NootedGreen.kext is on air! It's a long long road to complete..

jalavoui · May 14

did u try goto bios and add + mem ?

if the driver trys write pass this adress and can't u will never fix it

image.png.114682887ba9fcc2be4ec0655531a589.png

this needs tobe solved, check what happens when u dont have this bug in log

Edited May 14 by jalavoui

Stezza88 · May 14

with no GPU flip means the hardware scans from GGTT[0] (stolen base) which may or may not have visible content without the accelerator rendering a frame.

GFX+FB is the real test. When IGAccelDevice starts alongside the FB kext, it maps the GPU memory manager, WindowServer commits the first Y-tiled flip with a real surface address, and PLANE_SURF gets a non-zero value → display should come up

Fb-only logs

Lilu_1.7.2_23.6.txt x.log.zip

.

fb.log

Edited May 14 by Stezza88

Stezza88 · May 14

When configurePlane fires with GFX loaded, it should produce X-tiled — and here's why that's already the most likely outcome without any interception:

The FB-side paramsSurfCompare establishes PLANE_CTL=0x94000408 (bit10=1 = X-tiled, Gen12 encoding). macOS IOFramebuffer allocates X-tiled IOSurface objects for TGL-class hardware. When IGAccelDevice commits a GPU flip, it gets the surface attributes from the same IOSurface — so FlipTransactionArgs.TilingEnum should already arrive as 1 (X-tiled).

The passthrough is likely correct. configurePlane as-is will call Apple's implementation, which will read TilingEnum=1 from the args and write PLANE_CTL with bit10 set — matching what paramsSurfCompare already programmed.

What to watch in the GFX+FB boot log:

Enable the V406 diagnostic log by adding a temporary unconditional log at the top of configurePlane before the passthrough:

SYSLOG("ngreen", "configurePlane: TilingEnum=%u SURF=0x%x",
    flipArgs ? flipArgs->tilingEnum : 0xDEAD,
    flipArgs ? flipArgs->surfAddr : 0xDEAD);

If TilingEnum prints as 1 → passthrough is correct, no V406 intervention needed.
If it prints as 2 (Y-tiled) or 0 (linear) → then enable V406_APPROACH_TILING_PATCH with V406_TILING_VALUE=1.

The second thing to verify is that flipArgs->surfAddr is non-zero when configurePlane fires — that's the GPU-committed surface address hitting the plane. If SURF goes non-zero and display still shows blank, then the stride is the suspect (V406_APPROACH_STRIDE_DIVISOR).

but wait a moment... this "2026-05-14 13:19:41.008184+0200 localhost kernel[0]: (AppleGraphicsDeviceControl) AGDCC: Unauthorized client 'PerfPowerServices' blocked (IOService:/AppleACPIPlatformExpert/PC00/AppleACPIPCI/IGPU@2/AppleIntelFramebufferController/IntelFBClientControl) 2026-05-14 13:19:41.008215+0200 localhost kernel[0]: (AppleGraphicsDeviceControl) AGDCC: Unauthorized client 'PerfPowerServices' blocked (IOService:/AppleACPIPlatformExpert/PC00/AppleACPIPCI/IGPU@2/AppleIntelFramebufferController/IntelFBClientControl/AppleGraphicsDevicePolicy/AGDPClientControl)" need to be solved

Edited May 14 by Stezza88

Stezza88 · May 14

Why it's happening: on a real TGL Mac, AppleIntelTGLGraphics (the GPU accelerator) loads and registers its own AGDC nub with broader authorization. PerfPowerServices connects to that GPU-side nub. On our FB-only setup (no -allow3d), only the framebuffer side registers, which has the narrower WindowServer-only list.

Satisfying conditions:

Proper fix for GFX+FB: add -allow3d. The GPU accelerator loads, publishes the right AGDC nub, and PerfPowerServices finds it. No patch needed.
For FB-only: the block is harmless — PerfPowerServices needs GPU performance counters that don't exist without the accelerator anyway. The message is noise, not a cause of black screen.

