DrDonk/unlocker

Test using AMD Ryzen CPU

DrDonk opened this issue ยท 51 comments

I recently tested the unlocker on my son's AMD Ryzen based laptop (thanks Dan), and looking for others to try it out using a vanilla macOS installation, not one with an AMD kernel or patches. The unlocker cannot patch this but we can recommend settings for the VMX file that allows macOS to run on recent AMD CPUs

The CPU spec was: AMD Ryzen 3 3200U with Radeon Vega Mobile Gfx @ 2.60 Ghz

It ran when the following lines were added to the VMX file:

cpuid.0.eax = "0000:0000:0000:0000:0000:0000:0000:1011"
cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
cpuid.1.eax = "0000:0000:0000:0001:0000:0110:0111:0001"
cpuid.1.ebx = "0000:0010:0000:0001:0000:1000:0000:0000"
cpuid.1.ecx = "1000:0010:1001:1000:0010:0010:0000:0011"
cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"

UPDATE
You must have Hyper-V disabled on Windows or VMware falls back to a mode called ULM. CPUID masking is not available in ULM mode as it is pushed to Windows for the low level VMX/SVM operations. You can see if VMware is in ULM mode on Hyper_V by searching the guest's vmware.log file for these 2 lines:

vmx IOPL_Init: Hyper-V detected by CPUID

Monitor Mode: ULM

Here is a link to a Microsoft artcile on disabling Hyper-V.

https://docs.microsoft.com/en-us/troubleshoot/windows-client/application-management/virtualization-apps-not-work-with-hyper-v

Editing the VMX file

  1. Read this KB article to learn how to edit a guest's VMX file safely https://kb.vmware.com/s/article/2057902
  2. Add the following lines to the VMX file:
cpuid.0.eax = "0000:0000:0000:0000:0000:0000:0000:1011"
cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
cpuid.1.eax = "0000:0000:0000:0001:0000:0110:0111:0001"
cpuid.1.ebx = "0000:0010:0000:0001:0000:1000:0000:0000"
cpuid.1.ecx = "1000:0010:1001:1000:0010:0010:0000:0011"
cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"
vhv.enable = "FALSE"
vpmc.enable = "FALSE"
  1. Make sure there are no duplicate lines in the VMX file or the guest will not start and a dictionary error will
    be displayed by VMware.
  2. You can now install and run macOS as a gu

So looking for others to try this out and report back here with any details on success or failure.

Result: SUCCESS
CPU spec: AMD Ryzen 5 2500U with Radeon Vega Mobile Gfx 2.00 GHZ
Guest OS: macOS 12.4

STEPS:

  1. Add the following lines to the VMX file:
cpuid.0.eax = "0000:0000:0000:0000:0000:0000:0000:1011"
cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
cpuid.1.eax = "0000:0000:0000:0001:0000:0110:0111:0001"
cpuid.1.ebx = "0000:0010:0000:0001:0000:1000:0000:0000"
cpuid.1.ecx = "1000:0010:1001:1000:0010:0010:0000:0011"
cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"
  1. Remove the following lines from the VMX file:
vhv.enable = "TRUE"
vpmc.enable = "TRUE"

Good catch on the vhv and vpmc flags which would not work on AMD. So that means we cannot have nested virtualisation or virtual performance counters, but they are usually not enabled unless really needed.

AMD Ryzen 5 2600
Installing macOS 11

In previous installs on VMWare 15 with a different unlocker I had to add a bunch more settings.
All I had to do here was add the aforementioned CPU mask

I was also able to transfer my previous VM by copying over the vmx content (with cpu mask) of a new machine (and updating the name).

Thanks for letting me know.

Result: Fail
CPU: Ryzen 9 5900X
VMware version: 16.2.4; using unlocker 4.2.2
Host OS: Windows 11
Guest OS: macOS Monterey 13

The guest OS doesn't even get to show me the Apple logo. I get a "Failed to start the virtual machine." Tried with both the vhv and vmpc flags set to TRUE or FALSE, no difference. I can post logs or the vmx file, just let me know what you need.

Thanks for the post. Can you attach the vmx and vmware.log file to a post please? It's tricky to see what works and does not on AMD, but I will see if there is anything obvious.

Here you go. For the record, if I don't have the cpuid... lines in the VMX file, then the VM starts up, I get an Apple logo, but then it the CPU is halted.

macOS 13 .vmx.txt
vmware.log

I think it could be because you have Hyper-V enabled and VMware falls back to a mode called ULM. I believe CPUID masking is not available in that mode as it is pushed to Windows for the low level VMX/SVM operations.

Can you try disabling Hyper-V and trying again?

https://docs.microsoft.com/en-us/troubleshoot/windows-client/application-management/virtualization-apps-not-work-with-hyper-v

I have success to report with the above configuration (macOS Monterey, VMWare 16.x, Windows 11, Ryzen 9 5900X), finally

The road to getting there was not easy, though. It was very difficult to completely disable Hyper-V in Windows 11. Here are the steps I took, and to be completely honest, I don't know which combination worked. The last thing I did was bcdedit /set hypervisorlaunchtype off but I don't know that was enough or if the other steps were required.

To check whether Hyper-V is truly disabled, run msinfo32 and the very last line should NOT read "A hypervisor has been detected..." You should instead see 4 lines of information about Hyper-V features -- yes, that's misleading, but that's what you should see..

  • Windows Features ->

    Disable Hyper-V
    Disable Windows Hypervisor Platform
    Disable WSL

  • Set Credential Guard Off: from info in Microsoft's website, find the HCVI Readiness Tool, save it to disk, and run DG_Readiness_Tool.ps1 -Disable -AutoReboot

  • Settings -> Core Isolation -> Memory Integrity is Off

  • Open an elevated Command Prompt, bcdedit /set hypervisorlaunchtype off

Good news. I know switching off Hyper-V can be a problem.

I will update the issue and the readme file.

Thanks for the testing and the feedback.

@morphine00 Could you send me a vmare.log file from the workign guest please? I'm just checking on what CPUID masks are actually doing at runtime and it's logged in vmware.log.

Thanks

There you go.
vmware.log

Thanks

For the record, the VMWare Tools also installed just fine via the standard VMWare menus. Don't know if that was relevant to this issue or not.

AFAIK The tools should work just fine for Intel and AMD, but good to have it confirmed again.

Result: Success
CPU: Ryzen 9 5800X
VMware Player version: 16.2.4; using unlocker 4.2.2
Host OS: Windows 10 (21H2)
Guest OS: macOS Monterey 12.5.1

At first I was also getting "Failed to start the virtual machine." error, like @morphine00 did, then I disabled hyperv via:

  • Open an elevated Command Prompt, bcdedit /set hypervisorlaunchtype off

  • Windows Features ->

    Disable Hyper-V
    Disable Windows Hypervisor Platform
    Disable WSL

Result: Fail
CPU: Ryzen 9 5950X
VMware version: 16.2.4; using Unlocker 4.2.2
Host OS: Windows 11 22H2
Guest OS: macOS Ventura 13.0 Beta 5

Monterey works like a charm, I don't understand what's wrong with Ventura.
Hyper-V is disabled, but it doesn't fix the bootloop. :/
macOS.vmx.txt
vmware.log

You have vhv.enable = "TRUE", you sure this should be on?

I tried with vhv.enable = "FALSE", but it doesn't work either.

Currently not supported by VMware. There is one possible change as there have been reports of network adapter issues.

Edit VMX file and change

ethernet0.virtualDev = "e1000e"

to

ethernet0.virtualDev = "vmxnet3"

Unfortunately, I also tried this one, with no luck.

Ventura is hard resetting the CPU. No way I can see to sort that out. There are issues on Fusion as well.

New version of Fusion and Workstation on the way which may support Ventura but be aware VMware are dropping support for future macOS versions.

@Codling I think that VMware is masking out the AVX2 capability flag in the guest, and that is a new hard requirement of Ventura. I may be able to change the cpuid masks to force AVX2. However some bits cannot be passed thru and I'm going to have to check that out.

Thank you, @DrDonk! Can't wait to test this out. :)

@Codling I'm struggling with this and not sure if I have it figured out. Can you try Monterey out on your machine?

If you can please set the guest to output debug log using the steps from:

https://docs.vmware.com/en/VMware-Workstation-Pro/16.0/com.vmware.ws.using.doc/GUID-A438B4FE-8499-454C-BBDE-9299FCDFB455.html

That gives a complete cpuid dump and differences report. You could also do that on the Ventura guest as well.

I am going to be offline for 3 days so there's no rush, and don't worry if you are not able to do this. It may be worth waiting until Ventura and the next version of VMware products ships.

bodeg commented

CPU: AMD Ryzen 9 4900H with Radeon
VMware version: 16.2.3
Unlocker 4.2.2
Host OS: Windows 10 Pro

Guest OS: macOS Ventura 13.0 Beta 3
Result: Fail
boot loop - also fail with VirtualBox.

Guest OS: macOS Monterey 12.0.1
Result: Success

Thanks for the feedback. At this point I don't see a way of getting Ventura running. Looks like it needs something changing in the VMware core. Newer versions of products coming but as you may ahve seen VMware said wouldn't support future macOS versions. That may change but we will have to start getting used to the fact that Intel Mac is going and the journey is ccoming to an end.

The VM reboot when i try to use xcode's simulator. My CPU is amd R7 5800h (legion r9000p).
this is error log and vmx file:
vmx.txt
error-mac.txt

That is an invalid opcode panic and there is nothing I can do in VMware and the unlocker to fix this. Looks like there is code being called with Intel only opcode embedded in the executable, possibly in CoreCrypto. Best suggestion is to ask what to do in a forum that supports AMD Hackintoshes.

I will add note that Xcode Simulator does not work.

thank you,i will try it

It's working! thanks!

AMD 3700X + Nvidia 2060S, unlocker 4.2.3, vmware workstation 16.2.4 for windows, Big Sur and Monterey.

I am getting reports of issues with Ventura on AMD CPUs. Has anyone tested this and if so can you report whether it works or not?

I am getting reports of issues with Ventura on AMD CPUs. Has anyone tested this and if so can you report whether it works or not?

A few minutes ago, I tested Ventura 13.0 (22A380) with my settings(AMD 3700X + Nvidia 2060S, unlocker 4.2.3, vmware workstation 16.2.4 for windows), it can't boot, error message is "Your computer restarted because a problem. Press any key or wait a few seconds to continue starting up".

full debug log attached.
There is a panic for SMC.

2022-11-08T06:20:50.689Z Wa(03) vmx smc: Index 432: Inconsistent read information.
2022-11-08T06:20:50.689Z Cr(01) vmx PANIC: ASSERT bora\devices\misc\appleSMC.c:599
2022-11-08T06:20:50.689Z In(05) vmx MKSGrab: MKS release: start, unlocked, nesting 0
2022-11-08T06:20:50.689Z In(05) vmx CoreDump_CoreDump: faking exception to get context

vmware.zip

@z16166
Interesting. I think there are multiple issues happening with Ventura.

  1. Older Intel CPUs were dropped and because VMware virtualises the CPU the Ventura guest is issuing instructions that do not exist both on AMD and Intel.
  2. The SMC crash is interesting. Maybe the VMware virtual SMC implememtation does not have keys that macOS needs. There are supposed to be new versions of Fusion/Workstation/Player coming this month. Perhaps that may help.
  3. Intel virtual ethernet card does cause problems so make sure to change:
    ethernet0.virtualDev = "e1000e"
    to
    ethernet0.virtualDev = "vmxnet3"

I am going to write a note on how to capture macOS debug output via virtual serial port. May find something of use in that log.

So can you do 2 tests for me please? Do each one separately so can test each setting.

  1. Modify your ethernet settings:
    ethernet0.virtualDev = "e1000e"
    to
    ethernet0.virtualDev = "vmxnet3"
  2. Modify the VMX file to have:
    smc.version = "0"

Here's the notes on capturing debug info.

https://github.com/DrDonk/unlocker/wiki/Debugging-macOS-Guests

Here's the notes on capturing debug info.

https://github.com/DrDonk/unlocker/wiki/Debugging-macOS-Guests

Pity that I can't set vmx.buildType to "debug", because vmware will always core-dumped before booting to firmware.
So I changed vmx.buildType to "stats". Here are logs for above 2 conditions.

smc.version.0.zip
vmxnet3.zip

Thanks to several people helping out and the cause seems to be a missing dyld cache for the processor being used:

Library not loaded: /usr/lib/libSystem.B.dylib
  Referenced from: <2D7AC05B-8AF0-3676-A40A-E40B77ACA459> /sbin/launchd
  Reason: tried: '/usr/lib/libSystem.B.dylib' (no such file), '/System/Volumes/Preboot/Cryptexes/OS/usr/lib/libSystem.B.dylib' (no such file), '/usr/lib/libSystem.B.dylib' (no such file, no dyld cache)

uuid info:
 0x1031c5000	uuid = <2d7ac05b-8af0-3676-a40a-e40b77aca459>
 0x112662000	uuid = <0f050705-2258-3d40-b7bc-f3b35a44bbea>

Thread 0 crashed

RAX: 0x0000000002000209, RBX: 0x0000000000000000, RCX: 0x00007ff7bcd39738, RDX: 0x00007ff7bcd39ba0
RSP: 0x00007ff7bcd39738, RBP: 0x00007ff7bcd39780, RSI: 0x0000000000000001, RDI: 0x0000000000000006
R8:  0x00007ff7bcd397a0, R9:  0x0000000000000000, R10: 0x000000000000003d, R11: 0x0000000000000246
R12: 0x000000000000003d, R13: 0x00007ff7bcd39ba0, R14: 0x0000000000000001, R15: 0x0000000000000006
RFL: 0x0000000000000246, RIP: 0x00000001126cb83a, CS:  0x0000000000000007, SS:  0x0000000000000023

Thread 0: 0xffffff86c8195b30
	0x00000001126cb83a
	0x00000001126e49f9
	0x000000011266c1e1
	0x0000000112669660
	0x0000000112668281

Not sure where we go from here, and I suspect this will also affect older Interl CPUs.

I am going to track this in a separate issue #47 (comment)

I'm using a Ryzen 9 5950X
I have tested this long ago testing various configurations and reading through the vmware logs and cpuid wikipedia.
Since i need to use WSL, disabling the hypervisor is not an option for me.
So i started testing various vmx configurations.
Here's my findings.

To Add:

hw.model = "iMac20,2"
board-id = "Mac-AF89B6D9451A490B"
cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
cpuid.1.eax = "0000:0000:0000:0011:0000:0110:1010:1001"
cpuid.1.ecx = "1111:0010:1101:1000:0011:0010:0000:0011"
cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"
smbios.reflectHost = "FALSE"
vhv.enable = "FALSE"
vpmc.enable = "FALSE"
smc.version = "0"

To Add if missing or Replace if not 16:
virtualHW.version = "16"

cpuid.0.eax and cpuid.1.ebx is not needed.
I've also upgraded the cpu model from 55 (Bay Trail) to 58 (Ivy Bridge). Any models higher than Ivy Bridge (>58) is not working.

This is working for monterey and big sur, and if i remember correctly, with hypervisor enabled the last time i used it.
Not working on Ventura, constant reboots.
Currently my hypervisor is not working now as my hypervisor network adapters is bugged.

Do test if running this with hypervisor on is still working or not, as i'm unable to test now.

@jerrywoo96 I tried your settings but if I try to select the VM in VMware I'll get an error saying Error while opening the virtual machine: Internal error. These are my settings.

@jerrywoo96 I tried your settings but if I try to select the VM in VMware I'll get an error saying Error while opening the virtual machine: Internal error. These are my settings.

This line is missing
virtualHW.version = "16"

This line is missing virtualHW.version = "16"

Thanks. Now it's booting fine. The VM is very slow and sluggish. I'm running this on a Ryzen 6800U.

This line is missing virtualHW.version = "16"

Thanks. Now it's booting fine. The VM is very slow and sluggish. I'm running this on a Ryzen 6800U.

you can fix it by installing the VMware Tools.
Also are you running windows with hypervisor enabled?

I already installed the VMware Tools but performance did not increase significantly. Yes, I need to use WSL as well. So Hypervisor is enabled.

@jerrywoo96 thanks so much for your investigation. Now I can use macOS without having to disable the hypervisor and rebooting the machine. Performance is fairly slow but it's good enough for casual testing. Thanks!

CPU: Ryzen 9 5950X
VMware Player version: 16.2.4; using unlocker 4.2.2
Host OS: Windows 11 (22H2)
Guest OS: macOS BigSur(11.6)

"Failed to start the virtual machine." error, like @morphine00 and did, then I disabled hyperv via:

Open an elevated Command Prompt, bcdedit /set hypervisorlaunchtype off

Windows Features ->

Disable Hyper-V
Disable Windows Hypervisor Platform
Disable WSL

But im still not able to get passed Failed to start the virtual machine.

It will only give that error if i have this in the VMX
cpuid.0.eax = "0000:0000:0000:0000:0000:0000:0000:1011"
cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
cpuid.1.eax = "0000:0000:0000:0001:0000:0110:0111:0001"
cpuid.1.ebx = "0000:0010:0000:0001:0000:1000:0000:0000"
cpuid.1.ecx = "1000:0010:1001:1000:0010:0010:0000:0011"
cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"

If i remove the masking it gives me the Guest os disable the CPU

if anyone has ideas that would be helpful ๐Ÿ™‡โ€โ™‚๏ธ
vmware.log
macOS 11.1.txt

CPU: Ryzen 9 5950X VMware Player version: 16.2.4; using unlocker 4.2.2 Host OS: Windows 11 (22H2) Guest OS: macOS BigSur(11.6)

"Failed to start the virtual machine." error, like @morphine00 and did, then I disabled hyperv via:

Open an elevated Command Prompt, bcdedit /set hypervisorlaunchtype off

Windows Features ->

Disable Hyper-V
Disable Windows Hypervisor Platform
Disable WSL

But im still not able to get passed Failed to start the virtual machine.

It will only give that error if i have this in the VMX cpuid.0.eax = "0000:0000:0000:0000:0000:0000:0000:1011" cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111" cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110" cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001" cpuid.1.eax = "0000:0000:0000:0001:0000:0110:0111:0001" cpuid.1.ebx = "0000:0010:0000:0001:0000:1000:0000:0000" cpuid.1.ecx = "1000:0010:1001:1000:0010:0010:0000:0011" cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"

If i remove the masking it gives me the Guest os disable the CPU

if anyone has ideas that would be helpful ๐Ÿ™‡โ€โ™‚๏ธ vmware.log macOS 11.1.txt

remove all your current cpuids, add this.

cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
cpuid.1.eax = "0000:0000:0000:0011:0000:0110:1010:1001"
cpuid.1.ecx = "1111:0010:1101:1000:0011:0010:0000:0011"
cpuid.1.edx = "0000:0111:1000:1011:1111:1011:1111:1111"

change virtualHW.version = "18" to virtualHW.version = "16"

@hamsandvich You are still using Hyper-V as the the vmware.log shows that ULM is still being used. Please disable Hyper-V, it is the only consistent way to make his work.

(See https://github.com/DrDonk/unlocker/blob/main/TROUBLESHOOTING.md)

The current best settings for AMD are:

# >>> START <<<
# This spoofs CPUID as MacBook Pro (15-inch, 2018) - MacBookPro15,1
cpuid.0.ebx = "0111:0101:0110:1110:0110:0101:0100:0111"
cpuid.0.ecx = "0110:1100:0110:0101:0111:0100:0110:1110"
cpuid.0.edx = "0100:1001:0110:0101:0110:1110:0110:1001"
featMask.vm.cpuid.FAMILY = "Val:0x6"
featMask.vm.cpuid.MODEL = "Val:0x9e"
featMask.vm.cpuid.STEPPING = "Val:0x0a"
cpuid.brandstring = "Intel(R) Core(TM) i7-8850H CPU @ 2.60GHz"
cpuid.inhibitDarwinMasks = "TRUE"
board-id.reflectHost = "FALSE"
board-id = "Mac-937A206F2EE63C01"

# Throw VMware error if no AVX2 support in CPU
featMask.vm.cpuid.AVX2 = "Min:1"

# Ensure no boot loop due to macOS unsupported Intel e1000 NIC
ethernet0.virtualDev = "vmxnet3"
# >>> END <<<

@jerrywoo96 Thanks for the CPUID masks. I'll add the as alternatives to what I have already listed. Just FYI if you continue with Hyper-V enabled it will be slower than using VMware hypervisor and a limited set CPUID bits can be set. For example CPU vendor is not overwritten in the guest.

I'm now going to shut this issue.