Experiments in refit shell to enable 9400M on MBP 5,1

[metatechbe]

Thank Alex for the helpful research work !

I also did my own experiments, and I have different results on my MacBookPro 5,3.

I first looked in "About This Mac" under MacOS X, select "Hardware" in the left tree, then "Graphics/Displays".
Select "NVIDIA GeForce 9400M", and look the value of the "Device ID" field. I have 0x0863.
Select "NVIDIA GeForce 9600M GT", and look the value of the "Device ID" field. I have 0x0647.

Then I go to the rEFIt shell.

When I type "pci -b" I see two entries for display controllers :
00 02 00 00 ==> Display Controller - VGA/8514 controller
Vendor 10DE Device 0647 Prog Interface 0
00 03 00 00 ==> Display Controller - VGA/8514 controller
Vendor 10DE Device 0863 Prog Interface 0

and therefore the 2 cards are identified as follows :
00 02 00 : 9600M GT (0x647)
00 03 00 : 9400M (0x0863)
This is the opposite conclusion to yours. Thomas Gerlach seems to agree with me in his post "drivers/video/efifb.c: Framebuffer for NVIDIA 9400M in MacBook Pro 5,1".

Like you, when I do a "pci 00 02 00" or "pci 00 03 00", I have either all "0xFF" bytes for the disabled card, and an output starting with "DE 10" for the enabled one. The enabled card is the one activated in MacOS X, depending on the "Energy saver" preference pane radio button ("better battery life" or "higher performance").

Then I do a "devices -b" and I see two entries for NVIDIA :
E6 B - - 1 2 5 NVIDIA GPU
E8 B - - 1 5 6 NVIDIA GPU

Then I do a "dh -b e8" when the 9400M is enabled in "Energy saver", and I see the following parameters :
Handle E8 (AE6B7498 )
HorizontalResolution 1440
VerticalResolution 900
PixelsPerScanLine: 2048
FrameBufferBase 0xD0010000
FrameBufferSize 0x708000
PCI 00 03 00

Then I do a "dmpstore -b gpu-power-prefs" and its value is : 01 00 00 00
Then I do a "dmpstore -b legacyvgahandle" and its value is : 98 74 6B AE 00 00 00 00

Then I do a "dh -b e6" when the 9600M GT is enabled in "Energy saver", and I see the following parameters ::
Handle E6 (AE6B7B98 )
HorizontalResolution 1440
VerticalResolution 900
PixelsPerScanLine: 2048
FrameBufferBase 0xC0030000
FrameBufferSize 0x708000
PCI 00 02 00

Then I do a "dmpstore -b gpu-power-prefs" and it value is : 00 00 00 00
Then I do a "dmpstore -b legacyvgahandle" and its value is : 98 7B 6B AE 00 00 00 00

My conclusion is that all EFI variables have the correct values to refer the 9400M or the 9600M GT depending on the card chosen in "Energy Saver", but that the BIOS is not using them
The only option left is to trying and boot Linux in EFI mode.

Regards,

metatech

[emrys]

Guys, I opened a bug related to this to try to give it more visibility:

https://bugs.launchpad.net/ubuntu/+s...rs/+bug/592086

Maybe you could share your progress there also to help move this forward.

Cheers.

[metatechbe]

I did another experiment to try and activate the 9400M in the BIOS.

My reasoning was the following :
The MacBook Pro 15 (2009) comes in two flavours : 9400M only or 9400M+9600M GT.
The firmware version is the same (MBP53.00AC.B03).
The BIOS emulation layer running on top of EFI must therefore automatically detect whether the 9600M is present. If yes, it activates it; if no, the 9400M is used instead.
To do that, it can check at the PCI address for the 9600M (02 00 00) whether a card is present.
On the other side, RivaTuner contains a NVStrap driver that can change the PCI DeviceID ("Use ROM straps for PCI DeviceID programming" option), maybe using a the NVIDIA "soft strap" registers.

So I tried to extract the BIOS of my NVIDIA card, by following the steps :
- Download a MS-DOS boot disk (FreeDos does not work, the keyboard freezes in DOS mode).
I downloaded the "The Standard MS-DOS 7.10 Boot Disk" from http://ms-dos7.hit.bg/ (The other flavours do not work because they contain a grub bootloader).

Then you need to add nvflash to it and burn it to a CD-ROM :
- hdiutil attach ~/Documents/DOS71ISO/boot/boot.img # displays diskX, for instance disk2
- sudo cp ~/Documents/DOS71ISO/nvflash5/nvflash.exe /Volumes/MSDOS710
- sudo cp ~/Documents/DOS71ISO/nvflash5/CWS*.EXE /Volumes/MSDOS710
- diskutil unmount /dev/disk2
- dd if=/dev/disk2 of=~/Documents/DOS71ISO/boot/boot2.img bs=10k count=144
- disktool -e disk2
- mv ~/Documents/DOS71ISO/boot/boot2.img ~/Documents/DOS71ISO/boot/boot.img
- mkisofs -J -r -R -v -T -b boot/boot.img -o ~/MSDOS71.iso ~/Documents/DOS71ISO

Then use Apple's Disk Utility to burn the ISO file to a CD
Reboot the MacBook and press immediately "C".