So the actual question is: is this message causing any observable problem in your current tests, or is it just log noise? If it's causing something to fail (e.g., blocking display sleep/wake or brightness)

Visual Ehrmanntraut · May 14

15 minutes ago, Stezza88 said:

Why it's happening: on a real TGL Mac

erm... none exists

Stezza88 · May 14

The key sequence is now clear. AGDP reads DPCD[0x0000] = 0x14, then asserts linkBW = 0. This means GetLinkConfig (cmd=0x921) returned zero bitRate — because validateDisplayMode → return 0xe00002c2 (kIOReturnInvalid) caused the link config to come back zeroed.

Stezza88 · May 14

Violeet screen in FB+GFX XD

Kernel-2026-05-14-152754.panic

Edited May 14 by Stezza88

jalavoui · May 14

till ai give me what i think is right i'm not buying bs

let's proceed

i kinda remenber old nred code so try this

tell the bot to check this 2 functions and explain registers used

{"__ZN31AppleIntelFramebufferController18hwInitializeCStateEv",hwInitializeCState, this->ohwInitializeCState},

{"__ZN31AppleIntelFramebufferController20hwConfigureCustomAUXEb",hwConfigureCustomAUX, this->ohwConfigureCustomAUX},

and no bs i want this justified agains current linux source from drm_extracted

and because i probably made the right questions in the past tell ai to

read old insanly thread and answer some of jalavoui questions

add that ai can learn as those are human thinking not alucinations

6 minutes ago, Stezza88 said:

Violeet screen in FB+GFX XD

this is good i have a nice green screen. check logs

btw do u know visual did a great script for ghidra symbols in the past?

but i think he just delete it...

Edited May 14 by jalavoui

Visual Ehrmanntraut · May 14

7 minutes ago, jalavoui said:

but i think he just delete it...

I still have it on my drive, but I won't upload it.

jalavoui · May 14

good i feel better now.

tell ai bot:

study nred but be fast cause

image.png.33aec50a9c24e74f5b5f3e5fa6bedb65.png

code can vanish !

this is why i keep old kern_netdbg it's 2 good to trash

Edited May 14 by jalavoui

Visual Ehrmanntraut · May 14

2 minutes ago, jalavoui said:

code can vanish !

the feature won't go away, it'll be rewritten with something that's not hacky, using the new Runtime MetaClass system.

2 minutes ago, jalavoui said:

this is why i keep old kern_netdbg it's 2 good to trash

it's trash. but I have plans to make something similar but global. aka. sending all system logs to the network

Stezza88 · May 14

3 hours ago, jalavoui said:

no comments. just picture

howto find a var name ? sample here

same for var type uint32 = undefined4 or signed int if in code

note the bug at pg1 (maybe int or all others are unsigned)

ask the bot todo something usefull like rebuild vtables

in short this strucutures better not be in ngren cause if 1 field is wrong u get a ton of bugs

this mean bot can't see it's on top of function powerwell::init

worst it can't map osinfo flags and propagate in entire code

analysys will be weak or missleading

note to ai: u're fired

if I open structure editor got empty

jalavoui · May 14

omg now i understand what visual feels when i send him junk code

Stezza88 idk what else to tell u...

i found this. ai says this function is not ethical...

image.png.45a6d14b8e16a53f6caae69f1d98be5b.png

Edited May 14 by jalavoui

Stezza88 · May 14

Based on your screenshot, you are looking at a structure named AppleIntelScaler, which currently has a size of 0x0.

To populate the structure and begin your analysis of the AppleIntelTGLGraphicsFramebuffer, you can use the following methods:

1. Manual Entry in the Structure Editor

Add Fields: Click the green plus (+) icon in the top right of the Structure Editor window to add a new undefined line.
Define Types: Double-click the DataType column to specify the type (e.g., int, long, void *, or another structure).
Set Size: If you know the total size of the scaler object from your reverse engineering of the Intel graphics driver, you can click the n-ary button (three dots) next to the "Size" field at the bottom to manually grow the structure.

2. Creating from the Decompiler

Since you are looking at the programPipeScaler function, you can define the structure directly from the code:

Right-click the variable (likely this or a pointer to the scaler) in the Decompiler window.
Select Auto Create Structure. Ghidra will attempt to create a structure based on the offsets used in that function.

