iM 4,1-14,4 iMac 2011 (see more) UEFI Firmware Mod

[m0bil]

iMac 12,x Turbo Overclocking

This firmware patch enables CPU Turbo Overclocking and allows setting the Max Turbo Multipliers of the CPU.

Background​

After working for some months in my own overclocking code, I found out that large parts of the Intel reference code to setup Turbo Overclocking were already included in the iMac firmware. While some parts are missing, it's way better to use this code and patch the missing bits.

How it works​

Turbo Overclocking allows the CPU to reach core multipliers above its rated Processor Base Frequency.
The number of Turbo Bins (Intel terminology for a 100MHz multiplier) is fused at manufacture time, and the CPU will not run above its fused value.
For Sandy Bridge non-K cpus Turbo Overclocking is limited to 4 Bins above the Processor Base Frequency.
For -K CPUs the number of Bins is unlimited. For Xeon CPUs the number of Bins is 0.
Also, on standard setup the Turbo Bins depend on the number of active physical cores: 4 Bins are used when only one core is used, 3 Bins when 2 cores are used, 2 Bins when 3 cores are used and 1 Bin when all 4 cores are used.
As an example, an i7-2600 CPU with Processor Base Frequency rated at 3400 MHz will Turbo run at 3500 MHz when 4 cores are used and at 3800 MHz when just one core is used.

This patch allow independently setting the Max Core multipliers depending on the number of physical cores used. You will mostly always set the four max core multipliers to the same value.

For ease of use I have provided two version of the patch, one sets the 4 max multipliers to x40, and another that sets them to x44, otherwise they are identical. You can also look inside the patch and set your own max multiplier values.

This patch also works for non-K cpus. Setting the max multiplier to the same value on a non-K cpu will allow all four cores to run 4 Bins above the Processor Base Frequency (instead of just one Bin). This means an i7-2600 can run 4 cores at 3800 MHz instead of 3500 MHz without the patch, a nice ~8% speed increase in multi-core use.
For non-K cpus you can set the max multiplier higher than the cpu supports, but it will not run faster than the fused value, so you can use the x40 patch for non-K cpus safely.

Expected speed increase​

Sandy Bridge is one of the most overclock-friendly CPUs intel made, the -K CPUs can reach above 5GHz when properly cooled and setup. In an iMac 12,2 with standard cooling 4x44 up to 4x46 speeds have been tested and proved stable without the need of overvolting the CPU (We are lucky that the iGPU is not used in the iMac).
Real world speed increase can range from around 8% for an i7-2600 when using 4 cores, up to above 20% when using an i7-2700K. Higher speed ram may also help there.

Possible improvements​

While setting the max multipliers at firmware level is not ideal, it would be possible to develop an UEFI firmware module that reads values from NVRAM and sets them at runtime, but I currently have no time for it.

I have also tried to delay setup of the max multipliers after bios init, to see if they could be setup using an Opencore module, but for some reason Intel put a watchdog timer that resets the PCH if all power management of the CPU is not done early enough after boot. This means the max multipliers have to be setup at a very precise moment during EFI boot.

Notes​

Many thanks to all people who have helped testing this!!!

• Tested on iMac 12,2 with bootrom 87.0.0.0.0.
• May work on other macs with Sandy Bridge CPUs, pending to be tested.
• Not all CPUs are made the same. To be sure yours is stable after patching, run a stress/torture test, using Prime95 or similar, around one hour to be sure the iMac does not hang. Keep an eye on temperatures, according to Intel TJuncMax for Sandy Bridge is 98°C, so I'd try to keep temps in the low 80s at most.

​

How to apply patch​

I have started a Github repository to better keep track of firmware patches, this patch is there.

 

[Maggehagge]

I would love if someone would help me find out on how to do this on Imac 11,x because there is actually a unlocked CPU for those aswell. The i7-875K. Not widely known but it exists.

What tools do you use to find your findings? I myself used Ghidra and some plugins but i cant really understand to how you came up with where you should change the code and what you were looking for. Imac 11,x doesnt use same platform (P55 vs Z68) but it should be not too different is my amateur guess regarding how Turbo works.

