The same thing happened when I used another flash drive.
From which point of this method should I proceed, since the GPU has already been flashed? I just want to update vBios to get the brightness control.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
iM 4,1-14,4 iMac 2011 (see more) UEFI Firmware Mod
- Thread starter StephN999
- WikiPost WikiPost
- Start date
- Sort by reaction score
- Status
From which point of this method should I proceed, since the GPU has already been flashed? I just want to update vBios to get the brightness control.
Ok, first problem I think is that iMac does not use the iGPU for display, it uses a mxm dGPU that activates internal display using it's GOP UEFI driver, any idea how to proceed with that ?
soic clip is no problem, I already use that for my tests, and I'm now working on getting debug connector J5100/J6100 working so I can easily both get LPC debug codes and easier (clipless) SPI flash programming.
can you try to find out if the igpu hd2000 is not or is connected to any internal/extrnal ports? and how the machine switches or gmux it (like for macbookpro8,2/macbookpro10,1). i dont have those machines so my research there would be slow.
maybe its discussed in forums? or look broadview or schematics?
if igpu can get an output (int or ext) then maybe libgfxibit would work
in the rom if there is csm /bootcamp mode there may be a vbios. for yours there might be 2 (one for amd and the other maybe for igpu)
iirc some vbios is in the raw file section.
in dmesg the amd show the version string of the vbios being used can search in uefitool like that..
try dl coreboot and run autoport to see if it make any errors
run find-debug.sh in coreboot to see if debug ports exists
have you worked on coreboot with other machines before?
make sure to backup backup your spi full including me and fd and bios region and make copies everywhere. you would need to reflash a lot of times
if somehow the igpu can get output then maybe change it to ivy bridge hd4000 once coreboot working to get ventura/montery to work
sorry i keep editing this post
so if mxm is removed does igpu take over?
maybe there is vbios spi on the mxm card?
for autoport you can enable flashconsole and read back out its logs (and edit out a line if it hangs in SMM init ) to see if the coreboot code runs
Last edited:
I think the iGPU is not connected to any port (would have to check the schematics to be 100% sure, but already took a look in the past and also never saw an iMac use the iGPU for display). Mxm card removed mean no display at all (iMac works using remote access).
While there is a muxer used for target display mode and maybe the external display ports (managed by SMC?), I hope on boot the internal display is driven straight from one of the mxm dGPU ports without need of muxer initialization from the bios/smc.
Since we have an mxm card I think the vbios used for both bootcamp mode and uefi is the vbios stored on the mxm card eeprom (not on the iMac csm bios). This vbios has a "legacy" part and an UEFI part.
Never tried coreboot before (always thought MacOS integration would be very difficult), but often took a look at it's source to see how low level CPU initialization is done to try to enable Ivy Bridge and other CPU features on the iMac.
Thanks for suggestions, will try all them (coreboot/autoport/find-debug.sh) on the following days!
ok
what is the muxer name? i only know of gmux for macbook.. i not use imac before
for amd have to see if just using as its rom works or if it needs splitting. there was some talks in here or some pc mod forums about copying vbios values over etc.. only vbios method is used for amd.. its mostly trial and error (via grub2 serial ft232 dongle (2 kinds).. dont know if you have them in your toolkit yet.
there is also a discord for coreboot if you want to join
there is a few machines i trying put coreboot on (maybe too long to read)
my amd apu desktop pc i put in amd hdmi vbios i can blind boot
for my macbook10,1 it uses nvidia (and hd4000) and i was able to force nvidia only to show up after using vbios for coreboot but i did not like to run like that because the nvidia will eventually fail so i go the igpu route.
