since I've chosen to work on the first entry, I'll dump just 60 bytes.
ALso since each connector is 12 bytes, I dump 12 bytes per line for our viewing pleasure.
CODE
% dd if=AppleIntelSNBGraphicsFB of=/tmp/table bs=1 skip=173552 count=60
60+0 records in
60+0 records out
60 bytes transferred in 0.000142 secs (422955 bytes/sec)
% cd /tmp
% xxd -c 12 < table > hex
% cat hex
0000000: 0102 0400 1007 0000 1007 0000  ............
000000c: 0503 0000 0200 0000 3000 0000  ........0...
0000018: 0205 0000 0004 0000 0700 0000  ............
0000024: 0304 0000 0004 0000 0900 0000  ............
0000030: 0406 0000 0004 0000 0900 0000  ............
%

In the above table you can see that 4 connectors are marked usable, 1 LVDS and 3 DP. On my h67 motherboard, I have 4 connectors: VGA, DVI, DP and HDMI. The DVI, DP and HDMI connectors all work with the DP connectortype shown in this table (the intel driver doesn't seem to use the connectortype for much).

I believe I can tell which of the above entries match my hardware by checking which entry has av-signal-type set, (or when AAPL,DisplayPipe != 0xffff?). I certainly can by exhausting testing of the combinations...

Now, to remove the problematic LVDS entry, I edit the hex file, producing:
CODE
0000000: 0102 0300 1007 0000 1007 0000  ............
000000c: 0304 0000 0004 0000 0900 0000  ............
0000018: 0205 0000 0004 0000 0700 0000  ............
0000024: 0406 0000 0004 0000 0900 0000  ............
0000030: 0000 0000 0000 0000 0000 0000  ............

In the above I moved the hex from the 3rd connector (row 4) to the first (row 2), zeroed the hex in row 5, and subtracted 1 from the connector count in row 0.

Now I write back the result:
CODE
xxd -c 12 -r hex >! table
% dd if=table of=/System/Library/Extensions/AppleIntelSNBGraphicsFB.kext/Contents/MacOS/AppleIntelSNBGraphicsFB bs=1 seek=173552 conv=notrunc
% touch /System/Library/Extensions

Viola, 3 working connectors and no driver hangs, instead of 1 broken connector & 3 working connectors with driver hangs. 














引用drpc  特别感谢ps3bbs朋友


cd /System/Library/Extensions/AppleIntelSNBGraphicsFB.kext/Contents/MacOS

nm -arch x86_64 AppleIntelSNBGraphicsFB | grep 'D _PlatformInformationList'
会有一个数字反馈过来,比如我的就是0000000000029600 D _PlatformInformationList 这里标记为0x29600


bash-3.2# lipo -detailed_info AppleIntelSNBGraphicsFB 会得到
Fat header in: AppleIntelSNBGraphicsFB
fat_magic 0xcafebabenfat_arch 2
architecture x86_64   
cputype CPU_TYPE_X86_64   
cpusubtype CPU_SUBTYPE_X86_64_ALL   
offset 4096  
size 283552   
align 2^12 (4096)
architecture i386   
cputype CPU_TYPE_I386   
cpusubtype CPU_SUBTYPE_I386_ALL   
offset 290816  
  size 294736  
align 2^12 (4096)

这里根据你自己的内核是32还是64 去用上面的0x29600+ offset值 比如64内核就是0x29600+4096(这里4096转16进制是0x1000,打开计算器 0x29600+0x1000=0x2a600 转换为10进制就是 173586 记住这个数值(附注：此处计算有误，应该为173568)

dd if=AppleIntelSNBGraphicsFB of=/tmp/table bs=1 skip=173586 count=60



然后进入TMP
cd /tmp

xxd -c 12 < table > hex

cat hex

你会得到类似下面的数值

0000000: 0000 851e 0000 0f01 0000 d6bd  ............000000c: 0000 0000 0000 af1e 0000 0f01  ............0000018: 0000 c2c0 0000 0000 0000 dc1e  ............0000024: 0000 0f01 0000 bcc0 0100 0000  ............0000030: 0000 201f 0000 0f01 0000 eeaf  .. .........

第一行忽略, 第2345行分别对应VGA DVI HDMI DP把你要用的比如DVI (第3行)挪到第2行 下面的依次上提,然后第5行填满0  0000 0000 0000 0000 0000 是这样子的.

xxd -c 12 -r hex >! table

dd if=table of=/System/Library/Extensions/AppleIntelSNBGraphicsFB.kext/Contents/MacOS/AppleIntelSNBGraphicsFB bs=1 seek=173586 conv=notrunc

touch /System/Library/Extensions