Did you use IFRextract to guide you perhaps?

Maybe it's too advanced to explain or maybe its not but if you dont have to reverse engineer several functions/trees then it would be nice with some pointers on what to look after.

Great work anyways. You and many others have now cemented the Unibody Imac's as arguably the best Intel Imac's to buy if you can tinker!

Edit: Maybe i am hijacking this thread by talking about Imac 11,x? Just let me know and i will start a new thread or maybe this could cover both imac 11 and 12 since both are very popular with the tinkering community and the 11,x has a benefit of being compatible with more GPUs.

 

[Maggehagge]

I think i found one piece of the 2 part puzzle

qoute from m0bil's patch:
# Configure PPM Policy -> Per core max multipliers (0x28 = 40)
# Leftmost "0x28" value is 4-core max multiplier, rightmost is 1-core max multiplier.
A4F2909C-5E2A-438A-91BA-272B0923049A 10 P:FF9068010000488B056DC40100:C70128282828488B056DC40100

In imac 12,x the code for that looks like this:

And in Imac 11,x i found this part which is the only one that is matching so closely that i think it must be the same. If you look above both instructions it looks very similar aswell. I want to test it but i dont have a i7-875k yet and takes a month to get one so please if anyone wants to test do it BUT AT YOUR OWN RISK! Be prepared to rescue with clip/desoldering of flash chip. Also if someone that actually know what they are doing (not me ) could verify my findings is appreciated

Imac 11,x:

I dont know if you can just change it to the same code as m0bil did in Imac 12,x (C70128282828488B056DC40100) where 28 is the hex value of 40=40x multiplier or if it has to look different.

Finding the "enable turbo overclocking" puzzle piece seems not as straight forward because of the differences. I think i have located some possible areas but since i dont know what im doing or looking at mostly, i cant take a guess even.

@m0bil Is the enable part even needed if you have a unlocked CPU? Is it needed only on sandy bridge? If i remember, turbo is a bit more unrefined in Nehalem CPU's

 

[m0bil]

I would love if someone would help me find out on how to do this on Imac 11,x because there is actually a unlocked CPU for those aswell. The i7-875K. Not widely known but it exists.

What tools do you use to find your findings? I myself used Ghidra and some plugins but i cant really understand to how you came up with where you should change the code and what you were looking for. Imac 11,x doesnt use same platform (P55 vs Z68) but it should be not too different is my amateur guess regarding how Turbo works.

Did you use IFRextract to guide you perhaps?

Maybe it's too advanced to explain or maybe its not but if you dont have to reverse engineer several functions/trees then it would be nice with some pointers on what to look after.

Great work anyways. You and many others have now cemented the Unibody Imac's as arguably the best Intel Imac's to buy if you can tinker!

Edit: Maybe i am hijacking this thread by talking about Imac 11,x? Just let me know and i will start a new thread or maybe this could cover both imac 11 and 12 since both are very popular with the tinkering community and the 11,x has a benefit of being compatible with more GPUs.

I use IDA Pro with the UEFI_RETOOL plugin for UEFI reversing.
You should gain good knowledge of how EDK2 works, calling conventions and structures, specially for the PEI boot phase that is where the low-level stuff is setup.
I once tried IFR extractor, but while IFR data is present, the iMac bios does not use it. Most of the configuration values corresponding to bios settings are just hard-coded inside firmware.

Some Intel reference code can be found online, like here, while not 100% the same as the one used by Apple, sometimes it gives good clues at how things work and what kind of structures you should look for.
Coreboot sources, while completely different, are also sometimes useful to see how boot process works.
You also need to take deep look at Intel tech manuals for the CPU and PCH, take a look at MSR registers and PCH registers to see how they are used to setup overclocking. Sadly not all info is always included in the public manuals.

Taking a look to same CPU and PCH bios from other OEM vendors that allow overclocking can be also useful, but depending on vendor the bios structure can be different. Intel provided vendors with "reference code" and they adapted it to their needs. Apple essentially removed all hooks for custom configuration of power/ram/cpu settings and hardcoded them into bios.

