CORB (Probably a bit esoteric)

Summary:

Dumping extended controller info, for what it's worth...

CORB (Probably a bit esoteric)

codeye 1225559981|%e %b %Y, %H:%M %Z|agohover

I've put together another frontend utility for reggie_se to examine physical memory blocks in a more user friendly way - memory_dump0.1 (usual place).
Here are the first azalia dumps from the Command Output Ring Buffer (CORB) ie what azalia is sending to the codec.
I didn't want to fill up the main discussion thread.
Startup - 0x000f0000 0x000f0002 0x000f0004 0x001f0004 0x001f0005 0x001f2000 0x001f0008 0x001f000b
0x001f000a 0x001f000f 0x001f000d 0x001f0012 0x002f0009 0x002f000b 0x002f000a 0x002f0012 0x003f0009
0x003f000b 0x003f000a 0x003f0012 0x004f0009 0x005f0009 0x006f0009 0x006f000b 0x006f000a 0x007f0009
0x007f000e 0x007f0200 0x007f000b 0x007f000a 0x007f000d 0x008f0009 0x008f000e 0x008f0200 0x008f000b
0x008f000a 0x008f000d 0x009f0009 0x00af0009 0x00bf0009 0x00bf000e 0x00bf0200 0x00bf0204 0x00bf000d
0x00cf0009 0x00cf000e 0x00cf0200 0x00cf000d 0x00df0009 0x00df000e 0x00df0200 0x00df000d 0x00ef0009
0x00ef000e 0x00ef0200 0x00ef000d 0x00ff0009 0x010f0009 0x010f000b 0x010f000a 0x011f0009 0x011f000e
0x011f0200 0x011f000c 0x011f1c00 0x012f0009 0x012f000c 0x012f1c00 0x013f0009 0x014f0009 0x014f000e
0x014f0200 0x014f0012 0x014f000c 0x014f1c00 0x015f0009 0x015f000e 0x015f0200 0x015f0012 0x015f000c
0x015f1c00 0x016f0009 0x016f000e 0x016f0200 0x016f0012 0x016f000c 0x016f1c00 0x017f0009 0x018f0009
0x018f000e 0x018f0200 0x018f0012 0x018f000d 0x018f000c 0x018f1c00 0x019f0009 0x019f000e 0x019f0200
0x019f0012 0x019f000d 0x019f000c 0x019f1c00 0x01af0009 0x01af000e 0x01af0200 0x01af0012 0x01af000d
0x01af000c 0x01af1c00 0x01bf0009 0x01bf000e 0x01bf0200 0x01bf0012 0x01bf000d 0x01bf000c 0x01bf1c00
0x01cf0009 0x01df0009 0x01df000c 0x01df1c00 0x01ef0009 0x01ef000e 0x01ef0200 0x01ef000c 0x01ef1c00
0x01ff0009 0x020f0009 0x020f0010 0x021f0009 0x022f0009 0x023f0009 0x023f000e 0x023f0200 0x023f0204
0x024f0009 0x024f000e 0x024f0200 0x024f0204 0x024f000d 0x0017ff00 0x00170500 0x00270600 0x01470100
0x014ba000 0x0143a000 0x014b8000 0x01439000 0x00cb2000 0x00c36080 0x00cb0000 0x00c35080 0x00cb2000
0x00c36180 0x00cb0000 0x00c35180 0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x002ba000 0x0023a03f
0x002b8000 0x0023903f 0x01470740 0x00270610 0x00224031 0x002ba000 0x0023a030 0x014ba000 0x0143a000
0x002b8000 0x00239030 0x014b8000 0x01439000 0x00270600 0x01470100 0x014ba000 0x0143a000 0x014b8000
0x01439000 0x00cb2000 0x00c36080 0x00cb0000 0x00c35080 0x00cb2000 0x00c36180 0x00cb0000 0x00c35180
0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x002ba000 0x0023a03f 0x002b8000 0x0023903f 0x01470740
0x00270610 0x00224031 0x002ba000 0x0023a030 0x014ba000 0x0143a000 0x002b8000 0x00239030 0x014b8000
0x01439000
all the bold verbs are querying the codec
Wake from sleep - 0x0017ff00 0x00170500 0x01470100 0x014ba000 0x0143a000 0x014b8000 0x01439000
0x00cb2000 0x00c36080 0x00cb0000 0x00c35080 0x00cb2000 0x00c36180 0x00cb0000 0x00c35180 0x00cb2000
0x00c36000 0x00cb0000 0x00c35000 0x002ba000 0x0023a03f 0x002b8000 0x0023903f 0x01470740 0x00270610
0x00224031 0x002ba000 0x0023a030 0x014ba000 0x0143a000 0x002b8000 0x00239030 0x014b8000 0x01439000