for macbook8,2 the amd was already starting to show artifacts so i tried to make it 8,1 / disable dgpu asap. now it runs tianocore fine after lvds force dual mode but sudden reboots that need some spectre_v2 off in linux and the ethernet is missing maybe its related to the dgpu.. anyway thats another topic
osx works when it works but causes wierd panic because of opencore nvram bugs? the versions from big sur is very picky and panics easily because some “ fixed” value stuff is wrong/missing ..will tell you more if you get those panics what things to try
its nice to see some interest
new uefitool after 2 years no release https://github.com/LongSoft/UEFITool/releases/tag/A61
Although not directly related to the topic of this thread, I figured I'd post about this here to see if anybody had any ideas. Recently, I replaced both the CPU and PCH on a 2011 17" MacBook Pro logic board with those from an Ivy Bridge Mid-2012 15" MacBook Pro, upgrading the PCH from the original HM65 chipset (which does not support Ivy Bridge CPUs) to HM77, and the CPU to a Core i7 3720QM. With that done, utilizing an SPI-ROM dump from a MacBookPro9,1 flashed onto the 2011 board, I actually got it to boot, but it has many issues, mainly due to the fact that Apple repurposed many of the GPIO pins of the PCH on the 2012 MBPs. As such, running an unmodified BootROM for a Mid-2012 MBP does not work well (as it, of course, assumes the GPIO pins are connected as they are on a 2012 MBP logic board). Along with other things, the integrated video did not work, so the only way I was able to access the machine and confirm it booted was via Remote Desktop. (The AMD GPU is defective and is fully disabled using DeMux firmware).
With that said, I think the only good solution here is to somehow add support for the newer HM77 PCH, along with of course support for the Ivy Bridge CPU, into the original MacBookPro8,3 BootROM. I have already attempted adding the correct 306A9 CPU microcode, as well as replacing the ME region with ME8.0 (for HM77 chipset), neither of which made any difference. I do plan to look into this more myself, but for now I figured I'd post here to see if anyone else had any ideas. I should also note, that when attempting to boot with the MBP8,3 original BootROM, it seems to kind of work (the optical drive initializes, which means PCH is at least being initialized), but it doesn't chime or POST.
EDIT: I have attached the SPI-ROM dumps of both machines (the MBP8,3 board shown here, as well as the MBP9,1 board I took the CPU and PCH from).
With that said, I think the only good solution here is to somehow add support for the newer HM77 PCH, along with of course support for the Ivy Bridge CPU, into the original MacBookPro8,3 BootROM. I have already attempted adding the correct 306A9 CPU microcode, as well as replacing the ME region with ME8.0 (for HM77 chipset), neither of which made any difference. I do plan to look into this more myself, but for now I figured I'd post here to see if anyone else had any ideas. I should also note, that when attempting to boot with the MBP8,3 original BootROM, it seems to kind of work (the optical drive initializes, which means PCH is at least being initialized), but it doesn't chime or POST.
EDIT: I have attached the SPI-ROM dumps of both machines (the MBP8,3 board shown here, as well as the MBP9,1 board I took the CPU and PCH from).
Last edited:
Awesome work!!
The reason of not POSTing with an IvyBridge CPU I guess is the same as on the iMac 12,2. The MacBookPro8,3 BootROM probably lacks the IB CPU System Agent related initialization code, so it does not recognize the IB cpu steppings and the does not have the IB integrated memory controller and PCIe bus init code. it will try to execute some generic SandyBridge initialization code and hang at some point.
Since you already changed the PCH, it may be easier to try to use the MacBookPro9,1 rom and try to backport the gpio/igpu features, not sure about it.
But if you decide to go on with the MacBookPro8,3 BootROM mod I'd be more than happy to join efforts
Awesome, thanks for the info, that may just be the solution.Awesome work!!
The reason of not POSTing with an IvyBridge CPU I guess is the same as on the iMac 12,2. The MacBookPro8,3 BootROM probably lacks the IB CPU System Agent related initialization code, so it does not recognize the IB cpu steppings and the does not have the IB integrated memory controller and PCIe bus init code. it will try to execute some generic SandyBridge initialization code and hang at some point.
Since you already changed the PCH, it may be easier to try to use the MacBookPro9,1 rom and try to backport the gpio/igpu features, not sure about it.
But if you decide to go on with the MacBookPro8,3 BootROM mod I'd be more than happy to join efforts
Also, one thing to be aware of is that the HM65 and HM/QM67 chipsets do NOT support Ivy Bridge in any capacity. Only HM61 does (with correct BIOS support), which is... Odd. So if the iMac 12,x has HM65/HM67/QM67 (I can’t remember off the top of my head, but I think it does), a PCH replacement will be required in order to get an Ivy Bridge CPU working.
