Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Resolved Disable a failed AMD GPU on a 2011 MacBook Pro [GRUB solution]
- Thread starter brainshutdown
- Start date
- Sort by reaction score
Great news !!!
The Mac OS installer (USB Stick/Pendrive) also boots into Single User Mode. Tested with Sierra and High Sierra installers.
If you do not have a Mac OS system installed (HD / SSD empty), then you can now use the nvram gpu-power-prefs command with the Mac OS installer.
As a bonus, you can also disable SIP with the csrutil command (El Capitan, Sierra and High Sierra). This Single User Mode is special.
I did a complete test:
1 - Clear NVRAM / PRAM
Press Option + Command + P + R keys at boot and wait reboot MacBook Pro.
2 - After reboot, press Option key at boot and plug Mac OS installer (USB Stick/Pendrive).
Now the gpu-power-prefs will start with the AMD GPU with red screen and white stripes.
3 - You will see the Mac OS installer icon and a Wi-Fi selection menu (red screen and white stripes).
Press the Command + S keys and hold down these keys and click the Mac OS installer icon.
Hold down the Command + S keys until the Single User Mode process is finished and the command prompt appears to write the nvram commands.
4 - Now write these nvram commands:
5 - Reboot the system:
You are now enabled to use GRUB Solution.
The Mac OS installer (USB Stick/Pendrive) also boots into Single User Mode. Tested with Sierra and High Sierra installers.
If you do not have a Mac OS system installed (HD / SSD empty), then you can now use the nvram gpu-power-prefs command with the Mac OS installer.
As a bonus, you can also disable SIP with the csrutil command (El Capitan, Sierra and High Sierra). This Single User Mode is special.
I did a complete test:
1 - Clear NVRAM / PRAM
Press Option + Command + P + R keys at boot and wait reboot MacBook Pro.
2 - After reboot, press Option key at boot and plug Mac OS installer (USB Stick/Pendrive).
Now the gpu-power-prefs will start with the AMD GPU with red screen and white stripes.
3 - You will see the Mac OS installer icon and a Wi-Fi selection menu (red screen and white stripes).
Press the Command + S keys and hold down these keys and click the Mac OS installer icon.
Hold down the Command + S keys until the Single User Mode process is finished and the command prompt appears to write the nvram commands.
4 - Now write these nvram commands:
Code:
nvram fa4ce28d-b62f-4c99-9cc3-6815686e30f9:gpu-power-prefs=%01%00%00%00
nvram boot-args="-v"5 - Reboot the system:
Code:
rebootYou are now enabled to use GRUB Solution.
Unfortunately not. This procedure is for those who have the Mac OS installer and do not need to use ArchLinux to enable Intel's gpu-power-prefs with empty HD / SSD.
No system installed to boot from Single User Mode or Single User Recovery Mode.
High Sierra have inside AppleMuxControl.kext the variable NVRAM FA4CE28D-B62F-4C99-9CC3-6815686E30F9:backlight-regs.
I do not know if this NVRAM variable can change the brightness of the screen.
This link has the value of nvram backlight-regs but I do not know how to enter this value correctly.
FA4CE28D-B62F-4C99-9CC3-6815686E30F9:backlight-regs
0c000c01 0c010c01 ff030000 0c010000
https://github.com/ah-/gmux-scripts/issues/1#issuecomment-68113930
Hi,
My Macbook Pro 2011 was on 10.13 in September when it died on me (just 3 days after I went High Sierra). However since then I have been using the Page 35 Post 875 Mikey N's Guide to successfully work. I install all updates and after each major one rerun the process again and it has been working without fail.
Everything works - Sleep, Hibernate, Brightness, Keyboard Backlight Etc etc.
Now I updated to 13.3.3 on 25th Jan and again everything was working fine, I have rebooted coupla times since then and it was all perfect. (Obviously had to do NVRAM and Moving Kext Process again.)
However now yesterday on rebooting I got some kind of a Kernel Panic and Grey Screen on booting which says "Your Computer restarted because of a problem press any key to continue starting up". Any now I am stuck here. It continues to give me this message no matter what I do.
Safe Mode works just fine. I have been able to download the kernel Panic and its pasted below, I dont understand it much, it seems to be something to do with GPU itself.
