AppleAPIC.kext binary patch for Skylake

El Capitan (OS X 10.11.1) could only be installed – on a Skylake based hackintosh – with certain BIOS versions, and for this you had to disable a setting with the cryptic description: “IOAPIC 24-119 Entries“.

Asus BIOS test settings

Well cryptic perhaps for most people reading this, but for me it was a real eye opener. I immediately knew what it was. How come you ask? Well. I did read the Intel® 100 Series Chipset Family Platform Controller Hub (PCH) datasheet when it came out. And both volumes of it. That however was only the easy part, as I did not know how AMI implemented it, and what they do when you flip that setting. I had a hunch, sure, but I went on coding and asked others to confirm my findings, but let’s just skip the boring part and jump right to it. Here’s what you can find in the Intel® datasheet about the APIC Version Register at offset 1:

APIC Version Register

The default value is 0x770020, but that was 0x170020 on Haswell and before. And even Intel is somewhat confused because they wrote:

In PCH this field is defaulted to 17h to indicate 24 interrupts.”

And that may as well have contributed to the changed value, because what should be used? 0x170020 or indeed 0x77020? Fact is that Apple is still using/expecting 0x170020 and thus that is what my patch does. We give the AppleAPIC binary what it expects… 0x170020 Well. Actually. It expects 0x17 and that is exactly what we give it.

1.) Open /System/Library/Extensions/AppleAPIC.kext/Contents/AppleAPIC

2.) Search for: C1 E8 10 0F B6 F0

3.) Replace it with: BE 17 00 00 00 90

0000000000001254	movl	$0x1, (%rax)     // Load offset 1
000000000000125a	movq	0xb8(%r15), %rax // Write offset (select version register)
0000000000001261	movl	0x10(%rax), %eax // Read data (0x770020)
0000000000001264	shrl	$0x10, %eax      // shift value from 0x770020 to 0x77 
0000000000001267	movzbl	%al, %esi      // Load 0x77 in al register
000000000000126a	movl	%esi, 0xd8(%r15) // Move 0x77 into esi register
0000000000001271	cmpl	$0xff, %esi      // Check for dead end

Which my patch changes into:

0000000000001254	movl	$0x1, (%rax)
000000000000125a	movq	0xb8(%r15), %rax
0000000000001261	movl	0x10(%rax), %eax
0000000000001264	movl	$0x17, %esi      // Move 0x17 into esi register
0000000000001269	nop                      // Filler byte (do nothing)
000000000000126a	movl	%esi, 0xd8(%r15)
0000000000001271	cmpl	$0xff, %esi

And now AppleAPIC thinks to have read 0x170020 from the version register, insteads of our (broken) value of 0x770020, but using a HexEditor is so old school. Nowadays you can do something like this in Clover:

                <string>Skylake AppleAPIC Patch (c) Pike R. Alpha</string>

I of course first fixed RevoBoot. Other boot loaders like Chameleon (Enoch branch) should soon be fixed.

Anyway. Now you know who (me) did what (see above) to get your Skylake going without having to mess up your factory original BIOS or going back to a BIOS version with the setting.

Thanks to iStigPL and Tonymacx86 for their help with data and test results!


A few tips for folks who are still getting the dreadful: “Still waiting for root device“. First. Make sure that you have XHCI hand-off enabled in the BIOS and dropping ACPI tables like SaSsdt.aml may cause boot issues with SATA devices!

54 thoughts on “AppleAPIC.kext binary patch for Skylake

    • Yup. Just like I did so many times before, and I even helped to implement patches for newly released hardware. You have missed a lot. Apparently.

      The fact that I don’t use Clover myself doesn’t mean anything. I’m just not a fan but to each his own.

      • You tell em Piker Alpha.Thanks for the hard work.I dread to think where the hackintosh world would be without you.Thanks Again for you hard work

      • Exactly, Dee, he tell us…
        Anyway, the point is not whether or not the work is hard, the point is this is wrapped up Information. Surely wasn’t easy to get it, but is anyone in the place to ‘own’ information? Sure you could say the copyright is on the 6 bytes aka 12 characters, but considering this is a small snippet, there are few ways to solve it in the kext but your way (I don’t Think you wouldn’t remind the author of a similiar patch of your copyright?. For me, considering a minimal, derieved product from a piece of Information which has few or no alternatives, the same rules apply as for the information itself. So, if you copyright a small patch which is the direct result of a piece of Information, to me, you copyright the information itself.

      • Yes. This copyright “claim” is the result of my creative work. And I don’t even have to “claim it” because it became mine, automatically, the minute I published about it.