I never took a look at how to overclock Nehalem CPUs, probably is not that different from Sandy Bridge (I know BCLK can be overclocked there, not just the CPU multipliers), but my guess is that you'll need to enable Turbo Overclocking code, the same as in Sandy Bridge. If you take a look at other OEM manuals for bios configuration, you can make an idea of what needs to be configured. Also maybe you can test without i7-875k, in Sandy Bridge you can slightly overclock a non-k cpu to test if code works.

 

[Maggehagge]

I use IDA Pro with the UEFI_RETOOL plugin for UEFI reversing.
You should gain good knowledge of how EDK2 works, calling conventions and structures, specially for the PEI boot phase that is where the low-level stuff is setup.
I once tried IFR extractor, but while IFR data is present, the iMac bios does not use it. Most of the configuration values corresponding to bios settings are just hard-coded inside firmware.

Some Intel reference code can be found online, like here, while not 100% the same as the one used by Apple, sometimes it gives good clues at how things work and what kind of structures you should look for.
Coreboot sources, while completely different, are also sometimes useful to see how boot process works.
You also need to take deep look at Intel tech manuals for the CPU and PCH, take a look at MSR registers and PCH registers to see how they are used to setup overclocking. Sadly not all info is always included in the public manuals.

Taking a look to same CPU and PCH bios from other OEM vendors that allow overclocking can be also useful, but depending on vendor the bios structure can be different. Intel provided vendors with "reference code" and they adapted it to their needs. Apple essentially removed all hooks for custom configuration of power/ram/cpu settings and hardcoded them into bios.

I never took a look at how to overclock Nehalem CPUs, probably is not that different from Sandy Bridge (I know BCLK can be overclocked there, not just the CPU multipliers), but my guess is that you'll need to enable Turbo Overclocking code, the same as in Sandy Bridge. If you take a look at other OEM manuals for bios configuration, you can make an idea of what needs to be configured. Also maybe you can test without i7-875k, in Sandy Bridge you can slightly overclock a non-k cpu to test if code works.

I have already loked into other vendors UEFIs a bit. i tried with a P67 asrock with uefi but since P55 never existed with EFI, the possibilities are slim. I just started using IDA with efiXplorer plugin. didnt get retool to work and i think efiXplorer is more recent?

Intel datasheets were at hand but i simply dont have the knowledge about MSR. i know what they do and that they exist but thats about it.

Nehalem always allows turbo overclocking by one bin if i recall correctly. + x1. So while the testing might show something, I rather wait on my 875k.

Anyhow, i think i have to give up on this. I have ordered the 875k but it will be here in a month or so, until then there isnt much i can do. Hope someone more knowledgable than me want to continue this. I can send all my files if someone wants them. just message me.

 

[Lpumg]

Can this patch (iMac 12.x Turbo Overclocking) be applied to the i7 2600k processor?

 

[Lpumg]

Can this patch (iMac 12.x Turbo Overclocking) be applied to the i7 2600k processor?

 

[Cloud9]

Can this patch (iMac 12.x Turbo Overclocking) be applied to the i7 2600k processor?

In his post he stated the patch can be applied to non-k cpus so the standing assumption is it can be applied to the 2600k also since it was not singled out. Try it, post results.

 

[T2U]

Hello, first of all, I would like to thank everyone who contributed to this incredible work!

Currently, I have successfully applied and tested without any issues the following patches: Flash Protection Bypass, Igpu Disable, and DDR Frequency Limit .

My memory is now operating at 1600 MHz, and the Geekbench scores have improved by 3% in single-core and 6% in multicore performance. Interestingly, Valley benchmark stayed almost the same... maybe its GPU limited...

For any newcomers reading this post, I followed this video guide to use the CHA341 and remove the Flash Protection:

The next step will be the overclocking patch.

 

[T2U]

I applied the turbo overclock patch with a modified file for 42x (0x2A).


13% gain single-core and 17% in multicore performance on geekbench on my i7-2600 "non k"

System seems to be stable, but for that matter I need more testing time.

