XCPM for unsupported Processor…

The lack of XCPM support for my new Broadwell E processors was a bit frustrating and thus I had to do something about it. And I guess that most of you know me by now so it was just a matter of time. As in. Consider it done!

Yup. Time to say good-bye to the good old AppleIntelCPUPowerManagement.kext and the NullCPUPowerManagement.kext that served so many people for so long. Adieu my friends. They won’t be missed. LOL

Right. I can boot macOS Sierra and I see IOPPF: XCPM mode along with XCPM registered. That is pretty cool. In fact. This is amazing. Let’s go check some stuff.

sysctl -n machdep.xcpm.mode returns 1 so that is fine. Also. Running kextstat shows me that both AppleIntelCPUPowerManagement.kext and NullCPUPowerManagement.kext are missing in the list with loaded kexts. Great. Now a Geekbench v3.4.1 top score – one of four runs – of the Intel i7-6850K.

i7-6850K_macOS_Sierra_DP3_XCPM

I must admit. The longer I use this processor the more I get impressed by it. Who would have thought that? And let’s not forget. This is with XCPM so it is the more impressive. In fact. People with an old i7-5930K may keep it.

One thing though and that is that the RAM can’t run at full speed (runs like 2133MHz due to some bug) but anyway. Here is the output of AppleIntelInfo.kext

AppleIntelInfo.kext v1.5 Copyright © 2012-2016 Pike R. Alpha. All rights reserved

Settings:
------------------------------------
logMSRs............................: 1
logIGPU............................: 0
logCStates.........................: 1
logIPGStyle........................: 1
InitialTSC.........................: 0x150cbc299c8
MWAIT C-States.....................: 8480

Model Specific Registers
-----------------------------------
MSR_CORE_THREAD_COUNT......(0x35) : 0x6000C
MSR_PLATFORM_INFO..........(0xCE) : 0x20080C3BF3812400
MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x8402
MSR_PMG_IO_CAPTURE_BASE....(0xE4) : 0x10414
IA32_MPERF.................(0xE7) : 0x387EBCA78F
IA32_APERF.................(0xE8) : 0x3A56B9B06F
MSR_0x150..................(0x150) : 0x0
MSR_FLEX_RATIO.............(0x194) : 0xE0000
MSR_IA32_PERF_STATUS.......(0x198) : 0x23CF00002500
MSR_IA32_PERF_CONTROL......(0x199) : 0x2400
IA32_CLOCK_MODULATION......(0x19A) : 0x0
IA32_THERM_STATUS..........(0x19C) : 0x88490000
IA32_MISC_ENABLES..........(0x1A0) : 0x840089
MSR_MISC_PWR_MGMT..........(0x1AA) : 0x402000
MSR_TURBO_RATIO_LIMIT......(0x1AD) : 0x2525252525252828
IA32_ENERGY_PERF_BIAS......(0x1B0) : 0x1
MSR_POWER_CTL..............(0x1FC) : 0x2904005B
MSR_RAPL_POWER_UNIT........(0x606) : 0xA0E03
MSR_PKG_POWER_LIMIT........(0x610) : 0x7FFF80015FFF8
MSR_PKG_ENERGY_STATUS......(0x611) : 0x90C48C3
MSR_PKG_POWER_INFO.........(0x614) : 0x1700460
MSR_PP0_POWER_LIMIT........(0x638) : 0x0
MSR_PP0_ENERGY_STATUS......(0x639) : 0x0
MSR_PKGC6_IRTL.............(0x60b) : 0x0
MSR_PKG_C2_RESIDENCY.......(0x60d) : 0xA4268B844
MSR_PKG_C6_RESIDENCY.......(0x3f9) : 0x79FDD64350
IA32_TSC_DEADLINE..........(0x6E0) : 0x150CD144AC8

CPU Ratio Info:
------------------------------------
CPU Low Frequency Mode.............: 1200 MHz
CPU Maximum non-Turbo Frequency....: 3600 MHz
CPU Maximum Turbo Frequency........: 4000 MHz
CPU P-States [ 33 37 (40) ]
CPU C6-Cores [ 0 2 5 7 9 10 ]
CPU P-States [ 31 33 37 (40) ]
CPU C6-Cores [ 0 2 3 4 5 7 9 10 ]
CPU P-States [ (12) 31 33 37 40 ]
CPU C6-Cores [ 0 1 2 3 4 5 6 7 9 10 11 ]
CPU P-States [ (12) 25 31 33 37 40 ]
CPU P-States [ 12 25 29 31 33 37 (40) ]
CPU P-States [ 12 25 29 30 31 33 37 (40) ]
CPU P-States [ 12 25 28 29 30 31 33 37 (40) ]
CPU C6-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 ]
CPU P-States [ (12) 22 25 28 29 30 31 33 37 40 ]
CPU P-States [ (12) 21 22 25 28 29 30 31 33 37 40 ]
CPU P-States [ (12) 21 22 23 25 28 29 30 31 33 37 40 ]
CPU P-States [ (12) 20 21 22 23 25 28 29 30 31 33 37 40 ]
CPU P-States [ 12 20 21 22 23 25 28 29 30 31 32 33 37 (40) ]
CPU P-States [ 12 20 21 22 23 25 28 29 30 31 32 33 37 39 (40) ]
CPU P-States [ 12 20 21 22 23 25 27 28 29 30 31 32 33 37 39 (40) ]
CPU P-States [ (12) 17 20 21 22 23 25 27 28 29 30 31 32 33 37 39 40 ]
CPU P-States [ (12) 16 17 20 21 22 23 25 27 28 29 30 31 32 33 37 39 40 ]
CPU P-States [ (12) 16 17 18 20 21 22 23 25 27 28 29 30 31 32 33 37 39 40 ]
CPU P-States [ 12 16 17 18 19 20 21 22 23 25 27 28 29 30 31 32 33 37 39 (40) ]
CPU P-States [ 12 16 17 18 19 20 21 22 23 25 27 28 29 30 31 32 33 37 38 39 (40) ]
CPU P-States [ 12 16 17 18 19 20 21 22 23 25 26 27 28 29 30 31 32 33 37 38 39 (40) ]
CPU P-States [ 12 16 17 18 19 20 21 22 23 25 26 27 28 29 30 31 32 33 36 37 38 39 (40) ]
CPU P-States [ (12) 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 36 37 38 39 40 ]
CPU P-States [ 12 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 37 38 39 (40) ]
CPU P-States [ 12 14 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 37 38 39 (40) ]
CPU P-States [ (12) 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 37 38 39 40 ]
CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 (40) ]
CPU P-States [ (12) 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ]

Hmm. C3 is missing. Seems like I forgot to enable C3 for Broadwell E processors and thus I have to fix this and re-compile the kext. On a second thought. The redirection bits are not set in MSR 0xE2 so this is expected result.

But both MSR_PKG_C2_RESIDENCY and MSR_PKG_C6_RESIDENCY are non-zero. A sweet spot.

Update: I don’t have a lot of time, but I also do not want to let you wait so here you have it!

//
// kernel location 0x1fb451 (0xE9 in DP2/DP3/DP4, 0xF1 in DP1) _cpuid_set_info
//
// Broadwell E (0x4F)	-> Broadwell (0x47)	=> 0x4F-0x47 = 0x08	-> change 0xE9 into 0xE1
// Haswell E (0x3F)		-> Haswell (0x3C)	=> 0x3F-0x3C = 0x03	-> change 0xE9 into 0xE6
// Ivy Bridge E (0x3E)	-> Ivy Bridge (0x3A)	=> 0x3E-0x3A = 0x04	-> change 0xE9 into 0xE5

../..

//
// kernel location 0x22a422 (0xC4 in DP2/DP3/DP4, 0x?? in DP1) _xcpm_bootstrap
//
// Broadwell E (0x4F)	-> Broadwell (0x47)	=> 0x4F-0x47 = 0x08	-> change 0xC4 into 0xBC
// Haswell E (0x3F)		-> Haswell (0x3C)	=> 0x3F-0x3C = 0x03	-> change 0xC4 into 0xC1
// Ivy Bridge E (0x3E)	-> Haswell (0x3C)	=> 0x3E-0x3C = 0x02	-> change 0xC4 into 0xC2
//
// Broadwell E (0x4F)	-> Haswell (0x3C)	=> 0x4F-0x3C = 0x13	-> change 0xC4 into 0xB1

../..

//
// If MSR(0xE2) is locked (bit-15 is set) then also change
//
// kernel location 0x220b30 and 0x220b5f in _xcpm_idle from 0x0f30 (wrmsr) to 0x9090 (nop nop).

//
// Additionally (if booting results in a immediate reboot)
//
// kernel location 0x22a820 change 0x55 into 0xC3 (ret) to stop the KP.
//

Update: DP4 is now available and the byte patterns are still the same, but the locations have changed to: 0x1f8d81, 0x227d32, 0x21e440, 0x21e46f and 0x228130 (same order as above).

Update-2: DP5 is now available and the byte patterns are still the same, but the locations have changed to: 0x1f8930, 0x228af0, 0x21eff0, 0x21f01f and 0x228f50 (same order as above).

Update-3: DP6 is now available and the byte patterns are still the same, but the locations have changed to: 0x1f7cc0, 0x227f30, 0x21e430, 0x21e45f and 0x428390 (same order as above).

Update-4: DP7 is now available and the byte patterns are still the same, but the locations have changed to: 0x1f8d71, 0x227fc2, 0x21e460, 0x21e48f and 0x2283c0 (same order as above).

The patches can be done in at least three different ways and I picked what I think is the easiest one to understand. So I hope. Also. I don’t use FakeCPUID – nor Clover for that matter – with my patches, but some people using Clover reported a hang. For them it won’t boot without FakeCPUID (thanks to giacomoleopardo for the update).

Update: Owners of Ivy Bridge E or Haswell E processors do not need to patch the switch table used by _cpuid_set_info, because Apple already took care of it. Anyway. Have a look at this table:

switchtable_cpuid_set_info

The offset for the Broadwell E processor is missing in this table. There is an address but that jumps to a location for unsupported processors, which is why we need a patch for the Broadwell E processor (the red arrow shows you what we do with the patch) but I think that Apple will fix this with a future update of macOS Sierra so that we also no longer need to patch the table for Broadwell E processors.

Please note that the table was converted from the original one in the kernel, which looks like this:

0xffffff80003fbc6c	dd	0xfffff82c, 0xfffff831, 0xfffff831, 0xfffff7fb
0xffffff80003fbc7c	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff7fb
0xffffff80003fbc8c	dd	0xfffff7fb, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbc9c	dd	0xfffff831, 0xfffff831, 0xfffff809, 0xfffff831
0xffffff80003fbcac	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff810
0xffffff80003fbcbc	dd	0xfffff831, 0xfffff809, 0xfffff810, 0xfffff7fb
0xffffff80003fbccc	dd	0xfffff809, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbcdc	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbcec	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff817
0xffffff80003fbcfc	dd	0xfffff831, 0xfffff802, 0xfffff81e, 0xfffff817
0xffffff80003fbd0c	dd	0xfffff802, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbd1c	dd	0xfffff831, 0xfffff831, 0xfffff802, 0xfffff802
0xffffff80003fbd2c	dd	0xfffff81e, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbd3c	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff825
0xffffff80003fbd4c	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbd5c	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbd6c	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff831
0xffffff80003fbd7c	dd	0xfffff831, 0xfffff831, 0xfffff831, 0xfffff825

Update: DP4 is now available and while the table is still the same, the location of it has changed to: 0xffffff80003f959c

Update-2: DP5 is now available and while the table is still the same, the location of it has changed to: 0xffffff8000428cbc

Update-3: DP7 is now available and while the table is still the same, the location of it has changed to: 0xffffff80003f958c

And here is what I did with the values. Let’s take the last value (0xfffff825 ) as an example:

0xffffffff - (0xfffff825 - 0x01) = 0x7DB

I then used the value as a negative offset, and we do that because the table is located at a higher memory address, so here we go:

0xffffff80003fbc6c - 0x7DB = 0xffffff80003FB491

Great. Now look at this disassembled code snippet:

0xffffff80003fb43b	movzwl	0x6fcc42(%rip), %eax
0xffffff80003fb442	xorl	%ebx, %ebx				// Zero out %ebx
0xffffff80003fb444	movzbl	%al, %ecx
0xffffff80003fb447	cmpl	$0x6, %ecx				// Check CPU family
0xffffff80003fb44a	jne		0xffffff80003fb49d

0xffffff80003fb44c	movzbl	%ah, %eax
0xffffff80003fb44f	addl	$-0x17, %eax			// Lower model number (example: 0x5e -> 0x4f)
0xffffff80003fb452	cmpl	$0x47, %eax				// Check for unsupported model numbers
0xffffff80003fb455	ja		0xffffff80003fb49d		// Jump if greater than 0x47 (unsupported model numbers)

0xffffff80003fb457	leaq	0x80e(%rip), %rcx		// Store address of case table 0xffffff80003fbc6c into %rcx
0xffffff80003fb45e	movslq	(%rcx,%rax,4), %rax		// Move and sign-extend 32-bit value from switch table in %rax 
0xffffff80003fb462	addq	%rcx, %rax				// Example: 0xffffff80003fbc6c - 0x7db = 0xffffff80003fb491 (CPUFAMILY_INTEL_SKYLAKE)
0xffffff80003fb465	jmpq	*%rax					// Jump to target address

0xffffff80003fb467	movl	$0x6b5a4cd2, %ebx		// CPUFAMILY_INTEL_NEHALEM
0xffffff80003fb46c	jmp		0xffffff80003fb49d

0xffffff80003fb46e	movl	$0x10b282dc, %ebx		// CPUFAMILY_INTEL_HASWELL
0xffffff80003fb473	jmp		0xffffff80003fb49d

0xffffff80003fb475	movl	$0x573b5eec, %ebx		// CPUFAMILY_INTEL_WESTMERE
0xffffff80003fb47a	jmp		0xffffff80003fb49d

0xffffff80003fb47c	movl	$0x5490b78c, %ebx		// CPUFAMILY_INTEL_SANDYBRIDGE
0xffffff80003fb481	jmp		0xffffff80003fb49d

0xffffff80003fb483	movl	$0x1f65e835, %ebx		// CPUFAMILY_INTEL_IVYBRIDGE
0xffffff80003fb488	jmp		0xffffff80003fb49d

0xffffff80003fb48a	movl	$0x582ed09c, %ebx		// CPUFAMILY_INTEL_BROADWELL
0xffffff80003fb48f	jmp		0xffffff80003fb49d

0xffffff80003fb491	movl	$0x37fc219f, %ebx		// CPUFAMILY_INTEL_SKYLAKE
0xffffff80003fb496	jmp		0xffffff80003fb49d

0xffffff80003fb498	movl	$0x78ea4fbc, %ebx		// CPUFAMILY_INTEL_PENRYN
0xffffff80003fb49d	movl	%ebx, 0x6fcd35(%rip)
0xffffff80003fb4a3	cmpl	$0x0, 0x6fcb6e(%rip)
0xffffff80003fb4aa	je		0xffffff80003fb4c3

Our calculated address is spot on. Now let’s have a look at the switch table that is used by _xcpm_bootstrap in macOS Sierra DP3:

0xffffff800042a58c         dd         0xfffffeac, 0xfffffec7, 0xfffffeb8, 0xfffffeb8 
0xffffff800042a59c         dd         0xfffffeb8, 0xfffffeb8, 0xfffffeb8, 0xfffffeb8
0xffffff800042a5ac         dd         0xfffffeb8, 0xfffffed3, 0xfffffee9, 0xffffff0a
0xffffff800042a5bc         dd         0xfffffeb8, 0xfffffeb8, 0xfffffeb8, 0xfffffeb8
0xffffff800042a5cc         dd         0xfffffeb8, 0xfffffeb8, 0xffffff16, 0xfffffeb8
0xffffff800042a5dc         dd         0xfffffeb8, 0xfffffeb8, 0xfffffeb8, 0xfffffeb8
0xffffff800042a5ec         dd         0xfffffeb8, 0xfffffeb8, 0xfffffeb8, 0xfffffeb8
0xffffff800042a5fc         dd         0xfffffeb8, 0xfffffeb8, 0xfffffeb8, 0xfffffeb8
0xffffff800042a60c         dd         0xfffffeb8, 0xfffffeb8, 0xffffff2c

Update: DP4 is now available and while the table is still the same, the location of it has changed to: 0xffffff8000427e9c

Update: DP7 is now available and while the table is still the same, the location of it has changed to: 0xffffff800042812c

A shorter table with 34 instead of 72 values, but the idea here is the same. And with the same kind of table conversion we get this:

SwitchTable_xcmp_bootstrap

This time the table starts at 0x3c instead of 0x17 and there are no addresses for the Ivy Bridge E, Haswell E and Broadwell E processors, again, for the same reason; it jumps to a location for processors that do not support XCPM.

Speaking about that address. All locations in the switch table in the kernel with the value 0xfffffeb8 jump to the same location for unsupported processors and here is how to calculate the offset and target address for the jmp instruction:

0xffffffff - (0xfffffeb8-0x01) = 0x148
0xffffff800042a58c - 0x148 = 0xffffff800042a444

And looking at the disassembled code snipped of _xcpm_bootstrap that is where XCPM gets disabled:

0xffffff800042a420	addl	$-0x3c, %ebx					// Lower model number (example: 0x5e -> 0x22(34)
0xffffff800042a423	cmpl	$0x22, %ebx						// Check for unsupported models
0xffffff800042a426	ja		0xffffff800042a444				// Jump if greater than 0x22 (unsupported model numbers)

0xffffff800042a428	leaq	0x15d(%rip), %rax				// Store address of case table 0xffffff800042a58c into %rcx
0xffffff800042a42f	movslq	(%rax,%rbx,4), %rcx				// Move and sign-extend 32-bit value from switch table in %rax 
0xffffff800042a433	addq	%rax, %rcx						// Example: 0xffffff800042a58c - 0xd4 = 0xffffff80000x42a4b8 (Skylake)
0xffffff800042a436	jmpq	*%rcx							// Jump to target address

0xffffff800042a438	movl	$0x4, _xcpm_cpu_model(%rip)		// case 0: Haswell (0x3c-0x3c=0)
0xffffff800042a442	jmp		0xffffff800042a47f

0xffffff800042a444	movl	$0x0, _xcpm_mode(%rip)			// case 33: xcpm_mode = 0 (XCPM disabled)
0xffffff800042a44e	jmp		0xffffff800042a580

0xffffff800042a453	movl	$0x80, _xcpm_cpu_model(%rip)	// case 1: Broadwell (0x3d-0x3c=1)
0xffffff800042a45d	jmp		0xffffff800042a4ac

0xffffff800042a45f	movl	$0x10, _xcpm_cpu_model(%rip)	// case 9: Haswell-ULT (0x45-0x3c=9)
0xffffff800042a469	movl	$0x1, 0x602981(%rip)
0xffffff800042a473	jmp		0xffffff800042a47f

0xffffff800042a475	movl	$0x8, _xcpm_cpu_model(%rip)		// case 10: Crystalwell (0x46-0x3c=10)
0xffffff800042a47f	movl	$0x1, 0x602973(%rip)
0xffffff800042a489	movq	$0x0, 0x6029dc(%rip)
0xffffff800042a494	jmp		0xffffff800042a50c

0xffffff800042a496	movl	$0x40, _xcpm_cpu_model(%rip)	// case 11: Broadwell-H (0x47-0x3c=11)
0xffffff800042a4a0	jmp		0xffffff800042a50c

0xffffff800042a4a2	movl	$0x200, _xcpm_cpu_model(%rip)	// case 18: Skylake (0x4e-0x3c=18)
0xffffff800042a4ac	movl	$0x1, 0x60293e(%rip)
0xffffff800042a4b6	jmp		0xffffff800042a50c

0xffffff800042a4b8	movq	0x6cebf1(%rip), %rdi			// case 34: Skylake (0x5e-0x3c=34)
0xffffff800042a4bf	testq	%rdi, %rdi
0xffffff800042a4c2	jne		0xffffff800042a4d9

0xffffff800042a4c4	movq	0x6999b5(%rip), %rax
0xffffff800042a4cb	movq	0x488(%rax), %rdi
0xffffff800042a4d2	movq	%rdi, 0x6cebd7(%rip)

0xffffff800042a4d9	addq	$0x2, %rdi
0xffffff800042a4dd	movl	$0x2, %esi
0xffffff800042a4e2	callq	0xffffff8000402580
0xffffff800042a4e7	movzwl	%ax, %eax
0xffffff800042a4ea	cmpl	$0x1910, %eax
0xffffff800042a4ef	movl	$0x2000, %eax
0xffffff800042a4f4	movl	$0x1000, %ecx
0xffffff800042a4f9	cmovel	%eax, %ecx
0xffffff800042a4fc	movl	%ecx, _xcpm_cpu_model(%rip)
0xffffff800042a502	movl	$0x0, 0x6028e8(%rip)

This routine has no matching case number for the Ivy Bridge E, Haswell E and Broadwell E processors. That is why we lower the model number to make it match with a supported processors model. Like we are using a normal Ivy Bridge, Haswell or Broadwell processor. A simple but effective trick it seems.

I hope that my explanation about all this helps you to understand what we are doing.

Edit: Make sure that you either use a SMBIOS model/board-id with FrequencyVectors data in its plist, or patch it with help of freqVectorsEdit.sh v2.3.

You can verify that the FrequencyVector data is loaded with help of sysctl -n machdep.xcpm.vectors_loaded_count

Tips:

1.) The X86PlatformPlugin.kext will only load with the plugin-type property is set on the first logical CPU. This however is not enough to enable XCPM mode. No. You may still use AppleIntelCPUPowerManagement.kext Even when X86PlatformShim.kext is loaded.