It should boot in DOS mode.
A:\>nvflash --directpci --list

NVIDIA Firmware Update Utility (Version 5.95)

NVIDIA display adapters present in system:
<0> GeForce 9600M GT (10DE,0647,106B,00BC) H:--:NRM B:02,PCI,D:00,F:00


Only the 9600M is present, so it looks like the BIOS PCI calls filter out the 9400M.

A:\>nvflash --pciblocks

NVIDIA Firmware Update Utility (Version 5.95)

Adapter: GeForce 9600M GT (10DE,0647,106B,00BC) H:--:NRM B:02,PCI,D:00,F:00

The display may go *BLANK* on and off for up to 10 seconds during access to the EEPROM depending on your display adapter and output device.

Identifying EEPROM…
EEPROM ID (20,0000) : Unknown

ERROR : Supported EEPROM not found


So nvflash cannot access the 9600M GT at all

With wfflash V4.8 another error is displayed :
Cannot find NV device
Programming is Fail (X)
DOS/16M error: [26] 8042 timeout
CPU error: incorrect opcode, killing process.


So nothing works

Hint : if you wish to try to boot in rEFIt or DOS shell, your CPU will reach high temperatures in a few minutes (80 degrees Celsius or even more). Before doing it, set your CPU fan speed to 5000 RPM (for example in Linux) and then reboot.

[metatechbe]

Hello,

I managed to extract the BIOS of the NVIDIA card on my MacBook Pro 5,1.

Here are the steps :

Boot into rEFIt shell, and type the following commands :
- "devices -b"
E6 B - - 1 2 5 NVIDIA GPU
E8 B - - 1 5 6 NVIDIA GPU

- "dh -b e6"
ROM Size......: FE00
ROM Location..: AE62C018

- "fs0:"
- "mem AE62C018 FE00 > 9600_output.txt"


Now reboot to MacOS X and type the following commands :

- "sudo mkdir /Volumes/EFI"
- "sudo mount -t msdos /dev/disk0s1 /Volumes/EFI"
- Download attachment from this post and extract file from ZIP.
- "javac HexToBinary.java"
- "java /Volumes/EFI/9600_output.txt 9600.rom"


Now you can view it with NiBiTor.
It is indeed recognized as Device 0x0647.

I tried to change the ROM in-memory and boot into Linux but it only gives a black screen.
In rEFIT shell :

- mm AE62C20C
DE -> <press enter>
10 -> <press enter>
47 -> 48
06 -> 07
00 -> q
- reconnect -r E6


Anyone has ideas ?

Metatech

[metatechbe]

The easiest way to extract the BIOS is on Linux :
dd if=/dev/mem of=/boot/bios.bin bs=65536 skip=12 count=1

Alternately, from MacOS X, you can use nvflash

Download CharlesSoft Pacifist at http://www.charlessoft.com/
Download "Graphics Firmware Update 1.0 (iMac and Mac Pro) compatibility with Windows 7" at http://support.apple.com/kb/DL978
Open "GraphicsFirmwareUpdate.dmg"
Open Pacifist, drag and drop "GraphicsFirmwareUpdate.pkg" on Pacifist window
Expand "Packet contents", "Contents", "Applications", "Utilities", "Graphics Firmware Update.app"
Go to Finder, Right-click on "Graphics Firmware Update.app", select "Show packet contents", then browse to "Contents" / "Resources".
Copy nvFlashDriver.kext and nvcmdflasher into ~/Documents/temp


cd ~/Documents/temp
sudo chown -R root:wheel nvFlashDriver.kext/
sudo chmod -R 755 nvFlashDriver.kext/
sudo kextutil -l nvFlashDriver.kext/
sudo kextload nvFlashDriver.kext


Enable GeForce 9400M

./nvcmdflasher --list

NVIDIA Firmware Update Utility (Version 5.70d6)

NVIDIA display adapters present in system:
<0> GeForce 9400M (10DE,0863,106B,00BB) H:--:NRM B:03,PCI,D:00,F:00


Enable GeForce 9600M GT

./nvcmdflasher --list

NVIDIA Firmware Update Utility (Version 5.70d6)

NVIDIA display adapters present in system:
<0> GeForce 9600M GT (10DE,0647,0000,0000) H:--:NRM B:02,PCI,D:00,F:00
<1> GeForce 9400M (10DE,0863,106B,00BB) H:--:NRM B:03,PCI,D:00,F:00


Without the BIOS layer on top of the EFI, both cards are visible.

./nvcmdflasher -i 0 --save 9600.rom

NVIDIA Firmware Update Utility (Version 5.70d6)

Adapter: GeForce 9600M GT (10DE,0647,0000,0000) H:--:NRM B:02,PCI,D:00,F:00

The display may go *BLANK* on and off for up to 10 seconds during access to the EEPROM depending on your display adapter and output device.

Identifying EEPROM...
EEPROM ID (20,0000) : Unknown

ERROR: Supported EEPROM not found
./nvcmdflasher -i 1 --save 9400.rom

NVIDIA Firmware Update Utility (Version 5.70d6)

Adapter: GeForce 9400M (10DE,0863,106B,00BB) H:--:NRM B:03,PCI,D:00,F:00

The display may go *BLANK* on and off for up to 10 seconds during access to the EEPROM depending on your display adapter and output device.

Identifying EEPROM...
EEPROM ID (20,0000) : Unknown

ERROR: Supported EEPROM not found



Open an hex editor and change the following line :
000A2480 20 00 05 00 80 00 20 00 01 00 01 00 19 8e 07 00
by
000A2480 20 00 00 00 80 00 20 00 01 00 01 00 19 8e 07 00
in order to change
ST M25P05 512Kx1S 2.7-3.6V, 128B page, 32k blk, ID=(20,0005)
into
ST M25P05 512Kx1S 2.7-3.6V, 128B page, 32k blk, ID=(20,0000)

./nvcmdflasher --check

NVIDIA Firmware Update Utility (Version 5.70d6)

Adapter: GeForce 9400M (10DE,0863,106B,00BB) H:--:NRM B:03,PCI,D:00,F:00

The display may go *BLANK* on and off for up to 10 seconds during access to the EEPROM depending on your display adapter and output device.

Identifying EEPROM...
EEPROM ID (20,0000) : ST M25P05 2.7-3.6V 512Kx1S, page

./nvcmdflasher --save 9400.rom

NVIDIA Firmware Update Utility (Version 5.70d6)

Adapter: GeForce 9400M (10DE,0863,106B,00BB) H:--:NRM B:03,PCI,D:00,F:00

The display may go *BLANK* on and off for up to 10 seconds during access to the EEPROM depending on your display adapter and output device.

Identifying EEPROM...
EEPROM ID (20,0000) : ST M25P05 2.7-3.6V 512Kx1S, page
Reading adapter firmware image...
Image Type : Unavailable (Unknown)
Version : Unavailable (Invalid)
Image Size : 0 bytes
~CRC32 : 00000000
Subsystem Vendor ID : FAFC
Subsystem ID : 741A
Hierarchy ID : None
Image Type : Unavailable (Unknown)
Version : Unavailable (Invalid)
Saving of image completed.


So the firmware parameters have invalid values, so it still does not work
Maybe by hex editing with the correct guess for the set of EEPROM parameters, it could work ?

[emrys]

Wow, thanks metatechbe. It seems you are moving forward... Keep up the great work!

If you manage to do it you'll be my hero

[metatechbe]

Hello,

I found a much easier way to find the FrameBufferBase address than the rEFIt shell way.
Only two commands must be run from a Terminal (sudo is even not necessary) :
sudo ioreg -lw0 |grep manufacturer|cut -b25-80;sudo ioreg -lw0|grep "product-name"|cut -b 25-80;sudo dtrace -qn 'BEGIN{boot_args=((struct boot_args*)(`PE_state).bootArgs);printf("FrameBuff erBase: 0x%08x\nPixelsPerScanLine: %d\nHorizontalResolution: %d\nVerticalResolution: %d", boot_args->Video.v_baseAddr, boot_args->Video.v_rowBytes/4, boot_args->Video.v_width, boot_args->Video.v_height);exit(0)} '
This can allow to easily populate the missing entries in the Linux kernel framebuffer driver (drivers/video/efifb.c)

On my machine, when the 9400M is active at boot time the output is the following :
<"Apple Inc.">
<"MacBookPro5,3">
FrameBufferBase: 0xd0010000
PixelsPerScanLine: 2048
HorizontalResolution: 1440
VerticalResolution: 900

On my machine, when the 9600M is active at boot time the output is the following :
<"Apple Inc.">
<"MacBookPro5,3">
FrameBufferBase: 0xc0030000
PixelsPerScanLine: 2048
HorizontalResolution: 1440
VerticalResolution: 900

If the graphic card is switched after boot time (in "Energy Saving" preference pane or with gfxCardStatus), the FrameBufferBase value does not change anymore, it keeps its previous value.

Please contribute the results on your own machine !

Here is the mapping between the different parameter names : rEFIt, MacOS X kernel, Linux kernel MacOS X API :
PixelsPerScanLine -> v_rowBytes -> efifb_dmi_info.stride -> CGDisplayBytesPerRow
FrameBufferBase -> v_baseAddr -> efifb_dmi_info.base -> CGDisplayBaseAddress

Thanks,

metatech

[emrys]

Hi, mine says exactly the same:

<"MacBookPro5,3">
FrameBufferBase: 0xd0010000


Although, I needed sudo privileges for the second line.

[Sidolin]

<"MacBookPro6,2">
FrameBufferBase: 0x90030000

[metatechbe]

Thanks Sidolin,
Was it with the integrated or the discrete graphics activated at boot time ?
Thanks.
metatech