Jump to content

NootedGreen.kext is on air! It's a long long road to complete..

Stezza88

By Stezza88,
in Intel

 Share
559 posts in this topic

Recommended Posts

Stezza88
Stezza88
Posted
  • Author
Posted

This caused the apple logo flash brief write

  

bool planeEnabled = !!(planCtl & 0x80000000u);
		if (planeEnabled) {
			uint32_t planStrd = NGreen::callback->readReg32(0x70188); // PLANE_STRIDE
			uint32_t planSurf = NGreen::callback->readReg32(0x7019C); // PLANE_SURF
			uint32_t tiling = (planCtl >> 10) & 0x7; // bits[12:10]
			if (planSurf != 0 && tiling != 0) {
				uint32_t newCtl = planCtl & ~(0x7u << 10); // clear tiling -> linear
				uint32_t newStrd = planStrd;
				if (tiling == 1) {
					newStrd = planStrd * 8;
				} else if (tiling == 4) {
					newStrd = planStrd * 16;
				}
				NGreen::callback->writeReg32(0x70180, newCtl);
				NGreen::callback->writeReg32(0x70188, newStrd);
				NGreen::callback->writeReg32(0x7019C, planSurf);
				if (v71Count <= 20 || (v71Count % 20) == 0) {
					SYSLOG("ngreen", "V80L[%d]: tiling %u->linear CTL 0x%x->0x%x STRIDE 0x%x->0x%x SURF=0x%x",
						   v71Count, tiling, planCtl, newCtl, planStrd, newStrd, planSurf);
				}
			} else if (planSurf != 0) {
				NGreen::callback->writeReg32(0x7019C, planSurf);
				if (v71Count <= 20 || (v71Count % 20) == 0) {
					SYSLOG("ngreen", "V80L[%d]: already linear, SURF re-arm=0x%x", v71Count, planSurf);
				}
			}
		}

 

I believe too much in this library

Stezza88
Stezza88
Posted
  • Author
Posted (edited)

* freeze *userspace watchdog* solved, just wait

 

-v keepsyms=1 debug=0x100 IGLogLevel=8 -NGreenDebug -liludbg liludump=500 ngreen-dmc=skip -allow3d -disablegfxfirmware -ngreenexp -ngreenfullmtlcore -ngreenfullmtldyld -ngreenV69AllowOriginal -ngreenV142forceorig -ngreenlegacyown -ngreenv60 -ngreenv54off -ngreenv59off ngreenv74max=6000 -ngreenv74maskoff -ngreenv116off

 

=> what to do next : remove isolations one by one slowly

Edited by Stezza88
Stezza88
Stezza88
Posted
  • Author
Posted (edited)

* all committed and pushed

 

Pro : HD mouse cursor, no screen recycles, no more KP or ws stall freeze *userspace watchdog"

Cons : lost apple logo flash brief (available fortunately in RESET-4 head), black screen, tv-untuned effect

 

% git log --oneline -4

2d3d89d (HEAD) Various fixes..
1e5d4b8 kp resolved with V80L arg?
c7b5451 HD mouse returned.. kp resolved with '-ngreenV74?'
16329f9 Fragmented apple logo : start hook


boot-args used : -v keepsyms=1 debug=0x100 IGLogLevel=8 -NGreenDebug -liludbg liludump=250 ngreen-dmc=skip -allow3d -disablegfxfirmware -ngreenexp -ngreenfullmtlcore -ngreenfullmtldyld -ngreenV69AllowOriginal -ngreenV142forceorig -ngreenlegacyown

 

Detailed Boot Args Explanation in kern_gen11.cpp for Developers (there are still more but.. just wait)

 

-ngreenexp enables V60 + extra diagnostics,

 

-ngreenlegacyown enables legacy display ownership mode.

 

-ngreenv60 now actually gates the V60 GPU health monitor — it only runs when the flag is present
-ngreenv60 -ngreenv60rw enables aggressive mode with active register writes and V79 plane linearization

 

1. -ngreenv60rw / ngreenv60rw=1 (ACTIVE TUNING FLAG)
Status: Active and recommended for advanced tuning
Purpose: Controls V60 GPU health monitor mode, not whether it runs
Default: Read-only (safe, non-intrusive)

Read-Only Mode (Default):

V60 performs diagnostic reads every 2 seconds for 120 seconds total (60 iterations)
No hardware register modifications
Safe for production boots
Logs: V60M[1-60] entries showing ring health, error status, CSB pointers
Use case: Monitor system health without risk of side effects
Aggressive Mode (-ngreenv60rw):