The 2011 iMacs have a Z68 chipset that should support Ivy Bridge (at least the 3770 cpu).
On my tests with updated ME8 and 306A9 microcode, the boot stalls somewhere on the early PEI phase, most probably the MemoryInit module (SEC phase is very short, I have fully disassembled it and there's nothing in it that would prevent IB booting).
Big problem is not having a mean of debug, as I've tried some patching but don't know if either it's working and stalling at a later bios module, or not working at all.
Besides very expensive JTAG equipment I don't have access to, I found there is a "Frank" J5100/J6100 connector on the logic board that routes LPC port 80 debug codes, connecting that to a debug card would be enough to at least know where boot is stalling and make patching way easier. I think this connector is populated in MacBooks, but on the iMac I have to solder it to the logic board, that's what I'm (slowly) working on now...
Last edited:
Yep, the ability to debug is definitely the key here... So there is some sort of debug output on LPC during the early phases of booting? If so, I could definitely get the hardware necessary to read that kind of data (I could also connect the LPC bus to my logic analyzer and potentially use that). The MacBooks do not have this connector soldered, but it's pretty easy to just solder some wires to the correct pins and connect to those. Let me know which hardware I might need, and I'll see if I can acquire it. It looks like Intel ITP-XDP would be the best option, but those are a bit pricey and the software is hard to find. Though, some early production MacBook boards still have the XDP connector soldered that plugs right in to that device (and the pads are there on boards that don't have the connector soldered), so if I could get one it'd be really easy to use.The 2011 iMacs have a Z68 chipset that should support Ivy Bridge (at least the 3770 cpu).
On my tests with updated ME8 and 306A9 microcode, the boot stalls somewhere on the early PEI phase, most probably the MemoryInit module (SEC phase is very short, I have fully disassembled it and there's nothing in it that would prevent IB booting).
Big problem is not having a mean of debug, as I've tried some patching but don't know if either it's working and stalling at a later bios module, or not working at all.
Besides very expensive JTAG equipment I don't have access to, I found there is a "Frank" J5100/J6100 connector on the logic board that routes LPC port 80 debug codes, connecting that to a debug card would be enough to at least know where boot is stalling and make patching way easier. I think this connector is populated in MacBooks, but on the iMac I have to solder it to the logic board, that's what I'm (slowly) working on now...
Last edited:
should just usr coreboot /tianocore that bypasses all the apple efi bios checks/asserts/hangs. i can help with the part after (dsdt/nvram etc) mines ok in mbp8,2 mbp10,1 both disabled dgpu
I was considering this, and probably will try. Do you have your CoreBoot sources/config for those systems? Should be easily adaptable to my upgraded 8,3.
my sources is unorganized but i can tell you what to fix and problems i encountoured .. what is different in 8,3? i only know about 8,2 and 8,1.. not sure if 8,3 need the dual lvds patch thats why i ask.. also i havent try osx on it yet because the max hd3000 wont run well with newer osx but ok for linux machines.. then for thunderbolt support i think you would need opencore. i partially fixed thunderbolt on mbp10,1 but not on 8,x yet havent look. the ch1p guy have an 8,x i think but it need the lvds freq fix in the ads file b4 else screen not work.. drives dual link as single or vice versa i forgot. then some add/changes to early_init.c to set gmux and reenable the pci bridge for thunderbolt. plus the soic is at the left palmrest so reflashing is a chore, but i make a hole on mines. its also best to have a ft232 (2 versions) one for coreboot usb logs (untested on 8,x, ok for 10,1 if disable xhci i think on the right hand usb), then the other ft232H or something (one chip is square purple, one is reactangle chip) the other for grub ft232.mod debug at 9600 bps. I haven't try the older version osx on it yet I am not sure if it can work with libgfxinit or need vbios (can't do dual link patch), the hd4000 have assert panic bug that need vbios instead of libgfxinit to work.