ThrottleStop reported PKg Power around 80w during Prime95 4c/8t (96.1w peak).


Before the patch I manage to reach just 65w... Maybe the original 21.5 bios had some sort of cap that forced the processor to downclock. Maybe thats why my results are above expected.


Throttling is an issue. With single/ dual core tasks the system sustains 4.0 to 4.2Ghz speeds, but with 4 cores within a couple of minutes the multiplier goes down... with fans at full blast and room temperature @24 oC the cores reached 85 oC (peak of 91 oC)

 

[ChrizLoud]

I applied the turbo overclock patch with a modified file for 42x (0x2A).


13% gain single-core and 17% in multicore performance on geekbench on my i7-2600 "non k"

System seems to be stable, but for that matter I need more testing time.

ThrottleStop reported PKg Power around 80w during Prime95 4c/8t (96.1w peak).


Before the patch I manage to reach just 65w... Maybe the original 21.5 bios had some sort of cap that forced the processor to downclock. Maybe thats why my results are above expected.


Throttling is an issue. With single/ dual core tasks the system sustains 4.0 to 4.2Ghz speeds, but with 4 cores within a couple of minutes the multiplier goes down... with fans at full blast and room temperature @24 oC the cores reached 85 oC (peak of 91 oC)

With all threads active 3.9 Ghz is max. This is not throttling its normal behavior. Single core is 4.2 Ghz. Here is my 2600s in all thread test with intel power gadget with patch set to x46 after 30 minutes. Maybe you can try to apply new thermal paste (mine is stock 2011 thermal paste tough).

I used same patch set to x46 to my other 27" 2011 with 2700K but that runs hotter since ofc its pushing it harder at 4.6 ghz where the 2600s is not using unlimited multiplier and maxes out to 4.2 ghz.

 

[kocoman]

Can the uefi_retool script look at system agent sa and pei modules? Thx

 

[Dirty Jermz]

Hello everyone.

I have an iMac 12,2 and have recently bought a 2700k, 32gb (4x8gb) 1866 RAM and a GTX1070. The plan was to apply all the patches @m0bil has put together by compiling them and flashing them all to the chip in one go while everything is out.

I'm having trouble when it comes to flashing the eeprom using the CH341a Programmer (the black one).

I've tried using Asprogrammer but that produces an error when trying to read or ID the chip.

When using the CH341a program all the options become greyed out when it is all connected. Its almost like the program crashes as I have to unplug the USB, then disconnect the chip and only after plugging the USB back in do all the functions become selectable again.

I've tried reseating the clip many many times... spent a good couple of hours trying to get it to work from reinstalling drivers, trying different versions of the programs. Nothing seems to work.

I'm thinking of buying some chips and flashing one of those, then replace the chip on the board with it. But I'm not sure if this will work either.

Can anyone help?

Edit: The logic board is completely disconnected from the iMac, as I've replaced the CPU and GPU... don't know if my problems are caused because it isn't all connected and plugged in (but not powered on)

 

[Terros]

iMac 12,x DDR3 Frequency Limit disable

This firmware patch removes the 1333 MHz frequency limit Apple hardcoded in bios settings.
Faster DDR3 modules did work on iMac, but their speed was limited to 1333 MHz.
This patch removes such limit, allowing the use of 1600/1867/2133 MHz compatible modules at full speed.

Many thanks to @Ausdauersportler & @dfranetic for help in testing this!

Notes:

• Tested on iMac 12,x with bootrom 87.0.0.0.0.
• Not all ram modules tested seem to work. If they do not work at 1333 MHz for a start, they will probably not work at higher speeds. Please report if you get 1867/2133 modules to work at full speed with this patch.
• The "sweet spot" for Sandy Bridge seems 1600 MHz. Faster modules will bring very little (if any) performance increase.

I have started a Github repository to better keep track of firmware patches, this patch is there.

Got myself a 32gb batch of Kingston Hyperx Impact 8GB 1866MHz Ddr3l Cl11 Sodimm 1.35v HX318LS11IB/8 sticks

They only run at 1600Mhz with the Frequency Disabled patched. Triple confirmed.

i7 2700k, 1070

Thoughts @m0bil ?

 

[Terros]

Also seeing the 2700k CPU heavily underclock itself under load, down to 1600mhz at 60w but temps aren't higher than 60-62'c?

 

[m0bil]

Also seeing the 2700k CPU heavily underclock itself under load, down to 1600mhz at 60w but temps aren't higher than 60-62'c?

Probably a temperature sensor or display connection problem. The SMC will throttle the CPU to its lower multiplier (x16) if any temp values from sensors are missing.

 

[Terros]

Probably a temperature sensor or display connection problem. The SMC will throttle the CPU to its lower multiplier (x16) if any temp values from sensors are missing.

I can't seem to find anything. It seems to happen sporadically. All values in Hwinfo64 (windows) and macfancontrol show values. It just happens randomly and random games. Nothing sticks out temp wise at all either.

When you say Display Connection problem, do you mean the actual monitor?

 

[countryhick]

Just wanted to thank @m0bil @Ausdauersportler @internetzel and anyone else who's tested and contributed in the development of these mods.
I get a real kick out of keeping these machines out of the trash and still functioning well as daily users ❌🚮❌
As a complete novice when it comes to any kind of flashing etc.. It's taken quite a few hours of reading and scouring these threads to learn how to flash and patch ROMs, but I've now successfully patched the flash-protection-bypass and the ddr3-freq-limit-disable ☺️ as well as done a couple of GPU upgrades thanks to the guys in that thread. 🍻
Thanks again guys!!!
Andrew

 

[MacAfricaKE]

iMac 12,2 & 12,1 UEFI Windows audio ACPI patch (64bit PCIe address space enabler)

This patch modifies firmware ACPI tables to enable 64bit PCIe address space. This fixes the well known UEFI Windows audio driver error, as well as other potential driver issues in UEFI Windows.

To apply use non-NE UEFITool 0.28, load your firmware file and replace "as is" volume with guid 7E374E25-8E01-4FEE-87F2-390C23C606CD with the .ffs file included below.

View attachment 2139378

Since ACPI tables are platform dependent there are .ffs for the iMac 12,2 27'' (tested working) and iMac 12,1 21'' (not yet tested but should work), make sure to use the one intended for your model.
I have also included original DSDT files as well as the modified version.


In case you want to make your own ACPI mods, firmware volume 7E374E25-8E01-4FEE-87F2-390C23C606CD holds a Tiano compressed blob of ACPI tables, stored one after each other with a 4 bytes header prefix on each table. UEFITool can be used to extract and replace individual tables by right clicking in the "Raw section" (each Raw section is a table) inside the compressed section and using "Extract body..." or "Replace body..." options (that will skip or rebuild the required 4 bytes header as well as handle Tiano compression).
The extracted raw data will be the selected ACPI table in AML (ACPI Machine Language) format. You can use MaciASL to convert and edit them.

Tested it on my 2011 iMac 21.5" with the Patch for the 21.5" however if i disable the Patch in Open Core Legacy Patcher windows will give a blue screen with error code: APCI_BIOS_ERROR and reboots and when booting Mac it Gets Stuck throwing a APCI not found Error. will edit and attach images shortly

 

[m0bil]

When you say Display Connection problem, do you mean the actual monitor?

No, I mean the internal display. When the SMC can't get the internal display temp sensor data it also throttles CPU to x16.

 

[m0bil]

Tested it on my 2011 iMac 21.5" with the Patch for the 21.5" however if i disable the Patch in Open Core Legacy Patcher windows will give a blue screen with error code: APCI_BIOS_ERROR and reboots and when booting Mac it Gets Stuck throwing a APCI not found Error. will edit and attach images shortly

First, try to boot windows without OCLP: do a NVRAM reset and hold option/alt to boot from the windows volume.

If that also fails, send me by PM both you unpatched bios and the patched one so I can take a look.

 

[RaikoBR]

Has anyone tested the Add CPUID on iMac 14,2 or 14,1?

 

[Terros]

With all threads active 3.9 Ghz is max. This is not throttling its normal behavior. Single core is 4.2 Ghz. Here is my 2600s in all thread test with intel power gadget with patch set to x46 after 30 minutes. Maybe you can try to apply new thermal paste (mine is stock 2011 thermal paste tough).

I used same patch set to x46 to my other 27" 2011 with 2700K but that runs hotter since ofc its pushing it harder at 4.6 ghz where the 2600s is not using unlimited multiplier and maxes out to 4.2 ghz.

View attachment 2353550

Mind adding the 4.6ghz file here? or @m0bil can you upload it into the Github repo?

 

[Jali]

iMac 12,2 & 12,1 UEFI Windows audio ACPI patch (64bit PCIe address space enabler)

i need to learn how to implement my modified.aml into the Firmware File System for a permanent Windows audio ACPI patch. the MBP101 is my favorite laptop and i should document all the interesting things somewhere (GT 650M + igdkmd64.sys).

for now, i enable testsigning in Windows and load my modified table.

See attached for my files that I created and use for Large Memory in Windows 10.

BaseBoard Product Mac-C3EC7CD22292981F
BaseBoard Version MacBookPro10,1

Bcdedit.exe -set TESTSIGNING ON
asl.exe /loadtable dsdt-modified.aml

And to revert and delete overridden tables :
Bcdedit.exe -set TESTSIGNING OFF
asl /loadtable -d dsdt-modified.aml


to do:
learn how to implement into firmware as a permanent resolution.
learn if it is possible to fix the driver on Cirrus Logic CS4206B (AB 40) to recognize headphone+microphone (TRRS).

please reach out with questions or anything related to this model : )

edit 10/30/2024:

 

[Jali]

Hi @dosdude1 - If it's okay to ask, is the firmware driver/mod/patch which you used for this available anywhere?

I've tried disabling the dGPU on a MacBookPro10,1 using NVRAM FA4CE28D-B62F-4C99-9CC3-6815686E30F9:gpu-power-prefs=1, and also tried using NVRAM GfxMode=0 and GfxMode=4. These all do seemingly disable it, but the machine is unbootable. I've been assuming the issue is _something like_: the machine powers up in dGPU always, for EFI and onwards into the next OS; and it is only in macOS that it swaps over to using the iGPU for low power features. Therefore, if you disable the dGPU early, the machine won't start, or rather hangs very early in the boot sequence. I am happy to have any of this corrected/clarified, by anybody who knows better.

here's how-to disable the dGPU (GT 650M). i use debian 11 and windows (UEFI install).

git clone https://github.com/0xbb/gpu-switch.git && cd gpu-switch
sudo chmod +x gpu-switch
sudo ./gpu-switch -i
sudo systemctl poweroff

verify iGPU is active:

glxinfo | grep -i "opengl renderer"
sudo cat /sys/kernel/debug/vgaswitcheroo/switch
0:IGD:+:Pwr:0000:00:02.0
1:DIS: :Pwr:0000:01:00.0
2:DIS-Audio: :DynOff:0000:01:00.1

only the root user is able to power off with vgaswitcheroo:

su -
echo OFF > /sys/kernel/debug/vgaswitcheroo/switch
cat /sys/kernel/debug/vgaswitcheroo/switch
0:IGD:+:Pwr:0000:00:02.0
1:DIS: :Off:0000:01:00.0
2:DIS-Audio: :DynOff:0000:01:00.1

and a custom grub entry example:

menuentry 'WIN' {
insmod part_gpt
insmod fat
outb 0x7c2 1
outb 0x7d4 0x28
outb 0x7c2 2
outb 0x7d4 0x10
outb 0x7c2 2
outb 0x7d4 0x40

outb 0x7c2 1
outb 0x7d4 0x50
outb 0x7c2 0
outb 0x7d4 0x50
search --fs-uuid --no-floppy --set=root XXXX-XXXX
chainloader (${root})/EFI/Microsoft/Boot/bootmgfw.efi
}