Shiki — protected video playback support on recent hardware

[vit9696]

Hi,

 

This is a pretty tough question to answer right away due to my busyness, but perhaps I could give you some details at least.

 

As far as I know HDCP support is determined by AppleAUUC (Apple Upstream User Client), which forwards it to a gpu kext. For nvidia the kexts implementing hdcp chain is NVDA***Hal.kext → NVDAresman**.kext depending on the model. In Resman you could find some configuration options that could configure hdcp (RmWotHdcpEnable, RmDisableHdcp22), but you will need to do some brief RE to see how they work.

 

In fact a quick way to try this would be to get to the first RmDisableHdcp22 xref, which would seem to be a constructor function for the hdcp protocol, and then make it return with a non-zero value thus effectively preventing hdcp from being initialised.

 

Best regards,

Vit

[rolandino]

Thanks for the quick answer...

 

Do you think it could be also related to IOGraphicsFamily.kext ?

 

I checked the source code and found something inside IOGraphicsTypesPrivate.h:

kUpstreamProtocolHDCPStatus = 'auph',

kUpstreamProtocolHDCPConfigStatus = 'aupp',

 

 

Can you make something out of this?

 

 

There is also a folder with some header files called i2c.

As far as I know I2C is the bus implementation on the hardware side, that's handling EDID and HDCP handshakes.

 

 

Cheers

Roland

[vit9696]

Well, IOGraphicsFamily defines the constants, and that's all of it probably. These constants are interface identifiers for apple upstream kext, which itself forwards stuff to gpu drivers, as I mentioned. You could find the corresponding interfaces in it:

AppleUpstreamUserClientDriver::HandleHDCPStatus(IOFramebuffer*, void*)
AppleUpstreamUserClientDriver::hdcpInterruptOccurred(OSObject*, IOInterruptEventSource*, int)

Which are pure virtual calls to the active framebuffer driver implementation (see ::start method).

I guess you could try replacing these methods by no-op with some non-zero error code, if you do not want to dig into the driver implementation.

As for i2c, I do not think it is any relevant here.

[rolandino]

If you unload or delete the AUUC kext, HDCP is initialized anyway.

So we have to dig into the GPU drivers, don't we?

 

Unfortunately I'm not coder enough to do this, but I think a friend of mine has the knowledge to help me with the C++ stuff.

 

Sorry for the silly question: what is the best way to get the source code of the Nvidia drivers?

 

[vit9696]

I do not think deleting any kext is a solution. I am also starting to lose the idea what you understand under HDCP initialisation.

 

As for nvidia source code, http://www.nvidia.com/object/careers.html is the only way I know about.

[rolandino]

With HDCP initialization I mean, that if you connect a HDCP compliant display device to your Mac, the encryption is enabled (initialised) by default.

If you connect a non-compliant display, the encryption should normally not be enabled.

But there is this issue under certain circumstances, where the encryption is enabled though the display sink device "tells" the graphic card that it is non-HDCP.

 

And all this is happening even if AUUC kext is not loaded, so yes deleting this kext is not the solution.

Maybe I'm wrong but if HDCP is enabled regardless if AUUC is loaded or not, we have to search somewhere else?

 

 

[vit9696]

Got it. Yes, it is unlikely to have anything to do with AUUC, since this kext is for upstream APIs, i.e. allow other software use HDCP, and what you need is device init, which happens right inside the drivers.

It is a bit surprising the system works at all after deleting AUUC, however.

[pinarek]

vit9696.. thank you for you work... this works great with AppleALC 1.1.1 (incl. Lilu-kext) and last shiki-kext 2.0 and IntelGraphicsFixup.kext

in my as Macmini7,1 (see my Signature PC-1) in MacOS 10.12.3 Final.

 

I will testing next time with macOS 10.12.4. Beta 8

[sprxx]

Hi Vit9696,

 

Thanks for your work. I am trying to get my Apple Music music video to work. So I downloaded your kext and put them in L/E ( I know in Q&A you said it is not recommended, but many make it works this way). However, after fixing permission and running those lines in terminal and restart. It was not working. I am using a skylake CPU and RX480, running on 10.12.4. Is there something I might did wrong? Is the kext still compatible for 10.12.4? 

 

Thank you!

[Slice]

Hi Vit9696,

 

Thanks for your work. I am trying to get my Apple Music music video to work. So I downloaded your kext and put them in L/E ( I know in Q&A you said it is not recommended, but many make it works this way). However, after fixing permission and running those lines in terminal and restart. It was not working. I am using a skylake CPU and RX480, running on 10.12.4. Is there something I might did wrong? Is the kext still compatible for 10.12.4? 