3. Applying to the Listing

If you see a block of data in the Listing window that represents this structure:

Highlight the bytes in the Listing.
Right-click and select Data -> Choose Data Type.
Search for AppleIntelScaler. This will apply the structure to those bytes, and any changes you make in the Structure Editor will now reflect there.

jalavoui · May 14

m8 i write about this in github (see the resize struct part)

well lets save time. just look in variables table for type name

replace with the type u created

e.g your type is AppleIntelScaler_imp or whatever shows in list

u rename original to AppleIntelScaler2

then u rename you type from AppleIntelScaler_imp to AppleIntelScaler

if u import u get a list kinda like this. what u see in decompile is in Demangler always

image.png.ef9d261d790f1eba4498034dba386fbf.png

just delete that ai alucination. u will not get the job done like that

i think visual is one of the few doing this correctly but he wont teach us

Edited May 14 by jalavoui

Visual Ehrmanntraut · May 14

1 hour ago, jalavoui said:

i think visual is one of the few doing this correctly but he wont teach us

if you gave me that money he's already burnt and still burning to the "AI replacement overlords", I would've helped, and possibly even gotten it working already :^) I've been watching everything btw, just giggling to myself at you two thinking the text generation software is actually understanding and acting similarly like a person would, when it's just predicting what text it should respond with, combined with some results from running commands :^) :^)

Edited May 14 by Visual Ehrmanntraut

Visual Ehrmanntraut · May 14

I'll offer you a little help by a little tip about the slopware: after the first few messages the chat is essentially void. the messages are silently compressed down using a text summarisation model, so everything after that point is entirely hallucinated based on what's essentially a small "summarised memory" prompt. they only have higher context windows on the super expensive plans, because with big enough context windows, that {censored} sucks down enough electricity to power a small town just for one chat.

btw, your little week-long endeavour has probably caused a river's worth of water usage and a few commercial flights worth of CO2 emissions.

jalavoui · May 14

Stezza88 send the laptop to visual i think he deserves the pain

Visual Ehrmanntraut · May 14

Even if I wanted to work on it, I wouldn't be able to receive the laptop without giving you my name and home address, since I don't have a P.O. box, and wouldn't give that kind of information to anyone.

Visual Ehrmanntraut · May 14

And no, I don't want to work on it, at least not for free, and not right now. The laptop is not even a worthy payment for me to work on it since I already have better machines than it, that I bought with my savings.

jalavoui · May 14

escuses i bet u would spend a month just to unlock the framb.

i still dont get why this so hard on adl. no idea what am i missing

a yes the aproach is wrong. that kp shows frame loading with acel

ofc this is a bad path

nred start with a crazy guy patching connectors long ago

but them nblue only works for me so idk what's wrong with stezza

Edited May 14 by jalavoui

Visual Ehrmanntraut · May 14

4 minutes ago, jalavoui said:

escuses i bet u would spend a month just to unlock the framb.

Let me remind you that I got the AMD Touchpads working, AMD Vega iGPUs working, Navi 22 dGPUs working, made a better, universal, TSC sync plugin, improved RadeonSensor, and emulated the iPhone 11 running iOS 14 to iOS 22 all mostly by myself.
Look at the size of my RE databases:

And entire Developer folder:

I don't take insults kindly, so I'm withdrawing my offer; I will not help even if you pay me, and will continue observing your pal burn his salary on the iHallucinate Pro and you advising him by "tell AI to stop being lazy" and "tell AI to look at this".

jalavoui · May 14

u know very well i'm not insulting u.

back to code. that's why i'm here

ngreen git as a problem with ai defined strucuts. here's a sample

image.png.75fdb36bf42f1d321610995e4a0f1624.png

this only will work for debug version as production uses other offsets

also using this for classes is bad idea cause 1 wrong offset and it fails

just dont use this logic for writing code. keep it for ghidra checks

u can keep common structs if u sure they work. e.g. CRTCParms but still why risk new bugs if not using?

as i expected if ai as good definitions we get better results. it did found this fields

params->PIPE_SEAM_EXCESS

params->PS_PS_WIN_SZ

params->PS_HPHASE

if key structures are defined and we send that to ai results will pop

but need to check as many bs also come from this process

so here's what is missing to get good structs

ai is not checking all code. if it did how could it miss this vars names in CRTCParams?

image.png.2e04b3e171657ee284f777fe5a1ecd4b.png

this was my manual job with original header that got lost while exported to github

Edited May 14 by jalavoui

Stezza88 · May 14

Kernel-2026-05-14-195432.panic


/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
/* AppleIntelBaseController::hwWaitForVBlank(AppleIntelFramebuffer*, unsigned int) */

undefined8 __thiscall
AppleIntelBaseController::hwWaitForVBlank
          (AppleIntelBaseController *this,AppleIntelFramebuffer *param_1,uint param_2)

{
  long lVar1;
  long lVar2;
  char cVar3;
  int iVar4;
  uint uVar5;
  uint uVar6;
  int iVar7;
  undefined8 uVar8;
  AppleIntelFramebuffer *pAVar9;
  uint uVar10;
  uint uVar11;
  ulong uVar12;
  AppleIntelFramebuffer *pAVar13;
  int iVar14;
  AppleIntelFramebuffer *pAVar15;
  ulong uVar16;
  uint local_40;
  ulong local_38;
  
  _DAT_00156708 = _DAT_00156708 + 1;
  if (this[0x918] == (AppleIntelBaseController)0x0) {
    _DAT_00156f20 = _DAT_00156f20 + 1;
    if (param_1[0x4b8c] == (AppleIntelFramebuffer)0x0) {
      DAT_00155220 = DAT_00155220 + 1;
      DAT_0015a158 = DAT_0015a158 + 1;
      if (*(int *)(param_1 + 0x3fd8) == -1) {
        _DAT_0015a168 = _DAT_0015a168 + 1;
        pAVar9 = param_1 + 0x49f0;
      }
      else {
        _DAT_00155228 = _DAT_00155228 + 1;
        _DAT_0015a160 = _DAT_0015a160 + 1;
        pAVar9 = param_1 + 0x4a08;
      }
      lVar1 = *(long *)pAVar9;
      if (lVar1 == 0) {
        cVar3 = _IntelLogEnabled(1,0x19);
        if (cVar3 == '\0') {
          return 0xe00002d6;
        }
        _DAT_00156808 = _DAT_00156808 + 1;
        _IntelLog(1,0x19,
                  "/Library/Caches/com.apple.xbs/Sources/GPUDriversIntel/GPUDriversIntel-16.0.32/ION DRV/TGL/AppleIntelFramebuffer/AppleIntelController.cpp"
                  ,&DAT_00002122,"hwWaitForVBlank",
                  "FB%d: Bailing out as FB doesn\'t has displaypath\n",
                  *(undefined4 *)(param_1 + 0x1dc));
        return 0xe00002d6;
      }
      _DAT_00156720 = _DAT_00156720 + 1;
      DAT_001556c8 = DAT_001556c8 + 1;
      DAT_00155768 = DAT_00155768 + 1;
      iVar4 = *(int *)(lVar1 + 0x3640);
      _DAT_00155788 = _DAT_00155788 + 1;
      if (*(long *)(lVar1 + 0x3648) != 0) {
        _DAT_00155798 = _DAT_00155798 + 1;
        DAT_00156390 = DAT_00156390 + 1;
        if (*(int *)(*(long *)(*(long *)(lVar1 + 0x3648) + 0x548) + 8) == 0) {
          _DAT_00155790 = _DAT_00155790 + 1;
          iVar4 = 0xf;
        }
      }
      iVar4 = AppleIntelRegisterAccessManager::ReadRegister32
                        (*(AppleIntelRegisterAccessManager **)(this + 0xc40),
                         (ulong)(iVar4 * 0x1000 + 0x70008));
      if (iVar4 < 0) {
        DAT_00155768 = DAT_00155768 + 1;
        iVar4 = *(int *)(lVar1 + 0x3640) * 0x1000;
        if (*(int *)(param_1 + 0x4258) != 0) {
          _DAT_00156738 = _DAT_00156738 + 1;
          local_40 = *(uint *)(param_1 + 0x432c);
          uVar12 = (ulong)local_40;
          if (local_40 != 0) {
            iVar7 = (int)(1000 / (long)*(int *)(param_1 + 0x4258));
            uVar10 = iVar7 + 1;
            uVar5 = uVar10 * 1000;
            local_38 = uVar5 / uVar12;
            if (param_1[0x425c] != (AppleIntelFramebuffer)0x0) {
              _DAT_00156770 = _DAT_00156770 + 1;
              uVar10 = iVar7 + 2U >> 1;
              local_40 = local_40 >> 1;