        And it’s not about the information itself, but what to I did with it. Otherwise you could blame Apple et all for using the Intel datasheet and converting their data into a driver, or whatever. Or do you think that Intel owns Apple’s work?

        Also. The fact that there is no other solution… not without being stamped as “derived work” is not my problem. And if you, or anyone else have issues with this, then at least try to be their for people who are looking for your help. Be my guest… but I know from past experiences that it can take forever… Just a reminder to the HDMI solution that only worked after I stepped in. Or that stupid black screen problem. Or that Apple logo that was missing. Or power management that didn’t work. Well. I’m sorry but the list goes on and on and on. Not my problem.

        But instead of being grateful, some people come here to complain about the fact that I remind them about my work. Yeah that must hurt. Otherwise this all would have been a moot point anyway.

        [b]Tip[/b]: Google “gratitude” and accept the free ride.

    • Nope. Wait. That is a typo. The comments are ok but this has something to do with my eyes where a 1 and 7 is too similar. Thanks man! I’ll fix it right away.

      p.s. I recently had a similar issue with an “8” and a “B”. My stupid bad eyes.

  1. Man,maybe someone else would figure it out soon after or long after you,none the less you did,i hope some of those ridiculous comments don’t deter you from the work you will continue to do.If some of us keep our comments to our-self and just accept the good deeds.The man has a life real macs and still choose to help us is that to much?

    • Sure, you may. I uploaded reverse engineered code for a few Apple EFI drivers (which nobody ever bothered to, just some half-implemented protocols, provided (or will be providing as it’s WIP) with the most advanced SMC C header (WIP also, which also explains some of the mysterious “data window” Pike was thinking was just static data deployed with updates but rather is the MMIO interface, just as well as adding unknown commands and more), provided about all necessary info to solve the FileVault 2 issue, directly and indirectly contributed to boot solutions and helped people in IRCs for the past 2 years including a few who eventually wrote guides. I guess the difference is I use was less time to look at real-life user problems and rather silently work on what I want to and don’t announce everything with a megaphone in my hand. Users of course rather want their problems worked around, but just because I don’t directly solve, it doesn’t mean I did not contribute to it.

      Also, as I said, I did not judge on Pike’s work and even thanked him in the past, but only how he treats it. Should you really need to cramp out the link to the patch every single time you even mention it? What is legally allowed does not equal to what is morally right, though Pike has made his decision and I am done with it.
      Have a nice day.

      • Fritz,

        Let me be perfectly clear about one thing, and that is that it isn’t about what we do/did in the paste, but what people do with our work. Not just mine, but yeah I am pretty vocal about it. I express my concerns, and I have every right to do that, here and elsewhere.

        You may accept that people use your work and twist it into something of their own, but I won’t accept that. Oh wait. You don’t have that experience yourself, and clearly it doesn’t matter if that happens to someone else. Like me for example.

        And about the moral part. Well. I guess that you have to take it up with the folks that do this kind of stuff, and not try to shoot down the messenger. And when something like this happens, then we the community should act as one. Not diverted, but I guess it’s easy to look at it this way… when none of your work is being brutally morphed into something of someone else.

      • Just because nobody did it as part of the OSx86 project (yet?), it doesn’t mean it didn’t happen at all. This project is not the first and hopefully not the last I participate in. Furthermore, not everything is always handled publicly.😉
        I told you, I am done with it, I was asking for nothing else but if that was really the way you wanted to go – you repeated that it is and thus this topic is done for me. You do what you want with your stuff and you don’t depend on me agreeing to it.
        I hope the right of free voice of opinion is not underestimated by your readers (yes, your readers, as in fact it wasn’t you who called my comments redicilous or implied I never contributed anything and only complain about the great heros who do).

  2. Pike, you are the best there is! Like you said, this patch got to the installer. However, I can’t see my SATA disk, I can only install to a USB drive. I know this is related because patching other kexts with this same patch I got further (I got the SATA controller recognised in system information). I’m also having problems with all PCIe devices. It looks like this BIOS value is used in several other places, and I would dare say all not all of those can be patched in the same way.

    I know it’s a lot to ask, but you could find the time to research the subject I would greatly appreciate it. Otherwise, I’d also appreciate if you gave some pointer as to how to where and what to to look for. Thanks a lot.

    • The patch should only be used to patch the AppleAPIC.kext binary. Nothing more can be done with it so please don’t do that.

      Now about your SATA problem. I would first check the interrupt value, but since I cannot check this right now for you, so please contact someone with the same motherboard and see if the value you have is correct.