2.) The FrequencyVectors data in the plist is used to configure power management, and is not the same for all models/board-ids. Please use one that works for your setup.

3.) If sysctl -n machdep.xcpm.vectors_loaded_count returns 0 then the FrequencyVectors data is not being used. Backup the plist for your board-id and replace it with a different plist.

4.) If you use ssdtPRGen.sh to generate your ssdt_pr.aml then make sure to use the -turbo [top-turbo-frequency] argument for overclocked setups.

5.) Check for XCPM related errors at boot time. Like this: X86PlatformShim::start – Failed to send stepper. You got to fix errors or things may not work properly.

TODOs:

1.) Fix LFM frequency (fixed to 800MHz).
2.) Figure out what MSRs trigger a reboot and only block them. Not all other supported MSRs as well.

Advertisements

376 thoughts on “XCPM for unsupported Processor…

      • Thanks Pike, works a treat on my 5930K. Just one question. Have you worked out how to review the verbose boot log in Sierra’s new console app?

      • Hi Dave,

        Great. Good news. Thanks for the confirmation.

        About the verbose log. I don’t use the Console.app (still borked) but I use the command line log show --predicate 'process == "kernel"' --debug --info --last "5m" after selecting the debug mode (see document I linked to in my blog).

      • Hi Pike
        Oops I spoke to soon. I have just noticed that for my 5930K:
        IA32_ENERGY_PERF_BIAS……(0x1B0) : 0x0
        MSR_PKG_C2_RESIDENCY…….(0x60d) : 0x0
        MSR_PKG_C6_RESIDENCY…….(0x3f9) : 0x0.
        This appears to be the same whether I use Clover to gen the P and C states or ssdtprgen.sh.
        Both machdep.xcpm.vectors_loaded_count and machdep.xcpm.mode return 1. Any ideas?

      • No. Not right away. I first have to verify a few things, and I hope to be able to do this a.s.a.p. Will keep you posted.

        One other thing. Is your BIOS MSR 0xE2 locked? In case its not then the only MSRs that could possibly trigger a reboot – as far as I know now – is MSR 0x1aa and/or MSR 0x1a0. In this case it would be wise to only zero out these two. Not 0x1b0 and the all the other MSRs.

        I’ll try to figure it out and document it (in my blog).

      • It is locked (unfortunately). The power management dxe has changed so I can’t patch it until I identify which module it is

      • I see. Well. It should not be a problem; my BIOS is locked as well.

        Can you please add your output of the Model Specific Registers with AppleIntelInfo.kext This may be related to the value of 0xE2 and maybe we need to patch the kernel to make it work.

      • Hi Pike
        Here they are:
        Model Specific Registers
        ———————————–
        MSR_CORE_THREAD_COUNT……(0x35) : 0x6000C
        MSR_PLATFORM_INFO……….(0xCE) : 0x80C3BF3812300
        MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x400
        MSR_PMG_IO_CAPTURE_BASE….(0xE4) : 0x10414
        IA32_MPERF……………..(0xE7) : 0x2A09C086C3
        IA32_APERF……………..(0xE8) : 0x2188B51900
        MSR_FLEX_RATIO………….(0x194) : 0xE0000
        MSR_IA32_PERF_STATUS…….(0x198) : 0x27CE00002900
        MSR_IA32_PERF_CONTROL……(0x199) : 0x2900
        IA32_CLOCK_MODULATION……(0x19A) : 0x0
        IA32_THERM_STATUS……….(0x19C) : 0x884A0000
        IA32_MISC_ENABLES……….(0x1A0) : 0x850089
        MSR_MISC_PWR_MGMT……….(0x1AA) : 0x400001
        MSR_TURBO_RATIO_LIMIT……(0x1AD) : 0x2424292929292929
        IA32_ENERGY_PERF_BIAS……(0x1B0) : 0x5
        MSR_POWER_CTL…………..(0x1FC) : 0x2904005B
        MSR_RAPL_POWER_UNIT……..(0x606) : 0xA0E03
        MSR_PKG_POWER_LIMIT……..(0x610) : 0x7FFF80015FFF8
        MSR_PKG_ENERGY_STATUS……(0x611) : 0x27B574
        MSR_PKG_POWER_INFO………(0x614) : 0x1280460
        MSR_PP0_POWER_LIMIT……..(0x638) : 0x0
        MSR_PP0_ENERGY_STATUS……(0x639) : 0x0
        MSR_PKGC6_IRTL………….(0x60b) : 0x0
        MSR_PKG_C2_RESIDENCY…….(0x60d) : 0x0
        MSR_PKG_C6_RESIDENCY…….(0x3f9) : 0x0
        IA32_TSC_DEADLINE……….(0x6E0) : 0xF9972692B3

        PS I can confirm that Nikolaj’s patch for PpmInitialize Dxe unlocks the MSR 0xE2 on Asus X99 boards. Extract the body of the module using UEFITool, patch in Hexedit then replace with UEFITool. Flash the modded bios by renaming the bios file to the name appropriate for your board (for my X99M-WS it’s X99MWS.CAP) then flash using USB Flashback (bios file on FAT32 stick plugged into your rear white USB port, press and hold USB flashback button next to it until light starts flashing.

      • Ok so this is with the unlocked BIOS now. I see that your MSR_PMG_CST_CONFIG_CONTROL is not setup for C-State support because the lower bits (0000b) are zero, and that normally means “C0/C1 (no package C-state support)“.

        Then the IA32_ENERGY_PERF_BIAS readout of 0x5. That is not the highest performance. This value is taken from the FrequencyVectors so you could fix this by either using a source plist with a lower value (0x1) or use freqVector.sh -d and edit the value in the /tmp/FrequencyVectors.bin file.

        About the BIOS mod. I used UEFIPatch v0.3.9 and it did patch it, but I cannot flash it from the BIOS. I am getting this: “Selected file is not a proper BIOS” error.

        The X99-E motherboards (not the WS) lacks the BIOS flashback button on the back, and there is no white USB port.

      • 0000000000000f56 B9E2000000		mov	ecx, 0xe2
        0000000000000f5b 0F32			rdmsr      
        0000000000000f5d 48C1E220		shl	rdx, 0x20
        0000000000000f61 480BC2			or	rax, rdx
        0000000000000f64 4889442440		mov	qword [ss:rsp-0x0+arg_38], rax
        0000000000000f69 0FBA6C24400F	bts	dword [ss:rsp-0x0+arg_38], 0xf
        0000000000000f6f 488B542440		mov	rdx, qword [ss:rsp-0x0+arg_38]
        0000000000000f74 8B442440		mov	eax, dword [ss:rsp-0x0+arg_38]
        0000000000000f78 48C1EA20		shr	rdx, 0x20
        0000000000000f7c 0F30			wrmsr
        
        changes to:
        
        0000000000000f56 B9E2000000		mov	ecx, 0xe2
        0000000000000f5b 0F32			rdmsr      
        0000000000000f5d 48C1E220		shl	rdx, 0x20
        0000000000000f61 480BC2			or	rax, rdx
        0000000000000f64 4889442440		mov	qword [ss:rsp-0x0+arg_38], rax
        0000000000000f69 0FBA7424400F	btr	dword [ss:rsp-0x0+arg_38], 0xf
        0000000000000f6f 488B542440		mov	rdx, qword [ss:rsp-0x0+arg_38]
        0000000000000f74 8B442440		mov	eax, dword [ss:rsp-0x0+arg_38]
        0000000000000f78 48C1EA20		shr	rdx, 0x20
        0000000000000f7c 0F30			wrmsr
        
  1. “People with an old i7-5930K may keep it.” Guess this was pointed at me, haha. Very sweet , can’t wait to learn more ’bout XCPM on unsupported platforms.

      • It would be nice to be able to use 6+ core and TBolt. I know usb3 and esata are more than enough bandwidth for most uses, however…
        There are some edge cases in ‘high end’ AV/3d that require specialised TBolt adapters.
        Its a *silly* dream, but an overclockable Xeon 16xx (great single core AND multicore) would be the best of all worlds, impossible on X79 mobo’s and an edge case on X99.

    • No. Not yet. I want it to KP for MSR(0xE2) writes so that I know what is going on.

      Edit: There are two locations in _xcpm_idle next to _xcpm_core_scope_msrs that write to MSR(0xE2).

      • The patch for kernel location 0x22a820 should stop writes of:

        _xcpm_SMT_scope_msrs (11 msrs)
        _xcpm_core_scope_msrs (2 msrs)
        _xcpm_pkg_scope_msrs (7 msrs)

        from triggering an immediate reboot. A bit of a crude way, but it’ll work for most setups. For now. The next step is to locate and document the unsupported MSRs.

        Edit: The writes to MSR(0xE2) in _xcpm_idle will still trigger a reboot when MSR(0xE2) is locked by the BIOS, but we can solve this with another simple patch – replace 0f 30 with 90 90 (twice).

  2. I can tell you’re doing great work here, although I don’t understand it all. I’ve been trying to get SpeedStep working with my 6950x, without success. How can I use this code to enable XCPM?

      • Any tips on how to do it? I see the code above, but I don’t know where it’s supposed to go. And is this for Sierra only? I’m still using Yosemite for software compatibility.

    • Elliott: We have to wait for some of the Oracle’s to translate this into more user friendly tools for us mortals. (Be nice to know where to *start* to get a deeper handle on this – search terms for learning tutorials – until then I remain intrigued).

  3. It seems that you are getting close of having a full X99 system, and that is pretty cool to read!
    Are you planning releasing some kind of “how to install macOS Sierra on X99/Broadwell-E for dummies” ?

    From my understanding, what is needed is:
    – adjust DSDT if needed (I need to do this for my X58 build… so I assume this did not changed)
    – generating a SSDT using ‘ssdtPRGen.sh’
    – patching the kernel to get xcpm working (basically spoofing macOS, telling it “yeah, it is a Broadwell CPU”)
    – adding ‘-xcpm’ to the boot flags to turn XCPM on

    …however, I am still wondering I you managed to get rid of VoodooTSCSync.
    I have a 3930K at work, and I can’t boot it without this kext if all cores are enabled…

    I am still running a on rock-solid and stable X58 computer, with pm/speedstep working (the only modification I am doing is FakeSMC + custom DSDT), and I would really consider upgrading it to X99 + Broadwell-E if you are able to get it work properly (I mean, no VoodooTSC, no NullPowerManagement and other “workaround” kexts needed),

    • Nope. Not going to write a guide, but what I can tell you is that it is pretty simply to get it going. Also;

      1.) I’ll put my stripped DSDT on my Github repo when I find the time for it.
      2.) Yes. Running ssdtPRGen.sh and dropping two SSDT tables (SataTabl/PmMgt) works fine here.
      3.) I don’t need the -xcpm boot argument – faking the CPU model is enough to get XCPM registered.
      4.) I don’t need VooDooTSCSync.kext nor NullPowerManagement.kext.
      5.) I don’t use NullPowerManagement.kext Only one other kext for LAN.

      Did I miss anything?

      • Thanks for the prompt answer 🙂

        I am still wondering how you can get rid of VoodooTSCSync… Did you apply some “magic patch” on your DSDT? As mentionned, on the X79 I am playing with, I am getting a KP everytime I try to boot without, with all cores enabled.

  4. Pingback: freqVectorsEdit.sh v2.2. released – Pike's Universum

  5. can someone please make a magic kext for Yosemite using this that will make my e5-2630v3 use turbo? i’m dying at glacial speeds

  6. Pingback: freqVectorsEdit.sh v2.3 released – Pike's Universum

  7. Is XCPM ‘back ported’ to Sandy Bridge E – ie E5 1660 v1?

    Overclocking the E5 1660 v1 would get close to your geek bench PA 😉

    I don’t see the CPUID info in the Clover page (but it doesn’t look like its been updated in a while)

    https://clover-wiki.zetam.org/Configuration/KernelAndKextPatches#kernelandkextpatches_fakecpuid

    https://software.intel.com/en-us/articles/intel-architecture-and-processor-identification-with-cpuid-model-and-family-numbers

    • Not specifically, and I am still waiting for a confirmation for Sandy Bridge processors. For now. Have a look at the bytes for Sierra DP3 that ‘racermaster’ mentioned in the comments. You could try them and let me know if that works.

      Tip: Use a memory stick at first. Until that you are absolutely certain that it works for your setup. This way you don’t mess up your working setup.

      • OK, putting the pieces together… E5 1660 v1 is far more hassle than an E5 1650 V2 on Sierra.

        The small price difference on 1650 V2 would be worth it. It is, after all, the same CPU as a real nMP.

  8. hello, Can you post the patch on hexadecimal ??? To use with the new feauture clover kernel patch. Thanks for all your work.

      • Find: 0F B6 C4 83 C0 E9 83 F8 47
        Replace E9 with the new calculated value.

        Find: 78 24 83 C3 C4 83 FB 22
        Replace C4 with the new calculated value.

      • Which program you use to generate the assembler output. I use otool but does not give me the same locations.

      • otool –version

        llvm-otool(1): Apple Inc. version cctools-895
        Apple LLVM version 8.0.0 (clang-800.0.33.1)
        Optimized build.
        Default target: x86_64-apple-darwin16.0.0
        Host CPU: broadwell

      • Thanks to patch racermaster can already compare the file and find the location of the patch in my otool, the only missing to find me is the patch to avoid kernel panic. Please help me to find that patch because I want to port it to El Capitan and Mavericks. In my work, we need computers with Mavericks to use some programs that no longer work with the new systems and these patches help me to continue installing Mavericks on new computers, processors compatible with Mavericks no longer avaible. I can port the patch, just I need the locations patches to compare. Thank you.

      • Instead of a C3 (ret) instruction you can use this to locate the panic.

        _xcpm_init:

        # _xcpm_pkg_scope_msr
        BE 07 00 00 00 31 D2 E8 94 FC FF FF -> BE 07 00 00 00 31 D2 90 90 90 90 90

        sub_ffffff800042a820:

        # _xcpm_core_scope_msrs
        BE 02 00 00 00 31 D2 E8 6C FC FF FF -> BE 02 00 00 00 31 D2 90 90 90 90 90

        # _xcpm_SMT_scope_msrs
        BE 0B 00 00 00 31 D2 E8 59 FC FF FF -> BE 0B 00 00 00 31 D2 90 90 90 90 90

        # _xcpm_SMT_scope_msrs
        BE 0B 00 00 00 5D E9 08 00 00 00 -> BE 0B 00 00 00 5D C3 90 90 90 90

        Edit: This is of course macOS Sierra DP3 😉

      • Please this patterns @stinga11

        # _cpuid_set_info, replace XX

        dp3, dp2

        F: 0F B6 C4 83 C0 E9 83 F8 47
        R: 0F B6 C4 83 C0 XX 83 F8 47

        dp1

        F: 0F B6 C4 83 C0 F1 83 F8 4F
        R: 0F B6 C4 83 C0 XX 83 F8 4F

        # _xcpm_bootstrap, replace XX

        dp3, dp2, dp1

        F: 83 C3 C4 83 FB 22
        R: 83 C3 XX 83 FB 22

        # Additionally (if booting results in a immediate reboot), use RET

        dp3

        F: 55 48 89 E5 8B 17 48 8D 3D 03 28 60 00 BE 0B 00 00 00
        R: C3 90 89 E5 8B 17 48 8D 3D 03 28 60 00 BE 0B 00 00 00

        dp2

        F: 55 48 89 E5 8B 17 48 8D 3D 23 1C 60 00 BE 0B 00 00 00
        R: C3 90 89 E5 8B 17 48 8D 3D 23 1C 60 00 BE 0B 00 00 00

        dp1

        F: 55 48 89 E5 8B 17 48 8D 3D B3 11 60 00 BE 0B 00 00 00
        R: C3 90 89 E5 8B 17 48 8D 3D B3 11 60 00 BE 0B 00 00 00

      • Thanks, but the last three won’t help him with finding problematic MSRs, triggering a reboot. Something we really need to figure out. Patching the problematic MSRs is the best thing we can do. It may as well be limited to MSR 0xe2 for locked BIOSes and MSR 0x1a0 but without confirmations…

      • Thanks cecekpawon for the patch. Piker, I have a Ivy-E you said that is not necessary patch the kernel to use the Xcpm with this CPU ?

      • You do need to patch the kernel, but you should be able to skip the patched for the _cpuid_set_info routine. The other two sections that need to be patched are still mandatory.

      • I do not recommend that you continue to use the Clover fakecpuid to enable XCPM. It works well but is not stable. The tests that I did, show some random reboots. The best solution is use the Pikeralpha kernel patch.

    • It is possible patch the sandy-E to haswell or ivy to works with xcpm??
      #define CPUID_MODEL_JAKETOWN 0x2D ( sandy bridge-E)

      #define CPUID_MODEL_IVYBRIDGE 0x3A
      #define CPUID_MODEL_HASWELL 0x3C

      2D+3C???

      • @stinga11, that makes two of us to think replace IvyBridge(0x0306A0) processor with Haswell(0x0306C3) to enable XCPM, but sadly I just got KP(launchd exited — no exit reason available – – (signal 4, exit status 0)) on Haswell Celeron G1840. And, no luck on 10.11.x as well.

  9. Hey Pike,
    I will give it a try with my Asrock x99m Extreme4 and i7-5820k – at the moment running with nullcpupowermanagement and fakecpuid within clover (but without hibernation). this config does work without voodootsc kext. I hope to use your solution to get a stable, oc and hibernated x99 build (I already use your NVME patches :))

    Greetings
    Felix

    • Hi Felix,

      One tip. The patch for _cpuid_set_info is not required for Haswell E and Ivy Bridge E processors. I’ll add a table to explain how the switch table works shortly.

      • Hi Pike,

        as my x99m Build was on hold for the last month due to a move of my family, and after that, the x99m Asrock destroyed itself after 1h installed in my computer case, I’m back in the game. But now I’m pretty out of every information you posted within the last month.

        As my system boots up fine but without sleep/Hibernation and no turbo states, I’m pretty sure, that my ssdt is messed up.
        Can you give me a tip what the correct steps are to get my 5820k with turbo and hibernation work?

        1) I dont need to patch the frequency vectors ok,
        2) I need to boot 10.11.5 (no update to 6 actually cause I dont want to mess up the system) with SMBIOS MacPro 6.1,
        2.1) use your ssdtPRGen.sh using the board-id of iMac14,2 with turbo to get full speedstep,
        2.2) what do i need to configure in my config.plist? sure delete the fakecpuid
        2.2) delete nullcpupowermanagement.kext in clover/kexts/others

        that should work?

      • Good to see that you are back, but I cannot help you with this. Sorry. Not only are we on holiday, but I am sure that someone else, with the same processor, is a much better help for you.

  10. Did some comparisons between the 10.11.6 & 10.12 DP3 kernels, and I think I’ve figured out most of the _xcpm_cpu_model definitions, and also why XCPM doesn’t work on 10.12 for Ivy Bridge processors.

    #define XCPM_CPU_MODEL_IB_CORE		(1 << 1) // 0x2
    #define XCPM_CPU_MODEL_HASWELL		(1 << 2) // 0x4
    #define XCPM_CPU_MODEL_CRYSTALWELL	(1 << 3) // 0x8
    #define XCPM_CPU_MODEL_HASWELL_ULT	(1 << 4) // 0x10
    #define XCPM_CPU_MODEL_BROADWELL_H	(1 << 6) // 0x40
    #define XCPM_CPU_MODEL_BROADWELL	(1 << 7) // 0x80
    #define XCPM_CPU_MODEL_SKYLAKE		(1 << 9) // 0x200
    

    In 10.11.6’s _xcpm_bootstrap, if an Ivy Bridge CPU (_xcpm_cpu_model = 0x2) is detected, it checks for the presence of the -xcpm boot argument and sets _xcpm_mode to 1 if it is found.

    loc_ffffff80003f539e:
        *(int32_t *)_xcpm_cpu_model = 0x2;
        r14 = 0x1;
        goto loc_ffffff80003f5487;
    
    loc_ffffff80003f5487:
        *(int32_t *)_xcpm_bootstrap_count = *(int32_t *)_xcpm_bootstrap_count + 0x1;
        rax = _PE_parse_boot_argn("-xcpm", var_1C, 0x4);
        if ((r14 != 0x0) && (rax == 0x0)) {
                *(int32_t *)_xcpm_mode = 0x0;
        }
        else {
                *(int32_t *)_xcpm_mode = 0x1;
                _PE_parse_boot_argn("-xcpm_assert", _xcpm_assert_enable, 0x4);
                _PE_parse_boot_argn("-xcpm_assert_trace", _xcpm_assert_trace, 0x4);
                rax = *(int32_t *)(r15 + 0x190);
                CMP(rax, *(int32_t *)(r15 + 0x194));
                rax = rax - rax + CARRY(RFLAGS(cf)) & 0x1;
                *(int32_t *)_xcpm_SMT_platform = rax;
        }
        return rax;
    

    10.12 doesn’t have any checks for _xcpm_cpu_model 0x2, so it’s treated as an unsupported CPU (_xcpm_mode = 0x0).

    I tried patching 78 24 83 C3 C4 83 FB 22 to 78 24 83 C3 C6 83 FB 22 (C4 -> C6, fake Haswell), as well as C7 05 56 58 67 00 04 00 00 00 to C7 05 56 58 67 00 02 00 00 00 (set _xcpm_cpu_model to 0x2 instead of 0x4), but this causes a panic (“Unsupported CPU model”). NOP’ing this panic call simply results in an instant reboot (same as not patching _xcpm_cpu_model). I’ll try debugging this further. I think the Haswell-specific PM code might be writing to a MSR that’s locked on Ivy Bridge boards, but I haven’t really checked yet.