            }
            cVar3 = _IntelLogEnabled(8,0x19,(ulong)uVar5 % uVar12);
            if (cVar3 != '\0') {
              _DAT_00156780 = _DAT_00156780 + 1;
              _IntelLog(8,0x19,
                        "/Library/Caches/com.apple.xbs/Sources/GPUDriversIntel/GPUDriversIntel-16.0. 32/IONDRV/TGL/AppleIntelFramebuffer/AppleIntelController.cpp"
                        ,&DAT_000020ce,"hwWaitForVBlank","fb%d:(fb=%p, pollUSec=%d)\n",
                        *(undefined4 *)(param_1 + 0x1dc),param_1,local_38);
            }
            cVar3 = _IntelLogEnabled(8,0x19);
            if (cVar3 != '\0') {
              _DAT_00156790 = _DAT_00156790 + 1;
              _IntelLog(8,0x19,
                        "/Library/Caches/com.apple.xbs/Sources/GPUDriversIntel/GPUDriversIntel-16.0. 32/IONDRV/TGL/AppleIntelFramebuffer/AppleIntelController.cpp"
                        ,&DAT_000020cf,"hwWaitForVBlank","pollUsec = %d, waitMSec = %d\n",local_38,
                        uVar10);
            }
            if (param_2 == 1) {
              _DAT_00156798 = _DAT_00156798 + 1;
              uVar8 = TimeCriticalDelayTillVBL(this,param_1);
              return uVar8;
            }
            uVar12 = (ulong)(iVar4 + 0x70040);
            uVar5 = AppleIntelRegisterAccessManager::ReadRegister32
                              (*(AppleIntelRegisterAccessManager **)(this + 0xc40),uVar12);
            cVar3 = AppleIntelFramebuffer::IsCloseToFrameBoundary(param_1);
            if (cVar3 == '\0') {
              uVar11 = AppleIntelRegisterAccessManager::ReadRegister32
                                 (*(AppleIntelRegisterAccessManager **)(this + 0xc40),
                                  (ulong)(iVar4 + 0x70000));
              uVar6 = uVar11 & 0x1fff;
              if (local_40 < (uVar11 & 0x1fff)) {
                _DAT_001567a8 = _DAT_001567a8 + 1;
                uVar6 = local_40;
              }
              _IOSleep((ulong)(((local_40 - uVar6) + 3) * (int)local_38) / 1000);
            }
            else {
              _DAT_001567a0 = _DAT_001567a0 + 1;
              local_38 = (ulong)(uint)((int)local_38 * 5);
              _IODelay();
            }
            uVar6 = AppleIntelRegisterAccessManager::ReadRegister32
                              (*(AppleIntelRegisterAccessManager **)(this + 0xc40),uVar12);
            if (uVar5 == uVar6) {
              _DAT_001567b0 = _DAT_001567b0 + 1;
              _DAT_001567b8 = _DAT_001567b8 + 1;
              PollForFrameChange(this,param_1,(int)((uVar10 * 1000) / local_38),uVar5,(uint)local_38
                                );
            }
            _DAT_001567c0 = _DAT_001567c0 + 1;
            uVar16 = (ulong)(iVar4 + 0x70000);
            uVar10 = AppleIntelRegisterAccessManager::ReadRegister32
                               (*(AppleIntelRegisterAccessManager **)(this + 0xc40),uVar16);
            _IODelay(local_38);
            uVar6 = AppleIntelRegisterAccessManager::ReadRegister32
                              (*(AppleIntelRegisterAccessManager **)(this + 0xc40),uVar16);
            uVar11 = 200;
            do {
              if (((uVar6 ^ uVar10) & 0x1fff) != 0) goto LAB_0006d958;
              _DAT_001567c8 = _DAT_001567c8 + 1;
              _IODelay(local_38);
              uVar6 = AppleIntelRegisterAccessManager::ReadRegister32