I use thunderbolt for boot hdd because with the msata to sata adapters I get timeouts when using ssd/sshd/black2. (more with retail bios and less with coreboot, but still unsolved)
I just use the 5 io to goggle the gmux to switch dcc for internal to panel
iirc the dgpu is by default off so I didn't need touch it with gmux
I need edit the below to add the gmux stuff
(so there are 2 things to get correct, 1st is mux and the 2nd tricky is the lvds dual channel detected wrong, the screen would just be black (I broke my backlight via liquid spill so I am using external led backlight strip and I can see the difference when the display is init by gmux but no lvds signal sent because its wrong type being sent)
there is 10,1 also in the links inside with gmux stuff but my 8,2 is broken dgpu
I usually dl the tgz and only copy the files listed into a current coreboot clone then see 1st lesson to make crossgcc-i386
the lvds fix (not sure if it apply to your 8,3 as i don't have any info on that but my panel is 1440x900
95_000_000; 88_750_000 (the cbmem would show it detected lower theshhold, so I just set the 95_000_000 to 95_000 etc
there is linux kernel args to lvds_channel_mode to for blind boot if need fix something while the ads file above is not fixed yet
| https://github.com/coreboot/libgfxi...3baf005/common/hw-gfx-gma-config.ads.template |
| LVDS_Dual_Threshold : constant := 95_000_000; |
the tianocore(should use upstream, mrchromebox one might not init the video/dsdt/ec fixes I can tell you after)
ok i am mixing up between mbp10,1 and mbp8,2.. anyway i will reply more if I see a reply
also grub2 need a patch to add complier flag else it hangs as payload
Last edited:
the retail bios is very easy to hang it with missing files and with no debug to why thats why I switch and learn with coreboot / tianocore instead (it hang when I am removing the efi-properties-tree.dxe file ..but opencore can inject/read back from linux)The 2011 iMacs have a Z68 chipset that should support Ivy Bridge (at least the 3770 cpu).
On my tests with updated ME8 and 306A9 microcode, the boot stalls somewhere on the early PEI phase, most probably the MemoryInit module (SEC phase is very short, I have fully disassembled it and there's nothing in it that would prevent IB booting).
Big problem is not having a mean of debug, as I've tried some patching but don't know if either it's working and stalling at a later bios module, or not working at all.
Besides very expensive JTAG equipment I don't have access to, I found there is a "Frank" J5100/J6100 connector on the logic board that routes LPC port 80 debug codes, connecting that to a debug card would be enough to at least know where boot is stalling and make patching way easier. I think this connector is populated in MacBooks, but on the iMac I have to solder it to the logic board, that's what I'm (slowly) working on now...
but for a imac I find it hard to disassemble and reassemble many times without breaking flex stuff
Hi! I have no coding experience like you guys but I'm VERY interested in helping you guys to enable a Ivy Bridge upgrade to our 2011 iMacs and possibly enable slightly faster RAM speeds and, most importantly, better Ventura support. I have 4 iMacs that would love to endure an even longer lifecycle.
Tell me what you need (parts, etc) and I will try to arrange with you guys!
Tell me what you need (parts, etc) and I will try to arrange with you guys!
you want try coreboot/tianocore? I have all the edits you need to do and commands to run (but for imac is a TRY.. because I don't know if it will work or not I don't have imac only macbookpro)
you would need a soic clip and ch341/pi and make sure it can backup your flash first
Yes, we would like to try this. What do you need to provide a working firmware replacement?
Edit: I will step back, first help @dosdude1 finish his project.
Last edited:
I’ve been working on getting CoreBoot built for the MBP8,1 (just to test and make sure everything works as intended before modifying for my upgraded 8,3), but I can’t get it to display any video (though it seems to be POSTing). I’ve tried with libgfxinit, as well as using the iGPU VBIOS extracted from the original ROM, but still nothing. Just a black screen with backlight on. I did also build with ME region (clean) and flash descriptor region extracted from original MBP8,1 ROM as well.
Its the lvds is detected wrong by coreboot.. but I don't think they will fix the bug
its detected as
95_000_000; 88_750_000
nano 3rdparty/libgfxinit/common/ironlake//hw-gfx-gma-pch-lvds.adb
if you can run cbmem in grub2 (and see the gfxiinit detect 88_750_000, which is less than 9500000 so it runs single link, you can force it run dual link use edit 95_000 , need patch else hangs, and ft232 serial (its built in cbmemx or something)
LVDS_Dual_Threshold : constant := 95_000_000;
change to lower to force deteect
sorry I am messy writing.. I wrote this b4 in post 89 above here
you can force linux use dual lvds in the i915 parms in boot args and u see linux boot
if succesufy pelase write github your own host and put it for others so don't have to go thru blank screen and hard to reflash because SOIC is at top of keyboard.
please give my method a try and if sucessful more people trust you here than me they think i am insane
i work for over 7 years figure it out
just use 95_000 (replace) and it will *force dual link* in the ads file
recomplie and flash
don't need touch ME
restore your original me before you lose it
the screen is single link but for some reason it needs dual link to work
i tried to edit other logic code in the ads but it does not work for some reason.. there is some && || stuff
so just change the lvds threshold to lower than 88_750_000 then it will force it
i am at discord in coreboot channel if you need look for me
Last edited:
I'll try that, but it shouldn't make a difference if not using libgfxinit (but using the VBIOS instead), correct? I've got the machine's original BootROM backed up, so I won't lose anything.
if you are able to look at cbmem log, you can see the lvds panel detect the resolution 1440x900 but no output. (at first i thought it was gmux problem, but I saw the screen gone from white to black (I took out the backlight because the ic driver burnt out I think, and I put in 2 strip led I brought at ebay) its because for some reason the panel need dual link forced in order to show a image. the 88someHZ is near 95someHZ but is not enough for libgfxinit to trigger it into dual mode. I found it out when I use linux boot parameters to force dual link and I see the screen after the i915 initalized. If you are able to boot linux via grub2 (patched), with ft232 serial dongle, I can give you the boot args to try
With dual-link LVDS mode forced, this is all it does. Just a white line at the top of the screen. Keep in mind this is a 13” MacBookPro8,1, so it does not have a dual-link screen.
Attachments
does it use gmux dual gpu? you using libgfxinit? what payload are you using? if grub2 payload it need a patch first else it hangs?
so its different in dual vs not changing the ads file? this machine have your solder mods? does it show screen in retail bios? does caps lock toggle off and on or external usb keyboard connected can toggle caps lock?
the line is maybe grub2 hanging but i dunno your payload or what u using libgfxinit
you can try get flashconsole log to see if panel resolution is detected and if it jumped to payload
or usb ft232 logging (try find_debug.sh script in the utils dir) I didn't try which port for macbookpro8
(the macbookpro10,1 its on the right side usb with laptop face you normal use), but need disable usb 3.0 in devicetree.cb
edit
i think the ch1p builds is using mbp8,2 which have gmux. you might have to remove the code with gmux in devicetree.cb and other place and also there is a some early_init.c iirc that inside set to disable the dgpu or enable and also accidently disable the root hub switch (due to some logic error that applied to the levono where it was copied from and that when apply will cause thunderbolt to not init properly. i have fix for that and efi-properties- injection fix for eprom thunderboltdrom later if you get to that part too
so its different in dual vs not changing the ads file? this machine have your solder mods? does it show screen in retail bios? does caps lock toggle off and on or external usb keyboard connected can toggle caps lock?
the line is maybe grub2 hanging but i dunno your payload or what u using libgfxinit
you can try get flashconsole log to see if panel resolution is detected and if it jumped to payload
or usb ft232 logging (try find_debug.sh script in the utils dir) I didn't try which port for macbookpro8
(the macbookpro10,1 its on the right side usb with laptop face you normal use), but need disable usb 3.0 in devicetree.cb
edit
i think the ch1p builds is using mbp8,2 which have gmux. you might have to remove the code with gmux in devicetree.cb and other place and also there is a some early_init.c iirc that inside set to disable the dgpu or enable and also accidently disable the root hub switch (due to some logic error that applied to the levono where it was copied from and that when apply will cause thunderbolt to not init properly. i have fix for that and efi-properties- injection fix for eprom thunderboltdrom later if you get to that part too
Last edited:
this one have a "Remove Firmware lock" maybe same for pr0, pr1 unlock ??
github.com
GitHub - sadponyguerillaboy/Swift-Apple-EFI-Patcher: Apple EFI Patcher written in Swift with Flashrom Integration
Apple EFI Patcher written in Swift with Flashrom Integration - sadponyguerillaboy/Swift-Apple-EFI-Patcher
github.com