Can't Install Catalina Security Update 2021-004

[ThorTheNorseman]

Attempted to update on a Skylake system. The macOS Installer and macOS Installer pre-boot partitions just give me a black screen when I try to select them. I am running Clover r5119 because the later releases that incorporate OpenCore don't work for me. Standalone OpenCore is also broken for me. My kexts are up to date.

 

[Edhawk]

I don't understand why using Clover r5119 would prevent you from upgrading your Catalina installation. I have two HP Microservers using Sandy Bridge Xeon CPU's, using Clover r5119 that run Catalina with the newest security update without any issues. I would expect a Skylake and a Kaby Lake 17, to do the same but quicker.

@ThorTheNorseman I would look to your Clover setup, i.e. the config.plist, as having an issue. Post a copy of your CLOVER folder with the Serial Number, Board Serial Number, SmUUID, MLB and ROM deleted/redacted from your config.plist so we can see what you are using to boot your system.

 

[Edhawk]

@shujin I would look to the update you downloaded as possibly being the cause of the issue you are facing. You may need to look at deleting the current download and downloading it again. Unfortunately there doesn't seem to be a standalone download for this security update, yet.

 

[ThorTheNorseman]

I don't understand why using Clover r5119 would prevent you from upgrading your Catalina installation. I have two HP Microservers using Sandy Bridge Xeon CPU's, using Clover r5119 that run Catalina with the newest security update without any issues. I would expect a Skylake and a Kaby Lake 17, to do the same but quicker.

@ThorTheNorseman I would look to your Clover setup, i.e. the config.plist, as having an issue. Post a copy of your CLOVER folder with the Serial Number, Board Serial Number, SmUUID, MLB and ROM deleted/redacted from your config.plist so we can see what you are using to boot your system.

Here is my EFI folder. There are bits in there that I suspect are unnecessary, such as support for integrated audio and graphics (I need neither). There also seem to be some patches that have been made obsolete by WhateverGreen. Tried to clean that up before uploading this, but my system just refused to boot, so here's the unaltered one, with warts and all.

 

[Edhawk]

The config.plist is not too bad.

What really won't be helping your setup the following:

1. The duplicate/multiple SSDT's for CPU power management,
2. The SSDT for Nvidia Audio,
3. The SSDT-USB-Z170-Gaming-ITXac.aml for your USB ports, as this is trying to activate 19 USB ports, and
4. The obsolete kexts in the '/CLOVER/kexts/Other-old' sub-folder.
5. As you said your config.plist has a few unnecessary entries enabled, but that is fairly easy to fix.

From the above you need to do the following:

1. Delete SSDT-i7-6700.aml & the SSDT-i7-6700T.aml from the /CLOVER/ACPI/patched folder. Leaving jus the SSDT-i7-6700K.aml, which is I hope a match for your CPU. The two incorrect SSDT's will be doing nothing useful for your setup, except possibly messing up the CPU power management.
2. Delete the SSDT-Nvidia-HDMI-Audio.aml from the same folder. You are using an AMD graphics card so this will be doing nothing useful. Possibly messing up your setup.
3. Delete or edit the SSDT-USB-Z170-Gaming-ITXac.aml, so it matches your system and only activates 15 USB ports, to keep within Apple's 15 port limit.
4. You are not using USBInjectAll.kext, which is a prerequisite for using an SSDT to enable the USB ports. You don't need this kext when you use a USBPorts.kext or USBMap.kext.

Were I creating a CLOVER folder for your system this is how it would compare to your current setup:

Screenshot of your current Clover folder Screenshot of the Skylake Clover folder I would use



As you can see there is a marked difference between the two CLOVER folders.

1. Two additional SSDT's were added to the /CLOVER/ACPI/patched folder:
   • SSDT-EC-USBX.aml for fixing the Embedded controller and USB power.
   • SSDT-PLUG.aml requires a single entry to be enabled in the config.plist to provide full CPU power management for our Skylake system.
   • The ones marked for deletion above were removed.
2. Changed SMCHelper.efi to VirtualSMC.efi in the /CLOVER/drivers/UEFI folder as it is require when using VirtualSMC.kext.
   • SMCHelper is required when using FakeSMC.kext.
   • The two drivers and kexts should not be mixed and matched.
3. Removed the /CLOVER/kexts sub-folders bar Other, as they are not required and any duplicate kexts will be used by Clover when booting your system.
4. Added AppleALC.kext to your /CLOVER/kexts/Other folder, for built-in Realtek Audio.
5. Added USBInjectAll.kext to your /CLOVER/kexts/Other folder, for USB port discovery and if you decide to retain and edit your SSDT-USB-Z170-Gaming-ITXac.aml.
6. Deleted the /CLOVER/OEM/SystemProductName folder, as you don't need it with your setup.
7. Deleted the generic & Clovy Theme folders and basic pointer icons from the /CLOVER/themes folder.
8. Added Catalina theme to the /CLOVER/themes folder.
9. Deleted the config.default.plist from the CLOVER folder. It isn't used or required.

Your config.plist while OK could still do with some edits, especially given the removal of the CPU power management SSDT's.

I have ignored the config.default.plist, as it would never be used unless you specifically pointed your clover bootloader to use it from the boot screen.

Below is a screenshot comparison of the config.plist you are using (left hand side) and the one I would use for an identical Skylake system (based on my HP ML10 Gen9 server running latest version of macOS Catalina):

APCI 1

• Changes to ACPI Rename patches,
• Addition of ACPI fixes
• Deletion of unnecessary Drop Tables
• Change to SSDT fixes

APCI 2

• Addition of ACPI fixes

BOOT

• Changes to boot arguments
• Addition of NeverHibernate=true & Debug=true

Devices

• Removal of unnecessary USB options
• Removal of unnecessary Add Properties option for IGPU
• Addition of IGPU Headless/Empty framebuffer patch.

Close up of IGPU framebuffer entry


GUI

• Enable mouse & set speed.
• Enable Custom Scan options
• Change Theme from embedded to Catalina
• Add common Hide Volume names, to clean up Clover boot screen

Graphics

• Delete Inject Intel=true
• Delete ig-platform-id
• Add RadeonDeInit=true, for RX 580 dGPU

Kexts and Kernel Patches

• Add KernelXCPM=true
• Remove unnecessary and obsolete patches
• Add various common patches for Catalina including USB port limit patches.

System Parameters

• Remove Inject System ID=true, as not required since Chameleon bootloader was being used.

You don't have to make these changes, that is down to you but this is how I would setup a Skylake system such as yours.

If you do want to use this setup I have attached a CLOVER folder containing all the changes listed above. Obviously it is lacking the SMBIOS Serial Number etc, which you previously redacted.

If using this Clover folder I would recommend you install Clover r5119 to a USB, replace the CLOVER folder on the USB with the one attached below and boot from the USB, not your normal macOS drive. You should be able to tell you are booting from the new CLOVER folder due to the changes to the CLOVER boot theme and removal of some extraneous icons from the clover screen.

If this works, you can then replace your current CLOVER folder with the one attached. It should allow you to run the Catalina Security Update without any issues.