 

Thank you!

Yes, the kext is compatible with 10.12.4

[vit9696]

Hi Vit9696,

 

Thanks for your work. I am trying to get my Apple Music music video to work. So I downloaded your kext and put them in L/E ( I know in Q&A you said it is not recommended, but many make it works this way). However, after fixing permission and running those lines in terminal and restart. It was not working. I am using a skylake CPU and RX480, running on 10.12.4. Is there something I might did wrong? Is the kext still compatible for 10.12.4? 

 

Thank you!

It might be the case that Apple Music video uses a higher level DRM than general iTunes movies. Might you know whether Apple Music works on MacPro5,1 or older Mac hardware? Do trailers work fine?

Also note that streaming unlike fully downloaded videos is usually not working.

 

I might have an idea, but it would require some testing.

[vit9696]

Alright, I played a number of DRM-protected Apple Music videos and all of them play just fine. During download progress and after it is done.

 

Most likely you do not have HDCP functioning or have issues in VDA setup.

 

If you doubt it, consider writing a step-by-step guide on how to reproduce the issue with a link to the video that does not work for you. Better that would be while my Apple Music trial still works, because it is disgusting to continue using.

[sprxx]

Alright, I played a number of DRM-protected Apple Music videos and all of them play just fine. During download progress and after it is done.

 

Most likely you do not have HDCP functioning or have issues in VDA setup.

 

If you doubt it, consider writing a step-by-step guide on how to reproduce the issue with a link to the video that does not work for you. Better that would be while my Apple Music trial still works, because it is disgusting to continue using.

 

Firstly I want to thank you for replying me. It might be me who did something wrong during the process or I think it maybe RX480 related. This is how I did it step by step:

1. I downloaded your kext from "https://github.com/vit9696/Shiki/releases",and I download the 2.0.0.RELEASE.zip

2. I moved shiki.kext to /Library/Extension.

3. I run kext utility to fix permission and clear caches.

4. I go to terminal I run the code, and the result is this

defaults write com.apple.AppleGVA forceATI -boolean yes

 

defaults delete com.apple.coremedia

2017-03-30 11:25:40.606 defaults[14917:57532] 

Domain (com.apple.coremedia) not found.

Defaults have not been changed.

 

defaults delete com.apple.AppleGVA

sudo rm -rf /Users/Shared/SC\ Info

Password:

 

sudo defaults delete com.apple.coremedia

2017-03-30 11:25:54.248 defaults[14922:58381] 

Domain (com.apple.coremedia) not found.

Defaults have not been changed.

 

sudo defaults delete com.apple.AppleGVA

2017-03-30 11:25:58.969 defaults[14924:58644] 

Domain (com.apple.AppleGVA) not found.

Defaults have not been changed.

 

5. Restart.

 

The video I am trying to play is just a random music video in Apple Music. I just tried a movie trailer, and it works. I will also attached my config.plist(I don't know how to do this in insanelymac, please let me know if you need this). Maybe this is also worth mentioning, I am using the Apple Music in China. Maybe country can cause this issue?

Alright, I played a number of DRM-protected Apple Music videos and all of them play just fine. During download progress and after it is done.

 

Most likely you do not have HDCP functioning or have issues in VDA setup.

 

If you doubt it, consider writing a step-by-step guide on how to reproduce the issue with a link to the video that does not work for you. Better that would be while my Apple Music trial still works, because it is disgusting to continue using.

Do you know how to check if my HDCP function or VDA setup? I am happy to provide more information if you need it. Again, I really appreciate your work

[vit9696]

Please read the FAQ, there is VDADecoderChecker utility. For 10.12.x you need to recompile it.

[sprxx]

Please read the FAQ, there is VDADecoderChecker utility. For 10.12.x you need to recompile it.

I ran it in Xcode and got following result. I don't think I can enable iGPU for RX480, right?

 

2017-03-30 12:16:14.991433-0400 VDADecoderChecker[821:47435] GVA error: Failed to find IGPU IOService plane.

Hardware acceleration is fully supported

 

Program ended with exit code: 0

[vit9696]

First means your system is configured improperly.

[vandroiy2012]

To the owners of Intel HD530, who uses it as the only and basic card.

 

With the release of macOS 10.12.4 we were overtaken by the fate of the HD4400/4600 owners. They had a complete system crash when entering with Safari on rbc.ru or when trying to play a trailer in iTunes or imdb.com. With help of @vit9696 and @lvs1974 this problem was solved in Lilu plugin called IntelGraphicsFixup.kext. Until the release of 10.12.4 on HD530 nothing similar was observed and on March 27th this bug caught up with us . Now when you go through Safari to the above sites and iTunes trailers shows random fading of the interface the video is jerking. The situation is very similar to the one that was with the HD4400/4600 but not so critical. A complete crash of the system does not happen but spoils the life of perfectionists fairly

 

The patch for dealing with this problem was easier than in the case of the HD4400/4600. And it was not necessary to allocate it in a separate plugin for Lilu ... It is enough in config.plist in the KextsToPatch section to write the following:

 

It turned out not so simple. With this patch after waking from sleep WebKit were completely freezing. Now you should use latest IntelGraphicsFixup.kext to deal with PAVP/HDCP issue on Skylake HD Graphics https://sourceforge.net/projects/intelgraphicsfixup/files/  This version of IntelGraphicsFixup.kext also pinned in the bottom of this post. Credits for this changes to YungRanj

 

Before using new IntelGraphicsFixup.kext DELETE this old patch from your config.plist!!!

 

The next problem concerns the missing video hardware acceleration on the HD530 if a macmodel is used in which a discrete card is provided.

When playing HD content, CPU cores were loaded, and the IGPU was not involved in decoding. The result of playing 4K video WITHOUT hardware acceleration can be seen on the following screenshot:

As you can see, the situation is bleak.

Part of this problem could be solved by fixing the forceOfflineRenderer-> false parameter in System / Library / PrivateFrameworks / AppleGVA.framework / Resources / info.plist for your board-id, but changing the plist is fraught with signature verification failure when initializing DRM. In some cases, this will break the playback of purchased movies.

Intel online = intel with connectors

Intel offline = Intel without connectors

Therefore, it was decided to make edits through Shiki.kext. And ONLY for those who use the built-in graphics. For such cases a boot argument is needed:

-shikigva

If the key is present, the OfflineRenderer is forcibly turned off and hardware acceleration starts working. In this case the digital signature of AppleGVA.framework is not violated.
Screenshot of 4K video with hardware acceleration (-shikigva) on HD530

 

Test video - http://4ksamples.com/4k-chimei-inn-60mbps/

The output of VDADecoderChecker. The checker itself build for the Sierra  - VDADecoderCheckerSierra.zip

 

Hardware acceleration also works fine in VLC (if you select it forcibly in the settings)

 

In order to make it all work you need to put the most recent versions of Lilu.kext 1.1.0 and Shiki.kext 2.0.1. 

 

In connection with the significant differences in the Lilu 1.1.0 code the previous release plugins (AppleALC.kext, Shiki.kext, IntelGraphicsFixup.kext, NvidiaGraphicsFixup.kext, HibernationFixup.kext) will not work with this version of Lilu!!!

 

Lilu.kext version 1.1.0 and compatible with it plugins Shiki.kext 2.0.1 and AppleALC.kext 1.1.1 build from the most recent source code i will attach here. 

 

Lilu_1.1.0.zip

Shiki_2.0.1.zip

AppleALC_1.1.1.zip

 

Concerning the compatibility of IntelGraphicsFixup.kext, NvidiaGraphicsFixup.kext and HibernationFixup.kext with the new version of Lilu, you should contact @lvs1974 on http://applelife.ru.

Here is updated compatible with Lilu 1.1.0 plugins by @lvs1974

 

IntelGraphicsFixup_1.1.1.kext.zip

NvidiaGraphicsFixup.kext.zip

HibernationFixup.kext.zip

 

It should be noted that all the above kexts are preliminary versions at testing and finalization stage.

Without the urgent need don't use them.

 

All thanks to @vit9696 for time spent and code writing!!!

[ganxiao]

Hi vit9696,

 

My Hackintosh played drm video well using shiki.kext before upgrade to 10.12.4.

I have a GTX960 discrete graphic card using nvidia web driver and on-board hd4600 graphic card configured to connector-less AAPL,ig-platform-id prop,

use imac.kext to obtain hardware accelerated video decode.

 

After upgrade to 10.12.4 and the latest web driver, sierra can't recognize gtx960.

I finally found remove shiki.kext and imac.kext could re-enable web driver to drive gtx960.

1. Use imac.kext only, web driver not load

2. Use latest shiki v2.0.1 and Lily v1.1.0, web driver not load

3. Use latest shiki v2.0.1 and Lily v1.1.0 and -shikigva boot argument, web driver not load

 

Please check if shiki broke web driver on 10.12.4.

Thanks

Ganxiao

[vit9696]

Cannot really help you, I am afraid. Shiki itself does not do anything to prevent nvidia drivers from loading, so #2 and #3 make no sense to me.

You should seek for help in gpu driver forums.

[ganxiao]

Thanks for your reply.

I finally found using 0x11 CsrActiveConfig to make shiki and webdriver work again.

It seems webdriver checked its own digital signature since 10.12.4, 

I can use 0x10  CsrActiveConfig in 10.12.3 and older version with clover kext injection for shiki.

[darthsian]

Hi all. Anyone successfully used the solution below (from Shiki FAQ) on Skylake/Kabylake?

Im using it with z97+NVIDIA GTX9xx with no problems, but on z170+NVIDIA GTX9xx VDADecoderChecker show this:
GVA info: Successfully connected to the Intel plugin, offline Gen9

AVDCreateGPUAccelerator: Error loading GPU renderer

VDADecoderCreate failed. err: -12473

An error was returned by the decoder layer. This may happen for example because of bitstream/data errors during a decode operation. This error may also be returned from VDADecoderCreate when hardware decoder resources are available on the system but currently in use by another process.

VDADecoderCreate failed. err: -12473

 

For Intel HD 530 im using ig-platform-id <01 00 12 19>. SMBIOS iMac17,1.

 

 

Shiki-based solution for non-freezing Intel and/or any discrete GPU:

- IGPU device is enabled, and present with a connector-less AAPL,ig-platform-id prop (e.g. <04 00 12 04>, <07 00 62 01>), use connector-full framebuffers in solo mode;

- Discrete GPU is properly configured with IOVARendererID present in IOReg;

- VDADecoderChecker confirms Intel Offline (Online) VDA decoder working;

- IMEI device is present in IOReg;

- No override preferences are used;

- Mac model set to the one supporting hardware acceleration.

[vandroiy2012]

 

Hi all. Anyone successfully used the solution below (from Shiki FAQ) on Skylake/Kabylake?

Im using it with z97+NVIDIA GTX9xx with no problems, but on z170+NVIDIA GTX9xx VDADecoderChecker show this:

GVA info: Successfully connected to the Intel plugin, offline Gen9

AVDCreateGPUAccelerator: Error loading GPU renderer

VDADecoderCreate failed. err: -12473

An error was returned by the decoder layer. This may happen for example because of bitstream/data errors during a decode operation. This error may also be returned from VDADecoderCreate when hardware decoder resources are available on the system but currently in use by another process.

VDADecoderCreate failed. err: -12473

 

For Intel HD 530 im using ig-platform-id <01 00 12 19>. SMBIOS iMac17,1.

 

 

Shiki-based solution for non-freezing Intel and/or any discrete GPU:

- IGPU device is enabled, and present with a connector-less AAPL,ig-platform-id prop (e.g. <04 00 12 04>, <07 00 62 01>), use connector-full framebuffers in solo mode;

- Discrete GPU is properly configured with IOVARendererID present in IOReg;

- VDADecoderChecker confirms Intel Offline (Online) VDA decoder working;

- IMEI device is present in IOReg;

- No override preferences are used;

- Mac model set to the one supporting hardware acceleration.

 

 

 

From FAQ. 

• How can I inject IOVARendererID/IOVARendererSubID in certain NVIDIA GPUs?

  NVIDIA drivers do not properly add these values necessary for VDA decoding for Maxwell GPUs in their Web drivers. You could add them with a plist-only kext. The correct values for VP4 GPUs are:

  IOVARendererID → <08 00 04 01>

  IOVARendererSubID → <03 00 00 00>

  VP3 ones want a different IOVARendererID → <04 00 04 01>.

  Thanks to igork for noticing it.

 

Use injector from this post http://www.insanelymac.com/forum/topic/312278-shiki-—-userspace-patcher/?p=2245975

[darthsian]

From FAQ. 

 

Use injector from this post http://www.insanelymac.com/forum/topic/312278-shiki-—-userspace-patcher/?p=2245975

Thanks for response, but I already using it.

[xelanaiznac]

the issue, for me, are the values of IOVARendererID and IOVARendererSubID.

on shiki faq, it's written that suggested values refer to vp4 gpus.
here there is the list for Nvidia gpus https://en.wikipedia.org/wiki/Nvidia_PureVideo
your gtx 970 is vp6 and you are using iovarenderid for vp4

 

​ps. can someone please provide us iovarendid values and iovarendersubid for pascal gpus vp8?

[vandroiy2012]

ok. so because with this kext don't have the best experience I tried another trick, to inject device properties to clover. just like EFI strings in old days)

 

Sorry.  Device properties for what device? And how this EFI string helps you to play DRM content?