Skip to content

Constructing

Ausdauersportler edited this page Oct 23, 2024 · 30 revisions

We will step by step construct an EFI BIOS for the W5170M card. This is an AMD Venus GPU and the only Apple Mac which has used this type of GPU is the Apple MacBookPro 15" Mid 2015. You need to get a recent firmware update or you may fetch the firmware from such a system using the app RomTool.

Get the EG2, EDIDParser, and CoreEG2 parts from an suitable Apple Mac (efi module)

Use the UEFITool-NE, open the firmware dump and search for the ASCII string ATY (which will occur within the particular module several times, and hopefully only in a single module). Another indicator is the size of approximately 185K bytes. Some firmware files contain several graphics modules because the corresponding Apple models were offered (BTO) with different graphics options, like the iMac 2014 and 2015 models.

Finding the Apple video BIOS

Select the PE32 image section and right click Extract Body, the section will be saved with extension efi. I have already done this and prepared a file for this card and uploaded it in advance. Download the file, save it and open it in the hex editor Hex Fiend.

Now find frame buffer name and change if with fantasy name to force the usage of the generic radeon framebuffer, which honors the connector information we changed in the original BIOS in the OBJ_INFO module. Search for text Parent and find in this particular case ATY,RamenParent, the frame buffer is called Ramen.

To avoid any changes in size just select a five letter code like AMDFB and change it to ATY,AMDFBParent. There may be more hits where the original Apple frame buffer name Ramen is used, now search for strings starting with ATY,Ramen and replace with ATY,AMDFB. In this case it will be only a single other occurence. Now rename the file to M370.efi and save it locally, or download M370.efi from this repository.

Changing the frame buffer name

The list of supported device IDs of this driver software is right behind the spot you just found when searching for Parent, it is 20682168 25682768 23682B68, here we have to honor the endian and change byte order. We get the list of 6820 6821 6825 6827 6823 682B. The W5170M has the device-id of 6820, which fits perfectly. If your device ID is missing there you can change one existing entry with your cards ID. This will work only, if the card belongs to the same AMD dGPU family. A prominent example is the M4000 (Venus 682D). To make if work with the very same module modified here just exchange within the file the listed 2B68 with 2D68!

After some investigation Nick [D]vB found out the iMac17,1 versions of the EDIDParser_x64.efi and CoreEG2_x64.efi will work in an optimal way while other versions failed. These modules can be re-used in all EFI BIOS. Files are added to the repository instead of describing the extraction from the iMac17,1 firmware in detail. It follows the same scheme as just described from a different source file.

Compress the EFI module into a compatible EG2 BIOS

The GOP part is a compressed version of a similar EFI module, we want to replace the GOP module from the BIOS with our newly extracted and modified EG2 module. So we have to compress it in the same way using the program EFIrom:

./EfiRom -ec M370.efi -l 0x30000 -f 0x1002 -i 0x6820 -p -o M370-2820-EG2_.rom

This call creates a file named M370-2820-EG2_.rom with device-id 0x6820 and vendor-id 0x1002 . The "-p" argument makes EfiRom create a PCI 2.3 header instead of a PCI 3.0 header. This resulting file can be used to replace the GOP part using the hex editor, again.

While the upper driver is specific to a certain AMD dGPU family, the other two modules will be used in general for all EFI vBIOS versions to be generated in the same form. You can convert the other two EFI modules into compressed BIOS code in the same way (and any other EFI module), i.e.:

./EfiRom -ec EDIDParser_x64.efi -l 0x30000 -f 0x1002 -i 0x6820 -p -o EDIDParser_x64_.rom

./EfiRom -ec CoreEG2_x64.efi -l 0x30000 -f 0x1002 -i 0x6820 -p -o CoreEG2_x64_.rom

When needing this BIOS code for different AMD GPU with a different device-id just change the device-id the in command line or edit the output file in Hex Fiend. In fact the only difference after running EfiRom within the output file is the device-id entry within the BIOS PCI Data Structure (aka body). One can easily spot and change it using Hex Fiend. Since this change does not touch the legacy part no checksum adjustment is needed.

Replace the GOP with the newly created EG2 part using Hex Fiend

This is the most easy exercise we will probably see here within the wiki. First duplicate the GOP BIOS W5170M-GOP.rom and rename it to W5170M-EG2.rom. The art is to choose the correct edit mode (overwrite), open the W5170M-EG2.rom with this overwrite mode and the newly created M370-2820-EG2_.rom in Read-only mode, select all data from the latter file in the editor and copy it to the buffer using the well known command+C, move over to the first file, place the cursor exactly in front of the second part of the BIOS starting with the 55AA (which denotes the beginning of either the legacy or GOP BIOS part) and insert (in overwrite mode) the buffer using command+V.

Replace the GOP BIOS with an Apple EG2 BIOS

Now save the modified file with name W5170M-EG2.rom. You are done with creating an EFI Boot Screen BIOS for this card.

Testing by adding the EDIDParser and CoreEG2 to OpenCore drivers section

There are two ways to test our newly created BIOS.

You can simply add the EFI modules to the driver section of your OpenCore config.plist as shown here:

                <key>Drivers</key>
                <array>
                        <dict>
                                <key>Arguments</key>
                                <string></string>
                                <key>Enabled</key>
                                <true/>
                                <key>Path</key>
                                <string>CoreEG2_x64.efi</string>
                        </dict>
                        <dict>
                                <key>Arguments</key>
                                <string></string>
                                <key>Comment</key>
                                <string></string>
                                <key>Enabled</key>
                                <true/>
                                <key>Path</key>
                                <string>EDIDParser_x64.efi</string>
                        </dict>
                </array>

On boot you will (of course) not be able to force the EFI Boot Screen since both modules are clearly loaded late through OpenCore long after the first disk access and boot disk selection (obviously OpenCore has to reside on the boot disk). But you can check the functionality, the Apple system_profiler should report an EFI BIOS loaded.

Getting the real EFI boot picker functionality on boot by pressing alt/option using an iMac firmware mod

This second method give you the full functionality, but comes at the cost of great work and a firmware modification. As I wrote before the adoption rate is low, but it works great!

For now I will just refer to a post of the guy who (probably found) and published the method. Add the two ffs modules from the EG2 folder as shown in the video of this post or follow the not that complex verbal description.

  1. First update the firmware of your iMac to the known latest version. This version 3 of an ongoing series of posts contain the latest versions for the Apple systems we can modify. Apple stopped with updates when High Sierra went out of software support. So you can easily update your iMac firmware by installing High Sierra on an internal disk an apply all available Apple software updates to High Sierra, possibly the last security update from Summer 2020 will finally do the job.
  2. Now save the most recent firmware using the GRML Flash utility (using flashrom sofwtare). If you follow the guide found on this tool you can also enable software writing (using flashrom) in case you plan to apply more firmware modifications.
  3. Create a copy of the firmware file and keep the unmodified original file. Apply the modifications as described in the video to the copy.
  4. Write the modified firmware back to the system board using a CH341A clip programmer (at least the first write needs a hardware programmer). Apple shut down the software BIOS flashing capability in most Apple Mac systems to fix a security hole.

After installing the W5170M card, flashing the newly EG2 BIOS to the card, the iMac should show an EFI Boot Screen on an external display when pressing alt/option on boot.

C. The third solution would have been to add the EDIDParser_x64_.rom and CoreEG2_x64_.rom in the same way as we just added the EG2 part. One would have to change the Last Image Index of the EG2 part to 0x00, add both parts using the Hex Fiend editor, change the Last Image Index of the real last part now to 0x80, flash the BIOS and we would be ready. Unfortunately the chip on this particular W5170M card and more importantly the BIOS itself is limited to the size of 0x20000 = 131072 bytes. You can cross check the file sizes, this would not work out.

Getting around the 128k (0x20000) size limitation (not really)

In principle you can add all needed firmware modules either to the graphics card firmware or to the iMac/Mac firmware. The modules will be loaded regardless where you save them permanently. Since the iMac firmware modification has no easy software support adding those drivers the the video firmware was the more easy way to follow. But it hit the 128k wall within the graphics firmware, and so we had to make more space.

This is the most difficult (software) part since it needs recalculation of numerous hex addresses within the vBIOS after deleting the VGA support of the legacy part. At the end we got the place to include the other two modules into the first 0x20000 bytes and get an EFI BIOS usable without a firmware modification or OpenCore. This recipe can be found on the page named Deleting the VGA.

Clone this wiki locally