[IT BOOTS! (WIP)] ThinkPad X1 Carbon Gen 9 (i5-1145G7, Iris Xe) — macOS Tahoe 26.7.1 with working Metal 2, Wi-Fi and audio
>Flair: IT BOOTS! (WIP) — the graphics and Wi-Fi drivers here are experimental (WhateverXe, AirportItlwm alpha), so this is a documentation post, not a support request. Everything below was verified on one machine; no EFI is offered as a finished product.
TL;DR: Iris Xe (80 EU, 8086:9A49) runs with Metal 2 on Tahoe — but only on 26.7.1 build 25G241. On 26.7.2 (25G332) the accelerator silently refuses to start and you get an 8 MB VESA framebuffer. The OS build is the whole game, and no kext, quirk or boot-arg changes that.
Hardware
|||
|:-|:-|
|Model|ThinkPad X1 Carbon Gen 9, 20XXS7UY00|
|CPU|i5-1145G7 (Tiger Lake-UP3, 4C/8T, model 0x8C)|
|iGPU|Intel Iris Xe, 80 EU, 8086:9A49|
|RAM|16 GB LPDDR4x|
|Storage|512 GB NVMe|
|Display|1920×1200 internal eDP|
|Wi-Fi/BT|Intel AX201 CNVi (8086:A0F0)|
|Audio|Intel cAVS (8086:A0C8) + Realtek codec|
|Ethernet|none|
Software
- macOS Tahoe 26.7.1 (25G241) — pinned deliberately, see the build pin
- OpenCore 1.0.8, SMBIOS MacBookPro16,2
- CPUID spoofed to Ice Lake-U (0x000706E5)
- WhateverXe 0.6.1 + WhateverXe-Graphics 0.3.2
- No OpenCore Legacy Patcher root patches — they conflict with the WEX payload
✅ Working
- Boot — OpenCore, ~20 s from shutdown
- Graphics: Metal 2 — VRAM 1536 MB, 1920×1200 internal, Liquid Glass, Dock, animations
- Wi-Fi — AirportItlwm (Tahoe build), 802.11ac, no HeliPort needed
- Audio — AppleALC 1.9.8 + SimpleHDA + alcid=11 (with keepsyms=1)
- Keyboard + TrackPoint — VoodooPS2 with all four plugin entries
- Trackpad — VoodooI2C + VoodooI2CHID with -vi2c-force-polling
- Battery — ECEnabler, percentage/charging
- USB — all ports
❌ Not working
- Bluetooth (AX201) — firmware upload fails: IntelBluetoothFirmware loads but its service sits at !registered, !matched, and macOS reports the generic stub Chipset: BCM_4350C2 / Firmware: v0 c0 / State: Off. Full documented kext set was used (Firmware 2.5.0 + IntelBTPatcher + BlueToolFixup, no Injector); the remaining suspects are the absent USB port map and the known incompleteness of Intel BT on Apple's stack
- Hardware video decode — Safari/YouTube video is black. The video adapter is build-locked; workaround is software decode in a Chromium browser (brave://flags → Hardware-accelerated video decode → Disabled)
- AirDrop / AWDL / Handoff — Intel Wi-Fi limitation
- Sleep / wake — Modern Standby (S0ix) firmware, not attempted
- External displays — untested, reportedly unsolved on this platform
- Fingerprint reader — no driver
The finding that matters: the OS build is part of the driver
WhateverXe patches the running kernel by byte pattern and fixed offset. Its accelerator admission guard compares raw instruction bytes at _IOProtectCacheMode+0xCA:
Code block
25G241 (26.7.1): E8 71 CB 02 00 ✅ admitted → TGLMMIOStrongUCRouted = Yes
25G332 (26.7.2): E8 A1 CB 02 00 ❌ refused → TGLMMIOStrongUCRouted = No
Same instruction, same callee (_pmap_enter_options); the displacement moved 0x30 because Apple relinked the kernel. The result is deceptive: AppleIntelTGLGraphics + …Framebuffer load, /Library/Extensions looks right, kmutil shows everything, VRAM reports 1536 MB — and system_profiler SPDisplaysDataType returns nothing, because the accelerator never started.
The timeline explains it: Apple shipped 26.7.2 on 26 Oct 2026; WhateverXe 0.6.1 shipped 27 Oct, validated against the previous kernel.
Verify the installer media, not its filename:
bash
cat /Volumes/Install*/.IAPhysicalMedia
# ProductBuildVersion = 25G241, ProductVersion = 26.7.1
Config essentials
Code block
Booter/Quirks: SetupVirtualMap = true ← hangs ExitBootServices when false on this firmware
EnableWriteUnprotector = false
RebuildAppleMemoryMap = true
SyncRuntimePermissions = true
ProvideCustomSlide = true
EnableSafeModeSlide = true
FixupAppleEfiImages = true
AllowRelocationBlock = true
Kernel/Quirks: AppleXcpmExtraMsrs = true
ProvideCurrentCpuInfo = true
DisableLinkeditJettison = true
boot-args: -allow3d -disablegfxfirmware -vi2c-force-polling alcid=11 keepsyms=1
Security: SecureBootModel = Disabled, csr 0x803
Gotchas worth saving someone an evening
- OCLP is not an option here. Its root patches install an IO80211.framework that panics against the WEX payload: mapping process is a platform binary, but mapped file is not
- OpenCore does not load nested PlugIns. VoodooI2CServices, VoodooGPIO, VoodooInput, VoodooPS2Keyboard/Mouse/Trackpad each need their own Kernel → Add entry, dependencies first — otherwise the parent loads and the hardware stays dead
- Tahoe removed AppleHDA. AppleALC needs SimpleHDA in the order Lilu → AppleALC → SimpleHDA plus keepsyms=1. Without keepsyms=1 you get zero audio devices, not silence — that distinction is what finally pointed at the stack instead of the layout
- SecureBootModel=Default hides the macOS entry from the picker
- Intel BT needs IntelBTPatcher on Monterey+ per the vendor docs (Firmware ≥2.2.0 + BTPatcher + BlueToolFixup, no Injector). Still not working here, so treat AX201 BT as incomplete
Credits
acidanthera (OpenCore, Lilu, VirtualSMC, AppleALC, VoodooPS2), the VoodooI2C team, OpenIntelWireless, laobamac (AirportItlwm Tahoe build, SimpleHDA), b00t0x (WhateverXe), and the Dell Latitude 5420 (i5-1145G7) and X1 Carbon Gen 11 write-ups that documented the byte-pattern guard and the I2C0._PS3 ACPI issue.
45 points · 12 comments
Mentions
[IT BOOTS! (WIP)] ThinkPad X1 Carbon Gen 9 (i5-1145G7, Iris Xe) — macOS Tahoe 26.7.1 with working Metal 2, Wi-Fi and audio >Flair: IT BOOTS! (WIP) — the graphics and Wi-Fi drivers here are experimental (WhateverXe, AirportItlwm alpha), so this is a documentation post, not a support request. Everything below was verified on one machine; no EFI is offered as a finished product. TL;DR: Iris Xe (80 EU, 8086:9A49) runs with Metal 2 on Tahoe — but only on 26.7.1 build 25G241. On 26.7.2 (25G332) the accelerator silently refuses to start and you get an 8 MB VESA framebuffer. The OS build is the whole game, and no kext, quirk or boot-arg changes that. Hardware ||| |:-|:-| |Model|ThinkPad X1 Carbon Gen 9, 20XXS7UY00| |CPU|i5-1145G7 (Tiger Lake-UP3, 4C/8T, model 0x8C)| |iGPU|Intel Iris Xe, 80 EU, 8086:9A49| |RAM|16 GB LPDDR4x| |Storage|512 GB NVMe| |Display|1920×1200 internal eDP| |Wi-Fi/BT|Intel AX201 CNVi (8086:A0F0)| |Audio|Intel cAVS (8086:A0C8) + Realtek codec| |Ethernet|none| Software - macOS Tahoe 26.7.1 (25G241) — pinned deliberately, see the build pin - OpenCore 1.0.8, SMBIOS MacBookPro16,2 - CPUID spoofed to Ice Lake-U (0x000706E5) - WhateverXe 0.6.1 + WhateverXe-Graphics 0.3.2 - No OpenCore Legacy Patcher root patches — they conflict with the WEX payload ✅ Working - Boot — OpenCore, ~20 s from shutdown - Graphics: Metal 2 — VRAM 1536 MB, 1920×1200 internal, Liquid Glass, Dock, animations - Wi-Fi — AirportItlwm (Tahoe build), 802.11ac, no HeliPort needed - Audio — AppleALC 1.9.8 + SimpleHDA + alcid=11 (with keepsyms=1) - Keyboard + TrackPoint — VoodooPS2 with all four plugin entries - Trackpad — VoodooI2C + VoodooI2CHID with -vi2c-force-polling - Battery — ECEnabler, percentage/charging - USB — all ports ❌ Not working - Bluetooth (AX201) — firmware upload fails: IntelBluetoothFirmware loads but its service sits at !registered, !matched, and macOS reports the generic stub Chipset: BCM_4350C2 / Firmware: v0 c0 / State: Off. Full documented kext set was used (Firmware 2.5.0 + IntelBTPatcher + BlueToolFixup, no Injector); the remaining suspects are the absent USB port map and the known incompleteness of Intel BT on Apple's stack - Hardware video decode — Safari/YouTube video is black. The video adapter is build-locked; workaround is software decode in a Chromium browser (brave://flags → Hardware-accelerated video decode → Disabled) - AirDrop / AWDL / Handoff — Intel Wi-Fi limitation - Sleep / wake — Modern Standby (S0ix) firmware, not attempted - External displays — untested, reportedly unsolved on this platform - Fingerprint reader — no driver The finding that matters: the OS build is part of the driver WhateverXe patches the running kernel by byte pattern and fixed offset. Its accelerator admission guard compares raw instruction bytes at _IOProtectCacheMode+0xCA: Code block 25G241 (26.7.1): E8 71 CB 02 00 ✅ admitted → TGLMMIOStrongUCRouted = Yes 25G332 (26.7.2): E8 A1 CB 02 00 ❌ refused → TGLMMIOStrongUCRouted = No Same instruction, same callee (_pmap_enter_options); the displacement moved 0x30 because Apple relinked the kernel. The result is deceptive: AppleIntelTGLGraphics + …Framebuffer load, /Library/Extensions looks right, kmutil shows everything, VRAM reports 1536 MB — and system_profiler SPDisplaysDataType returns nothing, because the accelerator never started. The timeline explains it: Apple shipped 26.7.2 on 26 Oct 2026; WhateverXe 0.6.1 shipped 27 Oct, validated against the previous kernel. Verify the installer media, not its filename: bash cat /Volumes/Install*/.IAPhysicalMedia # ProductBuildVersion = 25G241, ProductVersion = 26.7.1 Config essentials Code block Booter/Quirks: SetupVirtualMap = true ← hangs ExitBootServices when false on this firmware EnableWriteUnprotector = false RebuildAppleMemoryMap = true SyncRuntimePermissions = true ProvideCustomSlide = true EnableSafeModeSlide = true FixupAppleEfiImages = true AllowRelocationBlock = true Kernel/Quirks: AppleXcpmExtraMsrs = true ProvideCurrentCpuInfo = true DisableLinkeditJettison = true boot-args: -allow3d -disablegfxfirmware -vi2c-force-polling alcid=11 keepsyms=1 Security: SecureBootModel = Disabled, csr 0x803 Gotchas worth saving someone an evening - OCLP is not an option here. Its root patches install an IO80211.framework that panics against the WEX payload: mapping process is a platform binary, but mapped file is not - OpenCore does not load nested PlugIns. VoodooI2CServices, VoodooGPIO, VoodooInput, VoodooPS2Keyboard/Mouse/Trackpad each need their own Kernel → Add entry, dependencies first — otherwise the parent loads and the hardware stays dead - Tahoe removed AppleHDA. AppleALC needs SimpleHDA in the order Lilu → AppleALC → SimpleHDA plus keepsyms=1. Without keepsyms=1 you get zero audio devices, not silence — that distinction is what finally pointed at the stack instead of the layout - SecureBootModel=Default hides the macOS entry from the picker - Intel BT needs IntelBTPatcher on Monterey+ per the vendor docs (Firmware ≥2.2.0 + BTPatcher + BlueToolFixup, no Injector). Still not working here, so treat AX201 BT as incomplete Credits acidanthera (OpenCore, Lilu, VirtualSMC, AppleALC, VoodooPS2), the VoodooI2C team, OpenIntelWireless, laobamac (AirportItlwm Tahoe build, SimpleHDA), b00t0x (WhateverXe), and the Dell Latitude 5420 (i5-1145G7) and X1 Carbon Gen 11 write-ups that documented the byte-pattern guard and the I2C0._PS3 ACPI issue.
原来的 AppleHDA 在 macOS Tahoe 上没了，AppleALC 的配置接不上，这个插件靠 OpenCore 把原版 AppleHDA 注回去，老声卡的那套 layout 还能继续用。 laobamac/SimpleHDA
Tahoe: No more root patches required for Intel WiFi and analog Audio! Kext-Order: AppleALC >> SImpleHDA boot-arg: keepsyms=1 --- AirportItlw for Sequoia/Tahoe without root patches: Fork: github.com/jzrodriguez98/itlwm/releases Instructions: - Disable Kernel → Block: - com.apple.iokit.IOSkywalkFamily - Kernel → Add: - Add AirportItlwm.kext for Sequoi or Tahoe - Disable or remove Itlwm.kext - Disable IOSkywalk.kext - Disable IO8021FamilyLegacy.kext - Kernel → Quirks: (optional) - If you need AppleVTD to be present, unselect DisableIoMapper if your system supports VT-D, and it's enabled in BIOS.