Contribute
Register

HP Elitebook Folio 1020 and DW1820a

Status
Not open for further replies.
thanks.
Does anyone done research on AirPort_Brcm4360::apple80211Request/wl_get_cca/getLINK_CHANGED_EVENT_DATA in our field? I was first see this today....Try google/wikipedia what is CCA...
 
RehabMan said:
It is possible to copy them, but they probably won't work.
Click to expand...
Workaround, copy 14F27 IO80211Family to 15G31, works....this post is using this method....

Nice software compatibility....:D
 
Dw1820a has some problem with el capitan, mostly on laptop (it works fine on nuc), one problem is that it calls kernel panic when boot in to os x. Steps to repeat panic:
0. power off laptop
1. remove AC adapter
2. make sure wi-fi status light off (I think this is important, because nuc-like do not have a wi-fi status light, therefore, no wi-fi switch)
3. plug AC adapter
4. power on and boot into os x, it will get a kernel panic. And this panic is reproducible

Append `keepsyms=1' to clover Boot Args, this makes kernel won't discard symbols are stored in the kernel and kext, and boot into os x. Here I use 10.11.5. Kernel panic log will store in console.app (full log attached):
Code: 
*** Panic Report ***
panic(cpu 2 caller 0xffffff80003ce6fa): Kernel trap at 0xffffff80003c5180, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x00000000000000ee, CR3: 0x0000000003e7f000, CR4: 0x00000000003627e0
RAX: 0xffffff8011f98e01, RBX: 0xffffff910ba23858, RCX: 0x0000000000000002, RDX: 0x0000000000000006
RSP: 0xffffff910ba235f0, RBP: 0xffffff910ba235f0, RSI: 0xffffff910ba2385c, RDI: 0x00000000000000ee
R8:  0x0000000000000001, R9:  0xffffff80143c7500, R10: 0x0000000000000000, R11: 0xffffff7f81be8dea
R12: 0xffffff8012053800, R13: 0xffffff910ba23858, R14: 0xffffff910ba2385c, R15: 0x0000000000000001
RFL: 0x0000000000010206, RIP: 0xffffff80003c5180, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0x00000000000000ee, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0

Backtrace (CPU 2), Frame : Return Address
0xffffff910ba23280 : 0xffffff80002dab52 mach_kernel : _panic + 0xe2
0xffffff910ba23300 : 0xffffff80003ce6fa mach_kernel : _kernel_trap + 0x91a
0xffffff910ba234e0 : 0xffffff80003ec563 mach_kernel : _return_from_trap + 0xe3
0xffffff910ba23500 : 0xffffff80003c5180 mach_kernel : _memcmp + 0x10
Loot at
Code: 
...Kernel trap at 0xffffff80003c5180, type 14=page fault, registers:
...
...RIP: 0xffffff80003c5180...
Fault CR2: 0x00000000000000ee, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0
...
0xffffff910ba23500 : 0xffffff80003c5180 mach_kernel : _memcmp + 0x10
Error code: 0x0 means indicating a read from a non-present page. The address of RIP is `0xffffff80003c5180', which indicate `_memcmp' in mach_kernel calls this panic.
Using
Code: 
$ otool -tV /System/Library/Kernels/kernel
can disassembly the mach_kernel. And we well see ONLY one function call `_memcmp', it is `__dtrace_ioctl'.

@RehabMan any ideas? Thanks.

PS: apple doc:
https://developer.apple.com/library.../IA32.html#//apple_ref/doc/uid/TP40002492-SW4
 

Attachments

  • Kernel_2017-05-08-215923_testdeMacBook-Air.panic.txt
    10.5 KB · Views: 102
  • RehabMan.zip
    1.9 MB · Views: 101
livacore said:
Dw1820a has some problem with el capitan, mostly on laptop (it works fine on nuc), one problem is that it calls kernel panic when boot in to os x. Steps to repeat panic:
0. power off laptop
1. remove AC adapter
2. make sure wi-fi status light off (I think this is important, because nuc-like do not have a wi-fi status light, therefore, no wi-fi switch)
3. plug AC adapter
4. power on and boot into os x, it will get a kernel panic. And this panic is reproducible

Append `keepsyms=1' to clover Boot Args, this makes kernel won't discard symbols are stored in the kernel and kext, and boot into os x. Here I use 10.11.5. Kernel panic log will store in console.app (full log attached):
Code: 
*** Panic Report ***
panic(cpu 2 caller 0xffffff80003ce6fa): Kernel trap at 0xffffff80003c5180, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x00000000000000ee, CR3: 0x0000000003e7f000, CR4: 0x00000000003627e0
RAX: 0xffffff8011f98e01, RBX: 0xffffff910ba23858, RCX: 0x0000000000000002, RDX: 0x0000000000000006
RSP: 0xffffff910ba235f0, RBP: 0xffffff910ba235f0, RSI: 0xffffff910ba2385c, RDI: 0x00000000000000ee
R8:  0x0000000000000001, R9:  0xffffff80143c7500, R10: 0x0000000000000000, R11: 0xffffff7f81be8dea
R12: 0xffffff8012053800, R13: 0xffffff910ba23858, R14: 0xffffff910ba2385c, R15: 0x0000000000000001
RFL: 0x0000000000010206, RIP: 0xffffff80003c5180, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0x00000000000000ee, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0

Backtrace (CPU 2), Frame : Return Address
0xffffff910ba23280 : 0xffffff80002dab52 mach_kernel : _panic + 0xe2
0xffffff910ba23300 : 0xffffff80003ce6fa mach_kernel : _kernel_trap + 0x91a
0xffffff910ba234e0 : 0xffffff80003ec563 mach_kernel : _return_from_trap + 0xe3
0xffffff910ba23500 : 0xffffff80003c5180 mach_kernel : _memcmp + 0x10
Loot at
Code: 
...Kernel trap at 0xffffff80003c5180, type 14=page fault, registers:
...
...RIP: 0xffffff80003c5180...
Fault CR2: 0x00000000000000ee, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0
...
0xffffff910ba23500 : 0xffffff80003c5180 mach_kernel : _memcmp + 0x10
Error code: 0x0 means indicating a read from a non-present page. The address of RIP is `0xffffff80003c5180', which indicate `_memcmp' in mach_kernel calls this panic.
Using
Code: 
$ otool -tV /System/Library/Kernels/kernel
can disassembly the mach_kernel. And we well see ONLY one function call `_memcmp', it is `__dtrace_ioctl'.

@RehabMan any ideas? Thanks.

PS: apple doc:
https://developer.apple.com/library.../IA32.html#//apple_ref/doc/uid/TP40002492-SW4
Click to expand...

That panic doesn't give you a lot to go from...

Have you tried removing the ACPI identity (and all related code) attached to the WNIC?
 
RehabMan said:
That panic doesn't give you a lot to go from...
Click to expand...
@RehabMan, Sorry, previous analysis of kerner panic are WRONG! So, I rePost it here, and will delete the old one after several days.

Dw1820a has some problem with el capitan, mostly on laptop (it works fine on nuc), one problem is that it calls kernel panic when boot in to os x. Steps to repeat panic:
0. power off laptop
1. remove AC adapter
2. make sure wi-fi status light off (I think this is important, because nuc-like do not have a wi-fi status light, therefore, no wi-fi switch)
3. plug AC adapter
4. power on and boot into os x, it will get a kernel panic. And this panic is reproducible

Append `keepsyms=1' to clover Boot Args, this makes kernel won't discard symbols are stored in the kernel and kext, and boot into os x. Here I use 10.11.6(15G31). Kernel panic log will store in console.app (full log attached):
Code: 
*** Panic Report ***
panic(cpu 2 caller 0xffffff80003ce6fa): Kernel trap at 0xffffff80003c5180, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x00000000000000ee, CR3: 0x0000000003e7f000, CR4: 0x00000000003627e0
RAX: 0xffffff8011f98e01, RBX: 0xffffff910ba23858, RCX: 0x0000000000000002, RDX: 0x0000000000000006
RSP: 0xffffff910ba235f0, RBP: 0xffffff910ba235f0, RSI: 0xffffff910ba2385c, RDI: 0x00000000000000ee
R8:  0x0000000000000001, R9:  0xffffff80143c7500, R10: 0x0000000000000000, R11: 0xffffff7f81be8dea
R12: 0xffffff8012053800, R13: 0xffffff910ba23858, R14: 0xffffff910ba2385c, R15: 0x0000000000000001
RFL: 0x0000000000010206, RIP: 0xffffff80003c5180, CS:  0x0000000000000008, SS:  0x0000000000000000
Fault CR2: 0x00000000000000ee, Error code: 0x0000000000000000, Fault CPU: 0x2, PL: 0