  3. on my notebook your patch doesn’t work properly i have an HM170 Chipset but i can’t see my SATA Drives. I can only install El Capitan to an external USB Drive. what do you need an informations for help?

  4. If you use Clover Configurator, go to Sections (left pane), select Devices. In the right there are several panes, one of which is named USB. FixOwnerShip is one of the options in the pane. I have checked all four of those btw.

      • But the IORegistryExplorer dump that you e-mailed me certainly does:

        compatible Data <“pci1025,1033”, “pci8086,a103”, “pciclass,010601”, “SAT0”>
        device-id Data <03 a1 00 00>
        IOName Data pci8086,a103
        name Data <“pci8086,a103”>

        Also. Look at this HSIO multiplexing diagram:

        HSIO Multiplexing on PCH-H

        In short. First try different SATA ports and also try without the M.2 SSD installed.

        Edit: Oops. You are using an Intel i7-6700HQ so this is probably a notebook of some sort. In that case try without the M.2 SSD but first stop dropping SSDT tables. I told people this before to be a cause of SATA issue.

        You also do not need to inject a device-id (0x191b) and a device name (Intel HD Graphics 530). Should work without them.

        About your LAN port. Look at this:

        LAN Controller [10EC:8168] :: PciRoot(0x0)\Pci(0x1C,0x3)\Pci(0x0,0x0)
        RCBA disabled; cannot use it

        You are probably using an old(er) kext that isn’t patched for Skylake.

  5. I´ve got the 6500u processor with the intel HD 520. Does this patch apply to my laptop as well? Latest El Capitan is already installed and I do not have any issues what so ever. Just the integrated graphics aren’t fully supported. (Animations are not working correctly).

  6. I have Z170 deluxe and have that setting disabled in the 1402 BIOS. I still get the “cannot find driver for platform acpi”. So even though I have that entry i still have to edit the IOACPIFamily.kext?

    I am assuming with my z170 deluxe, I disabled that setting with the ioapic setting, but i still get the kp “cannot find driver for this platorm acpi”. i tried acpi=off and that didn’t work. Do I still have to edit the kext you mentioned in this post? I have 6600k

    • Right. It is now using register EAX, instead of ESI, so now you need to search for:
      C1 E8 10 0F B6 C0 / QzFFODEwMEZCNkMw
      And replace that with this:
      B8 17 00 00 00 90 / QjgxNzAwMDAwMDkwCg==

      Edit: I would like to add that I don’t have a hack handy and thus I am unable to verify this patch myself!

  7. Pingback: Intel HD Graphics – Skylake — OSXPC

  8. Hey man, sorry to bother you.

    I’m using a 6700K and a Z170 chipset. However, since I don’t have a Mac on hand, I’m doing all of the manipulations on Windows 10, via TransMac.

    I’m trying to modify the file you mentioned – “AppleAPIC”, but I can’t seem to open it properly in Windows. It’s all jibberish.

    Here’s where the file lays in my case – AppleAPIC.kext / Contents / MacOS / AppleAPIC

    Here’s a screenshot

    Is this the correct location, and second – can you give me any tips on how to open this file in Windows and modify it? If that’s the file anyway..

    Thanks in advance!

  9. Thanks for this information. Has the patch changed in 10.11.6? Do you change the Bios Field option to disable for IOAPIC 24-119 entry? I still get the dreaded Still Waiting for Root Device” on my Skylake Asus Hero Alpha. This is with a Samsung Pro 850 SSD (AHCI).

  10. Hi Pike,
    This data changed in 10.11.6, the previous version was not confirmed.
    For 10.11.6, search for c1e8100fb6c0 and replace it with be1700000090. Not c1e8100fb6f0 anymore.

    — apic_10116.txt 2016-08-28 19:20:05.000000000 +0800
    +++ apic_10116_patched.txt 2016-08-28 19:20:41.000000000 +0800
    @@ -277,8 +277,8 @@
    000000000000120c c70001000000 movl $0x1, (%rax)
    0000000000001212 498b8424b8000000 movq 0xb8(%r12), %rax
    000000000000121a 8b4010 movl 0x10(%rax), %eax
    -000000000000121d c1e810 shrl $0x10, %eax
    -0000000000001220 0fb6c0 movzbl %al, %eax
    +000000000000121d be17000000 movl $0x17, %esi
    +0000000000001222 90 nop
    0000000000001223 41898424d8000000 movl %eax, 0xd8(%r12)
    000000000000122b 3dff000000 cmpl $0xff, %eax
    0000000000001230 0f84ca010000 je 0x1400

    Here is it😀.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s