of course in both cases 0x01470c02 (enable EAPD on NID 0x14) must be issued separately to get sound going.

Next a dump of a non-working AppleHDA.kext

last edited on 1225588420|%e %b %Y, %H:%M %Z|agohover by codeye + show more

Re: CORB (Probably a bit esoteric)

codeye 1225585830|%e %b %Y, %H:%M %Z|agohover

AppleHDA.kext (no sound using alc269 engine) without any added injected verbs

Startup
0x00270600 0x00224031 0x002a0000 0x00270500 0x00270610 0x01470100 0x014ba000 0x0143a000 0x014b8000
0x01439000 0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x00cb2000 0x00c36080 0x00cb0000 0x00c35080
0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x002ba000 0x0023a03f 0x002b8000 0x0023903f 0x014f0700
0x01470740 0x012f0700 0x01270724 0x012f0700 0x012f0700 0x01270720 0x01270720 0x00870610 0x00870600
0x00824031 0x008a0000 0x00870500 0x00870610 0x00870100 0x008b2000 0x00836011 0x008b0000 0x00835011
0x008b2000 0x00836011 0x008b0000 0x00835011 0x02370105 0x012f0700 0x01270720 0x002b8000 0x0023903f
0x002ba000 0x0023a03f 0x00870600 0x00824031 0x008a0000 0x00870500 0x00870610 0x002ba000 0x0023a03f
0x002b8000 0x0023903f 0x00270600 0x00224031 0x002a0000 0x00270500 0x00270610 0x020f0005 0x020f0009
0x020f000f 0x020f0012 0x020f000d 0x020f0009 0x020f0010 0x021f0005 0x021f0009 0x021f000f 0x021f0012
0x021f000d 0x021f0009 0x022f0005 0x022f0009 0x022f000f 0x022f0012 0x022f000d 0x022f0009 0x023f0005
0x023f0009 0x023f000f 0x023f0012 0x023f000d 0x023f0009 0x023f000e 0x023f0200 0x023f0204 0x024f0005
0x024f0009 0x024f000f 0x024f0012 0x024f000d 0x024f0009 0x024f0012 0x024f000d 0x024f000e 0x024f0200
0x024f0204 0x01570883 0x00270600 0x00270600 0x00224031 0x002a0000 0x00270600 0x01470100 0x014ba000
0x0143a000 0x014b8000 0x01439000 0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x00cb2000 0x00c36080
0x00cb0000 0x00c35080 0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x002ba000 0x0023a03f 0x002b8000
0x0023903f 0x014f0700 0x01470740 0x00270600 0x00224031 0x002a0000 0x00270600 0x002b8000 0x0023903f
0x002ba000 0x0023a03f 0x00270610 0x00270600 0x00224031 0x002a0000 0x00270610 0x01470100 0x014ba000
0x0143a000 0x014b8000 0x01439000 0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x00cb2000 0x00c36080
0x00cb0000 0x00c35080 0x00cb2000 0x00c36000 0x00cb0000 0x00c35000 0x002ba000 0x0023a03f 0x002b8000
0x0023903f 0x014f0700 0x01470740 0x00870600 0x00870600 0x00824031 0x008a0000 0x00870600 0x00870100
0x008b2000 0x00836091 0x008b0000 0x00835091 0x008b2000 0x00836011 0x008b0000 0x00835011 0x02370105
0x012f0700 0x01270720 0x00870600 0x00824031 0x008a0000 0x00870600 0x002b8000 0x0023903f 0x002ba000
0x0023a03f 0x0017201a 0x00172183 0x00172243 0x00172310 0x01171cf0 0x01171d11 0x01171e11 0x01171f41
0x01271c20 0x01271d09 0x01271ea3 0x01271f99 0x01471c10 0x01471d01 0x01471e13 0x01471f99 0x01571c1f
0x01571d40 0x01571e21 0x01571f01 0x01671cf0 0x01671d11 0x01671e11 0x01671f41 0x01871c30 0x01871d98
0x01871ea1 0x01871f01 0x01971cf0 0x01971d11 0x01971e11 0x01971f41 0x01a71cf0 0x01a71d11 0x01a71e11
0x01a71f41 0x01b71cf0 0x01b71d11 0x01b71e11 0x01b71f41 0x01d71c2d 0x01d71d82 0x01d71e05 0x01d71f40
0x01e71cf0 0x01e71d11 0x01e71e11 0x01e71f41 0x00170500 0x014f0700 0x014f0700 0x01470740 0x015f0700
0x015f0700 0x015707c0 0x015f0900 0x00270610

