Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

m0bil

macrumors 6502
Sep 29, 2020
436
509
iMac 12,x Turbo Overclocking

This firmware patch enables CPU Turbo Overclocking and allows setting the Max Turbo Multipliers of the CPU.

Background


After working for some months in my own overclocking code, I found out that large parts of the Intel reference code to setup Turbo Overclocking were already included in the iMac firmware. While some parts are missing, it's way better to use this code and patch the missing bits.

How it works

Turbo Overclocking allows the CPU to reach core multipliers above its rated Processor Base Frequency.
The number of Turbo Bins (Intel terminology for a 100MHz multiplier) is fused at manufacture time, and the CPU will not run above its fused value.
For Sandy Bridge non-K cpus Turbo Overclocking is limited to 4 Bins above the Processor Base Frequency.
For -K CPUs the number of Bins is unlimited. For Xeon CPUs the number of Bins is 0.
Also, on standard setup the Turbo Bins depend on the number of active physical cores: 4 Bins are used when only one core is used, 3 Bins when 2 cores are used, 2 Bins when 3 cores are used and 1 Bin when all 4 cores are used.
As an example, an i7-2600 CPU with Processor Base Frequency rated at 3400 MHz will Turbo run at 3500 MHz when 4 cores are used and at 3800 MHz when just one core is used.

This patch allow independently setting the Max Core multipliers depending on the number of physical cores used. You will mostly always set the four max core multipliers to the same value.

For ease of use I have provided two version of the patch, one sets the 4 max multipliers to x40, and another that sets them to x44, otherwise they are identical. You can also look inside the patch and set your own max multiplier values.

This patch also works for non-K cpus. Setting the max multiplier to the same value on a non-K cpu will allow all four cores to run 4 Bins above the Processor Base Frequency (instead of just one Bin). This means an i7-2600 can run 4 cores at 3800 MHz instead of 3500 MHz without the patch, a nice ~8% speed increase in multi-core use.
For non-K cpus you can set the max multiplier higher than the cpu supports, but it will not run faster than the fused value, so you can use the x40 patch for non-K cpus safely.

Expected speed increase​

Sandy Bridge is one of the most overclock-friendly CPUs intel made, the -K CPUs can reach above 5GHz when properly cooled and setup. In an iMac 12,2 with standard cooling 4x44 up to 4x46 speeds have been tested and proved stable without the need of overvolting the CPU (We are lucky that the iGPU is not used in the iMac).
Real world speed increase can range from around 8% for an i7-2600 when using 4 cores, up to above 20% when using an i7-2700K. Higher speed ram may also help there.

Possible improvements​

While setting the max multipliers at firmware level is not ideal, it would be possible to develop an UEFI firmware module that reads values from NVRAM and sets them at runtime, but I currently have no time for it.

I have also tried to delay setup of the max multipliers after bios init, to see if they could be setup using an Opencore module, but for some reason Intel put a watchdog timer that resets the PCH if all power management of the CPU is not done early enough after boot. This means the max multipliers have to be setup at a very precise moment during EFI boot.

Notes​

Many thanks to all people who have helped testing this!!!
  • Tested on iMac 12,2 with bootrom 87.0.0.0.0.
  • May work on other macs with Sandy Bridge CPUs, pending to be tested.
  • Not all CPUs are made the same. To be sure yours is stable after patching, run a stress/torture test, using Prime95 or similar, around one hour to be sure the iMac does not hang. Keep an eye on temperatures, according to Intel TJuncMax for Sandy Bridge is 98°C, so I'd try to keep temps in the low 80s at most.

How to apply patch​

I have started a Github repository to better keep track of firmware patches, this patch is there.
 
Last edited:

Maggehagge

macrumors newbie
Jan 18, 2023
8
4
I would love if someone would help me find out on how to do this on Imac 11,x because there is actually a unlocked CPU for those aswell. The i7-875K. Not widely known but it exists.

What tools do you use to find your findings? I myself used Ghidra and some plugins but i cant really understand to how you came up with where you should change the code and what you were looking for. Imac 11,x doesnt use same platform (P55 vs Z68) but it should be not too different is my amateur guess regarding how Turbo works.

Did you use IFRextract to guide you perhaps?

Maybe it's too advanced to explain or maybe its not but if you dont have to reverse engineer several functions/trees then it would be nice with some pointers on what to look after.

Great work anyways. You and many others have now cemented the Unibody Imac's as arguably the best Intel Imac's to buy if you can tinker!

Edit: Maybe i am hijacking this thread by talking about Imac 11,x? Just let me know and i will start a new thread or maybe this could cover both imac 11 and 12 since both are very popular with the tinkering community and the 11,x has a benefit of being compatible with more GPUs.
 
