Jump to content
559 posts in this topic

Recommended Posts

Posted (edited)

Do so for signed @jalavoui is this correct or is little bit too much?

# 1. Rename bundle ID
sudo sed -i '' 's|com\.apple\.driver\.AppleIntelTGLGraphicsFramebuffer|com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer|g' ~/Downloads/sle_Internal/sle/AppleIntelTGLGraphicsFramebuffer.kext/Contents/Info.plist

# 2. Remove OSBundleRequired
sudo /usr/libexec/PlistBuddy -c "Delete :OSBundleRequired" ~/Downloads/sle_Internal/sle/AppleIntelTGLGraphicsFramebuffer.kext/Contents/Info.plist

# 3. Remove kpi.private
sudo /usr/libexec/PlistBuddy -c "Delete :OSBundleLibraries:com.apple.kpi.private" ~/Downloads/sle_Internal/sle/AppleIntelTGLGraphicsFramebuffer.kext/Contents/Info.plist

# 4. Remove _CodeSignature
sudo rm -rf ~/Downloads/sle_Internal/sle/AppleIntelTGLGraphicsFramebuffer.kext/Contents/_CodeSignature

# 5. Add HookCase dep — THIS is what triggers the macOS permission prompt
sudo /usr/libexec/PlistBuddy -c "Add :OSBundleLibraries:org.smichaud.HookCase string 1.0" ~/Downloads/sle_Internal/sle/AppleIntelTGLGraphicsFramebuffer.kext/Contents/Info.plist

stripped down but finally system has asked me permissions.. !

 

For GFX

rm -rf AppleIntelTGLGraphics.kext/Contents/_CodeSignature

sudo /usr/libexec/PlistBuddy -c "Add :OSBundleLibraries:org.smichaud.HookCase string 1.0" AppleIntelTGLGraphics.kext/Contents/Info.plist

sudo sed -i '' 's|com\.apple\.driver\.AppleIntelTGLGraphics|com.xxxxx.driver.AppleIntelTGLGraphics|g' ~/Downloads/sle_Internal/sle/AppleIntelTGLGraphics.kext/Contents/Info.plist

 

Edited by Stezza88
Posted (edited)

And cpu big hanging on boot... finally it is "working" 😁

 

Now i need to clean some junk... wait for updates... need a lot of work now...

Edited by Stezza88
  • Like 2

Have double triple-boot.. on amd one with nootedred i do changes to ngreen so with the other i test it fast. I'm downloading xcode and visual studio code in the amd one.

 

War is starting just right now.. 🥸🥸🥸

1000027853 (1).jpg

  • Like 1
  • Haha 1
5 minutes ago, Stezza88 said:

Have double triple-boot.. on amd one with nootedred i do changes to ngreen so with the other i test it fast. I'm downloading xcode and visual studio code in the amd one.

 

War is starting just right now.. 🥸🥸🥸

1000027853 (1).jpg

 

I live in a bunker like Bin-Laden lol

Posted (edited)

OBSERVATION BEFORE EVERY TEST

 

After restart and have allowed system perms on kexts got :

% kextstat | grep -i TGL                  

Executing: /usr/bin/kmutil showloaded

No variant specified, falling back to release

  133    0 0xffffff7f964b5000 0xc7ff9    0xc7ff9    com.apple.driver.AppleIntelTGLGraphics (16.0.0) BA3AA1C0-FE6B-33B3-9D85-73F848394E3D <132 125 104 18 9 8 7 6 3 1>

% kmutil showloaded 2>/dev/null | grep -iE "NootedGreen|Lilu|TGL|ICL"

   57   13 0xffffff8003ce0000 0x8d000    0x8d000    as.vit9696.Lilu (1.7.2) EFF2113F-DA4B-32EA-833C-3C922F3FEDE9 <9 7 6 3 2 1>

  133    0 0xffffff7f964b5000 0xc7ff9    0xc7ff9    com.apple.driver.AppleIntelTGLGraphics (16.0.0) BA3AA1C0-FE6B-33B3-9D85-73F848394E3D <132 125 104 18 9 8 7 6 3 1>

 

 

But with the stripped down signed now got : kextload working

% sudo kextload -v /Library/Extensions/AppleIntelTGLGraphicsFramebuffer.kext

Password:

Executing: /usr/bin/kmutil load -p /Library/Extensions/AppleIntelTGLGraphicsFramebuffer.kext

% kmutil showloaded 2>/dev/null | grep -iE "NootedGreen|Lilu|TGL|ICL"

   57   13 0xffffff8003ce0000 0x8d000    0x8d000    as.vit9696.Lilu (1.7.2) EFF2113F-DA4B-32EA-833C-3C922F3FEDE9 <9 7 6 3 2 1>

  133    0 0xffffff7f964b5000 0xc7ff9    0xc7ff9    com.apple.driver.AppleIntelTGLGraphics (16.0.0) BA3AA1C0-FE6B-33B3-9D85-73F848394E3D <132 125 104 18 9 8 7 6 3 1>

  169    0 0xffffff7f96601000 0xc8000    0xc8000    com.xxxxx.driver.AppleIntelTGLGraphicsFramebuffer (16.0.0) B6078743-F795-3202-A55E-EA690FA40949 <147 132 130 125 49 18 17 9 7 6 3 1>

 

IS IT ALWAYS NEEDED THIS PASSAGE BEFORE EVERY TEST in your opinion? @jalavoui

Edited by Stezza88

think i fixed github acess at least hope so. 

i see no reason to mess with the signatures.

framebuffer kext dbg version is not signed. production version is signed

graphics kext is signed unless hacked for l/e

 

try the kexts i'm using

 

when u guys have time try feed ai with big sur image where all this junk came from

we need to solve those missing symbols and get rid of hookcase

 

if tgl kexts fail i keep in mind patching icl kexts

 

u have a big issue to solve in ngreen for your card

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj", releaseDoorbell},

this is need to setup the display and is the reason in the past the framebuffer fail to load

 

disabling with no patches allows to load but not to work e.g. this is a bad hack

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj.cold.1",releaseDoorbell},

 

your display need the right patches from linux to work properly

but keep gfx reasearch as it will be usefull when this is fixed

 

after some time i finally got the structs for this part. its important as apple code uses this flags.

 

image.thumb.png.b83eff8791a7aa9a53b8e3d693008a6a.png

 

this came from ghidra trial and adding structures. 

 

image.png.c040f0559298b087c72af529a1f9b476.png

 

here's howto import it

 

image.thumb.png.2d7d3ed51348ad9477fe2762d33868dd.png

 

gonna push it to github cant here

Edited by jalavoui
  • Like 1

linux and maybe apple code also dont use this. this forces acel to use mmio instead of hw stamps and ofc loop gpu crashes

need to remenber as i mess a lot with this settings and leave this set to zero

 

image.png.294b9033258cce62fc808c64d16f4b1a.png

Edited by jalavoui
  • Like 1
Posted (edited)
4 hours ago, jalavoui said:

think i fixed github acess at least hope so. 

i see no reason to mess with the signatures.

framebuffer kext dbg version is not signed. production version is signed

graphics kext is signed unless hacked for l/e

 

try the kexts i'm using

 

when u guys have time try feed ai with big sur image where all this junk came from

we need to solve those missing symbols and get rid of hookcase

 

if tgl kexts fail i keep in mind patching icl kexts

 

u have a big issue to solve in ngreen for your card

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj", releaseDoorbell},

this is need to setup the display and is the reason in the past the framebuffer fail to load

 

disabling with no patches allows to load but not to work e.g. this is a bad hack

{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj.cold.1",releaseDoorbell},

 

your display need the right patches from linux to work properly

but keep gfx reasearch as it will be usefull when this is fixed

 

Added with some loggings.. (attached linux i915 syslog ADL-P)

// V182: Enable/disable display power gates PW_1 and PW_2 on RPL/ADL-P.
// Linux i915 sequence: PW_1 → CDCLK → PW_2 → PW_A/B/C/D → eDP AUX.
// The original Apple TGL code uses the same HSW_PWR_WELL_CTL2 (0x45404)
// register and identical bit layout as ADL-P; it just needs that->0x78
// pointing at the live controller (ccont) so ReadRegister32/WriteRegister32
// route through our mapped MMIO rather than a stale pointer.
void Gen11::hwSetPowerWellStatePGE(void *that,bool param_1,uint param_2)
{
	static int v182PgeCalls = 0;
	v182PgeCalls++;
	const bool v182Log = (v182PgeCalls <= 40);