Wake up
0x0017201a 0x00172183 0x00172243 0x00172310 0x01171cf0 0x01171d11 0x01171e11 0x01171f41 0x01271c20
0x01271d09 0x01271ea3 0x01271f99 0x01471c10 0x01471d01 0x01471e13 0x01471f99 0x01571c1f 0x01571d40
0x01571e21 0x01571f01 0x01671cf0 0x01671d11 0x01671e11 0x01671f41 0x01871c30 0x01871d98 0x01871ea1
0x01871f01 0x01971cf0 0x01971d11 0x01971e11 0x01971f41 0x01a71cf0 0x01a71d11 0x01a71e11 0x01a71f41
0x01b71cf0 0x01b71d11 0x01b71e11 0x01b71f41 0x01d71c2d 0x01d71d82 0x01d71e05 0x01d71f40 0x01e71cf0
0x01e71d11 0x01e71e11 0x01e71f41 0x01570883 0x014f0700 0x014f0700 0x01470740 0x015f0700 0x015f0700
0x015707c0 0x015f0900 0x012f0700 0x012f0700 0x01270720 0x01270700

bold = software querying codec
underlined = setting pin config states
italics = setting stream formats

last edited on 1225592635|%e %b %Y, %H:%M %Z|agohover by codeye + show more

Re: CORB (Probably a bit esoteric)

codeye 1225721017|%e %b %Y, %H:%M %Z|agohover

HDAController Azalia correctly sets up an output stream at iomemory+0x100, and can be interacted with (crudely at present).
HDAController HDA sets up an output stream at iomemory+0x100, but there is no change in the Link Position in Buffer (LPIB) suggesting no bytes are transferred of the link into the codec.
http://svn.berlios.de/viewcvs/haiku/haiku/trunk/src/add-ons/kernel/drivers/audio/hda/?rev=28478
this may be adaptable for a userspace program to interact with the controller.

last edited on 1225724042|%e %b %Y, %H:%M %Z|agohover by codeye + show more

Re: CORB (Probably a bit esoteric)

Toonces 1225752876|%e %b %Y, %H:%M %Z|agohover

codeye, which codec are you using when testing the LPIB? I am wondering if the 262 & 885 might be dead ends. When I tested the AppleHDA.kext MadTux provided he seemed to indicate that the 885 codec was setting things up but not passing through any of the additional verbs we needed and switched to using one of the sigmatel codecs (the 9220 I think). Maybe you can try the last test AppleHDA.kext he uploaded (http://www.speedyshare.com/806961393.html) and see what is going on? That one seemed to have everything right in IOReg at least. Still no sound though. The only thing I keep seeing is that there are no mute controls and I have to think that has something to do with no sound even when I inject the EAPD verb it was silent.

last edited on 1225753004|%e %b %Y, %H:%M %Z|agohover by Toonces + show more

Re: CORB (Probably a bit esoteric)

codeye 1225757800|%e %b %Y, %H:%M %Z|agohover

toonces,
I've tested so many different incarnations of these kexts my head is spinning!
Up until now I have not been sure why there is no sound (ie could it be the amps turned off, not powered up, volume wrong etc).
The root problem it seems is that the controller sets up a stream to be sent to the codec but the link is "malformed".
Can this be overcome with the right incantation of verbs - possibly, and I would encourage everyone to keep trying, but I'm also wondering if I can hack the controller to get around this problem or whether it can be bypassed altogether.
What would be useful would be for someone with a 268 based hackintosh to load up a non-functional hda kext (but one that loads and appears to play a stream) and see if the controller registers are set similar to mine on the 269 ie output stream is set up but link isn't advancing this would suggest getting the verbs in the correct order will work. It might be that like the azalia inconsistencies we were having that firing all those verbs through the codec for the 268 just meant that the crucial one for EAPD was also sent by chance (I hope not).
Toonces, grab the hdaudio_03.pdf and have a look at how the registers are setup for the controller (it sits at 0xF7DB8000 on the 901).
You can see the HDAcontroller.kext is interacting with it (particularly with azalia loaded up and a stream playing), when you change sample rates this changes in the controller registers and you can stop a stream with the correct byte writes (using graphical reggie_se).
Maybe it is just a matter of getting the verbs correct…

last edited on 1225762823|%e %b %Y, %H:%M %Z|agohover by codeye + show more

Re: CORB (Probably a bit esoteric)

Toonces 1225780555|%e %b %Y, %H:%M %Z|agohover

Will do codeye! The AppleHDA.kext that MadTux posted last seems to me to be very close to what it should look like from what I can tell in IOReg. All of the streams are there just no sound and no mute control. I can turn the EAPD on and still no sound so maybe it's just muted. I'll take a look at that pdf and see if I can make heads or tails of it (You are light years ahead of my understanding. Ok, maybe a couple days and a few explanations but still more than what I currently understand). I'll try running your memory_dumper program tomorrow after I tear down my Audieee setup and reinstall that codec so we can see what it shows.

EDIT: Nope Light years was right. I think I sprained my RIRB trying to understand the CORB when I stepped in the stream.

last edited on 1225781353|%e %b %Y, %H:%M %Z|agohover by Toonces + show more

Re: CORB (Probably a bit esoteric)

snickersmd 1225785119|%e %b %Y, %H:%M %Z|agohover

I've been patiently watching your progress in this area… CORB is something I read about in my HDA spec research too but I never thought we would have to go so low level since the gurus that came before us never needed to themselves (at least, it never seemed so).

The symptoms that you are observing certainly correlate well with the way Apple has been evolving their HDA kexts… from the Azalia single kext to the early HDA kext with 3 separate subkexts and now the newer HDA kext with 5 subkexts and it just seems that they are making it more and more complicated.

Or rather, they are delegating out functionality to subkexts what was once taken care of by a single codebase.

My suggestion would be to take a step back… you have already uncovered the subtle differences in why it's not working, perhaps we need to go back to routine level rather than memory/byte level, and see if there isn't a simpler way to trick the code into working for us. Although, I do agree that the ultimate solution is likely to be verb level, I guess I'm just saying, you've been staring at registers for so long you would do well to take a step back, a deep breath, and a quick look at human readable text rather than binary. ;) To this end, I will prep some disassemblies and decompilations of both old and new AppleHDA binaries as well as the controller and generic driver (hell, Azalia too while I'm at it) to see if there isn't some binary patch that would solve our problem faster. Previously I have only been looking at a single decompilation of the new AppleHDA (10.5.5) but all the research shows the importance of the progression of the driver.

What would really really help is if we could debug the kext live in memory, the way that SoftICE in windows let us look at running device drivers. Unfortunately, I am unwilling to do instruction stepping using gdb ;p We will probably have to settle for dead list, text file approach. You guys have been doing your disassembly with otool and its brothers, I assume, and I have been using… something else.

As posting decompiled source is probably tantamount to piracy (also considering the tools required to produce it), I will prepare these text files and distribute them to the team via PM, hidden link, password protected archive.

last edited on 1225785276|%e %b %Y, %H:%M %Z|agohover by snickersmd + show more

Re: CORB (Probably a bit esoteric)

Toonces 1225911585|%e %b %Y, %H:%M %Z|agohover

codeye, Here's teh dump from the last AppleHDA.kext that MadTux sent me with no extra verbs injected. This one looks to be very close to working as I said previously since all of the streams are set up. I really think it has something to do with why there are no mute controls. This kext is using one of the stac codecs instead of the ALC262 or ALC885 codec.