Any help is much appreciated
My Macbook Pro 2011 was on 10.13 in September when it died on me (just 3 days after I went High Sierra). However since then I have been using the Page 35 Post 875 Mikey N's Guide to successfully work. I install all updates and after each major one rerun the process again and it has been working without fail.
Everything works - Sleep, Hibernate, Brightness, Keyboard Backlight Etc etc.
Now I updated to 13.3.3 on 25th Jan and again everything was working fine, I have rebooted coupla times since then and it was all perfect. (Obviously had to do NVRAM and Moving Kext Process again.)
However now yesterday on rebooting I got some kind of a Kernel Panic and Grey Screen on booting which says "Your Computer restarted because of a problem press any key to continue starting up". Any now I am stuck here. It continues to give me this message no matter what I do.
Safe Mode works just fine. I have been able to download the kernel Panic and its pasted below, I dont understand it much, it seems to be something to do with GPU itself.
Any help is much appreciated
Code:
Anonymous UUID: 2C3DD95E-1719-C79D-F449-1AE72C0A88B1
Fri Feb 2 08:49:41 2018
*** Panic Report ***
panic(cpu 6 caller 0xffffff7f8a6099e9): "GPU Panic: mux-regs 2 0 1 0 0 0 severity 3 WS-ready 0 switch-state 0 IG FBs 1 EG FBs 0:0 power-state 0 3D idle HDA idle : UH eHlPH
E0L H(L @ H HH
u: GPU is not found. PCI config access fails!!!
\n"@/BuildRoot/Library/Caches/com.apple.xbs/Sources/AppleGraphicsControl/AppleGraphicsControl-3.16.21/src/AppleMuxControl/kext/GPUPanic.cpp:162
Backtrace (CPU 6), Frame : Return Address
0xffffff9118603720 : 0xffffff800824f606
0xffffff9118603770 : 0xffffff800837c654
0xffffff91186037b0 : 0xffffff800836e149
0xffffff9118603830 : 0xffffff8008201120
0xffffff9118603850 : 0xffffff800824f03c
0xffffff9118603980 : 0xffffff800824edbc
0xffffff91186039e0 : 0xffffff7f8a6099e9
0xffffff9118603a40 : 0xffffff7f8a618d53
0xffffff9118603a70 : 0xffffff7f8aeb9eb9
0xffffff9118603aa0 : 0xffffff7f8aeba05d
0xffffff9118603ad0 : 0xffffff7f8b677f99
0xffffff9118603b40 : 0xffffff7f8b66ce79
0xffffff9118603bb0 : 0xffffff7f8a573940
0xffffff9118603c30 : 0xffffff7f8b66c4c8
0xffffff9118603c70 : 0xffffff7f8a56b158
0xffffff9118603cc0 : 0xffffff800886428f
0xffffff9118603d10 : 0xffffff80088c0463
0xffffff9118603d70 : 0xffffff8008328342
0xffffff9118603dc0 : 0xffffff8008254c40
0xffffff9118603e10 : 0xffffff8008231cbd
0xffffff9118603e60 : 0xffffff8008244b7b
0xffffff9118603ef0 : 0xffffff800835857d
0xffffff9118603fa0 : 0xffffff8008201926
Kernel Extensions in backtrace:
com.apple.iokit.IOGraphicsFamily(517.22)[2AEA02BF-2A38-3674-A187-E5F610FD65B7]@0xffffff7f8a55c000->0xffffff7f8a5a2fff
dependency: com.apple.iokit.IOPCIFamily(2.9)[8E6C654E-4A8F-3C6B-BBFE-BA8A68C9C146]@0xffffff7f88a94000
com.apple.driver.AppleMuxControl(3.16.21)[B4DB1D7A-D4DE-3965-94DC-05CE8B9F2802]@0xffffff7f8a5fb000->0xffffff7f8a60dfff
dependency: com.apple.driver.AppleGraphicsControl(3.16.21)[2EB9A384-439B-3BDC-927C-34E390CB0E59]@0xffffff7f8a5ee000