    • No. This is not correct.

      1.) The checks in _xcpm_bootstrap are based on the CPU model number and set _xcpm_cpu_model to some value for internal use. There is no check here for _xcpm_cpu_model and it doesn’t work (anymore) simply because there is no model number check for Ivy Bridge processors. That is now also an unsupported processor for XCPM. Like Haswell E and Broadwell E processors. Which is why we have to patch it in the first place.

      2.) Skylake uses both 0x200 and 0x1000. The former for mobile and latter for desktop processors. There is even a check for 0x2000 in _xcpm_monitor_init (which isn’t used yet).

      3.) The panic that you are getting is the one in _xcpm_monitor_init because you messed up the value of _xcpm_cpu_model. And when you look a bit further you’ll see that it uses the Haswell C-states. Doesn’t 10.11.6 include Ivy Bridge C-states as well?

      4.) The -xcpm boot argument doesn’t do anything anymore. Should soon be gone.

      • Ah, thanks for the clarification. I did see that -xcpm doesn’t appear to be used for anything, but missed that _xcpm_model_id isn’t either. Was curious about the 0x2000 value since I didn’t see it anywhere in the switch table. Will look more into this.

  11. Hi pikeralpha, I think I might have some information that might help with the weird 800MHz LFM bug.

    Annoyingly, this is not actually documented in the Intel-64 & IA-32 SDM, but in the MSR_PLATFORM_INFO register, in the “reserved” bits, the byte directly after the Maximum Efficiency Ratio, [55:48], contains the MFM or minimum frequency mode frequency. This is the absolute minimum frequency when in low power mode, and is only accessible when turbo boost is disabled and single thread mode. This frequency seems to set at 800MHz on most (or possibly all, it’s poorly documented so I am not really sure) processors with the LPM feature (bit 32 set indicates LPM support). For example, bit 51 in your own CPU’s register is set, so your MFM is 800MHz. It is set in mine as well, but on an E5-2690 v4 CPU, as is bit 32.

    It’s pretty clear the CPU never actually hits this frequency as the conditions for LPM aren’t met, so I am wondering if it is possible that kernel is reading [55:48] of the platform info register for that number, and that is why it shows 8?

    • Ah there you are. First of. Sorry for my late reply.

      Indeed poorly documented, but it is documented for Ivy Bridge (E) and Haswell E processor. Hopefully Intel will fix this omission soon in their documentation. It sucks to have to guess.

      Correct. Located in _xcpm_dvfs_configure:

      ffffff80004259f5         mov        ecx, 0xce
      ffffff80004259fa         rdmsr      
      ffffff80004259fc         mov        edi, eax			// low-order 32 bits of the MSR
      ffffff80004259fe         movzx      eax, ah
      ffffff8000425a01         mov        r14, rax
      ffffff8000425a04         mov        rax, rdx
      ffffff8000425a07         movzx      ecx, dh
      ffffff8000425a0a         mov        dword [ss:rbp+var_40], ecx	// store nominal multiplier in var_40
      ffffff8000425a0d         shr        edx, 0x10			// high-order 32 bits of the MSR
      ffffff8000425a10         movzx      r8d, dl
      ffffff8000425a14         mov        dword [ss:rbp+var_3C], r8d	// store 0x8 multiplier in var_3C
      ffffff8000425a18         shl        rax, 0x20
      ffffff8000425a1c         or         rdi, rax
      
  12. Guys, sorry to bother, but it’s been a week, every day, all day long, and still I can’t find locations on 10.11.6. to patch my Broadwell E (i7 6900k). Already unlocked X99-a II bios (checked with RW Everything -> thanks to CodeRush). I know my lack is both in the kernel patch knowledge and instruments to apply it (disassembler? offset?). So I’m asking for help. Thanks in advance

    • I don’t have OS X 10.11.6 running myself but try this:

      0x1f6190 replace 0x55 with 0xC3 (sub_ffffff80003f6190:)
      0x1f54b7 replace 0xBB with 0xB3 (_xcpm_bootstrap:)
      0x1bc276 replace 0xBB with 0xB3 (_cpuid_set_info:)

      Note: These are file offsets for HexEdit et all.

      Check your changes with:


      tool -tVj kernel_unpatched > kernel_unpatched.txt
      tool -tVj kernel_patched > kernel_patched.txt
      diff -uw kernel_unpatched.txt kernel_patched.txt

      • Thanks, Pike. With this patch no progress, though. Here’s the compare results:

        iMac-di-Giacomo:~ giacomo$ diff -uw /Users/giacomo/Desktop/kernel_unpatched.txt /Users/giacomo/Desktop/kernel_patched.txt
        — /Users/giacomo/Desktop/kernel_unpatched.txt 2016-08-07 10:36:15.000000000 +0200
        +++ /Users/giacomo/Desktop/kernel_patched.txt 2016-08-07 10:35:16.000000000 +0200
        @@ -1,4 +1,4 @@
        -/Users/giacomo/Desktop/kernel 10.11.6:
        +/Users/giacomo/Desktop/kernel 10.11.6patchedhex:
        (__TEXT,__text) section
        _vm_swapfile_for_handle:
        ffffff80002a7000 55 pushq %rbp
        @@ -294264,7 +294264,7 @@
        ffffff80003bc26d eb62 jmp 0xffffff80003bc2d1
        ffffff80003bc26f 83f85d cmpl $0x5d, %eax
        ffffff80003bc272 7f28 jg 0xffffff80003bc29c
        -ffffff80003bc274 8d48bb leal -0x45(%rax), %ecx
        +ffffff80003bc274 8d48b3 leal -0x4d(%rax), %ecx
        ffffff80003bc277 83f902 cmpl $0x2, %ecx
        ffffff80003bc27a 7327 jae 0xffffff80003bc2a3
        ffffff80003bc27c bbdc82b210 movl $0x10b282dc, %ebx ## imm = 0x10B282DC
        @@ -353804,7 +353804,7 @@
        ffffff80003f54ab e9d7000000 jmp 0xffffff80003f5587
        ffffff80003f54b0 83fb5d cmpl $0x5d, %ebx
        ffffff80003f54b3 7f2e jg 0xffffff80003f54e3
        -ffffff80003f54b5 83c3bb addl $-0x45, %ebx
        +ffffff80003f54b5 83c3b3 addl $-0x4d, %ebx
        ffffff80003f54b8 83fb09 cmpl $0x9, %ebx
        ffffff80003f54bb 7747 ja 0xffffff80003f5504
        ffffff80003f54bd 488d0550010000 leaq 0x150(%rip), %rax
        @@ -354596,7 +354596,7 @@
        ffffff80003f6182 5d popq %rbp
        ffffff80003f6183 e908000000 jmp 0xffffff80003f6190
        ffffff80003f6188 0f1f840000000000 nopl (%rax,%rax)
        -ffffff80003f6190 55 pushq %rbp
        +ffffff80003f6190 c3 retq
        ffffff80003f6191 4889e5 movq %rsp, %rbp
        ffffff80003f6194 4157 pushq %r15
        ffffff80003f6196 4156 pushq %r14
        iMac-di-Giacomo:~ giacomo$

        Still I don’t get how you found the offset locations. I’m going to read again everything on this post. Meanwhile, down here, the link to download both 10.11.6 kernels, patched and unpatched, if you want to take a look. Thanks
        http://download904.mediafire.com/1dtqb7u756cg/7zghp2n9pq7x71c/10.11.6+kernels.zip

      • Getting offsets is simple. Let’s take _xcpm_boostrap as example:

        0xFFFFFF80003F5420 – 0xFFFFFF8000200000 = 0x1F5420

        AKA: Address – VM Address of Text Segment = file offset.

  13. Pingback: Checks for two unused processor models found… – Pike's Universum

  14. Thanks Pike!

    I just implemented this with my ES E5-2697 V3 in 10.11.6. I was able to get the same peak performance using a FakeCPUID before this, but now I also have improved GB multi-core (~5%, 41.3K), slightly cooler (~5C) temps, and a much flatter and more reliable turbo.

    I used these three edits:
    xcpm_bootstrap 10.11.6 © Pike R. Alpha
    find 83C3BB83FB09 
    replace 83C3B883FB09

    cpuid_set_info 10.11.6 © Pike R. Alpha
    find 5D7F288D48BB83F902
    replace 5D7F288D48B883F902

    reboot fix 10.11.6 © Pike R. Alpha
    find 554889E5415741564155415453504189D64189F74889FB4585FF0F84
    replace C34889E5415741564155415453504189D64189F74889FB4585FF0F84

    Do you know which find/replace would work in 10.10.5? Is this applicable to 10.10.5? Thanks!

    • Hmm. What FakeCPUID did you use?

      I know this may be a little too much to ask, but would you mind disabling the patches and use the previous method that you used, and tell me what the output is of:
      sysctl machdep.xcpm

      • Sure, I will reply tomorrow with the output.

        Previously I had used FakeCPUID 0x0306E0, NullCPUPM, disabled EIST in BIOS, enabled All Core Turbo and set it to Auto. No SSDT/freqvect changes.

        I assume that method was my behind my occasional random reboot, but I will not know for sure until I have used your patches for a longer period of time.

      • Here is the output with my old style, xcpm is not running, but I get both single core and all core turbos very close to windows. Geekbench gives SC 3380/MC 39500. (2.7GHz 14-core)

        There is no real energy saving as IPG shows that it runs at 3GHz at all times. Same as below, AICPUPM is trying to load, but Null to stop it from KP’ing.

        :~ MacPro$ sysctl machdep.xcpm
        machdep.xcpm.mode: 0
        machdep.xcpm.hard_plimit_max_100mhz_ratio: 0
        machdep.xcpm.hard_plimit_min_100mhz_ratio: 0
        machdep.xcpm.soft_plimit_max_100mhz_ratio: 0
        machdep.xcpm.soft_plimit_min_100mhz_ratio: 0
        machdep.xcpm.tuib_plimit_max_100mhz_ratio: 0
        machdep.xcpm.tuib_plimit_min_100mhz_ratio: 0
        machdep.xcpm.tuib_enabled: 0
        machdep.xcpm.power_source: 0
        machdep.xcpm.bootplim: 0
        machdep.xcpm.bootpst: 0
        machdep.xcpm.tuib_ns: 0
        machdep.xcpm.ratio_changes_total: 0
        machdep.xcpm.maxbusdelay: 0
        machdep.xcpm.maxintdelay: 0
        machdep.xcpm.mbd_mode: 1
        machdep.xcpm.mbd_applications: 0
        machdep.xcpm.mbd_relaxations: 0
        machdep.xcpm.forced_idle_ratio: 100
        machdep.xcpm.forced_idle_period: 30000000
        machdep.xcpm.deep_idle_log: 0
        machdep.xcpm.qos_txfr: 1
        machdep.xcpm.deep_idle_count: 0
        machdep.xcpm.deep_idle_last_stats: n/a
        machdep.xcpm.deep_idle_total_stats: n/a
        machdep.xcpm.cpu_thermal_level: 0
        machdep.xcpm.gpu_thermal_level: 0
        machdep.xcpm.io_thermal_level: 0
        machdep.xcpm.io_control_engages: 0
        machdep.xcpm.io_control_disengages: 0
        machdep.xcpm.io_filtered_reads: 0

      • Disable xcpm
        Last login: Fri Aug 12 12:46:25 on console
        manoranjansPro2:~ manoranjan$ sysctl -a | grep xcpm
        machdep.xcpm.mode: 0
        machdep.xcpm.hard_plimit_max_100mhz_ratio: 0
        machdep.xcpm.hard_plimit_min_100mhz_ratio: 0
        machdep.xcpm.soft_plimit_max_100mhz_ratio: 0
        machdep.xcpm.soft_plimit_min_100mhz_ratio: 0
        machdep.xcpm.tuib_plimit_max_100mhz_ratio: 0
        machdep.xcpm.tuib_plimit_min_100mhz_ratio: 0
        machdep.xcpm.tuib_enabled: 0
        machdep.xcpm.power_source: 0
        machdep.xcpm.bootplim: 0
        machdep.xcpm.bootpst: 0
        machdep.xcpm.tuib_ns: 0
        machdep.xcpm.ratio_changes_total: 0
        machdep.xcpm.maxbusdelay: 0
        machdep.xcpm.maxintdelay: 0
        machdep.xcpm.mbd_mode: 1
        machdep.xcpm.mbd_applications: 0
        machdep.xcpm.mbd_relaxations: 0
        machdep.xcpm.forced_idle_ratio: 100
        machdep.xcpm.forced_idle_period: 30000000
        machdep.xcpm.deep_idle_log: 0
        machdep.xcpm.qos_txfr: 1
        machdep.xcpm.deep_idle_count: 0
        machdep.xcpm.deep_idle_last_stats: n/a
        machdep.xcpm.deep_idle_total_stats: n/a
        machdep.xcpm.cpu_thermal_level: 0
        machdep.xcpm.gpu_thermal_level: 0
        machdep.xcpm.io_thermal_level: 0
        machdep.xcpm.io_control_engages: 0
        machdep.xcpm.io_control_disengages: 0
        machdep.xcpm.io_filtered_reads: 0
        manoranjansPro2:~ manoranjan$

        With XCPM patched
        Last login: Sun Aug 14 14:57:30 on ttys000
        manoranjansPro2:~ navaratnammanoranjan$ sysctl machdep.xcpm
        machdep.xcpm.io_filtered_reads: 0
        machdep.xcpm.io_control_disengages: 1
        machdep.xcpm.io_control_engages: 0
        machdep.xcpm.io_thermal_level: 0
        machdep.xcpm.gpu_thermal_level: 0
        machdep.xcpm.cpu_thermal_level: 0
        machdep.xcpm.deep_idle_total_stats: n/a
        machdep.xcpm.deep_idle_last_stats: n/a
        machdep.xcpm.deep_idle_count: 0
        machdep.xcpm.qos_txfr: 1
        machdep.xcpm.deep_idle_log: 0
        machdep.xcpm.forced_idle_period: 30000000
        machdep.xcpm.forced_idle_ratio: 100
        machdep.xcpm.mbd_relaxations: 65880
        machdep.xcpm.mbd_applications: 65978
        machdep.xcpm.mbd_mode: 1
        machdep.xcpm.maxintdelay: 0
        machdep.xcpm.maxbusdelay: 4294967295
        machdep.xcpm.ratio_changes_total: 4380383
        machdep.xcpm.vectors_loaded_count: 0
        machdep.xcpm.tuib_ns: 0
        machdep.xcpm.bootpst: 43
        machdep.xcpm.bootplim: 0
        machdep.xcpm.power_source: 0
        machdep.xcpm.tuib_enabled: 0
        machdep.xcpm.tuib_plimit_min_100mhz_ratio: 8
        machdep.xcpm.tuib_plimit_max_100mhz_ratio: 43
        machdep.xcpm.soft_plimit_min_100mhz_ratio: 8
        machdep.xcpm.soft_plimit_max_100mhz_ratio: 43
        machdep.xcpm.hard_plimit_min_100mhz_ratio: 8
        machdep.xcpm.hard_plimit_max_100mhz_ratio: 43
        machdep.xcpm.mode: 1
        manoranjansPro2:~ navaratnammanoranjan$

        For 10.12 I don’t use any FakecpuID.

      • MOB, I assume you’re using Clover bootloader. Would you mind to share your EFI partition? With those binary corrections (applied directly on Kernel, not via Clover) and deleting fakeCPUID from clover confg.plist my system doesn’t boot. Pike thinks is a Clover issue. I’m confused. TIA

      • I use iMac 14.1 not work that why
        Can I ask 5960X my board x99 gaming g1
        Cooler is corsair H115i
        My board support auto over clock.when i try auto 4.3ghz with geekscore 26000 with xcpm
        How to increase geekbench score?

      • I don’t quite get it what you are trying to tell us here, but there are now 26 (I think) plists with FrequencyVectors in it, and if you are using a model/board-id combination (via SMBIOS setting) with FrequencyVectors in the plist, like the iMac14,1 does, then you don’t need to run freqVectorsEdit.sh

        Please note that the plists for the Broadwell models may include certain settings that will effectively limit the (maximum turbo) clock frequency to the one specified in the FrequencyVectors.

        About the Geekbench multi-score result; what exactly is it that you are looking for? What software do you use that requires a higher multi-core result?

      • [cid:E3EE57CB-258C-4402-8F4A-6E670BA80EE6@Home]

        With XCPM [cid:2B9183FB-949E-4F2A-9BF1-2317C2637A82@Home]

      • I am sorry I was wrong
        I patch freqVectorsEdit.sh after XCPM patched worked
        Now worked 17.1 Before i disable xcpm patched birth then restart worked.

  15. Hi Pike and MOB.
    Same workaround here for me (FakeCPUID 0x0306A0 rather than 0x0306E0). CPU ratio AUTO (the only value that allows speedsteps to work in OS X). NullCPUPowerManagement.kext mandatory to boot, as well as IOPCIFamily patch from 4881F901000040 to 4881F901000080 (clover config). Frequency vectors injected from iMac 14,2 into MacPro 6,1 .plist.
    sysctl -n machdep.xcpm.mode returns 0. Running kextstat shows me that both AppleIntelCPUPowerManagement.kext and NullCPUPowerManagement.kext are present in the list with loaded kexts (of course).
    MOB patches don’t work for me. No boot
    Asus X99-A II + Intel i7 6900K
    El Capita 10.11.6
    I’ve tried to get into the disassembled kernel instructions. That’s really too much for me. Sorry

  16. Oops, sorry! Here’s the build http://www.tonymacx86.com/threads/giacomoleopardos-workstation-triplet.199643/
    No it doesn’t reboot, with MOB patches it’s stuck on Apple logo (didn’t tried in verbose, no time this morning). Of course I removed FakeCPUID, first. Do you think I’m missing something? And MOB’s patches could be right even for our CPU’s (10.11.6 kernel, I mean)?
    As a matter of fact I trust you. How couldn’t I? Almost everything I know about hackintohsh is your sister’s and yours work!:-)
    I’m eager to test your suggestion.

    • I’m lost for words. Thanks!

      I always boot in verbose mode. At least until everything is sorted out and fully functional.

      The first two patched need to be changed for our processors:

      xcpm_bootstrap (OS X 10.11.6)

      find…: 83C3BB83FB09
      replace: 83C3B383FB09

      cpuid_set_info (OS X 10.11.6)

      find…: 5D7F288D48BB83F902
      replace: 5D7F288D48B383F902

      You may also need to patch _xcpm_idle (see patches in blog article):

      find…: 300f000000e2b920
      replace: 9090000000e2b920

      Warning: I do not know if you have to reverse the byte order for Clover! Please verify this with folks @ insanelymac.com and/or tonymaxc86.com

  17. Thanks. I used Find/Replace with the good old HexFiend. No luck, though. In verbose mode, the boot process doesn’t even start. No kernel Panic, nothing besides the initial OsxAptioFixDrv Starting overrides of System\Library\CoreServices\boot.efi

  18. Thank you Pikeralpa
    I try this 10.12DB5
    Haswell E
    xcpm_bootstrap (OS X 10.12 DB5)
    find…: 8B7C4018 488B
    replace: 8B7C1018 488B
    cpuid_set_info (OS X 10.12 DB5)
    find…: C0E95701
    replace: C0E95701
    reboot fix 10.12 DB5 © Pike R. Alpha
    find…: 554889E5 8B17488D 3D032860 00BE0B00 0000
    replace: C39089E5 8B17488D 3D032860 00BE0B00 0000

    Its kernell panic.

  19. Hi PikerAlpha,

    would it be possible to post a fairly easy guide for people like me who are no experts on xcpm.
    Since there are a lot of updates and comments it’s a little bit confusing.
    Otherwise it would be great if you could help me with my setup.

    I have to thank you for your help and work! You are the best!
    Regards,
    realFlow

    AppleIntelInfo.kext v1.5 Copyright © 2012-2016 Pike R. Alpha. All rights reserved

    CPU: Intel i7 – 5820k Haswell E (locked MSR)
    Mobo: Asus x99-a/USB3.1
    OS: macOS Sierra 10.12 PB 5 (16A294a)
    Bootl.: Clover 3696
    smbios: MacPro6,1
    BoardID:Mac-F60DEB81FF30ACF6

    sysctl -n machdep.xcpm.mode returns 0

    Output of AppleIntelInfo:

    Settings:
    ------------------------------------
    logMSRs............................: 1
    logIGPU............................: 0
    logCStates.........................: 1
    logIPGStyle........................: 1
    InitialTSC.........................: 0x2a40a694e0c9
    MWAIT C-States.....................: 8480

    Model Specific Registers
    -----------------------------------
    MSR_CORE_THREAD_COUNT......(0x35) : 0x6000C
    MSR_PLATFORM_INFO..........(0xCE) : 0x20080C3BF3812100
    MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x8400
    MSR_PMG_IO_CAPTURE_BASE....(0xE4) : 0x10414
    IA32_MPERF.................(0xE7) : 0x3E40E010D2D
    IA32_APERF.................(0xE8) : 0x3D25211127E
    MSR_FLEX_RATIO.............(0x194) : 0xE0000
    MSR_IA32_PERF_STATUS.......(0x198) : 0x20C700002100
    MSR_IA32_PERF_CONTROL......(0x199) : 0x2100
    IA32_CLOCK_MODULATION......(0x19A) : 0x0
    IA32_THERM_STATUS..........(0x19C) : 0x88320000
    IA32_MISC_ENABLES..........(0x1A0) : 0x850089
    MSR_MISC_PWR_MGMT..........(0x1AA) : 0x400000
    MSR_TURBO_RATIO_LIMIT......(0x1AD) : 0x2222242424242424
    IA32_ENERGY_PERF_BIAS......(0x1B0) : 0x0
    MSR_POWER_CTL..............(0x1FC) : 0x29040059
    MSR_RAPL_POWER_UNIT........(0x606) : 0xA0E03
    MSR_PKG_POWER_LIMIT........(0x610) : 0x7FFF80015FFF8
    MSR_PKG_ENERGY_STATUS......(0x611) : 0xC1F19B
    MSR_PKG_POWER_INFO.........(0x614) : 0x1280460
    MSR_PP0_POWER_LIMIT........(0x638) : 0x0
    MSR_PP0_ENERGY_STATUS......(0x639) : 0x0
    MSR_PKGC6_IRTL.............(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY.......(0x60d) : 0x0
    MSR_PKG_C6_RESIDENCY.......(0x3f9) : 0x0
    IA32_TSC_DEADLINE..........(0x6E0) : 0x2A40A921F8B1

    CPU Ratio Info:
    ------------------------------------
    CPU Low Frequency Mode.............: 1200 MHz
    CPU Maximum non-Turbo Frequency....: 3300 MHz
    CPU Maximum Turbo Frequency........: 3600 MHz
    CPU P-States [ (33) ]

      • Tried it just this minute with CPUID 0x0306A0 and got an kernel panic
        Kernel Extension in backtrace:
        com.apple.driver.AppleIntelCPUPowerManagement(219.0)
        with and without -xcpm

      • If I use an ID higher than 0x3A clover isn’t able to load. (Freezes on patching, ++++++++) With 0x3A I get the kernel panic. With 0x3F I’m able to boot (=real CPUID)

        Tried following CPUIDS, some also with disabled kernelpatches 0x0306A0 0x0306C0 0x0306C4 0x0306E0 0x0306E2 0x0306E4 0x040650

        Thank You!

        Gruß, Flo >

      • Hi Pikealpa
        I try XCPM DP6 for 5960X
        I thing I have wrong value xcpm_bootstrap
        Comment-xcpm_bootstrap 10.12 DP5 & DP6 © Pike R. Alpha
        Find-83C3C483 FB22
        Replace-83C3C183 FB22
        Please check for me.
        Thank you.

      • I try this but not work
        DP6

        0x227F90
        Find-83C3C483 FB22
        Replace-83C3C183 FB22

        0x2261904
        Find-554889E5 41574156 41554154 53504189 D641
        Replace-C39089E5 41574156 41554154 53504189 D641

      • Are you using Clover’s find/replace to patch the locations?

        Edit: The second patch pattern matches with twelve (12) different locations in the DP6 kernel. Not only that. It’s the wrong location that you are patching. Or you reported the wrong address.

        Please apply the patch (0x55 -> 0xC3) @ 0x228390 in HexEdit.

      • Yes Its worked same patched DP5 and DP6
        I was disabled XCPM in config thats why not work
        Thanks Pike.
        Last login: Fri Aug 19 09:02:39 on console
        navaratnams-Pro:~ navaratnammanoranjan$ sudo -s
        Password:
        bash-3.2# chown -R 0:0 ~/Desktop/AppleIntelInfo.kext
        bash-3.2# chmod -R 755 ~/Desktop/AppleIntelInfo.kext
        bash-3.2# kextload ~/Desktop/AppleIntelInfo.kext
        bash-3.2# cat /tmp/AppleIntelInfo.dat

        AppleIntelInfo.kext v1.2 Copyright © 2012-2015 Pike R. Alpha. All rights reserved

        Settings:

      • Oh ok. I see. No problem. Thanks for the update.

        Ehm. Something went wrong with the settings I guess.

        Tip: Put code and listings in a <code> </code> block 😉

      • I note in bios setting If I enable support states C6/C7 XCPM worked.
        How to put code and listens in a code block?give me a sample.
        Thank you.

      • Hi Pikeralpha
        XCPM-High score now
        #262

        _xcpm_bootstrap Sierra © Pike R. Alpha
        Find 83C3C483FB22
        Replace 83C3C183FB22

        _xcpm_pkg_scope_msr © Pike R. Alpha
        Find BE0700000031D2E894FCFFFF
        Replace BE0700000031D29090909090

        _xcpm_core_scope_msrs © Pike R. Alpha
        Find BE0200000031D2E86CFCFFFF
        Replace BE0200000031D29090909090

        xcpm performance fix 1 (wrsmr fix to get CPU max) © okrasit
        Find 89D8C1E008B99901
        Replace B800FF0000B99901

        XCPM_idle fix by Pike R. Alpha
        Find 20B9E20000000F30
        Replace 20B9E20000009090
        Without NullCPUPowerManagement.kext
        Without VoodooTSCSync.kext

        Last login: Fri Aug 19 14:24:45 on console
        navaratnams-Pro:~ navaratnammanoranjan$ sysctl machdep.xcpm
        machdep.xcpm.io_filtered_reads: 0
        machdep.xcpm.io_control_disengages: 1
        machdep.xcpm.io_control_engages: 0
        machdep.xcpm.io_thermal_level: 0
        machdep.xcpm.gpu_thermal_level: 0
        machdep.xcpm.cpu_thermal_level: 0
        machdep.xcpm.deep_idle_total_stats: n/a
        machdep.xcpm.deep_idle_last_stats: n/a
        machdep.xcpm.deep_idle_count: 0
        machdep.xcpm.qos_txfr: 1
        machdep.xcpm.deep_idle_log: 0
        machdep.xcpm.forced_idle_period: 30000000
        machdep.xcpm.forced_idle_ratio: 100
        machdep.xcpm.mbd_relaxations: 1356
        machdep.xcpm.mbd_applications: 1369
        machdep.xcpm.mbd_mode: 1
        machdep.xcpm.maxintdelay: 0
        machdep.xcpm.maxbusdelay: 4294967295
        machdep.xcpm.ratio_changes_total: 108135
        machdep.xcpm.vectors_loaded_count: 1
        machdep.xcpm.tuib_ns: 0
        machdep.xcpm.bootpst: 43
        machdep.xcpm.bootplim: 0
        machdep.xcpm.power_source: 0
        machdep.xcpm.tuib_enabled: 0
        machdep.xcpm.tuib_plimit_min_100mhz_ratio: 8
        machdep.xcpm.tuib_plimit_max_100mhz_ratio: 43
        machdep.xcpm.soft_plimit_min_100mhz_ratio: 8
        machdep.xcpm.soft_plimit_max_100mhz_ratio: 43
        machdep.xcpm.hard_plimit_min_100mhz_ratio: 8
        machdep.xcpm.hard_plimit_max_100mhz_ratio: 43
        machdep.xcpm.mode: 1
        navaratnams-Pro:~ navaratnammanoranjan$ [cid:A9D2F186-B351-48AF-97F6-20732C225454@Home]

      • Hi Piker,

        i got your patches working, but no xcpm yet.
        I think the error was the kernelcache.

        Replaced:
        0x1F7DE7: E9 -> E6 (First E9 after 0x1f7cc0)
        0x21E430: 0F30 -> 9090
        0x21E46E: 0F30 -> 9090
        0x227F92: C4 -> C1 (First C4 after 0x227f30)

        No FakeCPUID
        HaswellE Patch,  AppleRTC, Asus AICPUPM
        VoodooTSCSync.kext

        Result:
        com.apple.driver.AppleIntelCPUPowerManagement loaded
        AppleIntelInfo: CPU P-States [ 31 (33) ]
        machdep.xcpm.mode: 0
        machdep.xcpm.vectors_loaded_count: 0

      • Please try to boot without this setting.

        Note: Always have a secondary boot method handy when you try out changes.

        Just in case it hangs or reboots due to some panic.

      • In Bios If I Enabled-CPU thermal monitor-kernel panic-Reset to auto now.
        Can I ask my system msr locked or not?
        [cid:DF04329E-8E3E-4895-9FCC-14E9809F4AAE@Home][cid:C9A682C0-625B-49DB-BFAB-CEA68A97382F@Home]

      • Download and compiled every thing worked.
        Thanks Pike new update.
        Last login: Sat Aug 20 07:53:54 on console
        manoranjansPro2:~ navaratnammanoranjan$ sudo -s
        Password:
        bash-3.2# chown -R 0:0 ~/Desktop/AppleIntelInfo.kext
        bash-3.2# chmod -R 755 ~/Desktop/AppleIntelInfo.kext
        bash-3.2# kextload ~/Desktop/AppleIntelInfo.kext
        bash-3.2# cat /tmp/AppleIntelInfo.dat

        AppleIntelInfo.kext v1.5 Copyright © 2012-2016 Pike R. Alpha. All rights reserved

        Settings:

      • Hi Pike
        Please explain more about code block
        You mean this section.
        [cid:59805A86-040A-459C-84DE-5365E354C3F5@Home]

      • I don’t see any output of the AppleIntelInfo.kext so I presumed that something went wrong. Code blocks may help.

        In short. You want to check the value of MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0XNNNNN
        Check for bit-15 (0x8000) and thus if you see it there, then MSR 0xE2 is locked. Otherwise it is not locked.

      • Hi Pike Where I have to check bit-15 (0x8000)?

        What is Code block part of which one 1-Kernel 2-Bios 3-Clover

      • Can you check this for me. I tried this:

        0x82D060 _xcpm_pkg_scope_msrs
        F-DC 33 00 00
        R-00 00 00 00

        and

        0x82D040 _xcpm_pkg_scope_msrs
        F-DC 33 00 00
        R-C3 00 00 00

        Settings: MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x3
        Still not change

      • First. make sure that you are targeting the right locations. I mean. If I run:

        xxd -s 0x82d050 -l 48 -u /System/Library/Kernels/kernel

        Then I get this:
        <code>

        0082d050: 0000 0000 0000 0000 0000 0000 0000 0000
        0082d060: A001 0000 DC33 0000 0000 0000 0000 0000
        0082d070: 0000 0000 4000 0000 0100 0500 0000 0000 
        

        </code>
        That to me doesn’t look like MSR 0xE2. Also. There are more locations with MSR xE2 so make certain that you are patching the one that is used.

        Look what I have done with the code block 😉

      • I try today DP7 XCPM worked.

        10.12 Beta (16A304a)
        Last login: Tue Aug 23 10:54:09 on console
        navaratnams-Pro:~ navaratnammanoranjan$ sysctl machdep.xcpm
        machdep.xcpm.io_filtered_reads: 0
        machdep.xcpm.io_control_disengages: 1
        machdep.xcpm.io_control_engages: 0
        machdep.xcpm.io_thermal_level: 0
        machdep.xcpm.gpu_thermal_level: 0
        machdep.xcpm.cpu_thermal_level: 0
        machdep.xcpm.deep_idle_total_stats: n/a
        machdep.xcpm.deep_idle_last_stats: n/a
        machdep.xcpm.deep_idle_count: 0
        machdep.xcpm.qos_txfr: 1
        machdep.xcpm.deep_idle_log: 0
        machdep.xcpm.forced_idle_period: 30000000
        machdep.xcpm.forced_idle_ratio: 100
        machdep.xcpm.mbd_relaxations: 988
        machdep.xcpm.mbd_applications: 994
        machdep.xcpm.mbd_mode: 1
        machdep.xcpm.maxintdelay: 0
        machdep.xcpm.maxbusdelay: 4294967295
        machdep.xcpm.ratio_changes_total: 115492
        machdep.xcpm.vectors_loaded_count: 1
        machdep.xcpm.tuib_ns: 0
        machdep.xcpm.bootpst: 43
        machdep.xcpm.bootplim: 0
        machdep.xcpm.power_source: 0
        machdep.xcpm.tuib_enabled: 0
        machdep.xcpm.tuib_plimit_min_100mhz_ratio: 8
        machdep.xcpm.tuib_plimit_max_100mhz_ratio: 43
        machdep.xcpm.soft_plimit_min_100mhz_ratio: 8
        machdep.xcpm.soft_plimit_max_100mhz_ratio: 43
        machdep.xcpm.hard_plimit_min_100mhz_ratio: 8
        machdep.xcpm.hard_plimit_max_100mhz_ratio: 43
        machdep.xcpm.mode: 1
        navaratnams-Pro:~ navaratnammanoranjan$

      • Hi Pike Thank you for your hard work.
        My X99GamingG1 I thing is
        MSR(0xE2)unlock
        Because I never need PM patched for booting.

        Cecekpawon check my bios he say unlock please check my bios and confirm.

        #1849 Posted 04 November 2015

        MIXAGRIND:UEFIPatch_0.3.8_osx yod$ ./UEFIPatch X99GG1W.10d
        parseFile: non-empty pad-file contents will be destroyed after volume modifications
        No patches can be applied to input file

        probably already unlocked

      • Hi Pike I note this

        If C6/C7 Enable MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x403

        If C6/C7 AUTO MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x3

      • The 0x400 part you see there is bit-10. The bit used to enable/disable I/O MWAIT Redirection. This is what the Intel® 64 and IA-32 Architectures Software Developer’s Manual has to say about it:

        When set, will map IO_read instructions sent to IO register specified by MSR_PMG_IO_CAPTURE_BASE to MWAIT instructions

        By the way. MSR_PMG_IO_CAPTURE_BASE is MSR 0xE4. But in short. Set that BIOS setting to Enabled. Auto sucks.

      • Perfect, you were right!
        Disabling KernelHaswellE did it.
        My system is not completely stable yet, but xcpm is working.

        Thanks!

        CPU C6-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 ]
        CPU P-States [ (12) 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 36 ]
        sysctl -n machdep.xcpm.mode returns 1
        sysctl -n machdep.xcpm.vectors_loaded_count returns 0

        To sum up what was needed for 5820k on ASUS x99-a USB3.1 with PB5:
        Kernel Patching:
        0x1F7DE7: E9 -> E6 (First E9 after 0x1f7cc0)
        0x21E430: 0F30 -> 9090
        0x21E46E: 0F30 -> 9090
        0x227F92: C4 -> C1 (First C4 after 0x227f30)

        Clover:
        Bootoptions: -xcpm
        NO Kernel and Kext Patches activated!
        SSDT with ssdtPRGen.sh

        (Entered CPU details 3.300MHz & 100.000kHz also disabled Overclocking in BIOS, set BLKFreq to 100Mhz, ratio synced on all cores to 33 for better system stability)

        THANKS again.
        (Because you are a generous person i will take the occasion and donate some money 🙂 )

      • Thank you for the confirmation.

        One other thing. Is MSR 0xE2 locked (bit-15 set) or not? If not then you can dump the next two patches:
        0x21E430: 0F30 -> 9090
        0x21E46E: 0F30 -> 9090

        If MSR 0xE2 is indeed locked, then you should also block re-programming of the MSR’s (see link below).

        To get a stable system, please read this blog article. I would start by disabling the 0x01A0 and 0x01AA MSR’s. You can do that by replace DC 33 00 00 with 00 00 00 00

        Let me know how things go.

        Thank you for the consideration, but please wait. I’ll let you know when I am ready for it. Thanks!

      • I patched
        0x82D060 _xcpm_pkg_scope_msrs
        F-DC 33 00 00
        R-00 00 00 00
        I see bootlog

        0:100 0:000 Boot status=0
        0:100 0:000 Running on: 'Default string' with board 'X99-Gaming G1 WIFI'
        0:100 0:000 === [ GetCPUProperties ] ==================================
        0:100 0:000 CPU Vendor = 756E6547 Model=306F2
        0:100 0:000 got cores from CPUID_1 = 0
        0:100 0:000 The CPU supported turbo
        0:100 0:000 BrandString = Intel(R) Core(TM) i7-5960X CPU @ 3.00GHz
        0:100 0:000 MSR 0xE2 before patch 00000403
        0:100 0:000 MSR 0xE4 00010414
        0:100 0:000 MSR 0xCE 00080C3B_F3811E00
        0:100 0:000 MSR 0x1B0 00000000
        0:100 0:000 FSBFrequency=143MHz DMIvalue=100000kHz
        0:100 0:000 Corrected FSBFrequency=100MHz
        0:100 0:000 Vendor/Model/Stepping: 0x756E6547/0x3F/0x2
        0:100 0:000 Family/ExtFamily: 0x6/0x0
        0:100 0:000 MaxDiv/MinDiv: 30.0/12
        0:100 0:000 Turbo: 43/43/43/43
        0:100 0:000 Features: 0xBFEBFBFF
        0:100 0:000 Threads: 16
        0:100 0:000 Cores: 8
        0:100 0:000 FSB: 100 MHz
        0:100 0:000 CPU: 4300 MHz
        0:100 0:000 TSC: 4300 MHz
        0:100 0:000 PIS: 400 MHz

      • I was never sure if my MSR 0xE2 is locked, but I assumed it, because I had some issues with it some month ago. Now I dumped the 2 patches (and also “0x55 -> 0xC3) @ 0x228390”, which I somewhere saw in one of your comments, but was not needed) and it is also working now.

        Can I assume now, that my MSR 0xE2 is not locked?
        Is there a test (UEFI Shell command or something) to definitively determine that?
        Disabling MSR in 0x01A0 and 0x01AA not needed then, right?

        Thanks!

      • Seem like MSR 0xE2 is not locked. Lucky you 😉

        About disabling the other two MSR’s. You should only need to disable them if your system is unstable. When you experience unexpected hangs. Otherwise not.

      • Everything is working fine right now. So I don’t think it is necessary, but I will keep it in mind.
        Maybe I will look some further into the kernel, if I can use a longer hex code for find/replace with clover, so it even survives updates…

        Thanks for all the help, I’m looking forward to some new blog posts from you!

        For everyone else who stumbles across this and has also an ASUS x99-a USB3.1:
        Maybe the MSR 0xE2 has been unlocked with the BIOS update, which I installed a couple days ago. (Version 3301)

    • Hi realFlow,

      I have Asus X99-S which is pretty similar to yours and I can confirm that BIOS 3301 and 3402 are MSR locked and patches existing already in UEFIPatch do not work because the code that locks it is different and in a different module. Also AppleIntelInfo.kext reports MSR as not locked although Clover detects that is locked and enables some patches automatically for it. I created a patch for my bios and after I flashed it Clover no longer reports MSR as locked.

  20. Non of your patches applied yet, that is the point im confused right now.
    I think faking CPUID was not necessary for 10.11…
    I have activated the AppleRTC, ASUS IACPUPM and KernelHaswellE Patches in Clover.

  21. Thank you Pike! I had stability issues (random reboots) with all Sierra DPs and it seems everything is much better now disabling the 0x01A0 and 0x01AA MSRs (no reboots so far).
    The strange thing here is that MSR 0xE2 is locked on my board – I have an ASUS x99/a 3.1 BIOS 3301 (same as realFlow…)

    • Good to hear that.

      You know what. This is what I did; I bought a couple of cheap BIOS programmers plus some BIOS chips and programmed them one after the other with a patched version of the (0801) BIOS. Thanks to NikolajSchlej for his UEFIPatch tool and the Broadwell patch.

      Tip: You need to cut off the CAP header – the first 2048 bytes of the CAP file – and also rename the file extension from CAP to BIN before you start programming (with MS Windows).

      • You can also use BIOS flashback or emergency recover for flashing your modified bios.
        I also patched my Asus board with UEFI Tool.

        But you have to rename your patched BIOS to X99D.CAP and place it an a USB stick!
        Only with this rename your Board will flash a invalid Bios signature!

        But the only difference ist see is MSR_PKG_C3_RESIDENCY…….(0x3f8) : 0x0
        or MSR_PKG_C3_RESIDENCY…….(0x3f8) : 0x4E0377 -<this changes

    • Hi macandrea,

      i also thought my 0xE2 is locked, but somehow it works… Did not patch anything, maybe its unlocked with one of the bios settings?!

      What does your AppleIntelInfo print for 0xE2?

      I also have to add here, that I have still some issues. I realised, that my kernel changes are not applied directly, sometimes it only works after a couple reboots. Do you encounter the same problem?
      So Maybe I’m wrong…

      • Hi!
        Yesterday I’ve been able to Work with Apple Logic X all day no problem, with a very high load on CPU. PC was on from 10am to midnight. This morning after a few minutes I had a reboot 😦 any idea? Reboots happen with no panics nor errors and seem not to be related to overclock
        @realflow I am away for a Short vacation I’m checking when I am Back home

      • You had a reboot in what?

        Please. Be more specific. First thing first. Always include the OS version/build info, because I can’t keep up with everything. But let’s be fair. If you are using a DP or BP then that is not the final product. Not to mention that you are using a hack. Not a Mac.

        Anyway. Bugs in software may yield in unpredictable results. Anything is possible. Someone even mentioned that he had to reboot a couple of times before the patches worked in Clover. Go figure!

      • Hi MacAndrea

        you were completely right, the MSR 0xE2 is locked. It was my mistake (forgot the prelinked kernel…)

        I successfully patched my BIOS today, so Clover (in debug mode) does not mention that it is locked, also the value differs from 0x8400

        To unlock the 0xE2 you need to do:
        -downgrade your BIOS to a lower version than the latest (3101)

        -patch the latest BIOS (3301) with CodeRushs UEFIPatch: https://github.com/LongSoft/UEFITool/releases/tag/0.21.5
        Note: thanks to Piker CodeRush updated the containing patches.txt. You have to exchange the file with the latest one in GitHub
        Command to patch: UEFIPatch.exe

        -copy the resulting file with the name X99AU31.CAP (important!) on an usb stick (fat format) and plug it in the Flashback usb port, which is outlined green
        -press the flashback button a couple of seconds until it starts blinking and wait until it stops

        -config your bios, which will be reseted during the procedure….