Backtrace (CPU 2), Frame : Return Address
0xffffff910ba23280 : 0xffffff80002dab52 mach_kernel : _panic + 0xe2
0xffffff910ba23300 : 0xffffff80003ce6fa mach_kernel : _kernel_trap + 0x91a
0xffffff910ba234e0 : 0xffffff80003ec563 mach_kernel : _return_from_trap + 0xe3
0xffffff910ba23500 : 0xffffff80003c5180 mach_kernel : _memcmp + 0x10
0xffffff910ba235f0 : 0xffffff7f81e6c0a9 com.apple.driver.AirPort.Brcm4360 : _awdl_doiovar + 0x2332
0xffffff910ba23780 : 0xffffff7f81c9b123 com.apple.driver.AirPort.Brcm4360 : _wlc_iovar_op + 0x3a1
0xffffff910ba23830 : 0xffffff7f81bdc0ba com.apple.driver.AirPort.Brcm4360 : __ZN16AirPort_Brcm436018setAWDL_SYNC_STATEEP8OSObjectP26apple80211_awdl_sync_state + 0x112
0xffffff910ba23890 : 0xffffff7f81be9bf1 com.apple.driver.AirPort.Brcm4360 : __ZN16AirPort_Brcm436024apple80211VirtualRequestEjiP23IO80211VirtualInterfacePv + 0xe07
0xffffff910ba238e0 : 0xffffff7f80ebdae4 com.apple.iokit.IONetworkingFamily : __ZN19IONetworkController20executeCommandActionEP8OSObjectPvS2_S2_S2_ + 0x38
0xffffff910ba23910 : 0xffffff80008b6148 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0x1a8
0xffffff910ba23980 : 0xffffff7f80ebdb4b com.apple.iokit.IONetworkingFamily : __ZN19IONetworkController14executeCommandEP8OSObjectPFiPvS2_S2_S2_S2_ES2_S2_S2_S2_S2_ + 0x4f
0xffffff910ba239d0 : 0xffffff7f81b0acb1 com.apple.iokit.IO80211Family : __ZN18IO80211PeerManager14ioctl_internalEP18ioctl_internal_req + 0x69
0xffffff910ba239f0 : 0xffffff7f81adb1f9 com.apple.iokit.IO80211Family : __ZN22IO80211AWDLPeerManager9configureEv + 0xa35
0xffffff910ba23b40 : 0xffffff7f81ae287d com.apple.iokit.IO80211Family : __ZN22IO80211AWDLPeerManager20reportDataPathEventsEjPvm + 0xa4b
0xffffff910ba23c50 : 0xffffff7f81b31940 com.apple.iokit.IO80211Family : __ZN23IO80211VirtualInterface25reportDataPathEventsGatedEPvS0_S0_S0_S0_ + 0x42
0xffffff910ba23c80 : 0xffffff7f80ebdae4 com.apple.iokit.IONetworkingFamily : __ZN19IONetworkController20executeCommandActionEP8OSObjectPvS2_S2_S2_ + 0x38
0xffffff910ba23cb0 : 0xffffff80008b6148 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0x1a8
0xffffff910ba23d20 : 0xffffff7f80ebdb4b com.apple.iokit.IONetworkingFamily : __ZN19IONetworkController14executeCommandEP8OSObjectPFiPvS2_S2_S2_S2_ES2_S2_S2_S2_S2_ + 0x4f
0xffffff910ba23d70 : 0xffffff7f81b32d40 com.apple.iokit.IO80211Family : __ZN23IO80211VirtualInterface11postMessageEjPvm + 0x52
0xffffff910ba23da0 : 0xffffff7f81bc7e40 com.apple.driver.AirPort.Brcm4360 : __ZN16AirPort_Brcm436021powerCycleOffOnThreadEPvS0_S0_S0_ + 0x6e2
0xffffff910ba23e40 : 0xffffff7f81bc774c com.apple.driver.AirPort.Brcm4360 : __ZN16AirPort_Brcm436026powerCycleOffOnThreadGatedEP8OSObjectPvS2_S2_S2_ + 0x16
0xffffff910ba23e60 : 0xffffff80008b6148 mach_kernel : __ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ + 0x1a8
0xffffff910ba23ed0 : 0xffffff7f81bc3189 com.apple.driver.AirPort.Brcm4360 : __ZL22_powerCycleOffOnThreadPvS_ + 0x49
0xffffff910ba23f00 : 0xffffff800030f2da mach_kernel : _thread_call_isactive + 0x148a
0xffffff910ba23fb0 : 0xffffff80003c9117 mach_kernel : _call_continuation + 0x17
Error code: 0x0 means indicating a read from a non-present page. The address of RIP is `0xffffff80003c5180', which indicate `_memcmp' in mach_kernel calls this panic.

Loot at the full Backtrace, from the last line begin to read, it reflect the chain of function calls (each call in the format [KEXT] [Function] [Offset]):
Code: 
__ZL22_powerCycleOffOnThreadPvS_ ->
__ZN13IOCommandGate9runActionEPFiP8OSObjectPvS2_S2_S2_ES2_S2_S2_S2_ ->
__ZN16AirPort_Brcm436026powerCycleOffOnThreadGatedEP8OSObjectPvS2_S2_S2_ ->
...
__ZN16AirPort_Brcm436024apple80211VirtualRequestEjiP23IO80211VirtualInterfacePv ->
__ZN16AirPort_Brcm436018setAWDL_SYNC_STATEEP8OSObjectP26apple80211_awdl_sync_state ->
_wlc_iovar_op ->
_awdl_doiovar ->
_memcmp
memcmp(const void *s1, const void *s2, size_t n) simple compare two strings. If it panic, from my experience, it is cause of 'NULL Point' in _awdl_doiovar, which is called by _wlc_iovar_op. So the problem maybe AWDL related?!!!!!!!
Using
Code: 
$ otool -tV /S/L/E/IO80211Family.kext/Contents/PlugIns/AirPortBrcm4360.kext/Contents/MacOS/AirPortBrcm4360
can disassembly the AirPortBrcm4360. And we well see all source code of involved functions.

@RehabMan any ideas? Thanks.

PS: apple doc:
https://developer.apple.com/library.../IA32.html#//apple_ref/doc/uid/TP40002492-SW4

RehabMan said:
Have you tried removing the ACPI identity (and all related code) attached to the WNIC?
Click to expand...
Already try that, but I meet some problem, I will discuss it later in another thread. Before that, I post ACPI files of another device - ECS Liva Core - which is not a laptop. But DW1820a works with no problem in that device.
Could you look the ACPI file about RP04 (wireless device) of two device, and see which part code are incompatibile with OSX,
that cause hp 1020 panic, but ecs liva core are works fine.
Thanks.

----
If I remove all RP04, new panics.
Code: 
Device(RP04)
{
}
I guess ACPI must missing some code we have to patch, or have some extra code we must remove....
 

Attachments

  • Kernel_2017-05-08-215923_testdeMacBook-Air.panic.txt
    10.5 KB · Views: 82
  • RehabMan.zip
    1.9 MB · Views: 108
  • ecs_liva_core.zip
    40.3 KB · Views: 83
Last edited:
Remove only the code related to the leaf node (usually PXSX), not the code related to RP04.
 
RehabMan said:
Remove only the code related to the leaf node (usually PXSX), not the code related to RP04.
Click to expand...
Remove Device(WNIC), still panic.
 

Attachments

  • ecs_liva_core.zip
    40.3 KB · Views: 92
  • Kernel_2017-05-08-215923_testdeMacBook-Air.panic.txt
    10.5 KB · Views: 113
  • RehabMan.zip
    1.9 MB · Views: 79
livacore said:
Remove Device(WNIC), still panic.
Click to expand...

It is not possible to tell what you're doing from the files you provided...

Remove IO80211Family.kext (temporarily).
Go back to native ACPI (no patches).
Boot and collect ioreg. Attach.

Also, attach native ACPI and patched ACPI (+ config.plist).
 
RehabMan said:
It is not possible to tell what you're doing from the files you provided...

Remove IO80211Family.kext (temporarily).
Go back to native ACPI (no patches).
Boot and collect ioreg. Attach.

Also, attach native ACPI and patched ACPI (+ config.plist).
Click to expand...
Go back to native ACPI (no patches).
---
Does this means remove ACPI/patched/*.aml, but leave patchs in config.plist and clover default patches exist?
 

Attachments

  • RehabMan.zip
    3 MB · Views: 61
livacore said:
Go back to native ACPI (no patches).
---
Does this means remove ACPI/patched/*.aml, but leave patchs in config.plist and clover default patches exist?
Click to expand...

You can use a USB (prepared according to my guide) to boot with "native enough" ACPI.
 
Status
Not open for further replies.
Copyright © 2010 - 2024 tonymacx86 LLC
Back
Top