Enables active register writes during V60 ticks:
ERROR_GEN6 register cleared every tick (suppresses GPU errors)
EMR (Error Mask Register) re-masked to 0xFFFFFFFF every tick (prevents Apple driver from unmasking errors)
Enables V79 plane linearization: Converts display plane from tiled→linear format during first 5 iterations (~10s), producing the brief Apple logo flash visible at early boot
Plane writes cease after iteration 5 to avoid conflicts with WindowServer compositor
Use case: Developers debugging display issues, verifying GPU error suppression works correctly
Why this exists:

Display linearization was needed to prove GPU driver communication works
Active register writes help debug error recovery paths
Safely gated to avoid production issues


2. -ngreenfullmtl / ngreenfullmtl=1 (ADVANCED GRAPHICS TUNING)

(can be splitted in 2 -ngreenfullmtlcore -ngreenfullmtldyld)
Status: Active experimental flag
Purpose: Forces full CoreDisplay Metal rendering path on Ventura+/Sonoma
Default: Disabled (safety stubs active)

What it does:

Skips Stage-3 NULL safety stubs:
GetMTLTexture → normally returns NULL guard stub
GetMTLCommandQueue → normally returns NULL guard stub
RunFullDisplayPipe → normally returns NULL guard stub
With this flag: Attempts full Metal path (3D rendering, etc.)
Without this flag: Falls back to safe CPU paths when Metal operations fail
Important: This flag does NOT auto-enable Apple's original Blit3D initializer (see -ngreenV69AllowOriginal)

Why this exists:

Early driver initialization tries full Metal before falling back to CPU paths
On some hardware, the full Metal path can work if safety guards are removed
Conservative default (guards active) → opt-in via flag for testing
Separate from Blit3D testing; Metal path != Blit3D acceleration
Use case: Developers testing whether full 3D Metal rendering works on their hardware without CPU fallbacks

 

3. -ngreenV69AllowOriginal
Status: Active diagnostic flag
Purpose: Opt-in to Apple's original Blit3D initializer for 3D acceleration
Default: Disabled (NootedGreen's own Blit3D implementation used instead)

What Blit3D does:

Initializes 3D rendering context (blitting, texture operations, etc.)
Apple's original version: Works on real TGL, may not work on RPL/ADL
NootedGreen's conservative version: Safer, but may disable 3D on hardware that could support it
Behavior:

With this flag: Attempts Apple's original IGHardwareBlit3DContext::initialize()
Without this flag: Uses NootedGreen's safer bypass (return unsupported)
Can panic at IGHardwareBlit3DContext::initialize + 0x4c (SecurityAgent/IOAccel submit path) on unsupported setups
Why this exists:

Some hardware combinations can run Apple's original code if preconditions are right
Testing this path helps identify which RPL/ADL systems actually support full acceleration
Explicit opt-in prevents accidental crashes in production
Use case: Developers trying to enable 3D acceleration on specific hardware; controlled repro testing only

WARNING: Can cause kernel panics. Test in isolated environments only.

 

4.  -ngreenV142forceorig / ngreenV142=3 (GPU SUBMIT PATH TESTING)
Status: Active diagnostic flag for submitBlit command submission
Purpose: Select how NootedGreen handles 3D blit command submissions on spoofed CPUs
Default: Mode 1 (bypass, return 0)

Modes:

Mode 0 (ngreenV142=0😞 Return "unsupported" to macOS (disables 3D)
Mode 1 (ngreenV142=1): Bypass Apple's implementation, return 0 (success) — default/recommended
Mode 2 (ngreenV142=2😞 Bypass Apple's implementation, return 1 (alternate semantics)
Mode 3 (ngreenV142=3 or -ngreenV142forceorig): Call Apple's original submitBlit (high-risk)

Edited by Stezza88
Stezza88
Stezza88
Posted
  • Author
Posted 
NootedGreen    ngreen: @ init AppleIntelTGLGraphics (HW accelerator)
NootedGreen    ngreen: @ Loaded AppleIntelTGLGraphics! RPL spoofed — slices=1 subslices=12(6DSS) maxEU/SS=8 totalEU=96 L3=8
NootedGreen    ngreen: @ V44: MetalPlugin=AppleIntelTGLGraphicsMTLDriver GL=AppleIntelTGLGraphicsGLDriver VARendID=0x1080040
NootedGreen    ngreen: @ V44: DVD=AppleIntelTGLGraphicsVADriver MTL_TGL=1 GL_TGL=1 VA_TGL=1
NootedGreen    ngreen: @ V50: start() ret=1 — policy: TGL from /Library/Extensions, fallback ICL from /System/Library/Extensions
NootedGreen    ngreen: @ V50: active GPU plugin track = TGL (TGL and ICL both supported)
NootedGreen    ngreen: @ V44: T+500ms MetalPlugin=AppleIntelTGLGraphicsMTLDriver

 

x.log.zip

fb.log.zip Lilu_1.7.2_23.6.txt tgl_only.txt

jalavoui
jalavoui
Posted
Posted (edited)

dont remove flag so i can see log...

 

2026-05-02 14:59:17.622615+0200  localhost kernel[0]: (AppleIntelTGLGraphics) [IGPU] Failing probe (-allow3d is NOT set in boot-arg)!

anyway from current log it lacks link training call so acel can actual work

 

add nblue missing parts for frame config as i explained to u earlier

u have some strange bugs in frameb and ofc acel cant work 

 

check if windoserver hang log is generated. we need to see if /l/e is loading mtl bundle

Edited by jalavoui
Stezza88
Stezza88
Posted
  • Author
Posted (edited)
6 minutes ago, jalavoui said:

dont remove flag so i can see log...

 

2026-05-02 14:59:17.622615+0200  localhost kernel[0]: (AppleIntelTGLGraphics) [IGPU] Failing probe (-allow3d is NOT set in boot-arg)!

anyway from current log it lacks link training call so acel can actual work

 

check if windoserver hang log is generated

 

it is from empty nootedblue with enpty IOPCIPrimaryMatch and config.plist  I use to boot in the system, another boot

Edited by Stezza88
jalavoui
jalavoui
Posted
Posted (edited)

if u get stuck and cant enter the system (cause u have /l/e with predefined ids in info.plist)

 

boot safe image and delete /l/e tgl extension. hmm i dont remenber howto bring safe image menu in opencore...

maybe remove hideaux so safe boot menu shows up

image.png.2ca02757c053dcebbf616aed33e10c6a.png

 

 

delete /Library/KernelCollections/AuxiliaryKernelExtensions.kc

 

thats is why i have nblue info.plist logic

btw nred injection logic here https://github.com/ChefKissInc/NootedRed/blob/master/NootedRed/iVega/DriverInjector.cpp

i have a old version with another logic for mac os update boot in my nred version in ati thread

Edited by jalavoui
Stezza88
Stezza88
Posted
  • Author
Posted (edited)
1 hour ago, jalavoui said:

if u get stuck and cant enter the system (cause u have /l/e with predefined ids in info.plist)

 

boot safe image and delete /l/e tgl extension

delete /Library/KernelCollections/AuxiliaryKernelExtensions.kc

 

thats is why i have nblue info.plist logic

 

Just wait I'm on fire

 

Now, you need to set : 

-ngreenV142orig 
ngreenV142=3
Edited by Stezza88
  • Like 1
Stezza88
Stezza88
Posted
  • Author
Posted

- With mode 3 get kp or ws stall userspace watchdog, but I have an improvements, before kp or sw stall were earlier now got some time inside submitBlit

- Preserved mode 1 (circuit-breaked) system is stable till infinite..

Stezza88
Stezza88
Posted
  • Author
Posted

Good. The logic is correct: we probe-lock to verify the mapping is writable (null check), unlock, then call the original which does lock+memcpy+unlock itself. This avoids duplicating the 35 memcpy calls while confirming the mapping is accessible.

However there's a subtle issue: the original function was crashing because lockForCPUAccess returned a write-protected/read-only pointer (not null). If it returns non-null but the memory is still read-only, we'd still fault in the original. Let me reconsider — but actually the whole premise was "the CPU-side lockForCPUAccess ptr is read-only". With our kernel_task approach vs the kext's internal task pointer, the behavior should differ: the kext uses kernel_task too (from off_C8228). The real question is: why did it crash before?

Looking at the IDA again — IGSharedMappedBuffer::lockForCPUAccess at 0x10A20 calls IOAccelSysMemory::lockForCPUAccess([this+0x30]+0x18, kernel_task, 1) — it follows [this+0x30] to get the inner IOAccelSysMemory*. But blit3d_initialize_scratch_space(IGAccelSysMemory *this) passes this directly (NOT through IGSharedMappedBuffer). The that pointer in our hook is the IGAccelSysMemory* directly. This should be fine.

The previous crash was likely a genuine page fault from writing to an actually-unmapped page. Our probe-lock approach will catch it via cpuPtr == null. If lock returns non-null but the write still faults, we need a different strategy. But let's test this first — it's the most correct implementation matching the original code flow. Build and test will reveal if the lock succeeds.

Stezza88
Stezza88
Posted
  • Author
Posted (edited)

New logs show significant progress - the hang signature changed from 801 → 813, meaning the RCS is now executing (entering a batch buffer) rather than just the BCS ring stalling. 

Edited by Stezza88
jalavoui
jalavoui
Posted
Posted (edited)

gonna get your source from github and change 1 thing for u to test

try its for GraphicsSchedulerSelect=5

 

ng.zip

 

u guys on sonoma ? send me this file /System/Library/Extensions/AppleIntelGraphicsShared.bundle/Contents/MacOS/libMTLIGCCompilerPlugin.dylib

Edited by jalavoui
  • Like 1
 Share
Go to topic listing
×
×
  • Create New...