        MSR is unlocked now, unluckily i didn’t get xcpm working on pb6 yet.
        You also should have a second usb stick/computer with the unpatched 3310 just in case…

        Regards,
        realFlow

  22. Hi,

    i always read your Blog, your work is absolutely amazing, you are the best!

    Thank you for supporting us with your hard work.

    And sorry for my bad english… some funny words from the autocorrect and this long post 🙂

    I played around with the XCPM support for my Haswell-E, and used your article for this.

    First i startet with the _xcpm_bootstrap -> change 0xC4 into 0xC1

    and the reboot fix 0x55 into 0xC3 (sub_ffffff8000428390).

    Now xcpm works, but i want more. My CPU don´t use the lower C states, it prefers the upper C states.
    So i read your article „Checks for two unused processor models found“ and startet testing.

    Now i start splitting the „reboot fix“ and do some patches by find and replace (_xcpm_bootstrap) always applied.

    for sub_ffffff8000428390 _xcpm_SMT_scope_msrs i used location 0x22837d BE0B0000005DE908000000 -> BE0B0000005DC390909090
    for sub_ffffff8000428390 _xcpm_core_scope_msrs i used location 0x228718 BE0200000031D2E86CFCFFFF -> BE0200000031D29090909090
    for sub_ffffff8000428390 _xcpm_SMT_scope_msrs i used location 0x22872b BE0B00000031D2E859FCFFFF -> BE0B00000031D29090909090
    for sub_ffffff8000428390 _xcpm_pkg_scope_msrs i used location 0x2286f0 BE0700000031D2E894FCFFFF -> BE0700000031D29090909090

    My system boots fine.

    Same as before, lower C-states not used.

    Model Specific Registers
    ———————————–
    MSR_CORE_THREAD_COUNT……(0x35) : 0x6000C
    MSR_PLATFORM_INFO……….(0xCE) : 0x20080C3BF3812300
    MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x1E000005
    MSR_PMG_IO_CAPTURE_BASE….(0xE4) : 0x10414
    IA32_MPERF……………..(0xE7) : 0xAC57970D0
    IA32_APERF……………..(0xE8) : 0xD06308FDD
    MSR_FLEX_RATIO………….(0x194) : 0xE0000
    MSR_IA32_PERF_STATUS…….(0x198) : 0x2A1B00002C00
    MSR_IA32_PERF_CONTROL……(0x199) : 0x7F00
    IA32_CLOCK_MODULATION……(0x19A) : 0x0
    IA32_THERM_STATUS……….(0x19C) : 0x884C0000
    IA32_MISC_ENABLES……….(0x1A0) : 0x840089
    MSR_MISC_PWR_MGMT……….(0x1AA) : 0x400001
    MSR_TURBO_RATIO_LIMIT……(0x1AD) : 0x24242C2C2C2C2C2C
    IA32_ENERGY_PERF_BIAS……(0x1B0) : 0x1
    MSR_POWER_CTL…………..(0x1FC) : 0x2904005B
    MSR_RAPL_POWER_UNIT……..(0x606) : 0xA0E03
    MSR_PKG_POWER_LIMIT……..(0x610) : 0x7870800158640
    MSR_PKG_ENERGY_STATUS……(0x611) : 0x39C05C1
    MSR_PKG_POWER_INFO………(0x614) : 0x1280460
    MSR_PP0_POWER_LIMIT……..(0x638) : 0x0
    MSR_PP0_ENERGY_STATUS……(0x639) : 0x0
    MSR_PKGC6_IRTL………….(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY…….(0x60d) : 0x62AE094D2
    MSR_PKG_C6_RESIDENCY…….(0x3f9) : 0x415FBAB80
    IA32_TSC_DEADLINE……….(0x6E0) : 0x99C0144BEF5

    CPU Ratio Info:
    ————————————
    CPU Low Frequency Mode………….: 1200 MHz
    CPU Maximum non-Turbo Frequency….: 3500 MHz
    CPU Maximum Turbo Frequency……..: 4400 MHz
    CPU P-States [ 37 (44) ]
    CPU C3-Cores [ 1 3 5 8 11 ]
    CPU C6-Cores [ 1 3 5 7 9 11 ]
    CPU P-States [ (12) 36 37 44 ]
    CPU C3-Cores [ 1 2 3 4 5 8 11 ]
    CPU C6-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 ]
    CPU P-States [ (12) 34 36 37 44 ]
    CPU C3-Cores [ 0 1 2 3 4 5 8 10 11 ]
    CPU P-States [ 12 34 35 36 37 (44) ]
    CPU P-States [ 12 24 34 35 36 37 (44) ]
    CPU P-States [ 12 24 31 34 35 36 37 (44) ]
    CPU C3-Cores [ 0 1 2 3 4 5 8 9 10 11 ]
    CPU P-States [ 12 22 24 31 34 35 36 37 (44) ]
    CPU P-States [ (12) 22 24 30 31 34 35 36 37 44 ]
    CPU P-States [ (12) 22 24 25 30 31 34 35 36 37 44 ]
    CPU P-States [ 12 22 24 25 29 30 31 34 35 36 37 (44) ]
    CPU P-States [ 12 22 24 25 28 29 30 31 34 35 36 37 (44) ]
    CPU P-States [ 12 22 24 25 26 28 29 30 31 34 35 36 37 (44) ]
    CPU P-States [ 12 22 24 25 26 28 29 30 31 34 35 36 37 42 (44) ]
    CPU P-States [ (12) 22 23 24 25 26 28 29 30 31 34 35 36 37 42 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 34 35 36 37 42 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 34 35 36 37 42 43 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 42 43 44 ]
    CPU P-States [ 12 22 23 24 25 26 27 28 29 30 31 33 34 35 36 37 38 42 43 (44) ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 33 34 35 36 37 38 39 42 43 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 42 43 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 41 42 43 44 ]
    CPU P-States [ 12 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 (44) ]

    So more testing and for a booting system with xcpm and finally i only need 2 of the patches
    for sub_ffffff8000428390 _xcpm_SMT_scope_msrs i used location 0x22872b BE0B00000031D2E859FCFFFF -> BE0B00000031D29090909090
    for sub_ffffff8000428390 _xcpm_pkg_scope_msrs i used location 0x2286f0 BE0700000031D2E894FCFFFF -> BE0700000031D29090909090

    so it has the same results, system boots, xcpm was running, lower C-states no used.

    Model Specific Registers
    ———————————–
    MSR_CORE_THREAD_COUNT……(0x35) : 0x6000C
    MSR_PLATFORM_INFO……….(0xCE) : 0x20080C3BF3812300
    MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x1E000005
    MSR_PMG_IO_CAPTURE_BASE….(0xE4) : 0x10414
    IA32_MPERF……………..(0xE7) : 0xAC57970D0
    IA32_APERF……………..(0xE8) : 0xD06308FDD
    MSR_FLEX_RATIO………….(0x194) : 0xE0000
    MSR_IA32_PERF_STATUS…….(0x198) : 0x2A1B00002C00
    MSR_IA32_PERF_CONTROL……(0x199) : 0x7F00
    IA32_CLOCK_MODULATION……(0x19A) : 0x0
    IA32_THERM_STATUS……….(0x19C) : 0x884C0000
    IA32_MISC_ENABLES……….(0x1A0) : 0x840089
    MSR_MISC_PWR_MGMT……….(0x1AA) : 0x400001
    MSR_TURBO_RATIO_LIMIT……(0x1AD) : 0x24242C2C2C2C2C2C
    IA32_ENERGY_PERF_BIAS……(0x1B0) : 0x1
    MSR_POWER_CTL…………..(0x1FC) : 0x2904005B
    MSR_RAPL_POWER_UNIT……..(0x606) : 0xA0E03
    MSR_PKG_POWER_LIMIT……..(0x610) : 0x7870800158640
    MSR_PKG_ENERGY_STATUS……(0x611) : 0x39C05C1
    MSR_PKG_POWER_INFO………(0x614) : 0x1280460
    MSR_PP0_POWER_LIMIT……..(0x638) : 0x0
    MSR_PP0_ENERGY_STATUS……(0x639) : 0x0
    MSR_PKGC6_IRTL………….(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY…….(0x60d) : 0x62AE094D2
    MSR_PKG_C3_RESIDENCY…….(0x3f8) : 0x0
    MSR_PKG_C6_RESIDENCY…….(0x3f9) : 0x415FBAB80
    IA32_TSC_DEADLINE……….(0x6E0) : 0x99C0144BEF5

    CPU Ratio Info:
    ————————————
    CPU Low Frequency Mode………….: 1200 MHz
    CPU Maximum non-Turbo Frequency….: 3500 MHz
    CPU Maximum Turbo Frequency……..: 4400 MHz
    CPU P-States [ 37 (44) ]
    CPU C3-Cores [ 1 3 5 8 11 ]
    CPU C6-Cores [ 1 3 5 7 9 11 ]
    CPU P-States [ (12) 36 37 44 ]
    CPU C3-Cores [ 1 2 3 4 5 8 11 ]
    CPU C6-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 ]
    CPU P-States [ (12) 34 36 37 44 ]
    CPU C3-Cores [ 0 1 2 3 4 5 8 10 11 ]
    CPU P-States [ 12 34 35 36 37 (44) ]
    CPU P-States [ 12 24 34 35 36 37 (44) ]
    CPU P-States [ 12 24 31 34 35 36 37 (44) ]
    CPU C3-Cores [ 0 1 2 3 4 5 8 9 10 11 ]
    CPU P-States [ 12 22 24 31 34 35 36 37 (44) ]
    CPU P-States [ (12) 22 24 30 31 34 35 36 37 44 ]
    CPU P-States [ (12) 22 24 25 30 31 34 35 36 37 44 ]
    CPU P-States [ 12 22 24 25 29 30 31 34 35 36 37 (44) ]
    CPU P-States [ 12 22 24 25 28 29 30 31 34 35 36 37 (44) ]
    CPU P-States [ 12 22 24 25 26 28 29 30 31 34 35 36 37 (44) ]
    CPU P-States [ 12 22 24 25 26 28 29 30 31 34 35 36 37 42 (44) ]
    CPU P-States [ (12) 22 23 24 25 26 28 29 30 31 34 35 36 37 42 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 34 35 36 37 42 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 34 35 36 37 42 43 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 34 35 36 37 38 42 43 44 ]
    CPU P-States [ 12 22 23 24 25 26 27 28 29 30 31 33 34 35 36 37 38 42 43 (44) ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 33 34 35 36 37 38 39 42 43 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 42 43 44 ]
    CPU P-States [ (12) 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 41 42 43 44 ]
    CPU P-States [ 12 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 (44) ]

    Then i inspected the _xcpm_SMT_scope_msrs and _xcpm_pkg_scope_msrs.
    Reading this https://pikeralpha.wordpress.com/2016/07/26/xcpm-for-unsupported-processor/comment-page-1/#comment-6673
    and i started with disabling msr´s one by one, splitting them.

    For a booting system 2 _xcpm_pkg_scope_msrs must be disabled (clover stops when the kernel is loading/patching):

    0082d390: 3A06 0000 DC33 0000 0000 0000 0000 0000
    0082d3a0: 1F00 0000 0000 0000 0000 0000 0000 0000
    0082d3b0: 0000 0000 0000 0000 0000 0000 0000 0000

    and

    0082d3c0: 4206 0000 DC33 0000 0000 0000 0000 0000
    0082d3d0: 1F00 0000 0000 0000 1800 0000 0000 0000
    0082d3e0: 0000 0000 0000 0000 0000 0000 0000 0000

    doing this with 42060000DC33 ->420600000000
    and 3A060000DC33 -> 3A0600000000.

    Then system is booting, but with low performance…

    And then there are the two msrs 0082d060: A001 and 0082d2a0: A001
    (the 0x01A0 in _xcpm_SMT_scope_msrs and _xcpm_pkg_scope_msrs )

    This two changes the performance of my CPU and the use of C-states!

    When i boot with disabled msrs 0x01A0, then CPU can reach 100% under load and uses upper C-states,when this 2 msrs are enabled, then my CPU can´t stay at 100% (max. CPU multiplier) and drops around,but the lower C-states will be used better.

    Model Specific Registers
    ———————————–
    MSR_CORE_THREAD_COUNT……(0x35) : 0x6000C
    MSR_PLATFORM_INFO……….(0xCE) : 0x20080C3BF3812300
    MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x1E000005
    MSR_PMG_IO_CAPTURE_BASE….(0xE4) : 0x10414
    IA32_MPERF……………..(0xE7) : 0xEAC7A4132
    IA32_APERF……………..(0xE8) : 0xDD33792FE
    MSR_FLEX_RATIO………….(0x194) : 0xE0000
    MSR_IA32_PERF_STATUS…….(0x198) : 0x29E700002C00
    MSR_IA32_PERF_CONTROL……(0x199) : 0x2C00
    IA32_CLOCK_MODULATION……(0x19A) : 0x0
    IA32_THERM_STATUS……….(0x19C) : 0x88490000
    IA32_MISC_ENABLES……….(0x1A0) : 0x850089
    MSR_MISC_PWR_MGMT……….(0x1AA) : 0x400001
    MSR_TURBO_RATIO_LIMIT……(0x1AD) : 0x24242C2C2C2C2C2C
    IA32_ENERGY_PERF_BIAS……(0x1B0) : 0x1
    MSR_POWER_CTL…………..(0x1FC) : 0x2904005B
    MSR_RAPL_POWER_UNIT……..(0x606) : 0xA0E03
    MSR_PKG_POWER_LIMIT……..(0x610) : 0x7870800158640
    MSR_PKG_ENERGY_STATUS……(0x611) : 0x3EEB235
    MSR_PKG_POWER_INFO………(0x614) : 0x1280460
    MSR_PP0_POWER_LIMIT……..(0x638) : 0x0
    MSR_PP0_ENERGY_STATUS……(0x639) : 0x0
    MSR_PKGC6_IRTL………….(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY…….(0x60d) : 0x9C888EDA8
    MSR_PKG_C3_RESIDENCY…….(0x3f8) : 0x0
    MSR_PKG_C6_RESIDENCY…….(0x3f9) : 0x6E821B558
    IA32_TSC_DEADLINE……….(0x6E0) : 0xA51EC31BF25

    CPU Ratio Info:
    ————————————
    CPU Low Frequency Mode………….: 1200 MHz
    CPU Maximum non-Turbo Frequency….: 3500 MHz
    CPU Maximum Turbo Frequency……..: 4400 MHz
    CPU P-States [ (12) 34 ]
    CPU C3-Cores [ 1 2 5 ]
    CPU C6-Cores [ 0 2 4 6 8 10 ]
    CPU P-States [ (12) 19 34 ]
    CPU P-States [ (12) 19 32 34 ]
    CPU C3-Cores [ 1 2 4 5 ]
    CPU C3-Cores [ 0 1 2 4 5 ]
    CPU P-States [ 12 17 19 32 34 (35) ]
    CPU C6-Cores [ 0 1 2 3 4 6 8 9 10 ]
    CPU P-States [ (12) 17 19 21 32 34 35 ]
    CPU P-States [ 12 17 19 21 25 32 34 35 (44) ]
    CPU C6-Cores [ 0 1 2 3 4 6 7 8 9 10 ]
    CPU P-States [ (12) 17 19 21 22 25 32 34 35 44 ]
    CPU P-States [ (12) 17 19 21 22 25 32 33 34 35 44 ]
    CPU C3-Cores [ 0 1 2 3 4 5 ]
    CPU C6-Cores [ 0 1 2 3 4 6 7 8 9 10 11 ]
    CPU P-States [ 12 17 19 21 22 25 32 33 34 35 38 (44) ]
    CPU P-States [ (12) 17 18 19 21 22 25 32 33 34 35 38 44 ]
    CPU P-States [ 12 16 17 18 19 21 22 25 32 33 34 (35) 38 44 ]
    CPU C6-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 ]
    CPU P-States [ (12) 15 16 17 18 19 21 22 25 32 33 34 35 38 44 ]
    CPU P-States [ 12 15 16 17 18 19 21 22 24 25 32 33 34 (35) 38 44 ]
    CPU P-States [ (12) 15 16 17 18 19 20 21 22 24 25 32 33 34 35 38 44 ]
    CPU P-States [ (12) 14 15 16 17 18 19 20 21 22 24 25 32 33 34 35 38 44 ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 24 25 28 32 33 34 35 38 (44) ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 24 25 28 32 33 34 (35) 37 38 44 ]
    CPU P-States [ (12) 14 15 16 17 18 19 20 21 22 23 24 25 28 32 33 34 35 37 38 44 ]
    CPU P-States [ (12) 14 15 16 17 18 19 20 21 22 23 24 25 26 28 32 33 34 35 37 38 44 ]
    CPU P-States [ (12) 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 32 33 34 35 37 38 44 ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 31 32 33 34 35 37 38 (44) ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 31 32 33 34 35 37 38 (44) ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 31 32 33 34 (35) 36 37 38 44 ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 31 32 33 34 (35) 36 37 38 41 44 ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 31 32 33 34 35 36 37 38 41 43 (44) ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 31 32 33 34 35 36 37 38 39 41 43 (44) ]
    CPU P-States [ (12) 14 15 16 17 18 19 20 21 22 23 24 25 26 28 29 30 31 32 33 34 35 36 37 38 39 40 41 43 44 ]
    CPU P-States [ 12 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 43 (44) ]
    CPU P-States [ (12) 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 43 44 ]

    And now i´m running out of ideas, it´s funny, can interchange the tables, and system boots:

    i tested just for fun some patches:
    3A060000DC33000000000000000000001F00000000000000000000000000000000000000000000000000000000000000
    -> B00100004222000000000000000000000F00000000000000050000000000000000000000000000000000000000000000

    and 42060000DC33000000000000000000001F00000000000000180000000000000000000000000000000000000000000000
    -> B00100004222000000000000000000000F00000000000000050000000000000000000000000000000000000000000000.

    System is booting, but i don´t know what this „code“ is doing.

    I also tried: A0010000DC33000000000000000000000000000040000000010005000000000000000000000000000000000000000000
    -> B00100009001000000000000000000000F000000000000000F0000000000000000000000000000000000000000000000

    and it boots.

    Some combinations results in good performance, some in bad (upper/lower C-states) but nothing is a 100% solution. I never found a fix for 100% performance and using all C-states.

    Can you confirm my tests, and can you explain what the „code“ is doing?

    Is it possible to get xcpm working with the lower C-states and staying the CPU at max. CPU multi. under load?
    I also can see jumping CPU multi in IDLE mode (using Intel Power Gadget an 500ms sampling res.), it jumps from 12 to 36 or 44, and back to 12.

    HWMonitor shows me the same, and sometimes some errors, it shows me x48, x115 or x52 for the CPU multi. This may be a bug?

    I also tested other combinations, disabling only one of them (_xcpm_SMT_scope_msrs or _xcpm_pkg_scope_msrs).With 1 patched, xcpm uses lower C-States an CPU don´t stay at 100%.

    Is it time to give up?

    Have you any ideas for a fix, did you discover this with your Broadwell-E tests?

    Thank you!

  23. PB 6 if everything keeps the same following addresses should be the new ones.
    Just compared kernels…

    //
    // kernel location 0x1f7cf0 (0xE9 in DP2/DP3/DP4, 0xF1 in DP1) _cpuid_set_info
    //

    ../..

    //
    // kernel location 0x227f60 (0xC4 in DP2/DP3/DP4, 0x?? in DP1) _xcpm_bootstrap
    //

    ../..

    //
    // If MSR(0xE2) is locked (bit-15 is set) then also change
    //
    // kernel location 0x21e460 and 0x21e48f in _xcpm_idle from 0x0f30 (wrmsr) to 0x9090 (nop nop).

    //
    // Additionally (if booting results in a immediate reboot)
    //
    // kernel location 0x2283c0 change 0x55 into 0xC3 (ret) to stop the KP.
    //

    But you may wait for Piker to confirm.

    • Pretty close but not 100% accurate. You mentioned the start of the routines (the first two addresses) but the actual patch locations are further down. Hey. No worries. I made this mistake myself. Anyway. The correct locations are: 0x1f8d71 and 0x227fc2.

      Thanks for the reminder!

      p.s. Isn’t it fun when you learn something 😉

      • Hmm i have issues with patching PB6…
        I did it on purpose, because you also listed the start in your article.
        0x227fc2 is clear, but how do you get 0x1f8d71?
        (My assumption was first E9 in _cpuid_set_info)

        If i patched _cpuid_set_info in PB5 correctly (0x1F7DE7: 0xE9) shouldn’t the corresponding section in PB6 be 0x1F7E17: 0xB9 ?

        PB5:
        ffffff80003f7de2 mov edx, dword [ss:rbp+var_40]
        ffffff80003f7de5 mov dword [ds:0xffffff8000af61d4], edx
        ffffff80003f7deb cmp edx, 0x80000004
        ffffff80003f7df1 jb 0xffffff80003f806e
        ffffff80003f7df7 mov eax, 0x80000002

        PB6:
        ffffff80003f7e12 mov edx, dword [ss:rbp+var_40]
        ffffff80003f7e15 mov dword [ds:0xffffff8000af61d4], edx
        ffffff80003f7e1b cmp edx, 0x80000004
        ffffff80003f7e21 jb 0xffffff80003f809e
        ffffff80003f7e27 mov eax, 0x80000002

      • Do you have the Hopper disassembler app installed? If not, download the trial and have a look at the locations that I mentioned. Enter the _xcpm_bootstrap in the search field and scroll down to the exact spot. That is what we are patching. Not what you listed above.

        p.s. Only the start address of the MSR programming sub routine is listed. Or I so hope so.

      • Hi Pike Thank you for Hopper disassembler app info. Enjoy with Clover.Have a good luck.

      • Yes I already have it.
        Patching 0x227fc2 from c4 to c1 does not work for me. With only E9 to E3 it loads, but obviously no xcpm…
        Clover can’t load the kernel (stuck with +++++++++)

      • Please. I keep repeating this over and over; always include the used hardware specs. Like your processor. Don’t expect other people to remember every possible setup people may have. Next time use something like:

        Patching 0x227fc2 from c4 to c1 does not work for me… with my NNNN processor.

        Help me to help you. Thanks.

        The Clover booting problem was reported earlier. People had to use FakeCPUID and some driver. Can’t remember what it was. Google it.

  24. Sorry, wasn’t expecting much help here, because i will have not much time the next days. You will not hear that much from me in the future and therefore I want to thank you again for your amazing work and all your help!

    I would guess Clover freezes on +++ because there is some kind of an issue with the kernel and in some lucky cases it was fixed by faking CPUID.
    For any further comments I will add a footer.

    Regards,
    realFlow
    ————————————————————–
    CPU: Intel i7 5820k
    MoBo: ASUS x99-a USB 3.1
    GPU: NVIDIA GTX 970
    OS: macOS 10.12 PB6

    • One of the usual forum rules is to include your specs, and for good reasons, so that people know what they are dealing with.

      But yeah. I wish I could have done more for you, but I can’t. I no longer have the hardware (thanks to the big giveaway) and I also don’t use Clover. The good news is that there are many people who use Clover and use the same processor. Good luck!

  25. Hi Pike.

    I am on a Haswell-EP right now, i7-5960X in an ASUS X99-A USB 3.1 with an unlocked 0xE2 in the latest version of 10.11.6.

    I am using the following kernel patches (with Clover):

    reboot fix 10.11.6 (c) Pike R. Alpha

    xcpm_bootstrap 10.11.6 (c) Pike R. Alpha

    cpuid_set_info 10.11.6 (c) Pike R. Alpha (is this Broadwell-E only?)

    xcpm performance fix 1 (wrsmr fix to get CPU max) patches twice (c) okrasit

    XCPM_idle fix 10.11.6 (c) Pike R. Alpha

    With AppleIntelInfo.kext I get the following:

    ------------------------------------
    logMSRs............................: 1
    logIGPU............................: 0
    logCStates.........................: 1
    logIPGStyle........................: 1
    InitialTSC.........................: 0xb4eccbef11
    MWAIT C-States.....................: 8480

    Model Specific Registers
    -----------------------------------
    MSR_CORE_THREAD_COUNT......(0x35) : 0x80010
    MSR_PLATFORM_INFO..........(0xCE) : 0x20080C3BF3811E00
    MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x400
    MSR_PMG_IO_CAPTURE_BASE....(0xE4) : 0x10414
    IA32_MPERF.................(0xE7) : 0x26DA4FCD13
    IA32_APERF.................(0xE8) : 0x2CD857D177
    MSR_FLEX_RATIO.............(0x194) : 0xE0000
    MSR_IA32_PERF_STATUS.......(0x198) : 0x1F6200002300
    MSR_IA32_PERF_CONTROL......(0x199) : 0xFF00
    IA32_CLOCK_MODULATION......(0x19A) : 0x0
    IA32_THERM_STATUS..........(0x19C) : 0x88440000
    IA32_MISC_ENABLES..........(0x1A0) : 0x850089
    MSR_MISC_PWR_MGMT..........(0x1AA) : 0x400000
    MSR_TURBO_RATIO_LIMIT......(0x1AD) : 0x2323232323232323
    IA32_ENERGY_PERF_BIAS......(0x1B0) : 0x0
    MSR_POWER_CTL..............(0x1FC) : 0x2904005B
    MSR_RAPL_POWER_UNIT........(0x606) : 0xA0E03
    MSR_PKG_POWER_LIMIT........(0x610) : 0x7FFF80015FFF8
    MSR_PKG_ENERGY_STATUS......(0x611) : 0x2819B2
    MSR_PKG_POWER_INFO.........(0x614) : 0x1280460
    MSR_PP0_POWER_LIMIT........(0x638) : 0x0
    MSR_PP0_ENERGY_STATUS......(0x639) : 0x0
    MSR_PKGC6_IRTL.............(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY.......(0x60d) : 0x0
    MSR_PKG_C6_RESIDENCY.......(0x3f9) : 0x0
    IA32_TSC_DEADLINE..........(0x6E0) : 0xB4EE872D11

    My questions are:
    1. Is the cpuid_set_info only needed for Broadwell CPUs?

    2. I have C2 &C6 Residency showing 0x0–why is that? How can I address that? I have C-states set to Enabled (from Auto) in the BIOS.

    3. Are there any other MSRs that need to be unlocked, or nop’ed to prevent failed writes to them?
    I have had random reboots in 10.10 and some in 10.11 with my old method. I am thinking that it was because of attempts to write to 0xE2.

    4. Does it make sense that a locked E2 could lead to instant restarts under some conditions in 10.10/10.11?

    Thanks!

    Edit: I changed C State Package Limit to C6 (Retention) from C0/C1 (the default).

    I now see:
    MSR_PMG_CST_CONFIG_CONTROL.(0xE2) : 0x403 (was 400 before)
    MSR_PKG_C2_RESIDENCY…….(0x60d) : 0x853975FF8 (these were both 0x0)
    MSR_PKG_C6_RESIDENCY…….(0x3f9) : 0x3095CCDA92

    I have also had another random restart since unlocking 0xE2 ;(

    • 1.) For all processor models without a match in the switch table.
      2.) You answered this yourself (auto setting suck).
      3.) Unlocked not, but there may be attempts to set/wipe a reserved bit.
      4.) A lock 0xE2 MSR will most certainly trigger a reboot.

      About the restarts. This can be either a hardware or software issue. I’m sure that you know that, but since you also had restarts in 10.10. Well. That doesn’t sound very promising. I don’t know why, but perhaps you are using a badly developed kernel driver, which can end in unpredictable results. Then you are toast on whatever OS you run with that kernel driver. I would start by removing all used third party kernel drivers that you don’t need to boot, and see if that improves the stability of your hack.

      Edit: One more thing. I don’t know how this works with Clover, but you should figure out how you can stop it from rebooting and show the panic (kBootArgsFlagRebootOnPanic flag).

  26. I lost some info, despite using code tags above. (it does not seem to like ><)

    the patches were:
    reboot fix 10.11.6 (c) Pike R. Alpha
    554889e5 41574156 41554154 53504189 d64189f7 4889fb45 85ff0f84
    c34889e5 41574156 41554154 53504189 d64189f7 4889fb45 85ff0f84

    xcpm_bootstrap 10.11.6 (c) Pike R. Alpha
    83c3bb83 fb09
    83c3b883 fb09

    cpuid_set_info 10.11.6 (c) Pike R. Alpha (is this Broadwell-E only?)
    5d7f288d 48bb83f9 02
    5d7f288d 48b883f9 02

    xcpm performance fix 1 (wrsmr fix to get CPU max) patches twice (c) okrasit
    89d8c1e0 08b99901
    b800ff00 00b99901

    XCPM_idle fix 10.11.6 (c) Pike R. Alpha
    20b9e200 00000f30
    20b9e200 00009090

    You should use

    &lt;code&gt;..yourcode..&lt;/code&gt;
  27. Thanks for the advice!

    From what I can tell kBootArgsFlagRebootOnPanic is enabled (no reboot on panic) with the BooterConfig 0x28, which I have already set. I will bug Slice about it.

    If I wanted to block those other two MSRs that you mention in the comments, how would I do so for 10.11.6 and 10.10.5?

    It would be these, right? 0x1aa & 0x1a0

    I looked at the below locations, but do not see anything in 10.11.6, so I assume that location was 10.12 only.
    0x21E430: 0F30 -> 9090
    0x21E46E: 0F30 -> 9090

    I will also start over from scratch with this install, and perhaps do a Chameleon legacy boot just to reduce the variables while testing.

    • kBootArgsFlagRebootOnPanic = 1 so change the 0x28 into 0x29 and try again.

      The file offset for OS X 10.11.6 are:

      _xcpm_pkg_scope_msrs = 0x85b2f0
      _xcpm_core_scope_msrs = 0x85b440
      _xcpm_SMT_scope_msrs = 0x85b4d0

      That should help you to locate MSR 0x1aa and MSR 0x1a0.

      About Chameleon. I don’t know if it supports your processor. Hopefully it does, but I don’t know (ask Micky1979).

      • Unknown CPU Fixed. About this mac 5960X unknown CPU Fixed I just add CPU type 2561/0x0a01 (was 0x0705) and frequency 4300 with clover config its working.

        Do you have any kernel patches for CPU-Type?

        Thank you.

      • Hi pike
        If I set CPU-type 133 not work its say unknown.

        [cid:3D1B4754-BC8A-4604-AC57-66A10764B053@Home][cid:3FD3C6F9-76FC-4641-8976-60DC9CF8A2B6@Home]

      • What? No! Please don’t use 133. Sorry. Let me try to explain this. Take a look at this code snippet:

        //
        // OEM Processor Type (Apple Specific - Type 131)
        //
        
        struct SMBOemProcessorType {
        	SMB_STRUCT_HEADER
        	SMBWord    ProcessorType;
        };
        

        You can find this in Apple’s SMBIOS.h (think AppleSMBIOS.kext) and ProcessorType here get the value assigned to it that you enter in Clover’s SMBIOS data. Either that or the default value that Clover tries to guess for you, based on the processor model (I guess). The latter may fail (no pun intended) and then you give it what you think is correct for your processor. And you have done this before, successfully even, so please keep using what worked for you.

      • I see this
        0x2a95 Encode 7445

        [cid:350A33B5-6049-4D68-9743-AC9870F18FA5@Home]
        0x2a95 Encode 7445

      • I see that 10.11.6 AppleSMBIOS under __ZN11AppleSMBIOS29processSMBIOSStructureType133EPK21SMBOemPlatformFeatureP16SMBPackedStrings: // AppleSMBIOS::processSMBIOSStructureType133(SMBOemPlatformFeature const*, SMBPackedStrings*)

        0000000000002a4e je 0x2a95

        0000000000002a92 jmp qword [ds:rax+0x28]

      • Hi pike
        SMBios setting Which part I need to change
        Thank you

        [cid:B3EEC1FB-25EE-4230-B2BD-D5236C5CCD01@Home]hich part I need to change

      • I thing 2561 works. Thank you.

        sysctl -a | grep cpu

        hw.ncpu: 16
        hw.activecpu: 16
        hw.physicalcpu: 8
        hw.physicalcpu_max: 8
        hw.logicalcpu: 16
        hw.logicalcpu_max: 16
        hw.cputype: 7
        hw.cpusubtype: 8
        hw.cpu64bit_capable: 1
        hw.cpufamily: 280134364
        hw.cpufrequency: 4300000000
        hw.cpufrequency_min: 4300000000
        hw.cpufrequency_max: 4300000000
        hw.cputhreadtype: 1
        machdep.cpu.max_basic: 15
        machdep.cpu.max_ext: 2147483656
        machdep.cpu.vendor: GenuineIntel
        machdep.cpu.brand_string: Intel(R) Core(TM) i7-5960X CPU @ 3.00GHz
        machdep.cpu.family: 6
        machdep.cpu.model: 63
        machdep.cpu.extmodel: 3
        machdep.cpu.extfamily: 0
        machdep.cpu.stepping: 2
        machdep.cpu.feature_bits: 9223085887878593535
        machdep.cpu.leaf7_feature_bits: 14251
        machdep.cpu.extfeature_bits: 142473169152
        machdep.cpu.signature: 198386
        machdep.cpu.brand: 0
        machdep.cpu.features: FPU VME DE PSE TSC MSR PAE MCE CX8 APIC SEP MTRR PGE MCA CMOV PAT PSE36 CLFSH DS ACPI MMX FXSR SSE SSE2 SS HTT TM PBE SSE3 PCLMULQDQ DTES64 MON DSCPL VMX EST TM2 SSSE3 FMA CX16 TPR PDCM SSE4.1 SSE4.2 x2APIC MOVBE POPCNT AES PCID XSAVE OSXSAVE SEGLIM64 TSCTMR AVX1.0 RDRAND F16C
        machdep.cpu.leaf7_features: SMEP ERMS RDWRFSGS TSC_THREAD_OFFSET BMI1 AVX2 BMI2 INVPCID PQM FPU_CSDS
        machdep.cpu.extfeatures: SYSCALL XD 1GBPAGE EM64T LAHF LZCNT RDTSCP TSCI
        machdep.cpu.logical_per_package: 16
        machdep.cpu.cores_per_package: 8
        machdep.cpu.microcode_version: 45
        machdep.cpu.processor_flag: 2
        machdep.cpu.mwait.linesize_min: 64
        machdep.cpu.mwait.linesize_max: 64
        machdep.cpu.mwait.extensions: 3
        machdep.cpu.mwait.sub_Cstates: 8480
        machdep.cpu.thermal.sensor: 1
        machdep.cpu.thermal.dynamic_acceleration: 1
        machdep.cpu.thermal.invariant_APIC_timer: 1
        machdep.cpu.thermal.thresholds: 2
        machdep.cpu.thermal.ACNT_MCNT: 1
        machdep.cpu.thermal.core_power_limits: 1
        machdep.cpu.thermal.fine_grain_clock_mod: 1
        machdep.cpu.thermal.package_thermal_intr: 1
        machdep.cpu.thermal.hardware_feedback: 0
        machdep.cpu.thermal.energy_policy: 1
        machdep.cpu.xsave.extended_state: 7 832 832 0
        machdep.cpu.xsave.extended_state1: 1 0 0 0
        machdep.cpu.arch_perf.version: 3
        machdep.cpu.arch_perf.number: 4
        machdep.cpu.arch_perf.width: 48
        machdep.cpu.arch_perf.events_number: 7
        machdep.cpu.arch_perf.events: 0
        machdep.cpu.arch_perf.fixed_number: 3
        machdep.cpu.arch_perf.fixed_width: 48
        machdep.cpu.cache.linesize: 64
        machdep.cpu.cache.L2_associativity: 8
        machdep.cpu.cache.size: 256
        machdep.cpu.tlb.inst.large: 8
        machdep.cpu.tlb.data.small: 64
        machdep.cpu.tlb.data.small_level1: 64
        machdep.cpu.tlb.shared: 1024
        machdep.cpu.address_bits.physical: 46
        machdep.cpu.address_bits.virtual: 48
        machdep.cpu.core_count: 8
        machdep.cpu.thread_count: 16
        machdep.cpu.tsc_ccc.numerator: 0
        machdep.cpu.tsc_ccc.denominator: 0
        machdep.xcpm.cpu_thermal_level: 0

      • What I used for the XCPM patches for the Broadwell E processors was 0x47 aka 0x4f-0x8=0x47 and that would translate to something like 0x040674

        Broadwell E FakeCPUID

        0x040674

        Haswell-E FakeCPUID

        0x3f-0x3=0x3C

        0x0306C4

        Can I use this id for Haswell-E 0x0306C4

      • The Haswell E processor is based on the Haswell processor so it should work. That is. XCPM should function without too much issues, but you will need to disable (some of) the (re)programming of MSRs. Here is the list:

        0xE2 = MSR_PKG_CST_CONFIG_ CONTROL
        0x1A0 = IA32_MISC_ENABLE
        0x1FC = MSR_POWER_CTL
        0x1AA = MSR_MISC_PWR_MGMT
        0x620 = Unknown MSR name
        0x64C = MSR_TURBO_ACTIVATION_RATIO
        0x63A = MSR_PP0_POLICY
        0x642 = MSR_PP1_POLICY

        Tip: Without a IGPU you certainly need to disable MSR(0x642).

        What I had to disable (before I unlocked the MSR in the BIOS with help of UEFIPatch) was this.

      • Hi Pike If I want Disable MSR Can I patch Kernel This value from 10.12 DP8 How to Disable this

        _xcpm_pkg_scope_msrs 0x82D2A0 A0 01 00 00 DC 33 00 00 00

        _xcpm_core_scope_msrs 0x82D240

        E2 00

        _xcpm_SMT_scope_msrs 0x82D030

        2E 00 00

        MSR(0x642).

      • Here is the list. Please help re programming MSR. I don’t know how to patch bios if you can please patched for me. Thank you.

  28. Hello Piker

    First to congratulate you for your hard work and your help.

    My problem is when I try to run
    sysctl -n machdep.xcpm.vectors_loaded_count
    I get > sysctl: unknown oid ‘machdep.xcpm.vectors_loaded_count’

    I have no idea why I get this.
    however when I run sysctl -n machdep.xcpm.mode
    I get > 1

    5930k CPU
    SMBIOS MacPro6.1
    Motherboard Asus x99
    El Capitan 10.11.6

      • Last login: Fri Sep 2 05:39:27 on console
        iMac-de-jdeux~ jdeux$ sysctl machdep.xcpm
        machdep.xcpm.mode: 1
        machdep.xcpm.hard_plimit_max_100mhz_ratio: 37
        machdep.xcpm.hard_plimit_min_100mhz_ratio: 8
        machdep.xcpm.soft_plimit_max_100mhz_ratio: 37
        machdep.xcpm.soft_plimit_min_100mhz_ratio: 8
        machdep.xcpm.tuib_plimit_max_100mhz_ratio: 37
        machdep.xcpm.tuib_plimit_min_100mhz_ratio: 8
        machdep.xcpm.tuib_enabled: 0
        machdep.xcpm.power_source: 0
        machdep.xcpm.bootplim: 0
        machdep.xcpm.bootpst: 37
        machdep.xcpm.tuib_ns: 0
        machdep.xcpm.ratio_changes_total: 73532
        machdep.xcpm.maxbusdelay: 0
        machdep.xcpm.maxintdelay: 0
        machdep.xcpm.mbd_mode: 1
        machdep.xcpm.mbd_applications: 0
        machdep.xcpm.mbd_relaxations: 0
        machdep.xcpm.forced_idle_ratio: 100
        machdep.xcpm.forced_idle_period: 30000000
        machdep.xcpm.deep_idle_log: 0
        machdep.xcpm.qos_txfr: 1
        machdep.xcpm.deep_idle_count: 0
        machdep.xcpm.deep_idle_last_stats: n/a
        machdep.xcpm.deep_idle_total_stats: n/a
        machdep.xcpm.cpu_thermal_level: 0
        machdep.xcpm.gpu_thermal_level: 0
        machdep.xcpm.io_thermal_level: 0
        machdep.xcpm.io_control_engages: 0
        machdep.xcpm.io_control_disengages: 1
        machdep.xcpm.io_filtered_reads: 0

        I see iMac, but my SMBIOS is MacPro.

      • The plist for the MacPro6,1 – based on its board-id – has no FrequencyVectors and thus you have to add them either manually or with help of freqVectorsEdit.sh.

        You can change the computer name in System Preferences -> Sharing -> Computer Name

      • Thanks for your reply.
        It’s very strange’ve manually added the plist. I used Mac-42FD25EABCABB274.plist / iMac15,1
        I will describe the steps that I have done:
        1- I run ~/ssdtPRGen.sh -b Mac-42FD25EABCABB274 -Turbo 3700
        2- Edit and add SCK0 to SSDT (need I add SCK0?)
        3- Renown Mac-42FD25EABCABB274.plist to -Mac-F60DEB81FF30ACF6.plist and manually add to X86PlatformPlugin.kext
        4- Check for X86PlatformPlugin.kext and X86PlatformShim.kext (are loaded and no errors Log).
        5- I not use VoodooTSCSync.kext or FakeCPUID or NullCPUPowerManagement.kext.

        I use Clover (last version) and have added these patches

        XCPM_idle fix 10.11.6by Pike R. Alpha
        F: 20B9E20000000F30
        R: 20B9E20000009090

        xcpm performance fix 1 (wrsmr fix to get CPU max) © okrasit
        F: 89D8C1E008B99901
        R: B800FF0000B99901

        xcpm_bootstrap 10.11.6 Haswell-E © Pike R. Alpha
        F: 83C3BB83FB09
        R: 83C3B883FB09

        _cpuid_set_info 10.11.6 © Pike R. Alpha
        F: 5D7F288D48BB83F902
        R: 5D7F288D48B883F902

        I’m doing it the right way?

        Thanks again.

        El Capitan 10.11.6
        CPU> 5930k
        Motherboard> Asus x99
        SMBIOS> MacPro 6.1

      • 1.) Processor data fixed for your processor. No need for the -turbo argument anymore. Please file issues for stuff that doesn’t work, or nothing will get fixed. Thanks.

        2.) If the scripts fails, then again, file an issue so that I can fix it.

        3.) I would say just run the script. That is much easier.

        4.) And? Are the frequency vectors loaded now?

  29. Hello Piker, i’m having trouble in Sierra PB 16A303a, Motherboard Gigabyte X99P-SLI, Intel 6800K Clover latest.

    I know you don’t use CLover, but you seem to be one of the only ones that has broadwell working.

    I’ve used the following xcpm configs:

    _xcpm_bootstrap Sierra © Pike R. Alpha
    Find 83C3C483FB22
    Replace 83C3C183FB22

    _xcpm_pkg_scope_msr © Pike R. Alpha
    Find BE0700000031D2E894FCFFFF
    Replace BE0700000031D29090909090

    _xcpm_core_scope_msrs © Pike R. Alpha
    Find BE0200000031D2E86CFCFFFF
    Replace BE0200000031D29090909090

    xcpm performance fix 1 (wrsmr fix to get CPU max) © okrasit
    Find 89D8C1E008B99901
    Replace B800FF0000B99901

    XCPM_idle fix by Pike R. Alpha
    Find 20B9E20000000F30
    Replace 20B9E20000009090

    I deleted the NullCPUPowerManagement.kext & VoodooTSCSync.kext

    Deleted FAKECPUID (it was 0x0306a0), unticked KernelHaswellE Flag on Kernel & Kext Patches

    Rebooting after applying xcpm configs and doing the above causes the following error:

    Freeing Low memory (up to 0x20000000)…
    Result = 0
    OsxAptiofixDrv: Starting overrides for System\Library\CoreServices\boot.efi
    Using reloc bloc: no, hibernate wake: no
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

    I’ve commented over at Nick Woodhams blog (https://nickwoodhams.com/x99-hackintosh-osxaptiofixdrv-allocaterelocblock-error-update/) thinking it was a problem with OsxAptioFix2Drv-free2000.efi or similar but he seems to think it could be “Most likely related to which kexts you’re loading.”

    Not sure what i’m doing wrong with the frequency Vectors but after running the command sysctl machdep.xcpm

    I get the following output (frequency vectors loaded 0)

    machdep.xcpm.io_filtered_reads: 0
    machdep.xcpm.io_control_disengages: 0
    machdep.xcpm.io_control_engages: 0
    machdep.xcpm.io_thermal_level: 0
    machdep.xcpm.gpu_thermal_level: 0
    machdep.xcpm.cpu_thermal_level: 0
    machdep.xcpm.deep_idle_total_stats: n/a
    machdep.xcpm.deep_idle_last_stats: n/a
    machdep.xcpm.deep_idle_count: 0
    machdep.xcpm.qos_txfr: 1
    machdep.xcpm.deep_idle_log: 0
    machdep.xcpm.forced_idle_period: 30000000
    machdep.xcpm.forced_idle_ratio: 100
    machdep.xcpm.mbd_relaxations: 0
    machdep.xcpm.mbd_applications: 0
    machdep.xcpm.mbd_mode: 1
    machdep.xcpm.maxintdelay: 0
    machdep.xcpm.maxbusdelay: 0
    machdep.xcpm.ratio_changes_total: 0
    machdep.xcpm.vectors_loaded_count: 0
    machdep.xcpm.tuib_ns: 0
    machdep.xcpm.bootpst: 0
    machdep.xcpm.bootplim: 0
    machdep.xcpm.power_source: 0
    machdep.xcpm.tuib_enabled: 0
    machdep.xcpm.tuib_plimit_min_100mhz_ratio: 0
    machdep.xcpm.tuib_plimit_max_100mhz_ratio: 0
    machdep.xcpm.soft_plimit_min_100mhz_ratio: 0
    machdep.xcpm.soft_plimit_max_100mhz_ratio: 0
    machdep.xcpm.hard_plimit_min_100mhz_ratio: 0
    machdep.xcpm.hard_plimit_max_100mhz_ratio: 0
    machdep.xcpm.mode: 0

    anyway i’m sort of at a loss to the whole situation and as Leia said to R2D2, help me OB1 your my only hope….

    • PikerAlpha, i’ve now got it working using a FAKECPID of 0x040674

      will try and generate the freqVectorsEdit.sh and new ssdtPRGen.sh and report back, thanks for all the hard work, and i hope you get over the theft of your property, i really hate that shit

      • I think there is a problem, i’m having random reboots, and i think it may be due to using the FAKECPUID, where other people seem to be using your patches but without FAKECPUID on clover. Using the following patches on Sierra PB6, I was hoping you could check if these are ok and should I use them all or are there other patches to try:

        _xcpm_bootstrap Sierra © Pike R. Alpha Find 83C3C483FB22 Replace 83C3C183FB22
        _xcpm_pkg_scope_msr © Pike R. Alpha Find BE0700000031D2E894FCFFFF Replace BE0700000031D29090909090
        _xcpm_core_scope_msrs © Pike R. Alpha Find BE0200000031D2E86CFCFFFF Replace BE0200000031D29090909090
        xcpm performance fix 1 (wrsmr fix to get CPU max) © okrasit Find 89D8C1E008B99901 Replace B800FF0000B99901
        XCPM_idle fix by Pike R. Alpha find 20B9E20000000F30 replace 20B9E20000009090

      • Hi Ben,

        What value are you using for FakeCPUID?

        Also. Try this in Clover:

        Find 89D8C1E008B99901
        Replace B800220000B99901

        This way you are not using an illegal value (FF) and let the processor firmware select the turbo ratios.

  30. Piker
    Sorry for my ignorance, I have problems and I can not figure this out, I followed in his footsteps and use their ssdtPRGen.sh and freqVectorsEdit.sh v2.3 and I can not get it to work.

    I show you

    machdep.xcpm.mode: 1
    machdep.xcpm.hard_plimit_max_100mhz_ratio: 37
    machdep.xcpm.hard_plimit_min_100mhz_ratio: 8
    machdep.xcpm.soft_plimit_max_100mhz_ratio: 37
    machdep.xcpm.soft_plimit_min_100mhz_ratio: 8
    machdep.xcpm.tuib_plimit_max_100mhz_ratio: 37
    machdep.xcpm.tuib_plimit_min_100mhz_ratio: 8
    machdep.xcpm.tuib_enabled: 0
    machdep.xcpm.power_source: 0
    machdep.xcpm.bootplim: 0
    machdep.xcpm.bootpst: 37
    machdep.xcpm.tuib_ns: 0
    machdep.xcpm.ratio_changes_total: 194906
    machdep.xcpm.maxbusdelay: 0
    machdep.xcpm.maxintdelay: 0
    machdep.xcpm.mbd_mode: 1
    machdep.xcpm.mbd_applications: 0
    machdep.xcpm.mbd_relaxations: 0
    machdep.xcpm.forced_idle_ratio: 100
    machdep.xcpm.forced_idle_period: 30000000
    machdep.xcpm.deep_idle_log: 0
    machdep.xcpm.qos_txfr: 1
    machdep.xcpm.deep_idle_count: 0
    machdep.xcpm.deep_idle_last_stats: n/a
    machdep.xcpm.deep_idle_total_stats: n/a
    machdep.xcpm.cpu_thermal_level: 0
    machdep.xcpm.gpu_thermal_level: 0
    machdep.xcpm.io_thermal_level: 0
    machdep.xcpm.io_control_engages: 0
    machdep.xcpm.io_control_disengages: 1
    machdep.xcpm.io_filtered_reads: 0
    ———————————————————————
    sysctl -n machdep.xcpm.mode
    1
    sysctl -n machdep.xcpm.vectors_loaded_count
    sysctl: unknown oid ‘machdep.xcpm.vectors_loaded_count’
    ———————————————————
    Loglist X86PlatformShim
    9/3/16 8:17:54.000 PM kernel[0]: Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64
    9/3/16 8:37:29.000 PM kernel[0]: Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64
    9/3/16 8:41:37.000 PM kernel[0]: Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64
    9/3/16 9:02:43.000 PM kernel[0]: Darwin Kernel Version 15.6.0: Thu Jun 23 18:25:34 PDT 2016; root:xnu-3248.60.10~1/RELEASE_X86_64
    —————————————————————
    X86PlatformPlugin > Loaded
    X86PlatformShim > Loaded
    —————————————————————
    Intel Power Gadget Install
    CPU Not Supported
    Intel® Power Gadget only supports 2nd generation Intel® Core™ processors and later.

  31. Hi Pikeralpha,

    I am using fakeCPID 0x040674, I will try you fix an report back, I’m guessing I wil try and delete fakeCPUID as well and just use the patch?

    Is this patch called (from what i’ve read from other peoples patches…cpuid_set_info

    thanks for the help, always appreciated

    Edit: I already had the one you mentioned set:

    xcpm performance fix 1 (wrsmr fix to get CPU max) © okrasit
    Find 89D8C1E008B99901 replace B800FF0000B99901

    I hope it was credited correctly in comments

    Do you have a patch for cpuid_set_info (i can only find the one for 10.11.6), I want to be able to have no entry in Clover for fakeCPUID (currently 0x040674) and use the patch instead:

    Example (cpuid_set_info (OS X 10.11.6)
    find 5D7F288D48BB83F902 replace 5D7F288D48B883F902

  32. Hi Pike,

    Following your advice you gave me in a ssdtprgen issue I have this for macOS Sierra (GM) :

    ffffff80003f5ab1 leaq _xcpm_pkg_scope_msrs(%rip), %rdi
    ffffff80003f5ab8 movl $0x7, %esi
    ffffff80003f5abd xorl %edx, %edx
    ffffff80003f5abf callq 0xffffff80003f6190

    0x3f6190 – 0x200000 = 0x1f6190

    xxd -s 0x1f6190 -l 28 -psu kernel

    in macOS Sierra (GM) seems the same of DP8

    554889e5415741564155415453504189d64189f74889fb4585ff0f84

    so replace is:
    C34889e5415741564155415453504189d64189f74889fb4585ff0f84

    Is it possible to produce the other fix needed with a MSR 0xE2 unlocked?

    I am using also a Fakecpuid 0x040674 for my Broadwell EP Cpu

    With only reboot fix and FakeCpuId i have a KP
    In El Capitan 10.11.6 I was using this two kind of fixes (by you) and Brunbaer 5960x IOPCIFamily fix

    Have you any advice?
    Thank you again

    • About your: “Is it possible to produce the other fix needed with a MSR 0xE2 unlocked?“.

      You want to patch the MSR’s that trigger a reboot, KP or make your computer unstable? Instead of using the all-in-one reboot fix? If yes. Please address that there and not here. Otherwise.. what do you want?

      Also. I was under the impression that your computer did boot, since you provided data from it, but that the turbo multipliers were the issue that we were trying to solve. So what did you change to get this KP?

      • Hi Pike, my mistake
        I have a working El Capitan system with all your help applied on it

        Waiting for your finding for turbo multiplier issue to have a correct PM I have installed on a spare disk macOS Sierra (GM)
        From there I am trying to build a booting system patching properly the kernel as you are teaching in blog and in ssdtprgen github

        As Always thank you for your time

      • I don’t know why its not work after shutdown system.I am sorry.
        I check more then 3 times 10.12 (16A320) freqVectorsEdit.sh not work please check.

      • If you think to have found a bug in freqVectorsEdit.sh, which I doubt it is since you mentioned “after shutdown” (works before shutdown?) then please open a Github issue for it… where it belongs i.e. here. Not in my blog. But if this a problem with XCPM i.e. power management, then you have to do your homework 😉

        Thanks.

  33. Pingback: Installation MacOs Sierra - Hackintosh sur X79 - X99

  34. Not sure if I’m doing anything wrong, maybe someone can help.

    MacOS 10.12, i7 5820K. Asus X99-A

    Patching Kernel with Clover:
    KernelToPatch

    Comment
    _xcpm_bootstrap Sierra © Pike R. Alpha
    Disabled

    Find

    83C3C483FB22

    Replace

    83C3C183FB22

    Comment
    XCPM_reboot fix by Pike R. Alpha
    Disabled

    Find

    554889E5415741564155415453504189D641

    Replace

    C39089E5415741564155415453504189D641

    sysctl -n machdep.xcpm.mode returns 0

    Also tried with setting FakeCPUID to 0x306F4, 0x0306F0, 0x0306C0.

    Am I missing anything?

  35. For your CPU, the FakeID should 0x0306F0, the -xcpm flag should be off in Clover, and you should have generated an SSDT using ssdtprgen.sh. I used the parameters -p i7-5820K -turbo 4000 -x 1 -m MacPro6,1

  36. I have XCPM working well on a X99P-SLI, however I have two problems, one of which is probably not relevant here but I will mention it anyway:
    1. I use an Apple BCM943602CS PCIe adapter card, connected to an internal USB2 port. With this card connected, the Hack is unable to sleep and immediately wakes up.
    2. Removing the above card, the Hack will sleep correctly, but on wake the CPU maxes out at 4,000 and the speedster seems to be disabled.

    Any ideas on the latter primarily?

  37. Hello piker, have a quick question about pm on my new sierra upgrade… Been using your ssdtPRGen since 10.11 for my i7 – 4790k using custom smbios imac 14,2, and now regenerated ssdt for 10.12 with your latest version of the script. But I can’t find any mention of xcpm in console, before I would see it, same if I search with sudo dmesg.

    Weirdly enough sysctl -n machdep.xcpm.mode does return 1, and intel power gadget shows a cpu that varies in frequency and wattage quite well.

    With your AppleIntelInfo.kext I do get a clover hw.busfrequency error detected. But the rest looks good to my untrained eye, here it is below.

    So my question Is, is it normal that I can’t find xcpm in console (in el capitan it showed up) ? Do you think my pm is working now ? And do you think I should run your other script
    freqVectorsEdit.sh to generate more adapted frequency vectors (I know that i7 4790k is haswell and normally well supported by imac 14,2 smbios) ?

    Thanks and keep up the amazing work.

    ———–

    AppleIntelInfo.kext v1.8c Copyright © 2012-2016 Pike R. Alpha. All rights reserved

    Settings:
    ------------------------------------------
    logMSRs..................................: 1
    logIGPU..................................: 0
    logCStates...............................: 1
    logIPGStyle..............................: 1

    Warning: Clover hw.busfrequency error detected : 17d78400
    InitialTSC...............................: 0xb826a9b565ca (5061 MHz)
    MWAIT C-States...........................: 270624

    Processor Brandstring....................: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz

    Processor Signature..................... : 0x306C3
    ------------------------------------------
    - Family............................... : 6
    - Stepping............................. : 3
    - Model................................ : 0x3C (60)

    Model Specific Registers (MSRs)
    ------------------------------------------

    MSR_CORE_THREAD_COUNT............(0x35) : 0xFFFFFF8056BFB500
    ------------------------------------------
    - Core Count........................... : 4
    - Thread Count......................... : 8

    MSR_PLATFORM_INFO................(0xCE) : 0x80838F3012800
    ------------------------------------------
    - Maximum Non-Turbo Ratio.............. : 0x28 (4000 MHz)
    - Ratio Limit for Turbo Mode........... : 1 (programmable)
    - TDP Limit for Turbo Mode............. : 1 (programmable)
    - Low Power Mode Support............... : 0 (LMP not supported)
    - Number of ConfigTDP Levels........... : 0 (only base TDP level available)
    - Maximum Efficiency Ratio............. : 8
    - Minimum Operating Ratio.............. : 8

    MSR_PMG_CST_CONFIG_CONTROL.......(0xE2) : 0x1E000005
    ------------------------------------------
    - I/O MWAIT Redirection Enable......... : 0 (not enabled)
    - CFG Lock............................. : 0 (MSR not locked)
    - C3 State Auto Demotion............... : 1 (enabled)
    - C1 State Auto Demotion............... : 1 (enabled)
    - C3 State Undemotion.................. : 1 (enabled)
    - C1 State Undemotion.................. : 1 (enabled)
    - Package C-State Auto Demotion........ : 0 (disabled/unsupported)
    - Package C-State Undemotion........... : 0 (disabled/unsupported)

    MSR_PMG_IO_CAPTURE_BASE..........(0xE4) : 0x1814
    ------------------------------------------
    - LVL_2 Base Address................... : 0x1814
    - C-state Range........................ : 0 (C-States not included, I/O MWAIT redirection not enabled)

    IA32_MPERF.......................(0xE7) : 0xB727169E1AC
    IA32_APERF.......................(0xE8) : 0xBBC711AF9B9

    MSR_FLEX_RATIO...................(0x194) : 0xE0000
    ------------------------------------------

    MSR_IA32_PERF_STATUS.............(0x198) : 0x266200002C00
    ------------------------------------------
    - Current Performance State Value...... : 0x2C00 (4400 MHz)

    MSR_IA32_PERF_CONTROL............(0x199) : 0x2C00
    ------------------------------------------
    - Target performance State Value....... : 0x2C00 (4400 MHz)
    - Intel Dynamic Acceleration........... : 0 (IDA engaged)

    IA32_CLOCK_MODULATION............(0x19A) : 0x0
    IA32_THERM_STATUS................(0x19C) : 0x882F0282

    IA32_MISC_ENABLES................(0x1A0) : 0x850089
    ------------------------------------------
    - Fast-Strings......................... : 1 (enabled)
    - Automatic Thermal Control Circuit.... : 1 (enabled)
    - Performance Monitoring............... : 1 (available)
    - Enhanced Intel SpeedStep Technology.. : 1 (enabled)

    MSR_TEMPERATURE_TARGET...........(0x1A2) : 0x641400
    ------------------------------------------
    - Turbo Attenuation Units.............. : 0
    - Temperature Target................... : 100
    - TCC Activation Offset................ : 0

    MSR_MISC_PWR_MGMT................(0x1AA) : 0x1
    ------------------------------------------
    - EIST Hardware Coordination........... : 1 (disabled)

    MSR_TURBO_RATIO_LIMIT............(0x1AD) : 0x2C2C2C2C
    ------------------------------------------

    IA32_ENERGY_PERF_BIAS............(0x1B0) : 0x1
    ------------------------------------------
    - Power Policy Preference...............: 1 (highest performance)

    MSR_POWER_CTL....................(0x1FC) : 0x4005F
    ------------------------------------------
    - C1E Enable............................: 1

    MSR_RAPL_POWER_UNIT..............(0x606) : 0xA0E03
    ------------------------------------------
    - Power Units.......................... : 3 (1/8 Watt)
    - Energy Status Units.................. : 14 (61 micro-Joules)
    - Time Units .......................... : 10 (976.6 micro-Seconds)

    MSR_PKG_POWER_LIMIT..............(0x610) : 0xFFD00000EA82
    ------------------------------------------
    - Package Power Limit #1............... : 3408 Watt
    - Enable Power Limit #1................ : 1 (enabled)
    - Package Clamping Limitation #1....... : 0 (disabled)
    - Time Window for Power Limit #1....... : 0 (2 milli-Seconds)
    - Package Power Limit #2............... : 4090 Watt
    - Enable Power Limit #2................ : 1 (enabled)
    - Package Clamping Limitation #2....... : 0 (disabled)
    - Time Window for Power Limit #2....... : 0 (2 milli-Seconds)
    - Lock................................. : 0 (MSR not locked)

    MSR_PKG_ENERGY_STATUS............(0x611) : 0xF48B6FBA
    ------------------------------------------
    - Total Energy Consumed................ : 250413 Joules (Watt = Joules / seconds)

    MSR_PKG_POWER_INFO...............(0x614) : 0x2C0
    ------------------------------------------
    - Thermal Spec Power................... : 88 Watt
    - Minimum Power........................ : 0
    - Maximum Power........................ : 0
    - Maximum Time Window.................. : 0

    MSR_PP0_POWER_LIMIT..............(0x638) : 0xFFD0
    ------------------------------------------
    - Power Limit.......................... : 4090 Watt
    - Enable Power Limit................... : 1 (enabled)
    - Clamping Limitation.................. : 0 (disabled)
    - Time Window for Power Limit.......... : 0 (10 milli-Seconds)
    - Lock................................. : 0 (MSR not locked)

    MSR_PP0_ENERGY_STATUS............(0x639) : 0xF4662805
    ------------------------------------------
    - Total Energy Consumed................ : 250264 Joules (Watt = Joules / seconds)

    MSR_TURBO_ACTIVATION_RATIO.......(0x64C) : 0x0

    MSR_CONFIG_TDP_NOMINAL...........(0x648) : 0x28
    MSR_CONFIG_TDP_LEVEL1............(0x649) : 0x0
    MSR_CONFIG_TDP_LEVEL2............(0x64a) : 0x0
    MSR_CONFIG_TDP_CONTROL...........(0x64b) : 0x80000000
    MSR_TURBO_ACTIVATION_RATIO.......(0x64c) : 0x0
    MSR_PKGC3_IRTL...................(0x60a) : 0x8842
    MSR_PKGC6_IRTL...................(0x60b) : 0x8873
    MSR_PKGC7_IRTL...................(0x60c) : 0x8891
    MSR_PKG_C2_RESIDENCY.............(0x60d) : 0x9192E06B4478
    MSR_PKG_C3_RESIDENCY.............(0x3f8) : 0x0
    MSR_PKG_C6_RESIDENCY.............(0x3f9) : 0x0
    MSR_PKG_C7_RESIDENCY.............(0x3fa) : 0x0

    IA32_TSC_DEADLINE................(0x6E0) : 0xB826AE78F9F7

    CPU Ratio Info:
    ------------------------------------------
    Base Clock Frequency (BLCK)............. : 100 MHz
    Maximum Efficiency Ratio/Frequency.......: 8 ( 800 MHz)
    Maximum non-Turbo Ratio/Frequency........: 40 (4000 MHz)
    Maximum Turbo Ratio/Frequency............: 44 (4400 MHz)
    P-State ratio * 100 = Frequency in MHz
    ------------------------------------------
    CPU P-States [ (8) 38 44 ]
    CPU C3-Cores [ 0 4 6 7 ]
    CPU C6-Cores [ 0 1 4 5 7 ]
    CPU C7-Cores [ 0 4 5 6 7 ]
    CPU P-States [ (8) 25 38 44 ]
    CPU C6-Cores [ 0 1 2 3 4 5 7 ]
    CPU C7-Cores [ 0 2 3 4 5 6 7 ]
    CPU P-States [ (8) 25 34 38 44 ]
    CPU C3-Cores [ 0 2 4 6 7 ]
    CPU C6-Cores [ 0 1 2 3 4 5 6 7 ]
    CPU C7-Cores [ 0 1 2 3 4 5 6 7 ]
    CPU P-States [ 8 25 31 34 38 (40) 44 ]
    CPU C3-Cores [ 0 1 2 4 5 6 7 ]
    CPU P-States [ 8 25 27 31 34 38 (40) 44 ]
    CPU C3-Cores [ 0 1 2 3 4 5 6 7 ]
    CPU P-States [ 8 25 27 31 34 38 (40) 41 44 ]
    CPU P-States [ 8 25 27 28 31 34 38 (40) 41 44 ]
    CPU P-States [ (8) 25 27 28 31 32 34 38 40 41 44 ]
    CPU P-States [ 8 25 27 28 29 31 32 34 38 (40) 41 44 ]
    CPU P-States [ 8 25 27 28 29 30 31 32 34 38 (40) 41 44 ]
    CPU P-States [ 8 23 25 27 28 29 30 31 32 34 38 (40) 41 44 ]

    • You may be looking in the wrong log file. Please note that this has changed since macOS Sierra so first enable debug logging with:
      sudo log config --mode "level:debug"
      Then dump some output with:
      log show --predicate 'eventMessage CONTAINS "XCPM"' --last "1h"

  38. Thank you !! Indeed it showed up !! I also went ahead and ran
    freqVectorsEdit.sh and chose imac 15,1 to replace the frequency vectors in my imac 14,2 plist since imac 15,1 does officially support i7-4790k… Hope this is the kind of use case this script was intended for… 🙂

  39. Hi Pike,

    First I want to thank you for sharing all this knowledge and helping people.

    I’ve been reading posts and comments here and in your github to configure my system and now I would like to get some advice from you to tune it. Main problem is frequency graph in IPG always jumping between 3,xx-2,xxGHz and not idling. Also if you can check what else should i address based on the output of AppleIntelInfo.kext. Could you take a look whenever you have some time (no hurries)?

    Thank your very much.

    My system:
    Asus X99 Deluxe II (bios 1003 patched with coderush uefipatch)
    Intel i7 6900k

    MacOS X Sierra 10.12

    Clover
    SSDT>DropOEM – yes
    FakeCPUID 0x040671

    KernelToPatch:
    _xcpm_pkg_scope_msr 10.12 © Pike R. Alpha
    find BE070000 0031D2E8 94FCFFFF
    replace BE070000 0031D290 90909090

    _xcpm_SMT_scope_msrs 10.12 © Pike R. Alpha
    find BE0B0000 0031D2E8 59FCFFFF
    replace BE0B0000 0031D290 90909090

    SSDT
    ./ssdtPRGen.sh -turbo 4000

    FREQVECTORS
    ./freqVectorsEdit.sh (then selected 22 for iMac17,1)

    SMBIOS = MacPro6,1

    AppleIntelInfo.kext v1.8c Copyright © 2012-2016 Pike R. Alpha. All rights reserved

    Settings:
    ------------------------------------------
    logMSRs..................................: 1
    logIGPU..................................: 0
    logCStates...............................: 1
    logIPGStyle..............................: 1
    InitialTSC...............................: 0xc91e95614e0 (431 MHz)
    MWAIT C-States...........................: 8480

    Processor Brandstring....................: Intel(R) Core(TM) i7-6900K CPU @ 3.20GHz

    Processor Signature..................... : 0x406F1
    ------------------------------------------
    - Family............................... : 6
    - Stepping............................. : 1
    - Model................................ : 0x4F (79)

    Model Specific Registers (MSRs)
    ------------------------------------------

    MSR_CORE_THREAD_COUNT............(0x35) : 0xFFFFFF80B8BC1500
    ------------------------------------------
    - Core Count........................... : 8
    - Thread Count......................... : 16

    MSR_PLATFORM_INFO................(0xCE) : 0x20080C3BF3812000
    ------------------------------------------
    - Maximum Non-Turbo Ratio.............. : 0x20 (3200 MHz)
    - Ratio Limit for Turbo Mode........... : 1 (programmable)
    - TDP Limit for Turbo Mode............. : 1 (programmable)
    - Low Power Mode Support............... : 1 (LPM supported)
    - Number of ConfigTDP Levels........... : 1 (additional TDP level(s) available)
    - Maximum Efficiency Ratio............. : 12
    - Minimum Operating Ratio.............. : 8

    MSR_PMG_CST_CONFIG_CONTROL.......(0xE2) : 0x1E000005
    ------------------------------------------
    - I/O MWAIT Redirection Enable......... : 0 (not enabled)
    - CFG Lock............................. : 0 (MSR not locked)
    - C3 State Auto Demotion............... : 1 (enabled)
    - C1 State Auto Demotion............... : 1 (enabled)
    - C3 State Undemotion.................. : 1 (enabled)
    - C1 State Undemotion.................. : 1 (enabled)
    - Package C-State Auto Demotion........ : 0 (disabled/unsupported)
    - Package C-State Undemotion........... : 0 (disabled/unsupported)

    MSR_PMG_IO_CAPTURE_BASE..........(0xE4) : 0x10414
    ------------------------------------------
    - LVL_2 Base Address................... : 0x414
    - C-state Range........................ : 1 (C-States not included, I/O MWAIT redirection not enabled)

    IA32_MPERF.......................(0xE7) : 0x6267B63BB
    IA32_APERF.......................(0xE8) : 0x65A3A3C8D
    MSR_0x150........................(0x150) : 0x72525

    MSR_FLEX_RATIO...................(0x194) : 0xE0000
    ------------------------------------------

    MSR_IA32_PERF_STATUS.............(0x198) : 0x222E00002300
    ------------------------------------------
    - Current Performance State Value...... : 0x2300 (3500 MHz)

    MSR_IA32_PERF_CONTROL............(0x199) : 0x2800
    ------------------------------------------
    - Target performance State Value....... : 0x2800 (4000 MHz)
    - Intel Dynamic Acceleration........... : 0 (IDA engaged)

    IA32_CLOCK_MODULATION............(0x19A) : 0x0
    IA32_THERM_STATUS................(0x19C) : 0x88470000

    IA32_MISC_ENABLES................(0x1A0) : 0x840089
    ------------------------------------------
    - Fast-Strings......................... : 1 (enabled)
    - Automatic Thermal Control Circuit.... : 1 (enabled)
    - Performance Monitoring............... : 1 (available)
    - Enhanced Intel SpeedStep Technology.. : 0 (disabled)

    MSR_TEMPERATURE_TARGET...........(0x1A2) : 0x640A00
    ------------------------------------------
    - Turbo Attenuation Units.............. : 0
    - Temperature Target................... : 100
    - TCC Activation Offset................ : 0

    MSR_MISC_PWR_MGMT................(0x1AA) : 0x402000
    ------------------------------------------
    - EIST Hardware Coordination........... : 0 (enabled)

    MSR_TURBO_RATIO_LIMIT............(0x1AD) : 0x2323232323232828
    ------------------------------------------

    IA32_ENERGY_PERF_BIAS............(0x1B0) : 0x1
    ------------------------------------------
    - Power Policy Preference...............: 1 (highest performance)

    MSR_POWER_CTL....................(0x1FC) : 0x2904005B
    ------------------------------------------
    - C1E Enable............................: 1

    MSR_RAPL_POWER_UNIT..............(0x606) : 0xA0E03
    ------------------------------------------
    - Power Units.......................... : 3 (1/8 Watt)
    - Energy Status Units.................. : 14 (61 micro-Joules)
    - Time Units .......................... : 10 (976.6 micro-Seconds)

    MSR_PKG_POWER_LIMIT..............(0x610) : 0x7FFF80015FFF8
    ------------------------------------------
    - Package Power Limit #1............... : 4095 Watt
    - Enable Power Limit #1................ : 1 (enabled)
    - Package Clamping Limitation #1....... : 1 (allow going below OS-requested P/T state during Time Window for Power Limit #1)
    - Time Window for Power Limit #1....... : 10 (2560 milli-Seconds)
    - Package Power Limit #2............... : 4095 Watt
    - Enable Power Limit #2................ : 1 (enabled)
    - Package Clamping Limitation #2....... : 1 (allow going below OS-requested P/T state setting Time Window for Power Limit #2)
    - Time Window for Power Limit #2....... : 3 (20 milli-Seconds)
    - Lock................................. : 0 (MSR not locked)

    MSR_PKG_ENERGY_STATUS............(0x611) : 0xB220A
    ------------------------------------------
    - Total Energy Consumed................ : 44 Joules (Watt = Joules / seconds)

    MSR_PKG_POWER_INFO...............(0x614) : 0x1780460
    ------------------------------------------
    - Thermal Spec Power................... : 140 Watt
    - Minimum Power........................ : 0
    - Maximum Power........................ : 0
    - Maximum Time Window.................. : 0

    MSR_PP0_POWER_LIMIT..............(0x638) : 0x0

    MSR_PP0_ENERGY_STATUS............(0x639) : 0x0

    MSR_TURBO_ACTIVATION_RATIO.......(0x64C) : 0x0

    MSR_PKGC3_IRTL...................(0x60a) : 0x0
    MSR_PKGC6_IRTL...................(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY.............(0x60d) : 0x26EAA4600
    MSR_PKG_C3_RESIDENCY.............(0x3f8) : 0x0
    MSR_PKG_C2_RESIDENCY.............(0x60d) : 0x26EAA4600
    MSR_PKG_C3_RESIDENCY.............(0x3f8) : 0x0
    MSR_PKG_C6_RESIDENCY.............(0x3f9) : 0x17F6B7B6E0

    IA32_TSC_DEADLINE................(0x6E0) : 0xC91EC54257F

    CPU Ratio Info:
    ------------------------------------------
    Base Clock Frequency (BLCK)............. : 100 MHz
    Maximum Efficiency Ratio/Frequency.......: 12 (1200 MHz)
    Maximum non-Turbo Ratio/Frequency........: 32 (3200 MHz)
    Maximum Turbo Ratio/Frequency............: 40 (4000 MHz)
    P-State ratio * 100 = Frequency in MHz
    ------------------------------------------
    CPU P-States [ 26 35 (37) ]
    CPU C3-Cores [ 1 3 15 ]
    CPU C6-Cores [ 1 3 5 7 9 11 12 15 ]
    CPU P-States [ 26 33 35 (37) ]
    CPU C3-Cores [ 1 3 14 15 ]
    CPU C6-Cores [ 0 1 3 5 7 9 11 12 13 15 ]
    CPU P-States [ 26 30 33 35 (37) ]
    CPU C3-Cores [ 0 1 3 14 15 ]
    CPU C6-Cores [ 0 1 3 5 6 7 9 11 12 13 15 ]
    CPU P-States [ 26 30 31 33 35 (37) ]
    CPU P-States [ 26 29 30 31 33 35 (37) ]
    CPU C6-Cores [ 0 1 3 5 6 7 9 10 11 12 13 15 ]
    CPU P-States [ (12) 25 26 29 30 31 33 35 37 ]
    CPU C3-Cores [ 0 1 2 3 14 15 ]
    CPU C6-Cores [ 0 1 2 3 4 5 6 7 9 10 11 12 13 14 15 ]
    CPU C6-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 ]
    CPU P-States [ 12 25 26 28 29 30 31 33 35 (37) ]
    CPU P-States [ 12 25 26 28 29 30 31 32 33 35 (37) ]
    CPU P-States [ 12 25 26 27 28 29 30 31 32 33 35 (37) ]
    CPU P-States [ (12) 25 26 27 28 29 30 31 32 33 34 35 37 ]
    CPU P-States [ 12 24 25 26 27 28 29 30 31 32 33 34 35 (37) ]
    CPU P-States [ 12 24 25 26 27 28 29 30 31 32 33 34 35 37 (40) ]
    CPU P-States [ 12 24 25 26 27 28 29 30 31 32 33 34 (35) 36 37 40 ]
    CPU P-States [ 12 24 25 26 27 28 29 30 31 32 33 34 35 36 37 39 (40) ]
    CPU P-States [ (12) 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ]
    CPU P-States [ (12) 21 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ]
    CPU P-States [ (12) 21 22 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ]
    CPU P-States [ (12) 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ]
    CPU C3-Cores [ 0 1 2 3 4 14 15 ]
    CPU C3-Cores [ 0 1 2 3 4 5 14 15 ]
    CPU P-States [ (12) 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 ]
    CPU P-States [ 12 18 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 (37) 38 39 40 ]
    CPU C3-Cores [ 0 1 2 3 4 5 6 14 15 ]
    CPU C3-Cores [ 0 1 2 3 4 5 6 10 14 15 ]
    CPU C3-Cores [ 0 1 2 3 4 5 6 8 10 11 14 15 ]
    CPU C3-Cores [ 0 1 2 3 4 5 6 7 8 10 11 14 15 ]
    CPU C3-Cores [ 0 1 2 3 4 5 6 7 8 9 10 11 14 15 ]

    • This weird jumping is still an unknown factor and I would like to get to the bottom of it, but then I need help from people with setups that expose this problem.

      1.) Verify that power management works with MS Windows and/or Linux.
      2.) Read the MSR’s that AppleIntelInfo.kext dumps.
      3.) Compare the values and their settings.

  40. Hi Pike – Here are my results with E5-2603v4 CPU’s … If there is anything I can do for bug hunting or further testing let me know.

    Martin

    AppleIntelInfo.kext v1.8c Copyright © 2012-2016 Pike R. Alpha. All rights reserved

    Settings:
    ——————————————
    logMSRs…………………………….: 1
    logIGPU…………………………….: 0
    logCStates………………………….: 1
    logIPGStyle…………………………: 1

    Warning: Clover hw.busfrequency error detected : 17d78400
    InitialTSC………………………….: 0x2512cb3c2dd (149 MHz)
    MWAIT C-States………………………: 8480

    Processor Brandstring………………..: Genuine Intel(R) CPU 0000 @ 1.70GHz

    Processor Signature………………… : 0x406F1
    ——————————————
    – Family…………………………. : 6
    – Stepping……………………….. : 1
    – Model………………………….. : 0x4F (79)

    Model Specific Registers (MSRs)
    ——————————————

    MSR_CORE_THREAD_COUNT…………(0x35) : 0xFFFFFF8046656D00
    ——————————————
    – Core Count……………………… : 6
    – Thread Count……………………. : 6

    MSR_PLATFORM_INFO…………….(0xCE) : 0x20080C3BFB811100
    ——————————————
    – Maximum Non-Turbo Ratio………….. : 0x11 (1700 MHz)
    – Ratio Limit for Turbo Mode……….. : 1 (programmable)
    – TDP Limit for Turbo Mode…………. : 1 (programmable)
    – Low Power Mode Support…………… : 1 (LPM supported)
    – Number of ConfigTDP Levels……….. : 1 (additional TDP level(s) available)
    – Maximum Efficiency Ratio…………. : 12
    – Minimum Operating Ratio………….. : 8

    MSR_PMG_CST_CONFIG_CONTROL…….(0xE2) : 0x8403
    ——————————————
    – I/O MWAIT Redirection Enable……… : 1 (enabled, IO read of MSR(0xE4) mapped to MWAIT)
    – CFG Lock……………………….. : 1 (MSR locked until next reset)
    – C3 State Auto Demotion…………… : 0 (disabled/unsupported)
    – C1 State Auto Demotion…………… : 0 (disabled/unsupported)
    – C3 State Undemotion……………… : 0 (disabled/unsupported)
    – C1 State Undemotion……………… : 0 (disabled/unsupported)
    – Package C-State Auto Demotion…….. : 0 (disabled/unsupported)
    – Package C-State Undemotion……….. : 0 (disabled/unsupported)

    MSR_PMG_IO_CAPTURE_BASE……….(0xE4) : 0x10414
    ——————————————
    – LVL_2 Base Address………………. : 0x414
    – C-state Range…………………… : 1 (C6 is the max C-State to include)

    IA32_MPERF…………………..(0xE7) : 0x23502FE8087
    IA32_APERF…………………..(0xE8) : 0x234FD7E0577
    MSR_0x150……………………(0x150) : 0x1F00000000

    MSR_FLEX_RATIO……………….(0x194) : 0x0
    ——————————————

    MSR_IA32_PERF_STATUS………….(0x198) : 0x1B4100001100
    ——————————————
    – Current Performance State Value…… : 0x1100 (1700 MHz)

    MSR_IA32_PERF_CONTROL…………(0x199) : 0x1100
    ——————————————
    – Target performance State Value……. : 0x1100 (1700 MHz)
    – Intel Dynamic Acceleration……….. : 0 (IDA engaged)

    IA32_CLOCK_MODULATION…………(0x19A) : 0x0
    IA32_THERM_STATUS…………….(0x19C) : 0x883D0000

    IA32_MISC_ENABLES…………….(0x1A0) : 0x840089
    ——————————————
    – Fast-Strings……………………. : 1 (enabled)
    – Automatic Thermal Control Circuit…. : 1 (enabled)
    – Performance Monitoring…………… : 1 (available)
    – Enhanced Intel SpeedStep Technology.. : 0 (disabled)

    MSR_TEMPERATURE_TARGET………..(0x1A2) : 0x5D0A00
    ——————————————
    – Turbo Attenuation Units………….. : 0
    – Temperature Target………………. : 93
    – TCC Activation Offset……………. : 0

    MSR_MISC_PWR_MGMT…………….(0x1AA) : 0x402040
    ——————————————
    – EIST Hardware Coordination……….. : 0 (enabled)

    MSR_TURBO_RATIO_LIMIT…………(0x1AD) : 0x1111111111111111
    ——————————————

    IA32_ENERGY_PERF_BIAS…………(0x1B0) : 0x0

    MSR_POWER_CTL………………..(0x1FC) : 0x2904005B
    ——————————————
    – C1E Enable……………………….: 1

    MSR_RAPL_POWER_UNIT…………..(0x606) : 0xA0E03
    ——————————————
    – Power Units…………………….. : 3 (1/8 Watt)
    – Energy Status Units……………… : 14 (61 micro-Joules)
    – Time Units …………………….. : 10 (976.6 micro-Seconds)

    MSR_PKG_POWER_LIMIT…………..(0x610) : 0x78330001582A8
    ——————————————
    – Package Power Limit #1…………… : 85 Watt
    – Enable Power Limit #1……………. : 1 (enabled)
    – Package Clamping Limitation #1……. : 1 (allow going below OS-requested P/T state during Time Window for Power Limit #1)
    – Time Window for Power Limit #1……. : 10 (2560 milli-Seconds)
    – Package Power Limit #2…………… : 102 Watt
    – Enable Power Limit #2……………. : 1 (enabled)
    – Package Clamping Limitation #2……. : 1 (allow going below OS-requested P/T state setting Time Window for Power Limit #2)
    – Time Window for Power Limit #2……. : 3 (20 milli-Seconds)
    – Lock…………………………… : 0 (MSR not locked)

    MSR_PKG_ENERGY_STATUS…………(0x611) : 0x20D074C4
    ——————————————
    – Total Energy Consumed……………. : 33601 Joules (Watt = Joules / seconds)

    MSR_PKG_POWER_INFO……………(0x614) : 0x2F055001C802A8
    ——————————————
    – Thermal Spec Power………………. : 85 Watt
    – Minimum Power…………………… : 0
    – Maximum Power…………………… : 170
    – Maximum Time Window……………… : 0

    MSR_PP0_POWER_LIMIT…………..(0x638) : 0x0

    MSR_PP0_ENERGY_STATUS…………(0x639) : 0x0

    MSR_TURBO_ACTIVATION_RATIO…….(0x64C) : 0x11

    MSR_PKGC3_IRTL……………….(0x60a) : 0x0
    MSR_PKGC6_IRTL……………….(0x60b) : 0x0
    MSR_PKG_C2_RESIDENCY………….(0x60d) : 0x0
    MSR_PKG_C3_RESIDENCY………….(0x3f8) : 0x0
    MSR_PKG_C2_RESIDENCY………….(0x60d) : 0x0
    MSR_PKG_C6_RESIDENCY………….(0x3f9) : 0x0

    IA32_TSC_DEADLINE…………….(0x6E0) : 0x2512EC0654E
    (HWP Disabled)

    CPU Ratio Info:
    ——————————————
    Base Clock Frequency (BLCK)…………. : 100 MHz
    Maximum Efficiency Ratio/Frequency…….: 12 (1200 MHz)
    Maximum non-Turbo Ratio/Frequency……..: 17 (1700 MHz)
    Maximum Turbo Ratio/Frequency…………: 17 (1700 MHz)
    P-State ratio * 100 = Frequency in MHz
    ——————————————
    CPU P-States [ (17) ]

    • Warning: Clover hw.busfrequency error detected : 17d78400

      to solve this error if you are using clover boot loader you have to put 100 in QPI value of CPU section

      • Thanks for the quick QPI fix Pike, appreciated 🙂
        Should I get full kernel power management with these CPU’s being locked @1700Mhz ?
        I get Shim success for the cores but then it says the plist is NULL! and that the Stepper failed.
        I tried your freqvectorseditor script and set it to 14,2 to match the smBIOS but it doesn’t fix the vectors loaded count which stays at zero.

        Would I be right in assuming it’s because these chips are locked to one speed ?

        Martin

      • Hi Pike
        I need your help for Install Sierra without SSE4 CPU.
        Its worked on 10.11

        S5000XVN
        Intel® Xeon® Processor X5365

        If I use FakecpuID and PlatformSupport.plist (10.11) clover run after usb sleep its panic.
        I used X5460 CPU iD to X5365 CPU
        FakeCPUID=0x01067A

        I have thread 0: panic.[cid:22D46024-C0AF-4C56-8404-77267DAE11F2@Home]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s