Last edited:

Maggehagge

macrumors newbie
Jan 18, 2023
8
4
I think i found one piece of the 2 part puzzle

qoute from m0bil's patch:
# Configure PPM Policy -> Per core max multipliers (0x28 = 40)
# Leftmost "0x28" value is 4-core max multiplier, rightmost is 1-core max multiplier.
A4F2909C-5E2A-438A-91BA-272B0923049A 10 P:FF9068010000488B056DC40100:C70128282828488B056DC40100

In imac 12,x the code for that looks like this:
1707476642287.png


And in Imac 11,x i found this part which is the only one that is matching so closely that i think it must be the same. If you look above both instructions it looks very similar aswell. I want to test it but i dont have a i7-875k yet and takes a month to get one so please if anyone wants to test do it BUT AT YOUR OWN RISK! Be prepared to rescue with clip/desoldering of flash chip. Also if someone that actually know what they are doing (not me :p) could verify my findings is appreciated :)

Imac 11,x:
1707476926871.png
I dont know if you can just change it to the same code as m0bil did in Imac 12,x (C70128282828488B056DC40100) where 28 is the hex value of 40=40x multiplier or if it has to look different.

Finding the "enable turbo overclocking" puzzle piece seems not as straight forward because of the differences. I think i have located some possible areas but since i dont know what im doing or looking at mostly, i cant take a guess even.

@m0bil Is the enable part even needed if you have a unlocked CPU? Is it needed only on sandy bridge? If i remember, turbo is a bit more unrefined in Nehalem CPU's
 

m0bil

macrumors 6502
Sep 29, 2020
436
509
I would love if someone would help me find out on how to do this on Imac 11,x because there is actually a unlocked CPU for those aswell. The i7-875K. Not widely known but it exists.

What tools do you use to find your findings? I myself used Ghidra and some plugins but i cant really understand to how you came up with where you should change the code and what you were looking for. Imac 11,x doesnt use same platform (P55 vs Z68) but it should be not too different is my amateur guess regarding how Turbo works.

Did you use IFRextract to guide you perhaps?

Maybe it's too advanced to explain or maybe its not but if you dont have to reverse engineer several functions/trees then it would be nice with some pointers on what to look after.

Great work anyways. You and many others have now cemented the Unibody Imac's as arguably the best Intel Imac's to buy if you can tinker!

Edit: Maybe i am hijacking this thread by talking about Imac 11,x? Just let me know and i will start a new thread or maybe this could cover both imac 11 and 12 since both are very popular with the tinkering community and the 11,x has a benefit of being compatible with more GPUs.

I use IDA Pro with the UEFI_RETOOL plugin for UEFI reversing.
You should gain good knowledge of how EDK2 works, calling conventions and structures, specially for the PEI boot phase that is where the low-level stuff is setup.
I once tried IFR extractor, but while IFR data is present, the iMac bios does not use it. Most of the configuration values corresponding to bios settings are just hard-coded inside firmware.

Some Intel reference code can be found online, like here, while not 100% the same as the one used by Apple, sometimes it gives good clues at how things work and what kind of structures you should look for.
Coreboot sources, while completely different, are also sometimes useful to see how boot process works.
You also need to take deep look at Intel tech manuals for the CPU and PCH, take a look at MSR registers and PCH registers to see how they are used to setup overclocking. Sadly not all info is always included in the public manuals.

Taking a look to same CPU and PCH bios from other OEM vendors that allow overclocking can be also useful, but depending on vendor the bios structure can be different. Intel provided vendors with "reference code" and they adapted it to their needs. Apple essentially removed all hooks for custom configuration of power/ram/cpu settings and hardcoded them into bios.

I never took a look at how to overclock Nehalem CPUs, probably is not that different from Sandy Bridge (I know BCLK can be overclocked there, not just the CPU multipliers), but my guess is that you'll need to enable Turbo Overclocking code, the same as in Sandy Bridge. If you take a look at other OEM manuals for bios configuration, you can make an idea of what needs to be configured. Also maybe you can test without i7-875k, in Sandy Bridge you can slightly overclock a non-k cpu to test if code works.
 
  • Like
Reactions: Maggehagge

Maggehagge

macrumors newbie
Jan 18, 2023
8
4
I use IDA Pro with the UEFI_RETOOL plugin for UEFI reversing.
You should gain good knowledge of how EDK2 works, calling conventions and structures, specially for the PEI boot phase that is where the low-level stuff is setup.
I once tried IFR extractor, but while IFR data is present, the iMac bios does not use it. Most of the configuration values corresponding to bios settings are just hard-coded inside firmware.

Some Intel reference code can be found online, like here, while not 100% the same as the one used by Apple, sometimes it gives good clues at how things work and what kind of structures you should look for.
Coreboot sources, while completely different, are also sometimes useful to see how boot process works.
You also need to take deep look at Intel tech manuals for the CPU and PCH, take a look at MSR registers and PCH registers to see how they are used to setup overclocking. Sadly not all info is always included in the public manuals.

Taking a look to same CPU and PCH bios from other OEM vendors that allow overclocking can be also useful, but depending on vendor the bios structure can be different. Intel provided vendors with "reference code" and they adapted it to their needs. Apple essentially removed all hooks for custom configuration of power/ram/cpu settings and hardcoded them into bios.

I never took a look at how to overclock Nehalem CPUs, probably is not that different from Sandy Bridge (I know BCLK can be overclocked there, not just the CPU multipliers), but my guess is that you'll need to enable Turbo Overclocking code, the same as in Sandy Bridge. If you take a look at other OEM manuals for bios configuration, you can make an idea of what needs to be configured. Also maybe you can test without i7-875k, in Sandy Bridge you can slightly overclock a non-k cpu to test if code works.
I have already loked into other vendors UEFIs a bit. i tried with a P67 asrock with uefi but since P55 never existed with EFI, the possibilities are slim. I just started using IDA with efiXplorer plugin. didnt get retool to work and i think efiXplorer is more recent?

Intel datasheets were at hand but i simply dont have the knowledge about MSR. i know what they do and that they exist but thats about it.

Nehalem always allows turbo overclocking by one bin if i recall correctly. + x1. So while the testing might show something, I rather wait on my 875k.

Anyhow, i think i have to give up on this. I have ordered the 875k but it will be here in a month or so, until then there isnt much i can do. Hope someone more knowledgable than me want to continue this. I can send all my files if someone wants them. just message me.
 

Lpumg

macrumors newbie
Jun 21, 2023
3
0
Can this patch (iMac 12.x Turbo Overclocking) be applied to the i7 2600k processor?
 

Lpumg

macrumors newbie
Jun 21, 2023
3
0
Can this patch (iMac 12.x Turbo Overclocking) be applied to the i7 2600k processor?
 

T2U

macrumors newbie
Nov 14, 2023
5
0
Hello, first of all, I would like to thank everyone who contributed to this incredible work!

Currently, I have successfully applied and tested without any issues the following patches: Flash Protection Bypass, Igpu Disable, and DDR Frequency Limit .

My memory is now operating at 1600 MHz, and the Geekbench scores have improved by 3% in single-core and 6% in multicore performance. Interestingly, Valley benchmark stayed almost the same... maybe its GPU limited...

For any newcomers reading this post, I followed this video guide to use the CHA341 and remove the Flash Protection:



The next step will be the overclocking patch.
 

T2U

macrumors newbie
Nov 14, 2023
5
0
I applied the turbo overclock patch with a modified file for 42x (0x2A).


13% gain single-core and 17% in multicore performance on geekbench on my i7-2600 "non k"

System seems to be stable, but for that matter I need more testing time.

ThrottleStop reported PKg Power around 80w during Prime95 4c/8t (96.1w peak).


Before the patch I manage to reach just 65w... Maybe the original 21.5 bios had some sort of cap that forced the processor to downclock. Maybe thats why my results are above expected.


Throttling is an issue. With single/ dual core tasks the system sustains 4.0 to 4.2Ghz speeds, but with 4 cores within a couple of minutes the multiplier goes down... with fans at full blast and room temperature @24 oC the cores reached 85 oC (peak of 91 oC)
 

ChrizLoud

macrumors member
Feb 11, 2021
57
22
I applied the turbo overclock patch with a modified file for 42x (0x2A).


13% gain single-core and 17% in multicore performance on geekbench on my i7-2600 "non k"

System seems to be stable, but for that matter I need more testing time.

ThrottleStop reported PKg Power around 80w during Prime95 4c/8t (96.1w peak).


Before the patch I manage to reach just 65w... Maybe the original 21.5 bios had some sort of cap that forced the processor to downclock. Maybe thats why my results are above expected.


Throttling is an issue. With single/ dual core tasks the system sustains 4.0 to 4.2Ghz speeds, but with 4 cores within a couple of minutes the multiplier goes down... with fans at full blast and room temperature @24 oC the cores reached 85 oC (peak of 91 oC)
With all threads active 3.9 Ghz is max. This is not throttling its normal behavior. Single core is 4.2 Ghz. Here is my 2600s in all thread test with intel power gadget with patch set to x46 after 30 minutes. Maybe you can try to apply new thermal paste (mine is stock 2011 thermal paste tough).

I used same patch set to x46 to my other 27" 2011 with 2700K but that runs hotter since ofc its pushing it harder at 4.6 ghz where the 2600s is not using unlimited multiplier and maxes out to 4.2 ghz.

Skärmavbild 2024-02-27 kl. 17.58.12.png
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.