                                (*(AppleIntelRegisterAccessManager **)(this + 0xc40),uVar16);
              uVar11 = uVar11 - 1;
            } while (1 < uVar11);
            _DAT_001567d0 = _DAT_001567d0 + 1;
            cVar3 = _IntelLogEnabled(1,0x19);
            if (cVar3 != '\0') {
              _DAT_001567e0 = _DAT_001567e0 + 1;
              _IntelLog(1,0x19,
                        "/Library/Caches/com.apple.xbs/Sources/GPUDriversIntel/GPUDriversIntel-16.0. 32/IONDRV/TGL/AppleIntelFramebuffer/AppleIntelController.cpp"
                        ,&DAT_0000210d,"hwWaitForVBlank","Timed out waiting for frame change\n");
            }
LAB_0006d958:
            uVar10 = AppleIntelRegisterAccessManager::ReadRegister32
                               (*(AppleIntelRegisterAccessManager **)(this + 0xc40),uVar12);
            if (uVar5 != uVar10) {
              return 0;
            }
            _DAT_001567e8 = _DAT_001567e8 + 1;
            cVar3 = _IntelLogEnabled(1,0x19);
            if (cVar3 == '\0') {
              return 0xe00002d6;
            }
            _DAT_001567f8 = _DAT_001567f8 + 1;
            _IntelLog(1,0x19,
                      "/Library/Caches/com.apple.xbs/Sources/GPUDriversIntel/GPUDriversIntel-16.0.32 /IONDRV/TGL/AppleIntelFramebuffer/AppleIntelController.cpp"
                      ,&DAT_00002118,"hwWaitForVBlank",
                      "FB%d: Wait for vblank did not wait for frame change startFrame = %d --> endFr ame = %d\n"
                      ,*(undefined4 *)(param_1 + 0x1dc),uVar5,uVar5);
            return 0xe00002d6;
          }
        }
        _DAT_00156730 = _DAT_00156730 + 1;
        iVar7 = *(int *)(param_1 + 0x3fd8);
        if (iVar7 == -1) {
          _DAT_0015a168 = _DAT_0015a168 + 1;
          pAVar9 = param_1 + 0x49f0;
        }
        else {
          _DAT_00155228 = _DAT_00155228 + 1;
          _DAT_0015a160 = _DAT_0015a160 + 1;
          pAVar9 = param_1 + 0x4a08;
        }
        iVar14 = 0x21;
        lVar1 = DAT_00155220 + 1;
        lVar2 = DAT_0015a158 + 1;
        if (*(int *)(*(long *)pAVar9 + 0x138) != 0) {
          _DAT_00156750 = _DAT_00156750 + 1;
          if (iVar7 == -1) {
            _DAT_0015a168 = _DAT_0015a168 + 1;
            pAVar9 = param_1 + 0x49f0;
          }
          else {
            _DAT_00155228 = _DAT_00155228 + 1;
            _DAT_0015a160 = _DAT_0015a160 + 1;
            pAVar9 = param_1 + 0x4a08;
          }
          lVar1 = DAT_00155220 + 2;
          lVar2 = DAT_0015a158 + 2;
          if (*(long *)(*(long *)pAVar9 + 0x118) != 0) {
            _DAT_00156748 = _DAT_00156748 + 1;
            if (iVar7 == -1) {
              _DAT_0015a168 = _DAT_0015a168 + 1;
              pAVar9 = param_1 + 0x49f0;
            }
            else {
              _DAT_00155228 = _DAT_00155228 + 1;
              _DAT_0015a160 = _DAT_0015a160 + 1;
              pAVar9 = param_1 + 0x4a08;
            }
            lVar1 = DAT_00155220 + 3;
            lVar2 = DAT_0015a158 + 3;
            if (*(int *)(*(long *)pAVar9 + 0x144) != 0) {
              _DAT_00156740 = _DAT_00156740 + 1;
              if (iVar7 == -1) {
                _DAT_0015a168 = _DAT_0015a168 + 1;
                pAVar9 = param_1 + 0x49f0;
              }
              else {
                _DAT_00155228 = _DAT_00155228 + 1;
                _DAT_0015a160 = _DAT_0015a160 + 1;
