Haswell/Mavericks Troubles
Many people with Haswell laptops (and some desktops) have been running into a new problem Apple has thrown at us. The new Mavericks kernel has power management moved down into the kernel. For this reason, my MacBookAir6,2 running Mavericks does not load AppleIntelCPUPowerManagement. In the past, we patched AppleIntelCPUPowerManagement to avoid the kernel writing to locked CPU MSRs (machine specific registers, credit RevoGirl). Some BIOSes lock some of these registers (the common one is 0xE2, I don't know if others can be locked as well). The problem is that touching these registers when they are locked causes an unexpected fault and you get a KP. It seems this KP is so early, that the kernel is unprepared to handle it, and the computer reboots.
Some people have found that if they use a kernel modified for AMD systems, they are able to boot (see here:
http://www.tonymacx86.com/mountain-lion-laptop-support/110981-asus-g750jx-4.html#post697066). I tried this and it indeed works. But other things break... I was able to install (using that kernel), but I couldn't boot with caches (always had to use "-f"). Booting with caches caused a KP. In addition, there was no power management. CPU was running at x24 always.
But...
I decided to see what I could do by building my own kernel. My main thought was to make some changes, see if I could avoid touching locked MSRs with modifications to the source code with the idea to fold the changes into a patch. So, I downloaded the kernel source from opensource.apple.com, found out how to build it (thanks google!), and tried to use it. On first try, I didn't make any changes... and I was surprised that I was able to start the installer with the newly built kernel! No changes and it just works. WTF?
Turns out the sources for the kernel do not include the parts for xnu power management. Since it isn't there, it doesn't cause the problem. But of course, AppleIntelCPUPowerManagement expects for PM to be provided by the kernel, so it doesn't work. It doesn't crash, but still no power management. Since 10.8.5 does not have this change, I decided to try the (patched) AppleIntelCPUPowerManagement from 10.8.5 (v214). And that actually works.
I don't really like doing rollbacks like that, but it is probably a workable solution until something better comes along.
I still think it might be possible to patch the kernel to avoid the MSR writing problem. See updates below on patches.
Update 2013-11-25
With some prodding by Pike's blog, I went back to my original patch that I had attempted a number of weeks ago, and I found the mistakes I had made with my patch (this was prior to building the kernel from sources). The details are on my blog here:
http://racerrehabman.wordpress.com/2013/11/25/maverickshaswell-kernel-patch-for-early-reboot/
As a result, I'm now running a patched mach_kernel (not built from source, but patched from retail), MacBookPro11,2 smbios.plist, AppleIntelCPUPowerManagement.kext, ssdt.aml generated with Pike's script (plugin-type=1). Of course, AppleIntelCPUPowerManagement does not load, as all CPU power management is handled by the kernel (xcpm). In other words, it is running just as a real Haswell MacBookPro would as far as power management. The only "problem" that I can see, is that I'm not getting pstates between x8 and x24, much like the results with iMac14,2. I wonder if something is missing (taking the place of X86PlatformPlugin plists?) that the bootloader/DSDT/SSDT should be injecting to inform the kernel's xcpm behavior? More investigation is needed. I will investigate by watching the behavior of my real MacBookAir6,2 and perhaps a friend's real MacBookPro11,x.
I will update this post should I find more information.
Just for ease of reference here is the currently recommended patches...
Update 2014-10-18
I updated my blog and this post with the patches for the recently released Yosemite 10.10.
The xcpm patches for Yosemite 10.10:
Code:
perl -pi -e 's|\xe2\x00\x00\x00\x02\x00\x00\x00|\x00\x00\x00\x00\x02\x00\x00\x00|g' kernel
perl -pi -e 's|\xe2\x00\x00\x00\x4c\x00\x00\x00|\x00\x00\x00\x00\x4c\x00\x00\x00|g' kernel
perl -pi -e 's|\xe2\x00\x00\x00\x90\x01\x00\x00|\x00\x00\x00\x00\x90\x01\x00\x00|g' kernel
Please note the kernel resides at /System/Library/Kernels/kernel.
Update 2014-02-25
10.9.x Local APIC mach_kernel patch updated to work with new 10.9.2 mach_kernel. The new patch is more generic and works with all 10.9.x.
The xcpm patch works with all 10.9.x, no changes for 10.9.2.
Code:
# for xpcm related panic/reboot 10.9.x kernel
perl -pi -e 's|\x74\x6c(\x48\x83\xc7\x28\x90\x8b\x05..\x5e\x00\x85\x47\xdc)\x74\x54(\x8b\x4f\xd8\x45\x85\xc0\x74\x08\x44\x39\xc1\x44\x89\xc1)\x75\x44(\x0f\x32\x89\xc0\x48\xc1\xe2\x20\x48\x09\xc2\x48\x89\x57\xf8\x48\x8b\x47\xe8\x48\x85\xc0\x74\x06\x48\xf7\xd0\x48\x21\xc2\x48\x0b\x57\xf0\x49\x89\xd1\x49\xc1\xe9\x20\x89\xd0\x8b\x4f\xd8\x4c\x89\xca)(\x0f\x30\x8b\x4f\xd8\x0f\x32\x89\xc0\x48\xc1\xe2\x20\x48\x09\xc2\x48\x89\x17\x48\x83\xc7\x30\xff\xce)\x75\x99(\x5d\xc3)\x90{7}|\x74\x73${1}\x74\x5b${2}\x75\x4b${3}\x66\x81\xf9\xe2\x00\x74\x02${4}\x75\x92${5}|g' mach_kernel
Code:
# for xpcm related panic/reboot 10.8.5 kernel
perl -pi -e 's|\x74\x69(\x48\x83\xc7\x28\x90\x8b\x05\xfe\xce\x5f\x00\x85\x47\xdc)\x74\x51(\x8b\x4f\xd8\x45\x85\xc0\x74\x05\x44\x39\xc1)\x75\x44(\x0f\x32\x89\xc0\x48\xc1\xe2\x20\x48\x09\xc2\x48\x89\x57\xf8\x48\x8b\x47\xe8\x48\x85\xc0\x74\x06\x48\xf7\xd0\x48\x21\xc2\x48\x0b\x57\xf0\x49\x89\xd1\x49\xc1\xe9\x20\x89\xd0\x8b\x4f\xd8\x4c\x89\xca)(\x0f\x30\x8b\x4f\xd8\x0f\x32\x89\xc0\x48\xc1\xe2\x20\x48\x09\xc2\x48\x89\x17\x48\x83\xc7\x30\xff\xce)\x75\x9c(\x5d\xc3)\x90{7}(\x90{3})|\x74\x70${1}\x74\x58${2}\x75\x4b${3}\x66\x81\xf9\xe2\x00\x74\x02${4}\x75\x95${5}${6}|g' mach_kernel
Code:
# for Local APIC panic (also causes instant reboot) 10.9.x kernel
perl -pi -e 's|(\x25\x1c\x00\x00\x00\x48\x8d\x0d..\x5e\x00\x3b\x01)\x74(\x11\x48\x8d\x3d...\x00\x44)|${1}\xeb${2}|g' mach_kernel
Code:
# for Local APIC panic (also causes instant reboot) 10.8.5 kernel
perl -pi -e 's|(\x25\x14\x00\x00\x00\x48\x8d\x0d\x50\x37\x60\x00\x3b\x01)\x74(\x10\x48\x8d\x3d\xfc\x12\x3f\x00\x89)|${1}\xeb${2}|g' mach_kernel
How to patch your kernel
The vanilla mach_kernel is located on your USB installer after running Unibeast. Here's how to patch it:
Code:
# in Terminal, assuming your USB is called Installer
cp /Volumes/Installer/mach_kernel ~/Desktop/mach_kernel_backup
cp /Volumes/Installer/mach_kernel ~/Desktop/mach_kernel
cd ~/Desktop
# now copy/paste one or more of the perl patches from above into Terminal
perl ...[from above]... mach_kernel
perl ...[from above]... mach_kernel
# patched mach_kernel is now at ~/Desktop/mach_kernel
sudo cp mach_kernel /Volumes/Installer/mach_kernel
After you install OS X to your HDD, you will have vanilla mach_kernel on the HDD, leading to the same instant reboot problem. So, you must re-enter the OS X installer, and go into Terminal (using Utilities -> Terminal) and replace the mach_kernel with the patched version:
Code:
# in Terminal from the OS X installer, assuming your HDD volume is called "Macintosh HD"
cp /mach_kernel "/Volumes/Macintosh HD/mach_kernel"
After that, you can exit the installer, and boot into the installed partition to finish installation and reach the desktop.
MD5 sums for mach_kernel
Check your md5 sums with:
10.10 kernel
vanilla: 9f1768fddec369e545d938f0f4f76350
xcpm patched: eb21ca4bd7aba97d5e7b080a481fc173
10.9.5 mach_kernel
vanilla: 8f9adba4ca2f55907b8ec8d4bbf4c555
xpcm patched: 0563c5d1fd99db17198d53ad60c9d9ba
lapic patched: 0dd9c1bf48b4377553d0dfbfc2c49e8c
patched with both: 49f889eeb27689bec3d1aea30e2ed328
10.9.4 mach_kernel
vanilla: 3d0ad5a7a8ef3b1d4e6ea33e92e4d3b5
xpcm patched: 921c850e3062e750730b0e99f5eaa381
lapic patched: 855f9bf2fd7bcf570fa40e4406d1c661
patched with both: e0307d0e1151468c551274ac78d6dbbf
10.9.3 mach_kernel
vanilla: 5ba55b0d446094f82e48e8a413ddfaec
xcpm patched: 6848b1904426d5e270a2db6fada67fb0
lapic patched: f600afe2413450a9405fd8dc4c555043
patched with both: 33e741649352c1545a269cf0700d65e0
10.9.2 mach_kernel
vanilla: 15ce54d9b6edc47e282fdf038f71738c
xcpm patched: aeb9203dc754afac23bf9696833032fe
lapic patched: e146cd0e8baa61b6c394ec44e4f5eaf4
patched with both: 68d82160351204af5dad5d7414fdefa9
10.9 mach_kernel
vanilla: 06b687fa00945c97e06ad1919625793c
xcpm patched: 88bf62a7955b9e20cdb19906bdda6b43
lapic patched: 6ac911a71dc47d6c6233d28b60c9dbb7
patched with both: 9b2bdec07dc8a8d95a7a510700bad7fb
10.8.5 mach_kernel
vanilla: e835be83eb956af0b63d28f69bfb22b3
xcpm patched: 539c3a1e2fef063384b44543765b8a39
lapic patched: 00bdc1a157c6f380eae816565c46033f
patched with both: 88dbe889c7b21ee951907c894bae6248
Computer Specifics
HP Envy 15-J063CL (Costco)
i7-4700MQ @2.4Ghz, 12GB RAM
HM87 chipset
HD4600 graphics (1080p panel)
BCM4352 ac WiFi (works with only injection)
RTL8111/8168/8411 (works with RealtekRTL8111)
(I am not certain that I'm keeping this laptop...)
Working:
- power management (currently using iMac14,2... could be improved)
- booting with caches
- HD4600 graphics (this computer uses eDP)
- HDMI
- USB3 (before sleep)
- trackpad/keyboard (Synaptics)
- sleep
- sleep triggered by lid
- shutdown/restart
- backlit keyboard on/off (must be hardwired)
- Camera (kind of grainy, but could be poor lighting)
- USB3 (after sleep w/ -gux_defer_usb2)
- display brightness (using PNLF patch + blinkscreen)
- audio yet (patched AppleHDA)
Not Working/Not Started/In progress
Not Tested
- Bluetooth
PStates:
*
iMac14,2 (X86PlatformPlugin)
DPCIManager PStates: 8,24,25,26,27,28,29,30,31,32
*
MacBookPro8,3 (ACPI_SMC_PlatformPlugin)
DPCIManager PStates: 8,12,16,20,24,26,28,30,31,32
MacBookPro11,2 (xcpm, patched mach_kernel)
DPCIManager PStates: 8,24,25,26,27,29,30,32,33
DSDT Patches:
I have published my DSDT patch project on github. It relies heavily on my generic laptop DSDT patch repo. Read the README.md and setup carefully in order to use.
https://github.com/RehabMan/HP-Envy-DSDT-Patch
See my blog for perl patch for mach_kernel.
*
*
10.9 kernel built from Apple's sources is provided below:
Update 2014-02-13
Attached mach_kernel built from Apple's sources removed. There is no reason to use it. Use the provided patches to create a mach_kernel that works with machines with locked MSR 0xE2.