0xF7EB8000:     0x01004401
0xF7EB8004:     0x001d003c
0xF7EB8008:     0x00000101
0xF7EB800C:     0x00010000
0xF7EB8010:     0x00000000
0xF7EB8014:     0x00000000
0xF7EB8018:     0x00180030
0xF7EB801C:     0x00000000
0xF7EB8020:     0xc0000010
0xF7EB8024:     0x00000000
0xF7EB8028:     0x00000000
0xF7EB802C:     0x00000000
0xF7EB8030:     0xf6c1bfc2
0xF7EB8034:     0x00000000
0xF7EB8038:     0x00000000
0xF7EB803C:     0x00000000
0xF7EB8040:     0x05c44080
0xF7EB8044:     0x00000000
0xF7EB8048:     0x00fb00fb
0xF7EB804C:     0x00420002
0xF7EB8050:     0x11fae000
0xF7EB8054:     0x00000000
0xF7EB8058:     0x000100fb
0xF7EB805C:     0x00420007
0xF7EB8060:     0x00000000
0xF7EB8064:     0x00000000
0xF7EB8068:     0x00000000
0xF7EB806C:     0x00000000
0xF7EB8070:     0x00000000
0xF7EB8074:     0x00000000
0xF7EB8078:     0x00000000
0xF7EB807C:     0x00000000
0xF7EB8080:     0x00140000
0xF7EB8084:     0x00000000
0xF7EB8088:     0x00010000
0xF7EB808C:     0x0004000f
0xF7EB8090:     0x4031009f
0xF7EB8094:     0x00000000
0xF7EB8098:     0x1420e000
0xF7EB809C:     0x00000000
0xF7EB80A0:     0x00040000
0xF7EB80A4:     0x00000000
0xF7EB80A8:     0x00000000
0xF7EB80AC:     0x00040000
0xF7EB80B0:     0x00000077
0xF7EB80B4:     0x00000000
0xF7EB80B8:     0x00000000
0xF7EB80BC:     0x00000000
0xF7EB80C0:     0x00040000
0xF7EB80C4:     0x00000000
0xF7EB80C8:     0x00000000
0xF7EB80CC:     0x00040000
0xF7EB80D0:     0x00000077
0xF7EB80D4:     0x00000000
0xF7EB80D8:     0x00000000
0xF7EB80DC:     0x00000000
0xF7EB80E0:     0x00040000
0xF7EB80E4:     0x00000000
0xF7EB80E8:     0x00000000
0xF7EB80EC:     0x00040000
0xF7EB80F0:     0x00000077
0xF7EB80F4:     0x00000000
0xF7EB80F8:     0x00000000
0xF7EB80FC:     0x00000000

Here it is after injecting EAPD on (still no audio)

0xF7EB8000:     0x01004401
0xF7EB8004:     0x001d003c
0xF7EB8008:     0x00000101
0xF7EB800C:     0x00010000
0xF7EB8010:     0x00000000
0xF7EB8014:     0x00000000
0xF7EB8018:     0x00180030
0xF7EB801C:     0x00000000
0xF7EB8020:     0xc0000010
0xF7EB8024:     0x00000000
0xF7EB8028:     0x00000000
0xF7EB802C:     0x00000000
0xF7EB8030:     0x2b5e5bef
0xF7EB8034:     0x00000000
0xF7EB8038:     0x00000000
0xF7EB803C:     0x00000000
0xF7EB8040:     0x05c44080
0xF7EB8044:     0x00000000
0xF7EB8048:     0x00fb00fb
0xF7EB804C:     0x00420002
0xF7EB8050:     0x11fae000
0xF7EB8054:     0x00000000
0xF7EB8058:     0x00010009
0xF7EB805C:     0x00420007
0xF7EB8060:     0x014f070c
0xF7EB8064:     0x00000040
0xF7EB8068:     0x00000002
0xF7EB806C:     0x00000000
0xF7EB8070:     0x00000000
0xF7EB8074:     0x00000000
0xF7EB8078:     0x00000000
0xF7EB807C:     0x00000000
0xF7EB8080:     0x00140000
0xF7EB8084:     0x00000000
0xF7EB8088:     0x00010000
0xF7EB808C:     0x0004000f
0xF7EB8090:     0x4031009f
0xF7EB8094:     0x00000000
0xF7EB8098:     0x1420e000
0xF7EB809C:     0x00000000
0xF7EB80A0:     0x00040000
0xF7EB80A4:     0x00000000
0xF7EB80A8:     0x00000000
0xF7EB80AC:     0x00040000
0xF7EB80B0:     0x00000077
0xF7EB80B4:     0x00000000
0xF7EB80B8:     0x00000000
0xF7EB80BC:     0x00000000
0xF7EB80C0:     0x00040000
0xF7EB80C4:     0x00000000
0xF7EB80C8:     0x00000000
0xF7EB80CC:     0x00040000
0xF7EB80D0:     0x00000077
0xF7EB80D4:     0x00000000
0xF7EB80D8:     0x00000000
0xF7EB80DC:     0x00000000
0xF7EB80E0:     0x00040000
0xF7EB80E4:     0x00000000
0xF7EB80E8:     0x00000000
0xF7EB80EC:     0x00040000
0xF7EB80F0:     0x00000077
0xF7EB80F4:     0x00000000
0xF7EB80F8:     0x00000000
0xF7EB80FC:     0x00000000

Re: CORB (Probably a bit esoteric)

snickersmd 1225915513|%e %b %Y, %H:%M %Z|agohover

I was a bit skeptical when MadTux proposed to use the stac codec routine path instead of the realtek codec routines, but if this works, I have to wonder why… Does anyone know, historically, which codec chip was used in the first Intel Macs? Perhaps the routine path for the stac codec is similar to the original Azalia driver? If patching the HDA kext to use the stac codec brings us back to Azalia functionality, then all we would have to do for all future iterations would be to use this path plus the proposed VerbSyringe approach to get full audio on the ALC269 and future codecs.

Re: CORB (Probably a bit esoteric)

codeye 1225928702|%e %b %Y, %H:%M %Z|agohover

Thanks for adding your thoughts guys, it may take a bit longer to sort this out than we hoped!
I think using the alc262 routines was a great idea as the alsa patch suggests the alc262 and the analogue component
of alc269 are very similar. I also think we need to work out which subroutine is not firing (and why) as it seems virtually all the kexts I load up set the streams correctly (input at f7db8000+0x80, output f7db8000+0x100 & f7db8000+0x120) but despite setting the run bit in the stream (in software) it doesn't run - in Azalia if I set the run bit it runs the stream but without sound.
Toonces even without a loading kext the HDBAR gets setup as above the interesting bits occur at HDBAR+0x100-0x120.
Mutes may be important (at present I'm not sure of anything) but people have reported working HDA without mute working (I think), it would be nice to have a working sound hackintosh to compare maybe hagglebeef can let us know when the aspire works.
Snickersmd, I have looked at the decompiled azalia and hda controllers and they are VERY similar, I'm thinking my next approach will be to NOP or RET many of the extra routines in HDAController binary and see what happens (again it would be best to be able to do that on a working hackitosh with sound and see what you can remove safely) - I know noone has had to do this to get working sound, but there are a lot of failed attempts with just plugging in verbs and node settings.
If you can get more detailed decompilations please do [source code would be great ;-)]

Re: CORB (Probably a bit esoteric)

snickersmd 1225933983|%e %b %Y, %H:%M %Z|agohover

@codeye

More detailed decompilations? How about C pseudocode? Not just disassemblies but true decompilations?

I've decompiled every single kext and subkext from Azalia, AppleHDA older and newer.

Check your PMs for the download link. If any other sound dev wants the file, PM me. DEVS ONLY.

Re: CORB (Probably a bit esoteric)

joeblough 1226559077|%e %b %Y, %H:%M %Z|agohover

guys - a bit off topic, but do you know if reggie_se can be used to read/write I/O space registers? the graphical app "Reggie" can do this but it would be a heck of a lot easier to do what i'm doing from the command line… from the man page and help for reggie_se it seems like it just can't do it, but since Reggie can do it it seems a bit strange that they would leave this functionality out of reggie_se.