                pAVar9 = param_1 + 0x4a08;
              }
              if (iVar7 == -1) {
                _DAT_0015a168 = _DAT_0015a168 + 1;
                pAVar13 = param_1 + 0x49f0;
              }
              else {
                _DAT_00155228 = _DAT_00155228 + 1;
                _DAT_0015a160 = _DAT_0015a160 + 1;
                pAVar13 = param_1 + 0x4a08;
              }
              if (iVar7 == -1) {
                _DAT_0015a168 = _DAT_0015a168 + 1;
                pAVar15 = param_1 + 0x49f0;
              }
              else {
                _DAT_00155228 = _DAT_00155228 + 1;
                _DAT_0015a160 = _DAT_0015a160 + 1;
                pAVar15 = param_1 + 0x4a08;
              }
              iVar14 = (int)((((ulong)(*(ushort *)(*(long *)pAVar13 + 0x146) & 0x1fff) + 1) *
                              ((ulong)(*(uint *)(*(long *)pAVar9 + 0x138) >> 0x10 & 0x3fff) + 1) *
                             1000) / *(ulong *)(*(long *)pAVar15 + 0x118)) + 2;
              lVar1 = DAT_00155220 + 6;
              lVar2 = DAT_0015a158 + 6;
            }
          }
        }
        DAT_0015a158 = lVar2;
        DAT_00155220 = lVar1;
        iVar7 = AppleIntelRegisterAccessManager::ReadRegister32
                          (*(AppleIntelRegisterAccessManager **)(this + 0xc40),
                           (ulong)(iVar4 + 0x70040));
        _IOSleep(iVar14);
        iVar4 = AppleIntelRegisterAccessManager::ReadRegister32
                          (*(AppleIntelRegisterAccessManager **)(this + 0xc40),
                           (ulong)(iVar4 + 0x70040));
        if (iVar7 == iVar4) {
          cVar3 = _IntelLogEnabled(8,6);
          if (cVar3 == '\0') {
            return 0xe00002d6;
          }
          _DAT_00156768 = _DAT_00156768 + 1;
          _IntelLog(8,6,
                    "/Library/Caches/com.apple.xbs/Sources/GPUDriversIntel/GPUDriversIntel-16.0.32/I ONDRV/TGL/AppleIntelFramebuffer/AppleIntelController.cpp"
                    ,&DAT_000020bb,"hwWaitForVBlank","ERROR: VBL wait Timed out\n");
          return 0xe00002d6;
        }
        _DAT_00156758 = _DAT_00156758 + 1;
      }
      else {
        _DAT_00156728 = _DAT_00156728 + 1;
      }
    }
    else {
      _DAT_00156718 = _DAT_00156718 + 1;
    }
  }
  else {
    _DAT_00156710 = _DAT_00156710 + 1;
  }
  return 0;
}

void Gen11::hwWaitForVBlank(AppleIntel::AppleIntelBaseController *that,
                             AppleIntel::AppleIntelFramebuffer *fb, uint pipe)
{
	if (!NGreen::callback->isRealTGL) {
		DBGLOG("ngreen", "hwWaitForVBlank: non-TGL skip (avoid #DE on stale fb+0x432c)");
		return;
	}
	FunctionCast(hwWaitForVBlank, callback->ohwWaitForVBlank)(that, fb, pipe);
}

Edited May 14 by Stezza88

jalavoui · May 14

idk what ure doing but this only happens if on acel mode? is frame working solo?

well now that u mention this function as a nblue patch. it's in the pipe=0/1 logic from some time

look at the code

image.png.71ac3669ecd7f332184f6099730c7d03.png

anyway u just cant disable this function. bad idea

Edited May 14 by jalavoui

NootedGreen.kext is on air! It's a long long road to complete..

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

1. Manual Entry in the Structure Editor

2. Creating from the Decompiler

3. Applying to the Listing

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites