Intel MBP + Fusion 13 Pro + Ventura 13.2 VM + Filevault full disk encryption = no "screen" at boot

[Tantamount]

Hi Friends -- I've got a working snapshotted VM of Ventura 13.2 running on my 16" 2019 Intel MBP (also Ventura 13.2) without Filevault enabled. I'm using the latest version of VMware Fusion Pro: v13.0.0 (20802013).

If I boot up the VM, login in, enable Filevault, and reboot, I'm no longer able to see anything in the dedicated window for the VM -- it's not a black screen, just a cleared screen like you'd see before the white apple appears.  Eventually right around 5 minutes of inactivity, and without any errors, the VM will shut off.

Is filevault not supported?  I'm testing some mdm profiles, and unfortunately, one of the requirements is to enable filevault.

One thing I attempted was to add this to the vmx file:

macosguest.forceRecoveryModeInstall = "TRUE"

 but that didn't help -- I also tried deleting the nvram file.

I have since removed that configuration.  Any other suggestions? I've read in other threads about enabling auto-login for Windows VMs but I don't think that's an option here?

[ColoradoMarmot]

What happens if you enable filevault while doing the initial os install?  

[Tantamount]

Where is that an option during install?  I only see the option to choose the disk, not to enable encryption? (I poked around in the menu options above too and didn't see anything relevant, and even tried holding down the various Shift, Option, and Command key combos to see if some extras showed up)

[ColoradoMarmot]

It prompts you later in the installation process - will ask if you want to turn it on, then will either activate with appleid or create a recovery key.

[Tantamount]

That did not happen -- what did I miss (see mp4 capture of install process).

[Tantamount]

I've narrowed down the problem to the vmware tools, and likely the "preboot volume" it sets up.

When I spun up the new vm (13.1 Ventura), after the install was over, I enabled the Filevault -- it worked fine -- I was able to reboot, etc.  I thought maybe it was the 13.2 update, so I installed that next, but that also worked fine -- as I was rebooting however, I noticed that I was seeing much more of the boot process -- at no point was the screen blank like in the example screenshot I provided above -- this is different behavior than even with the working snapshot from my original vm -- that starts with the blank "screen" and then eventually something shows up -- here, the screen is immediate --starting with the mostly white background that one sees when the computer first starts.

I then installed the vmware tools -- this was a two step process -- when the vmware tools installer runs, Apple's security pops up to accept the system extensions, but when I did this, it wants to restart to take effect -- which aborts the vmware tools installation (There's a quick message about the installer failing).   So after it booted back up, I re-installed the tools to make sure the whole process completed.  Once I rebooted one final time, I'm left with a dead VM similar to the one that started this thread.

During the second install of the tools, I noticed it performed some additional steps, one of which was installing a "preboot volume."

[Tantamount]

Follow up with this new VM -- I reverted to a snapshot before I installed the vmware tools, and retried the tools installation -- this time not re-installing after the failed install of the tools after approving the system extensions since I seemed to have gotten what I wanted from the tools without having to install that preboot volume -- unfortunately, after another subsequent reboot, I found that the vm was left in the same unusable state.  This was all done in 13.1, so 13.2 can be ruled out as a factor here.

I'm curious if anyone out there has filevault working in Ventura with the vmware tools installed.

Oh, and one fun fact -- following the instructions here to remove vmware-tools (https://docs.vmware.com/en/VMware-Fusion/13/com.vmware.fusion.using.doc/GUID-6F7BE33A-3B8A-4C57-9C35...) shows as succeeding, however the boot up differences remain, and enabling Filevault still results in an unusable system.  Apparently it doesn't fully remove everything.

[Tantamount]

Another update -- apparently if you reset (remove) the custom window size coordinates from the vmx file so that the window is the default small size from when the vm was originally created, it will display the boot up process where I was just seeing that blank screen previously.

What that revealed was that the vm was stuck in a boot loop -- it would attempt this but then go to a black screen for less than a second, and then repeat over and over.  I think that's pretty conclusive that something about encrypting the apfs volume with filevault doesn't play nice with whatever vmware tools does early on to the boot process.

I extended the bios boot delay (bios.bootDelay = "10000") so that I could "esc" into menu, and could see all the different EFI options, but it's all greek to me:

 

[ColoradoMarmot]

That's really strange - I can't think of what the tools might be doing that would impact the boot process.

[Tantamount]

I used to run a hackintosh, and I know that to get that working on a PC meant emulating some apple specific bios hardware and firmware settings.  I imagine VMWare may be doing something similar to add whatever additional features vmware tools adds to the os?  I wonder if Apple has configured things to rely on some kind of TPM Secure Boot chain when filevault is enabled and maybe it sees VMWare as trying to MITM things.  I tried another install of Ventura with Secure Boot turned on to test this, but couldn't get the installer to run.

[Tantamount]

Additional follow up lol -- how much time have I spent on this...

I updated to the newer version that was just released: 3.0.1 (21139760) and updated the vmware-tools in another test vm.  It didn't help.

Nevertheless, I was able to recover the broken vm.  I saved a snapshot of its current broken state, and performed a full clone of that.

I then reverted the original vm back to before I used filevault so that it was bootable again.  I then added the hard drive from the full clone to this vm, and decrypted that drive.  The full clone was able to boot again.

I was playing a bit more around with the other test vm I was running, and I was able to successfully get filevault working with vmware-tools -- I think the trick is to never resize the window after installing vmware-tools.  So weird.  It's unfortunate I don't have any kind of SLA with VMWare to report this and, perhaps, help them figure out the root cause of this, but at least if anyone else runs into this issue, this thread will help.

[ColoradoMarmot]

That's really strange, and well done.  @Mikero FYI.