dependency: com.apple.iokit.IOACPIFamily(1.4)[8794C760-FDD9-3664-ADED-4A9BBEC6E517]@0xffffff7f88f3f000
dependency: com.apple.iokit.IOPCIFamily(2.9)[8E6C654E-4A8F-3C6B-BBFE-BA8A68C9C146]@0xffffff7f88a94000
dependency: com.apple.iokit.IOGraphicsFamily(517.22)[2AEA02BF-2A38-3674-A187-E5F610FD65B7]@0xffffff7f8a55c000
dependency: com.apple.AppleGraphicsDeviceControl(3.16.21)[F8503E88-24EF-3DBA-A4D6-FA1CE4C47427]@0xffffff7f8a5f1000
com.apple.kext.AMDLegacySupport(1.6)[595D9BF9-EC9E-3441-A191-3446E3CF78AA]@0xffffff7f8a614000->0xffffff7f8a735fff
dependency: com.apple.iokit.IOACPIFamily(1.4)[8794C760-FDD9-3664-ADED-4A9BBEC6E517]@0xffffff7f88f3f000
dependency: com.apple.iokit.IOPCIFamily(2.9)[8E6C654E-4A8F-3C6B-BBFE-BA8A68C9C146]@0xffffff7f88a94000
dependency: com.apple.iokit.IOGraphicsFamily(517.22)[2AEA02BF-2A38-3674-A187-E5F610FD65B7]@0xffffff7f8a55c000
com.apple.kext.AMD6000Controller(1.6)[20C07AFC-249A-387D-9F54-CECD9B14B762]@0xffffff7f8ae9c000->0xffffff7f8afc9fff
dependency: com.apple.iokit.IOACPIFamily(1.4)[8794C760-FDD9-3664-ADED-4A9BBEC6E517]@0xffffff7f88f3f000
dependency: com.apple.iokit.IOPCIFamily(2.9)[8E6C654E-4A8F-3C6B-BBFE-BA8A68C9C146]@0xffffff7f88a94000
dependency: com.apple.iokit.IOGraphicsFamily(517.22)[2AEA02BF-2A38-3674-A187-E5F610FD65B7]@0xffffff7f8a55c000
dependency: com.apple.kext.AMDLegacySupport(1.6.0)[595D9BF9-EC9E-3441-A191-3446E3CF78AA]@0xffffff7f8a614000
com.apple.kext.AMDLegacyFramebuffer(1.6)[153C1052-E16D-3E8B-9747-E394CF3DF0C3]@0xffffff7f8b66b000->0xffffff7f8b68cfff
dependency: com.apple.iokit.IOACPIFamily(1.4)[8794C760-FDD9-3664-ADED-4A9BBEC6E517]@0xffffff7f88f3f000
dependency: com.apple.iokit.IOPCIFamily(2.9)[8E6C654E-4A8F-3C6B-BBFE-BA8A68C9C146]@0xffffff7f88a94000
dependency: com.apple.iokit.IOGraphicsFamily(517.22)[2AEA02BF-2A38-3674-A187-E5F610FD65B7]@0xffffff7f8a55c000
dependency: com.apple.kext.AMDLegacySupport(1.6.0)[595D9BF9-EC9E-3441-A191-3446E3CF78AA]@0xffffff7f8a614000
BSD process name corresponding to current thread: WindowServer
Mac OS version:
17D47
Kernel version:
Darwin Kernel Version 17.4.0: Sun Dec 17 09:19:54 PST 2017; root:xnu-4570.41.2~1/RELEASE_X86_64
Kernel UUID: 18D901F1-4A03-3FF1-AE34-C26B2732F13C
Kernel slide: 0x0000000007e00000
Kernel text base: 0xffffff8008000000
__HIB text base: 0xffffff8007f00000
System model name: MacBookPro8,2 (Mac-94245A3940C91C80)
System uptime in nanoseconds: 91068510828
last loaded kext at 87392142368: com.apple.filesystems.autofs 3.0 (addr 0xffffff7f8b75b000, size 45056)
last unloaded kext at 45410355170: com.apple.driver.AppleIRController 352 (addr 0xffffff7f8a4bf000, size 28672)
loaded kexts:
com.avatron.AVExFramebuffer 1.7
com.globaldelight.driver.Boom2Device 1.1
com.kairos.driver.DuetDisplay 2
com.iospirit.driver.rbiokithelper 1.32
io.github.blackgate.AMDGPUWakeHandler 1
com.logmein.driver.LogMeInSoundDriver 4.1.67f95
com.Cycling74.driver.Soundflower 1.6.7
com.globaldelight.driver.BoomDevice 1.1
com.cleverandson.driver.XAerial 1.0.0
com.avatron.AVExVideo 1.7
com.intel.driver.EnergyDriver 2.0
com.paragon-software.filesystems.ntfs 70.1.15
expressvpn.tun 1.0
jp.plentycom.driver.SteerMouse 4.1.3
com.iospirit.CandelairIRBaseDriver 1
at.obdev.nke.LittleSnitch 5094
com.seagate.driver.PowSecDriverCore 5.1.1
com.apple.filesystems.autofs 3.0
com.apple.driver.AppleGraphicsDevicePolicy 3.16.21
com.apple.AGDCPluginDisplayMetrics 3.16.2
com.apple.driver.AppleHV 1
com.apple.driver.AudioAUUC 1.70
com.apple.iokit.IOUserEthernet 1.0.1
com.apple.iokit.IOBluetoothSerialManager 6.0.2f2
com.apple.driver.pmtelemetry 1
com.apple.Dont_Steal_Mac_OS_X 7.0.0
com.apple.kext.AMDLegacyFramebuffer 1.6.0
com.apple.driver.AppleMikeyHIDDriver 131
com.apple.driver.AppleUpstreamUserClient 3.6.4
com.apple.driver.ApplePolicyControl 3.16.21
com.apple.driver.AppleHDAHardwareConfigDriver 280.12
com.apple.driver.AGDCBacklightControl 3.16.2
com.apple.driver.AppleMikeyDriver 280.12
com.apple.driver.AppleIntelHD3000Graphics 10.0.4
com.apple.driver.AppleTyMCEDriver 1.0.3d2
com.apple.driver.AGPM 110.23.30
com.apple.driver.AppleHDA 280.12
com.apple.driver.AirPort.Brcm4331 800.21.30
com.apple.driver.AppleBacklight 170.10.2
com.apple.driver.eficheck 1
com.apple.kext.AMD6000Controller 1.6.0
com.apple.driver.AppleThunderboltIP 3.1.1
com.apple.iokit.AppleBCM5701Ethernet 10.3.1
com.apple.driver.AirPort.Brcm4360 1220.18.1a2
com.apple.driver.AppleMCCSControl 1.5.3
com.apple.iokit.IOBluetoothUSBDFU 6.0.2f2
com.apple.driver.AppleLPC 3.1
com.apple.driver.AppleSMCPDRC 1.0.0
com.apple.driver.AppleMuxControl 3.16.21
com.apple.driver.SMCMotionSensor 3.0.4d1
com.apple.driver.AppleOSXWatchdog 1
com.apple.driver.AppleIntelSNBGraphicsFB 10.0.4
com.apple.driver.AppleSMCLMU 211
com.apple.driver.ACPI_SMC_PlatformPlugin 1.0.0
com.apple.driver.AppleIntelSlowAdaptiveClocking 4.0.0
com.apple.driver.AppleFIVRDriver 4.1.0
com.apple.driver.AppleUSBTCKeyEventDriver 254
com.apple.driver.AppleUSBTCKeyboard 254
com.apple.filesystems.apfs 748.41.3
com.apple.driver.AppleFileSystemDriver 3.0.1
com.apple.filesystems.hfs.kext 407.30.1
com.apple.AppleFSCompression.AppleFSCompressionTypeDataless 1.0.0d1
com.apple.BootCache 40
com.apple.AppleFSCompression.AppleFSCompressionTypeZlib 1.0.0
com.apple.driver.AppleSDXC 1.7.6
com.apple.driver.AppleFWOHCI 5.5.8
com.apple.driver.AppleAHCIPort 329
com.apple.driver.AppleSmartBatteryManager 161.0.0
com.apple.driver.AppleRTC 2.0
com.apple.driver.AppleACPIButtons 6.1
com.apple.driver.AppleHPET 1.8
com.apple.driver.AppleSMBIOS 2.1
com.apple.driver.AppleACPIEC 6.1
com.apple.driver.AppleAPIC 1.7
com.apple.driver.AppleIntelCPUPowerManagementClient 220.0.0
com.apple.nke.applicationfirewall 183
com.apple.security.TMSafetyNet 8
com.apple.security.quarantine 3
com.apple.IOBufferCopyEngineTest 1
com.apple.driver.AppleIntelCPUPowerManagement 220.0.0
com.apple.kext.triggers 1.0
com.apple.driver.AppleSSE 1.0
com.apple.iokit.IOSurface 209.2.2
com.apple.iokit.IOSerialFamily 11
com.apple.kext.AMDSupport 1.6.0
com.apple.AppleGPUWrangler 3.16.2
com.apple.driver.DspFuncLib 280.12
com.apple.kext.OSvKernDSPLib 526
com.apple.driver.AppleBacklightExpert 1.1.0
com.apple.iokit.IONDRVSupport 517.22
com.apple.driver.AppleHDAController 280.12
com.apple.iokit.IOHDAFamily 280.12
com.apple.iokit.IOAudioFamily 206.5
com.apple.vecLib.kext 1.2.0
com.apple.iokit.IOEthernetAVBController 1.1.0
com.apple.iokit.IO80211Family 1200.12.2
com.apple.driver.mDNSOffloadUserClient 1.0.1b8
com.apple.driver.corecapture 1.0.4
com.apple.driver.AppleSMBusController 1.0.18d1
com.apple.kext.AMDLegacySupport 1.6.0
com.apple.driver.AppleSMBusPCI 1.0.14d1
com.apple.AppleGraphicsDeviceControl 3.16.21
com.apple.driver.AppleGraphicsControl 3.16.21
com.apple.iokit.IOFireWireIP 2.2.8
com.apple.iokit.IOGraphicsFamily 517.22
com.apple.driver.IOPlatformPluginLegacy 1.0.0
com.apple.driver.IOPlatformPluginFamily 6.0.0d8
com.apple.iokit.IOSlowAdaptiveClockingFamily 1.0.0
com.apple.driver.AppleThunderboltEDMSink 4.1.2
com.apple.driver.AppleThunderboltDPOutAdapter 5.0.2
com.apple.driver.usb.cdc.ecm 5.0.0
com.apple.driver.usb.cdc.ncm 5.0.0
com.apple.iokit.BroadcomBluetoothHostControllerUSBTransport 6.0.2f2
com.apple.iokit.IOBluetoothHostControllerUSBTransport 6.0.2f2
com.apple.iokit.IOBluetoothHostControllerTransport 6.0.2f2
com.apple.driver.IOBluetoothHIDDriver 6.0.2f2
com.apple.iokit.IOBluetoothFamily 6.0.2f2
com.apple.driver.AppleUSBMultitouch 261
com.apple.iokit.IOUSBHIDDriver 900.4.1
com.apple.driver.usb.IOUSBHostHIDDevice 1.2
com.apple.driver.usb.cdc 5.0.0
com.apple.driver.usb.networking 5.0.0
com.apple.driver.usb.AppleUSBHostCompositeDevice 1.2
com.apple.filesystems.hfs.encodings.kext 1
com.apple.driver.usb.AppleUSBHub 1.2
com.apple.driver.AppleThunderboltDPInAdapter 5.0.2
com.apple.driver.AppleThunderboltDPAdapterFamily 5.0.2
com.apple.driver.AppleThunderboltPCIDownAdapter 2.1.3
com.apple.driver.AppleXsanScheme 3
com.apple.iokit.IOAHCIBlockStorage 301.40.2
com.apple.iokit.IOFireWireSBP2 4.2.7
com.apple.driver.AppleThunderboltNHI 4.5.6
com.apple.iokit.IOThunderboltFamily 6.6.3
com.apple.driver.AppleUSBMergeNub 900.4.1
com.apple.driver.usb.AppleUSBHostPacketFilter 1.0
com.apple.iokit.IOUSBFamily 900.4.1
com.apple.iokit.IOFireWireFamily 4.6.8
com.apple.driver.AppleUSBHostMergeProperties 1.2
com.apple.iokit.IOAHCIFamily 288
com.apple.driver.usb.AppleUSBEHCIPCI 1.2
com.apple.driver.usb.AppleUSBUHCIPCI 1.2
com.apple.driver.usb.AppleUSBUHCI 1.2
com.apple.driver.usb.AppleUSBEHCI 1.2
com.apple.driver.AppleEFINVRAM 2.1
com.apple.driver.AppleEFIRuntime 2.1
com.apple.iokit.IOHIDFamily 2.0.0
com.apple.iokit.IOSMBusFamily 1.1
com.apple.security.sandbox 300.0
com.apple.kext.AppleMatch 1.0.0d1
com.apple.iokit.IOBufferCopyEngineFamily 1
com.apple.driver.DiskImages 480.30.2
com.apple.driver.AppleFDEKeyStore 28.30
com.apple.driver.AppleEffaceableStorage 1.0
com.apple.driver.AppleKeyStore 2
com.apple.driver.AppleUSBTDM 439.30.4
com.apple.driver.AppleMobileFileIntegrity 1.0.5
com.apple.iokit.IOUSBMassStorageDriver 140.30.1
com.apple.iokit.IOSCSIBlockCommandsDevice 404.30.2
com.apple.iokit.IOSCSIArchitectureModelFamily 404.30.2
com.apple.iokit.IOStorageFamily 2.1
com.apple.driver.AppleCredentialManager 1.0
com.apple.driver.KernelRelayHost 1
com.apple.iokit.IOUSBHostFamily 1.2
com.apple.driver.usb.AppleUSBCommon 1.0
com.apple.driver.AppleBusPowerController 1.0
com.apple.driver.AppleSEPManager 1.0.1
com.apple.driver.IOSlaveProcessor 1
com.apple.iokit.IOTimeSyncFamily 650.5
com.apple.iokit.IONetworkingFamily 3.4
com.apple.iokit.IOReportFamily 31
com.apple.driver.AppleAC
EOFIs there anything wrong or have you been able to fix the brightness problem in HighSierra with GRUB Solution? Brightness slider do not show with GRUB Solution.
Are not you making some confusion? Something like you no longer use GRUB Solution but forgot to remove AMDGPUWakeHandler.kext from within /System/Library/Extensions?
"Wondering what made it act up now after 2 months and numerous restarts."
Maybe you were able to start normally because of the SIP Enable (with AMDGPUWakeHandler.kext inside /System/Library/Extensions). With SIP enable, only the signed kexts are loaded.
AMDGPUWakeHandler is unsigned kext.
In these latest boots with HighSierra you should have disabled the SIP to move the AMDRadeonX3000.kext and with that enabled the loading of the unsigned kext AMDGPUWakeHandler.kext.
Theoretically you would not need to remove the AMDGPUWakeHandler.kext from /System/Library/Extensions. All you have to do is to use the SIP Enable to not load this AMDGPUWakeHandler.kext during boot.
hi everyone, i think i made a great mistake
i have a MBPro early 2011 15" os 10.13.3 with the GPU dead, i follow the steps of AppleMacFinder and everythinks seems good, the mac boots again, but almost everytime i try to reboot it don't start anymore so i have to repeat everything
so i follow the step at the beginning of this post but now i have a kernell panic and i dont know what i have to do, there are same ways to step back?
please help
thanks
i have a MBPro early 2011 15" os 10.13.3 with the GPU dead, i follow the steps of AppleMacFinder and everythinks seems good, the mac boots again, but almost everytime i try to reboot it don't start anymore so i have to repeat everything
so i follow the step at the beginning of this post but now i have a kernell panic and i dont know what i have to do, there are same ways to step back?
please help
thanks
Why is it so hard to find someone with an Apple Developer account to make the signed kext for us? I have a friend's 2011 MacBook Pro that's been sitting on a table for months awaiting it. Disabling SIP is not an option for the GRUB solution, and the freezes on sleep vs. heat are not an option for the older solution.... I used to have an Apple Developer account years ago, just to get some Apple software I needed, but it's not free any more. Does no one know of anybody with a Developer account who could be prevailed upon to do this one thing for us?
[doublepost=1518660710][/doublepost]
Are you using the EFI or GRUB fix?
I'm confused with this, since the GRUB solution requires the SIP to be disabled, specified in step 2.
Are you using the EFI or GRUB fix?
I'm confused with this, since the GRUB solution requires the SIP to be disabled, specified in step 2.
Attachments
^ Right, but you can't turn SIP back on, or else the kext fails, unless we get a signed one. That's what's not an option: running normally without SIP.
What are you talking about? My MBP's running normally with the SIP disabled, with the kext BSD provided. You don't really have to turn SIP back on if you don't do anything low-level that would potentially damage your system. The only time you do that is when applying the GRUB solution.
Last edited:
^ It's not an option to run without SIP enabled after the GRUB solution is applied because this is not my Mac on which I'm being asked to do the surgery. If it were my Mac, I could live with it. But I have three friends who need the solution, and I cannot leave them with this security vulnerability. (Any more than I can return them a Mac with which sleep cannot be used or it runs hotter with the other solution.) The layman will not understand; it's a whole different set of expectations. We need a signed kext post haste, so that they're returned a Mac with the security to which they've become accustomed.
The layman must learn. And they should. Since they are laymen, they wouldn't be doing anything low-level, would they? That's why you're doing it. You can also give them a reminder not to open any suspicious email or web links. That's the most you can do.
I'm a layman after all, but, I did take the effort to learn about this. Your friends should as well, at least in knowing and understanding the risk involved in making a vintage, out of warranty machine work again.
Oh my, how demanding are we now? If you need a solution post haste, maybe you should pay someone a commission to make that kext. Apple won't. Developers probably won't either, since it might be a breach of their terms and agreement.
Besides, the SIP was only incorporated in El Capitan to prevent laymen from doing stupid stuff or install apps that can potentially crash systems by preventing those software from installing stuff that can corrupt system files. OS X versions earlier than El Capitan didn't have it, and they don;t really have problems, so, the real question is, did the Mac OS really need it, or is it really just an added level of security on top the already secure OS X?
It's really up to you. Or, up to your friends, if they can live with the risk. Rather that than bricks, yes?
Last edited:
^ Now you're just rationalizing and hand-waving. Grandma won't understand. We need a signed kext.
I'm not rationalizing, since I haven't said anything that isn't applicable to anyone or isn't factual. I'm just being practical, whereas you're just being demanding like a child, as if people owe you something.
The solution is there. You can use it now and educate your layman friends instead, so they'll have working machines. Or, you can wait in vain for something that might not come.
I'm done. You can have the last word on this matter.
Grandma pledges $100 reward to anyone whose efforts lead to getting someone with an Apple Developer account making us a signed AMDGPUWakeHandler kext.
Apple does not make life easier for the domestic/home developer.
Now with the High Sierra, Apple has increased the security level to load a kext.
If for those who have a company it is already a bureaucracy to obtain a certificate for the signed kext, then imagine for a domestic/home developer.
"What’s all this mean? For more details, see below the jump.
Apple has been trying to discourage third party software developers from using kernel extensionsfor the past few years. The reason for this has been that kernel extensions are able to plug into the macOS kernel’s space and access low-level resources, like hardware devices. The issue for Apple is that, when kernel extensions aren’t working right, the whole OS has problems that wouldn’t otherwise happen."
"A memory error in a kernel extension can cause a kernel panic, which crashes the whole operating system."
https://derflounder.wordpress.com/2017/08/24/kernel-extensions-and-macos-high-sierra/
I come from the Linux world, so the user operating the system has only the "Standard/Normal" rights. I use this same rule in Mac OS.
If you use SIP disabled, then you should be careful to always be using the user with administrative rights (user created during Mac OS installation).
The user created during the Mac OS installation has administrator rights. This user I use only to install some app by the authentication method / config System Preferences / kextload AMDRadeonX3000.kext / Shutdown or Reboot Macbook Pro.
https://www.ru.ac.za/media/rhodesun...ges/helpconfigs/OSX_Authentication_Window.png
https://developer.apple.com/library...ion_concepts/02authconcepts/authconcepts.html
After completing the Mac OS installation, I create a user with "Standard" rights -> System Preferences -> Users & Groups.
This increases the level of security in the system. Certain directories and configuration files can only be accessed by increasing the user's right level. So a virus / malware would have difficulty contaminating the entire system.
In graphical mode you have the window authentication.
If you want to change to a user with administrative rights in Terminal, then you have to use the command "su" command.
You can know the user logged in with the "whoami" command.
Example - switch normal/standard user to admin user and Halt/Power off Macbook Pro:
macstan: user standard rights
macadmin: user with administrative rights
Open Finder -> Applications -> Terninal:
If you use SIP disabled, then you should be careful to always be using the user with administrative rights (user created during Mac OS installation).
The user created during the Mac OS installation has administrator rights. This user I use only to install some app by the authentication method / config System Preferences / kextload AMDRadeonX3000.kext / Shutdown or Reboot Macbook Pro.
https://www.ru.ac.za/media/rhodesun...ges/helpconfigs/OSX_Authentication_Window.png
https://developer.apple.com/library...ion_concepts/02authconcepts/authconcepts.html
After completing the Mac OS installation, I create a user with "Standard" rights -> System Preferences -> Users & Groups.
This increases the level of security in the system. Certain directories and configuration files can only be accessed by increasing the user's right level. So a virus / malware would have difficulty contaminating the entire system.
In graphical mode you have the window authentication.
If you want to change to a user with administrative rights in Terminal, then you have to use the command "su" command.
You can know the user logged in with the "whoami" command.
Example - switch normal/standard user to admin user and Halt/Power off Macbook Pro:
macstan: user standard rights
macadmin: user with administrative rights
Open Finder -> Applications -> Terninal:
Code:
macstan$ su macadmin
Password (enter macadmin password):
bash-3.2$
bash-3.2$ whoami
macadmin
bash-3.2$ sudo shutdown -h now
Password (enter macadmin password):
Last edited:
Which is what I pointed out earlier on. It's not as simple to have a kext signed on a whim, just because a user with layman friends want it post haste. I've been checking my developer account (I have one under my Apple ID), but they changed the terms. I now have to re-enroll my account as a developer ID, with additional legalese. Any signed kext is tied to that ID, and if that kext does harm to any system, that developer will be held liable.
Which I also pointed out. Since laymen users, even with admin privileges, don't necessarily (or are afraid to) dive into low-level coding, running the system with SIP disabled shouldn't really be much of an issue.
Addendum:
Found this discussion on Stackoverflow. It's a bit old, but it addresses the reason why kext signing isn't as easy as it sounds, since apple does not allow/no longer allows non-Apple kext at all.
Last edited:
You can disable SIP only partially (just the kext signature enforcement part) by doing:
instead of:
*Technically* disabling kext signature enforcement alone is enough to disrupt SIP security wise (as anyone with root privileges can load a kext crafted to disable the rest of SIP), but that'd require an attacker to specifically target this configuration which is quite unlikely (it being a non standard one).
@brainshutdown, @nsgr
I found this article regarding kext signing and unsigned kexts bypassing the SIP protocol. I can vaguely understand a few things, but, maybe you guys can shed light on this for us.
https://pikeralpha.wordpress.com/2015/07/28/apples-kext-signing-bypassed/
[doublepost=1518736811][/doublepost]
Wouldn't that require a password prompt to begin with? Any attempted changes inside the System folder requires root admin privileges, like installing apps in the Applications and Utilities folder.
I found this article regarding kext signing and unsigned kexts bypassing the SIP protocol. I can vaguely understand a few things, but, maybe you guys can shed light on this for us.
https://pikeralpha.wordpress.com/2015/07/28/apples-kext-signing-bypassed/
[doublepost=1518736811][/doublepost]
Wouldn't that require a password prompt to begin with? Any attempted changes inside the System folder requires root admin privileges, like installing apps in the Applications and Utilities folder.
csrutil is only usable from Terminal from recovery mode, or from single user mode (if it was usable from within regular macOS that'd defeat the point).
Long story short, SIP limits what the root user can do; if an attacker obtained root privileges you're already pretty much screwed but SIP limits the damage a bit by preventing loading kernel code by making sure Apple signed it, or tampering with important OS files or with the memory of Apple software. With the command I suggested SIP isn't turned off completely ("just" the kext/kernel code Apple signature enforcement) which in theory is enough for an attacker to overthrow SIP altogether by loading a malicious kext; but in practice it's unlikely an attacker would focus on this non-default SIP configuration.
Last edited: