AppleAPIC.kext binary patch for Skylake

El Capitan (OS X 10.11.1) could only be installed – on a Skylake based hackintosh – with certain BIOS versions, and for this you had to disable a setting with the cryptic description: “IOAPIC 24-119 Entries“.

Well cryptic perhaps for most people reading this, but for me it was a real eye opener. I immediately knew what it was. How come you ask? Well. I did read the Intel® 100 Series Chipset Family Platform Controller Hub (PCH) datasheet when it came out. And both volumes of it. That however was only the easy part, as I did not know how AMI implemented it, and what they do when you flip that setting. I had a hunch, sure, but I went on coding and asked others to confirm my findings, but let’s just skip the boring part and jump right to it. Here’s what you can find in the Intel® datasheet about the APIC Version Register at offset 1:

The default value is 0x770020, but that was 0x170020 on Haswell and before. And even Intel is somewhat confused because they wrote:

“In PCH this field is defaulted to 17h to indicate 24 interrupts.”

And that may as well have contributed to the changed value, because what should be used? 0x170020 or indeed 0x77020? Fact is that Apple is still using/expecting 0x170020 and thus that is what my patch does. We give the AppleAPIC binary what it expects… 0x170020 Well. Actually. It expects 0x17 and that is exactly what we give it.

1.) Open /System/Library/Extensions/AppleAPIC.kext/Contents/AppleAPIC

2.) Search for: C1 E8 10 0F B6 F0

3.) Replace it with: BE 17 00 00 00 90

0000000000001254	movl	$0x1, (%rax)     // Load offset 1
000000000000125a	movq	0xb8(%r15), %rax // Write offset (select version register)
0000000000001261	movl	0x10(%rax), %eax // Read data (0x770020)
––––––––––––––––––––––––––––––––––––––––––––––––
0000000000001264	shrl	$0x10, %eax      // shift value from 0x770020 to 0x77 
0000000000001267	movzbl	%al, %esi      // Load 0x77 in al register
––––––––––––––––––––––––––––––––––––––––––––––––
000000000000126a	movl	%esi, 0xd8(%r15) // Move 0x77 into esi register
0000000000001271	cmpl	$0xff, %esi      // Check for dead end

Which my patch changes into:

0000000000001254	movl	$0x1, (%rax)
000000000000125a	movq	0xb8(%r15), %rax
0000000000001261	movl	0x10(%rax), %eax
––––––––––––––––––––––––––––––––––––––––––––––––
0000000000001264	movl	$0x17, %esi      // Move 0x17 into esi register
0000000000001269	nop                      // Filler byte (do nothing)
––––––––––––––––––––––––––––––––––––––––––––––––
000000000000126a	movl	%esi, 0xd8(%r15)
0000000000001271	cmpl	$0xff, %esi

And now AppleAPIC thinks to have read 0x170020 from the version register, insteads of our (broken) value of 0x770020, but using a HexEditor is so old school. Nowadays you can do something like this in Clover:

<key>KextsToPatch</key>        
<array>
            <dict>
                <key>Comment</key>
                <string>Skylake AppleAPIC Patch (c) Pike R. Alpha</string>
                <key>Find</key>
                <data>
                wegQD7bw
                </data>
                <key>Name</key>
                <string>AppleAPIC</string>
                <key>Replace</key>
                <data>
                vhcAAACQ
                </data>
</dict>
</array>

I of course first fixed RevoBoot. Other boot loaders like Chameleon (Enoch branch) should soon be fixed.

Anyway. Now you know who (me) did what (see above) to get your Skylake going without having to mess up your factory original BIOS or going back to a BIOS version with the setting.

Thanks to iStigPL and Tonymacx86 for their help with data and test results!

Update

A few tips for folks who are still getting the dreadful: “Still waiting for root device“. First. Make sure that you have XHCI hand-off enabled in the BIOS and dropping ACPI tables like SaSsdt.aml may cause boot issues with SATA devices!