	uint32_t ctlBiosBefore = 0;
	uint32_t ctl2Before = 0;
	uint32_t pcodeBefore = 0;
	if (v182Log) {
		ctlBiosBefore = NGreen::callback->readReg32(0x45400);
		ctl2Before = NGreen::callback->readReg32(0x45404);
		pcodeBefore = NGreen::callback->readReg32(0x42000);
		SYSLOG("ngreen", "V182.PGE[%d].enter: pw=%p en=%u mask=0x%x ctlBios=0x%x ctl2=0x%x pcode=0x%x",
		       v182PgeCalls, that, param_1 ? 1 : 0, param_2,
		       ctlBiosBefore, ctl2Before, pcodeBefore);
	}

	getMember<void *>(that, 0x78) = ccont;
	if (!callback->ohwSetPowerWellStatePGE) {
		SYSLOG("ngreen", "V182.PGE: original symbol missing, skipping callthrough");
		return;
	}
	FunctionCast(hwSetPowerWellStatePGE, callback->ohwSetPowerWellStatePGE)(that,param_1,param_2);

	if (v182Log) {
		uint32_t ctlBiosAfter = NGreen::callback->readReg32(0x45400);
		uint32_t ctl2After = NGreen::callback->readReg32(0x45404);
		uint32_t pcodeAfter = NGreen::callback->readReg32(0x42000);
		SYSLOG("ngreen", "V182.PGE[%d].exit:  pw=%p en=%u mask=0x%x ctlBios=0x%x->0x%x ctl2=0x%x->0x%x pcode=0x%x->0x%x",
		       v182PgeCalls, that, param_1 ? 1 : 0, param_2,
		       ctlBiosBefore, ctlBiosAfter, ctl2Before, ctl2After, pcodeBefore, pcodeAfter);
	}
}

void Gen11::hwSetPowerWellStateDDI(void *that,bool param_1,uint param_2)
{
	getMember<void *>(that, 0x78) = ccont;
	FunctionCast(hwSetPowerWellStateDDI, callback->ohwSetPowerWellStateDDI)(that,param_1,param_2);
}

 

i915.log.zip

Edited by Stezza88

review this old code:

void Gen11::enableDisplayEngine(void *that)
{
    getMember<void *>(that, 0x78) = ccont;

 

this is to fix bugged vars in framebuffer but nblue as updates for this.

u dont did all. check nblue as it seems fine.

frame might work when u fix it but for acel u need some more junk from  nblue like flags setup,etc

 

consider using drm_extracted so ai uses latest linux fixs as need and all this functions are there

this is from your log

2024-10-23T18:27:18.192356+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 5 GT workarounds on global
2024-10-23T18:27:18.192357+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 11 engine workarounds on rcs'0
2024-10-23T18:27:18.192377+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 4 whitelist workarounds on rcs'0
2024-10-23T18:27:18.192378+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 5 context workarounds on rcs'0
2024-10-23T18:27:18.192378+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 engine workarounds on bcs'0
2024-10-23T18:27:18.192379+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 whitelist workarounds on bcs'0
2024-10-23T18:27:18.192380+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 context workarounds on bcs'0
2024-10-23T18:27:18.192381+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 engine workarounds on vcs'0
2024-10-23T18:27:18.192381+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 whitelist workarounds on vcs'0
2024-10-23T18:27:18.192381+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 engine workarounds on vcs'2
2024-10-23T18:27:18.192382+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 whitelist workarounds on vcs'2
2024-10-23T18:27:18.192382+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 engine workarounds on vecs'0
2024-10-23T18:27:18.192382+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:wa_init_finish [i915]] GT0: Initialized 1 whitelist workarounds on vecs'0

 

display 13? u gonna have some work here. this is part of structures im trying to port from linux.

