Contribute
Register

[Guide] Patching the kernel for Haswell CPUs, XCPM early reboot

RehabMan

Moderator
Joined
May 3, 2012
Messages
191,716
Motherboard
Intel DH67BL
CPU
Core i7-2600K
Graphics
Intel HD 3000
Mac
MacBook Air
Mobile Phone
iOS
Overview

The first version of OS X to support Haswell CPUs was Mountain Lion 10.8.5. At the same time, for certain CPUs including Haswell, Apple moved CPU power management from AppleIntelCPUPowerManagement.kext to the kernel. This technology is known as XCPM (Xnu CPU Power Management). This technology is enabled for Haswell CPUs automatically and can optionally be use with Ivy Bridge CPUs with the -xcpm kernel flag.

The problem is Apple's computers do not have a locked MSR 0xE2, yet most PC laptops do. When the kernel tries to write to this locked register, it causes a panic. And this panic happens so early in the process that it results in a reboot. Similar to how we must patch AppleIntelCPUPowerManagement.kext for locked CPU MSR 0xE2, the kernel must also be patched for CPUs using XCPM to avoid this reboot.

Background information can be found here: http://www.tonymacx86.com/mavericks-laptop-support/114677-haswell-early-reboot-mavericks-locked-msrs-hp-envy-15-j063cl-i7-4700mq.html


How to patch the kernel

The vanilla kernel is located on your USB installer after running Unibeast. Here's how to patch it:

For Yosemite 10.10.x:
Code:
# in Terminal, assuming your USB is called Installer
cp /Volumes/Installer/System/Library/Kernels/kernel ~/Desktop/kernel_backup
cp /Volumes/Installer/System/Library/Kernels/kernel ~/Desktop/kernel
cd ~/Desktop
# now patch the kernel at ~/Desktop/kernel
perl -pi -e 's|\xe2\x00\x00\x00\x02\x00\x00\x00|\x00\x00\x00\x00\x00\x00\x00\x00|g' kernel
perl -pi -e 's|\xe2\x00\x00\x00\x4c\x00\x00\x00|\x00\x00\x00\x00\x00\x00\x00\x00|g' kernel
perl -pi -e 's|\xe2\x00\x00\x00\x90\x01\x00\x00|\x00\x00\x00\x00\x00\x00\x00\x00|g' kernel
# patched kernel is now at ~/Desktop/kernel
sudo cp kernel /Volumes/Installer/System/Library/Kernels/kernel
After you install OS X to your HDD, you will have vanilla kernel on the HDD, leading to the same instant reboot problem. So, you must re-enter the OS X installer, and go into Terminal (using Utilities -> Terminal) and replace the kernel with the patched version:

Code:
# in Terminal from the OS X installer, assuming your HDD volume is called "Macintosh HD"
cp /System/Library/Kernels/kernel "/Volumes/Macintosh HD/System/Library/Kernels/kernel"
After that, you can exit the installer, and boot into the installed partition to finish installation and reach the desktop.


MD5 sums for the kernel

Check your md5 sums with:
Code:
md5 /Volumes/Installer/System/Library/Kernels/kernel
10.10/10.10.1 kernel
vanilla: 9f1768fddec369e545d938f0f4f76350
xcpm patched: 1938ebb0bd6cdc00930543025d3df887

10.10.2 kernel
vanilla: 8a985412c42c153601580fd1b8bc360e
xcpm patched: cc46457172315aea68d8e1f957d2746c

10.10.3 kernel
vanilla: fd9b0ed2a37a393d145033a2f0ce46b4
xcpm patched: d89759c11c5f434b4434b6fbf0464d6c

A note about Clover

The Clover bootloader has this patch built-in with the config.plist/KernelAndKextPatches/KernelPm option.

Keep in mind if you're not using Clover (and KernelPm), you will have to re-patch the (new) kernel after any OS X update. With Clover, it is automatic provided the code in Clover is updated (if necessary) to patch the (new) kernel.

The Clover guide is linked from the FAQ:

http://www.tonymacx86.com/el-capitan-laptop-support/164990-faq-read-first-laptop-frequent-questions.html


Update 2015-01-26

For details see the blog article: https://racerrehabman.wordpress.com/2014/10/18/yosemitehaswell-kernel-patch-for-early-reboot/
 
Joined
Jul 31, 2012
Messages
449
Motherboard
Lenovo U310
CPU
i5-3317
Graphics
intel HD 4000
Mac
Classic Mac
Mobile Phone
iOS
Thanks for the info.

Is there any windows app out there that can be used to check if MSR 0xE2 is locked?

 

RehabMan

Moderator
Joined
May 3, 2012
Messages
191,716
Motherboard
Intel DH67BL
CPU
Core i7-2600K
Graphics
Intel HD 3000
Mac
MacBook Air
Mobile Phone
iOS
Thanks for the info.

Is there any windows app out there that can be used to check if MSR 0xE2 is locked?

Aida64 can provide a CPU MSR dump (and probably RW-Everything too). If bit 15 of MSR 0xE2 is set, then it is locked.

The U310 has a locked MSR, although there is a patched BIOS available that unlocks it (as well as removing the whitelist).
 
Joined
Jul 31, 2012
Messages
449
Motherboard
Lenovo U310
CPU
i5-3317
Graphics
intel HD 4000
Mac
Classic Mac
Mobile Phone
iOS
Aida64 can provide a CPU MSR dump (and probably RW-Everything too). If bit 15 of MSR 0xE2 is set, then it is locked.

The U310 has a locked MSR, although there is a patched BIOS available that unlocks it (as well as removing the whitelist).

thanks. I've already patched my U310 and have Yosemite up and running.
I'll be getting a new laptop (asus Q301LA/S301LA) next week and want to check before I go investigate how to patch a bios and not brick my new lappy.
I want to use this new laptop to play with Clover. Not sure how much I want to mess with the chimera based U310 since I currently dual boot it Windows.
 

RehabMan

Moderator
Joined
May 3, 2012
Messages
191,716
Motherboard
Intel DH67BL
CPU
Core i7-2600K
Graphics
Intel HD 3000
Mac
MacBook Air
Mobile Phone
iOS
thanks. I've already patched my U310 and have Yosemite up and running.
I'll be getting a new laptop (asus Q301LA/S301LA) next week and want to check before I go investigate how to patch a bios and not brick my new lappy.
I want to use this new laptop to play with Clover. Not sure how much I want to mess with the chimera based U310 since I currently dual boot it Windows.
Keep in mind there is no need to patch BIOS. Especially if you're using Clover, since the KernelPm patches the kernel as it loads, there is no hassle with manual patching.
 
Joined
Jul 31, 2012
Messages
449
Motherboard
Lenovo U310
CPU
i5-3317
Graphics
intel HD 4000
Mac
Classic Mac
Mobile Phone
iOS
Keep in mind there is no need to patch BIOS. Especially if you're using Clover, since the KernelPm patches the kernel as it loads, there is no hassle with manual patching.
That is great to know. thanks!
 
Joined
Nov 5, 2014
Messages
3
Motherboard
Windows 8.1
CPU
4th Gen i5
Graphics
HD 4000
Mac
Classic Mac
Mobile Phone
Most confusing instructions ever o_O
 

RehabMan

Moderator
Joined
May 3, 2012
Messages
191,716
Motherboard
Intel DH67BL
CPU
Core i7-2600K
Graphics
Intel HD 3000
Mac
MacBook Air
Mobile Phone
iOS
In the aida64 application, where can i see the CPU MSR dump ?
I really don't remember, but I found it once... look around.

Bottom line: If you're getting early reboot with a Haswell CPU, locked MSR 0xE2 is the likely cause.
 

RehabMan

Moderator
Joined
May 3, 2012
Messages
191,716
Motherboard
Intel DH67BL
CPU
Core i7-2600K
Graphics
Intel HD 3000
Mac
MacBook Air
Mobile Phone
iOS
I found how to do a CPU debug , you need to right click on bottom of the Aida.
Here is my debug info ..


------[ Versions ]------

Program Version : AIDA64 v4.70.3200
BenchDLL Version: 4.1.622-x64

------[ CPU Info ]------

CPU Type : Mobile DualCore Intel Core i5-480M, 2933 MHz (22 x 133)
CPU Alias : Arrandale-3M
Your CPU is not Haswell. If you're getting early reboot, it is caused by something else (perhaps "Local APIC" panic).

You should read here: http://www.tonymacx86.com/yosemite-laptop-support/146864-guide-booting-os-x-installer-laptops-unibeast-chimera-chameleon.html

Please do not write further posts regarding this here (open a separate thread). Since you do not have a Haswell, CPU, your posts are off-topic. Thanks.
 
Top