[CDG5] RockHopper patches

Thu Mar 11 20:47:13 AWST 2021

I accidentally just threw away some work in IDA. For the record... in at least some machines, the backlight driver makes _Status 192 calls to the video driver to set the brightness. I will need to play around with this on a real machine...

> On 11 Mar 2021, at 7:30 pm, Elliot Nunn <elliotnunn at fastmail.com> wrote:
> 
> I'm reversing the backlight driver to figure out the inversion bug. Could you please use MacsBug on a laptop running 9.2.2 with the latest tbxi, search for the below text in the system heap using MacsBug, and dump the 512 or so bytes starting from there?
> 
> 0000000000002460  70 61 6E 65 6C 2D 66 61  6D 69 6C 79 00 44 46 50  panel-family.DFP
> 0000000000002470  2C 45 44 49 44 00 41 54  59 00 4E 56 44 41 00 64  ,EDID.ATY.NVDA.d
> 0000000000002480  72 69 76 65 72 2D 72 65  66 00 62 61 63 6B 6C 69  river-ref.backli
> 0000000000002490  67 68 74 2D 63 6F 6E 74  72 6F 6C 00 61 74 69 00  ght-control.ati.
> 00000000000024A0  70 6D 75 00 6D 6E 63 61  00 00 00 00 00 00 00 00  pmu.mnca........
> 
>> On 8 Mar 2021, at 9:28 pm, Elliot Nunn <elliotnunn at fastmail.com> wrote:
>> 
>> Easiest to hardest…
>> 
>> 1. If no patch is needed to the ATY,Via driver, then it can just be injected directly into the "Parcelfile", like here...
>> 
>> https://github.com/elliotnunn/tbxi-patches/blob/96730fe/macmini.py#L455
>> 
>> No need to carry out the fiddly binary edit that RockHopper requires.
>> 
>> 2. Backlight: interesting! Not too long ago I dove deep into the System 7.1 ".Backlight" driver. These control and status calls are probably still used in later versions. Lightly edited SuperMario source below.
>> 
>> /* Control Calls */
>> #define KCONTROLCALL 0x4300
>> #define kSetScreenBrightness (KCONTROLCALL + 1)
>> #define kSaveScreenBrightness (KCONTROLCALL + 2)
>> #define kCdevActive (KCONTROLCALL + 3)
>> #define kSetBrightnessKeys (KCONTROLCALL + 4)
>> #define kSavePKeys (KCONTROLCALL + 5)
>> #define kSetRange (KCONTROLCALL + 6)
>> #define kSetTable (KCONTROLCALL + 7)
>> 
>> /* Status Calls */
>> #define KSTATUSCALL 0x5300
>> #define kGetScreenBrightness (KSTATUSCALL + 1)
>> #define kGetBrightnessKeys (KSTATUSCALL + 2)
>> #define kGetBrightnessRange (KSTATUSCALL + 3)
>> #define kGetPBacklight (KSTATUSCALL + 4)
>> #define kGetPKey (KSTATUSCALL + 5)
>> #define kGetMaximum (KSTATUSCALL + 6)
>> #define KGetVersion (KSTATUSCALL + 7)
>> #define kGetUserInput (KSTATUSCALL + 8)
>> 
>> I don't remember exactly how I patched the ndrv that I posted years ago, but it might be worth posting a video. But ultimately we really just need to reverse the ndrv then patch it to apply the correct transformation to the backlight.
>> 
>> 3. Sleep: good sleuthing so far. We need a way to get output from the machine. From what you say, the power and caps lock light seem to be under programmatic control.
>> 
>> ---
>> 
>> I'm most interested in backlight for now. Send me that video and I'll get hacking.
>> 
>>> On 8 Mar 2021, at 6:11 pm, Jd Lyons <lyons_dj at yahoo.com> wrote:
>>> 
>>> No patches have been needed to the ATY,Via ’NDRV’, but I’ve never tried the external VGA, as I’ve never ordered the Mini VGA adapter.
>>> 
>>> On the iBook ( Powerbook6,5 ) 14” ( inverted backlight ) we patch ‘mica’ with ‘ati’ to get the backlight control somewhat functional. When sleep is entered, the backlight goes off, but comes back on when the sleep light on the front of the iBook starts pulsing.
>>> 
>>> Exiting sleep the backlight turns back off, the disks never spin back up, but if the caps lock was set, the light for the caps lock on the keyboard comes back on, and the sleep light on the front goes off.
>>> 
>>> We just hang there.
>>> 
>>> On the iBook( Powerbook6,3 ) we use the same patch ‘mnca>ati’ the backlight is not inverted, when we enter sleep the backlight goes off, but it doesn’t come back on when we try to exit sleep, Ross reported he could hear the disks spin back up on sleep exit, but the screen never wakes, and the system hangs there.
>>> 
>>> On the 2005 iBook 12"( PowerBook6,7 ) with R9550 graphics, we use the same ‘mnca>ati’ and the backlight is not inverted, the system enters sleep, the backlight stays off, sleep light pulsing, but we still hang on sleep exit, and I never hear the disks spinning back up.
>>> 
>>> I have checked that the system doesn’t wakeup with the backlight just being off, we are crashing on sleep exit, and that’s going to be really hard to debug.
>>> 
>>> Some things I've noted, if we use the Energy Saver Control Panel to set a ‘Wakeup’ time, when that time comes, the system does try to wake, so we know that the system has not crashed in sleep mode as it’s still monitoring the clock.
>>> 
>>> When the battery becomes very low the system will enter sleep, even if sleep is set to ’never’ in the energy saver control panel. This is not a bug, it’s a feature, same thing happens in OS X, and the system will not respond to any ‘wake’ events until you plug in a power adapter. So we know we have not crashed in sleep as the system is monitoring the battery and the power adapter.
>>> 
>>> The ‘Caps Lock’ light lets us know that the system is trying to return power at wake, we just have to figure why it’s failing and crashing.
>>> 
>>> When we have someone with a Mini to test sleep for us, we should know if it’s an issue with the iBook, or the Mini also hangs on sleep exit, tho I think we need to make a new ‘prim-info’ for the Mini, as it’s more of a mobile unit without a backlight and a battery. It shares more in common with the iBook/PowerBook than it does any desktop Macs.
>>> 
>>> As to the ‘mnca>ati’ we really should make attempts to fix this, I did build a ROM with your patched Backlight ’NDRV’ and it does send backlight control events to the NK Log, I’m just not sure what info from that will be useful, and I suppose I’ll have to upload pictures of the screen, unless there is someway of getting the NK log to output to file?
>>> 
>>>> On Mar 7, 2021, at 7:00 PM, Elliot Nunn <elliotnunn at fastmail.com> wrote:
>>>> 
>>>> Thank you for the tip regarding the mini. I’m afraid mine is in a sea container for the forseeable.
>>>> 
>>>> What sort of crash are you seeing coming out of sleep? And do you need help patching the backlight driver? I think we were working on backlights a couple of years ago but left it hanging.
>>>> 
>>>> Did the ATY,Via driver require patches to work on the iBook?
>>>> 
>>>>> On 7 Mar 2021, at 8:15 pm, Jd Lyons <lyons_dj at yahoo.com> wrote:
>>>>> 
>>>>> The iBook G4’s with R9200 all use the ATY,Via ’NDRV’ and have a device ID of 0x5c63
>>>>> 
>>>>> One thing I have noted on the ATY,Via ’NDRV’ is we are not limited to the version that comes with 10.3.7 like we are with the Mini. I tested the version from 10.4.11 and it works just fine. I’ll haver to extract the one from 10.5.8 and see if that one works well also, because it’s normally best to use the lastest version that is compatible to get all the bug fixes.
>>>>> 
>>>>> Also, when you have time, if you still have access to the G4 Mini, I’ve managed to enable sleep on the iBook G4 by using the “pci-probe-mask” to mask one of the USB devices and the Airport Extreme Card.
>>>>> 
>>>>> Tho the system crashes trying to come out of sleep, and that may or may not be related to the backlight.
>>>>> 
>>>>> I’m not sure the Mini uses the same PCI layout as the, but I need someone with a Mini to test this and see if the Mini can enter and exit sleep.   
>>>>> 
>>>>> http://macos9lives.com/smforum/index.php/topic,5880.0.html
>>>>> 
>>>>>> On Mar 1, 2021, at 3:57 PM, Elliot Nunn <elliotnunn at fastmail.com> wrote:
>>>>>> 
>>>>>> Yes, this sure is possible. Which NDRVs and device IDs are needed for those machines?
>>>>>> 
>>>>>>> On 1 Mar 2021, at 7:32 pm, Jd Lyons <lyons_dj at yahoo.com> wrote:
>>>>>>> 
>>>>>>> Is there any way we can make the RockHopper2 patch for the Mini a generic patch that just reads the first three digits of the Radeon 9200 Device ID and does the real time patches?
>>>>>>> 
>>>>>>> The iBook G4 and I assume also the eMac suffer from the mouse pointer freeze bug, with some other odd side effects of my patches the the Device ID of the Radeon drivers.
>>>>>>> 
>>>>>>> 
>>>>>> 
>>>>> 
>>>> 
>>> 
>> 
> 