2024-10-23T18:27:18.193661+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: display version: 13
2024-10-23T18:27:18.193661+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: cursor_needs_physical: no
2024-10-23T18:27:18.193662+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_cdclk_crawl: yes
2024-10-23T18:27:18.193662+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_cdclk_squash: no
2024-10-23T18:27:18.193662+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_ddi: yes
2024-10-23T18:27:18.193662+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_dp_mst: yes
2024-10-23T18:27:18.193663+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_dsb: yes
2024-10-23T18:27:18.193663+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_fpga_dbg: yes
2024-10-23T18:27:18.193663+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_gmch: no
2024-10-23T18:27:18.193664+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_hotplug: yes
2024-10-23T18:27:18.193664+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_hti: no
2024-10-23T18:27:18.193664+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_ipc: yes
2024-10-23T18:27:18.193664+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_overlay: no
2024-10-23T18:27:18.193665+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_psr: yes
2024-10-23T18:27:18.193665+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_psr_hw_tracking: no
2024-10-23T18:27:18.193665+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: overlay_needs_physical: no
2024-10-23T18:27:18.193666+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: supports_tv: no
2024-10-23T18:27:18.193666+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_hdcp: yes
2024-10-23T18:27:18.193666+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_dmc: yes
2024-10-23T18:27:18.193666+02:00 sgiammoript-Predator-PT14-51 kernel: i915 display info: has_dsc: yes

 

and i'm stuck on this on mac os... but u might be luck as u have 4 ports instead of 2. u need this to load acelerator for frameb mode no need.

2024-10-23T18:27:18.718581+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:intel_dp_link_training_clock_recovery [i915]] [CONNECTOR:236:eDP-1][ENCODER:235:DDI A/PHY A][DPRX] Clock recovery OK
2024-10-23T18:27:18.718584+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:intel_dp_program_link_training_pattern [i915]] [CONNECTOR:236:eDP-1][ENCODER:235:DDI A/PHY A][DPRX] Using DP training pattern TPS4
2024-10-23T18:27:18.720680+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:intel_dp_link_training_channel_equalization [i915]] [CONNECTOR:236:eDP-1][ENCODER:235:DDI A/PHY A][DPRX] Channel EQ done. DP Training successful
2024-10-23T18:27:18.720683+02:00 sgiammoript-Predator-PT14-51 kernel: i915 0000:00:02.0: [drm:intel_dp_link_train_phy [i915]] [CONNECTOR:236:eDP-1][ENCODER:235:DDI A/PHY A][DPRX] Link Training passed at link rate = 810000, lane count = 4

 

linux log if u wanna check

sys.log.zip

 

i wonder what apple combo flags will work for you? check nblue getOSInformation()+initPlatformWorkarounds() choose with care as it mess with apple code

after u get rid of powerwellbus check apple enableDisplayEngine() it as other drm configs that u might need overwrite

Edited by jalavoui
Posted (edited)
2 minutes ago, jalavoui said:

if u do that in /L/E they will load on every boot !

 

 

But finally Lilu is loading it.

 

I have access on MAC folders from windows so i remove tgl fb kext from Windows then restart the workflow on Mac.

It will be a long long night..

Edited by Stezza88
Posted (edited)

I booted in black screen 🤠

 

Fresh BIG logs are coming after so much time..! 

 

I restored a releasedoorbell because if not couldn't boot.. our hwSetPowerWellStatePGE is spinning cpu and no logs, with releasedoorbell booted in black screen with panics

BIG CLUE HERE

// V182: callthrough with 0x78=ccont fixup; cold.1-.12 remain no-op (silence timeout panics)
// =| {"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj", hwSetPowerWellStatePGE, this->ohwSetPowerWellStatePGE},
{"__ZN19AppleIntelPowerWell21hwSetPowerWellStatePGEbj", releaseDoorbell},

 

This are big but panic

Kernel-2026-05-01-003052.panic WindowServer-2026-05-01-002351.ips WindowServer-2026-05-01-002340.ips WindowServer-2026-05-01-002334.ips

fb.log.zip

Edited by Stezza88
  • Like 1
Posted (edited)

GOT Framebuffer logs with releasedoorbell version!!! just check above

 

* first fix to stubs committeed and pushed, re-removed the doorbell

 

now test -v keepsyms=1 debug=0x100 IGLogLevel=8 -NGreenDebug -liludbg liludump=250 ngreen-dmc=skip -allow3d -disablegfxfirmware -ngreenexp -ngreenfullmtl -ngreenV69AllowOriginal

 

second test : add -ngreenV142orig boot arg

 

UPDATE : stubs fixed, saw a cursor also

 

-v keepsyms=1 debug=0x100 IGLogLevel=8 -NGreenDebug -liludbg liludump=250 ngreen-dmc=skip -allow3d -disablegfxfirmware -ngreenexp -ngreenfullmtl -ngreenV69AllowOriginal

Edited by Stezza88
Posted (edited)

Without releasedoorbell saw a cursor but windows stall still and no more kp!!!

 

fb.log.zip

 

First test -v keepsyms=1 debug=0x100 IGLogLevel=8 -NGreenDebug -liludbg liludump=250 ngreen-dmc=skip -allow3d -disablegfxfirmware -ngreenexp -ngreenfullmtl -ngreenV69AllowOriginal

 

Stubs fixed in this way

 

// V183: ADL-P/RPL write-only power well handler.
// HSW_PWR_WELL_CTL2 (0x45404): REQ bits = mask 0xAA (bits 1,3,5,7);
//                               STATE bits = mask 0x55 (bits 0,2,4,6).
// TGL original polls STATE bits after writing REQ — on ADL-P those ACKs
// never arrive within the 20-iteration timeout, spinning the CPU.
// Fix: write REQ bits directly, skip polling entirely.
// param_2 carries the REQ bitmask (matches the `(val & 0xFFFFFF55) | param_2`
// pattern seen in IDA for PGE enable stages).
void Gen11::hwSetPowerWellStatePGE(void *that, bool param_1, uint param_2)
{
	if (!NGreen::callback->isRealTGL) {
		uint32_t ctl2 = NGreen::callback->readReg32(0x45404);
		uint32_t newVal;
		if (param_1) {
			// Enable: clear all REQ bits then set the requested ones.
			newVal = (ctl2 & 0xFFFFFF55U) | (param_2 & 0xAAU);
		} else {
			// Disable: clear the requested REQ bits.
			newVal = ctl2 & ~(param_2 & 0xAAU);
		}
		DBGLOG("ngreen", "V183.PGE: en=%u mask=0x%x ctl2: 0x%x->0x%x",
		       (unsigned)param_1, param_2, ctl2, newVal);
		NGreen::callback->writeReg32(0x45404, newVal);
		return;
	}
	// Real TGL: use original with ccont fixup.
	getMember<void *>(that, 0x78) = ccont;
	FunctionCast(hwSetPowerWellStatePGE, callback->ohwSetPowerWellStatePGE)(that, param_1, param_2);
}

void Gen11::hwSetPowerWellStateDDI(void *that,bool param_1,uint param_2)
{
	getMember<void *>(that, 0x78) = ccont;
	FunctionCast(hwSetPowerWellStateDDI, callback->ohwSetPowerWellStateDDI)(that,param_1,param_2);
}

void Gen11::hwSetPowerWellStateAux(void *that,bool param_1,uint param_2)
{
	getMember<void *>(that, 0x78) = ccont;
	FunctionCast(hwSetPowerWellStateAux, callback->ohwSetPowerWellStateAux)(that,param_1,param_2);
}

 

WindowServer-2026-05-01-005100.ips

WindowServer-2026-05-01-005050.ips WindowServer-2026-05-01-005039.ips WindowServer-2026-05-01-005028.ips WindowServer-2026-05-01-005017.ips WindowServer-2026-05-01-005007.ips WindowServer-2026-05-01-004956.ips WindowServer-2026-05-01-004945.ips WindowServer-2026-05-01-004939.ips

Edited by Stezza88

Second test : -v keepsyms=1 debug=0x100 IGLogLevel=8 -NGreenDebug -liludbg liludump=250 ngreen-dmc=skip -allow3d -disablegfxfirmware -ngreenexp -ngreenfullmtl -ngreenV69AllowOriginal -ngreenV142orig

fb.log.zip Lilu_1.7.2_23.6.txt Kernel-2026-05-01-012241.panic WindowServer-2026-05-01-004945.ips WindowServer-2026-05-01-010940.ips WindowServer-2026-05-01-010934.ips

Posted (edited)

changed nblue to load from /l/e but gpubundle patch not working for my ventura versions maybe

acel loads 2d and hangs

 

very nice framebuffer log - u finally have a driver !

 

aply the patch and test on nblue - that old code ure using kills me

 

ah dam your log still doesnt have the acelerator loading

 

now i get it, cause of extra patches ioacel is trying to load and force windoserver status

u just need to make ngreen load the acel kext

 

if ure on black screen and from linux logs it can be the drm firmware not loaded on apple side

wonder if were all stuck cause of some registers not working

Edited by jalavoui
×
×
  • Create New...