Lenovo Y50 with Clover

[RehabMan]

[Guide] Lenovo Y50

Just so you know, not all the framebuffer data is understood.

For example on the HD4000 we commonly need to use 0x1660004 for displays that are dual-link (usually high resolution displays). And we use 0x1660003 for displays that are single link (usually lower resolution displays).

But if you look at 0x01660003 and 0x01660004 you discover that 0003 uses 64MB for BIOS memory, where 0004 uses 32MB for BIOS memory. Clearly a display with less resolution would not need more BIOS memory than a display with more resolution. And it seems also unlikely that BIOS would change the allocation (especially smaller) upon replacing a low resolution screen with a higher resolution screen. One would think the BIOS allocation is fixed and does not depend on the screen that is connected.

And yet we have this situation that 0004 works with dual-link and 0003 does not. It must be some other data.

Being curious, I decided to take a look at it. Besides many other differences in the connector data (01660004 has no external connections), the connector data for LVDS is slightly different:

01660003: 05030000 02000000 30000000
01660004: 05030000 02000000 30020000

Note that the only difference is the '02' instead of '00'. On the hunch that this difference is what makes the connector dual-link, I changed my 4540s configuration (it has 1080p upgraded screen) to use 01660003 instead of the usual 01660004 by using a Clover patch (and injecting ig-platform-id = 01660003). The patch is this:

Name: AppleIntelFramebufferCapri
Find: 05030000 02000000 30000000
Repl: 05030000 02000000 30020000

The find pattern is unique enough to find only the LVDS connector data in the 01660003 framebuffer config.

And... it works. I was able to sucessfully boot with 01660003 injection with this patch and it confirms that the data where we changed 0 to 2 has something to do with dual-link LVDS displays. At least as far as HD4000/Capri is concerned.

I post this here, just to give you an idea of the type of reverse engineering required here.

I still find it interesting that this machine will work with either a 32mb or 64mb BIOS memory, a data value that is often believed to need an exact match.

 

[niceidiot]

[Guide] Lenovo Y50

Probably 0xa2e0008 is the one you want to focus on...

What happens when you take a screen shot with this "distorted" screen showing?

How does the resulting png come out?

http://support.apple.com/en-us/HT201361

Is the BIOS unlock a flash of patched BIOS or is it something else? (eg. something tweaked in UEFI shell?)

Will take a screenshot and post it shortly. I have a hunch that the resulting screenshot will look normal.

The bios is a patched backup image of my bios. I did this in part to remove the wifi whitelist in the event that I want to swap out the unsupported wifi for something that is more OSX friendly.

EDIT: The screenshot looks glorious.

 

[OatmealDome]

[Guide] Lenovo Y50

@RehabMan,

How would we know if the LVDS display use dual-link? Is there a program we can use or some characteristic that can help distinguish between normal and dual link other than dual link is meant to drive high resolutions? If the internal display in UHD models is dual link, perhaps we could also try to change the same byte (0200 0000 3000 0000 -> 0200 0000 3002 0000) you changed in your framebuffer.

(as a side note, Apple seems to reuse the same structure of framebuffers between their graphics drivers... I've seen the same structure when I had to modify "personalities" for the Radeon drivers.)


@niceidiot,

It does look glorious! I notice that the menu bar items in the top left (Apple Menu, the name of the application active, the file menu, etc) is missing, though.

 

[RehabMan]

[Guide] Lenovo Y50

Will take a screenshot and post it shortly. I have a hunch that the resulting screenshot will look normal.

The bios is a patched backup image of my bios. I did this in part to remove the wifi whitelist in the event that I want to swap out the unsupported wifi for something that is more OSX friendly.

EDIT: The screenshot looks glorious.

It makes me wonder if this is a EDID issue? It could be either framebuffer or EDID... I do not have enough knowledge of either to make a judgment call. But I believe that when we've had glitches on the display before (eg. the menubar trash without the "9mb cursor bytes" patch), those glitches show in the screenshot.

 

[RehabMan]

[Guide] Lenovo Y50

@RehabMan,

How would we know if the LVDS display use dual-link? Is there a program we can use or some characteristic that can help distinguish between normal and dual link other than dual link is meant to drive high resolutions? If the internal display in UHD models is dual link, perhaps we could also try to change the same byte (0200 0000 3000 0000 -> 0200 0000 3002 0000) you changed in your framebuffer.

Not sure there is a way to know (maybe in Linux somewhere?). We know on the ProBook because the part# is different... and the dual-link cable itself is noticeably thicker than the single-link cable.

It is always worth a try, just to see what happens...

(as a side note, Apple seems to reuse the same structure of framebuffers between their graphics drivers... I've seen the same structure when I had to modify "personalities" for the Radeon drivers.)


@

Yup. Handy, eh?

 

[OatmealDome]

[Guide] Lenovo Y50

@RehabMan,

Very handy indeed

@niceidiot,

If we want to try changing the byte, AppleIntelFramebufferAzul.sh can't help us with that, as there is no option. (see attached screenshot) We'll need to use a hex editor. I use iHex, which is available for free from the Mac App Store. You will need to open the file /System/Library/Extensions/AppleIntelFramebufferAzul.kext/Contents/MacOS/AppleIntelFramebufferAzul.

To find the framebuffer to patch, press Command + F and search for the framebuffer sequence in reverse.

Example: 0x0a2e0008 -> 08 00 2e 0a

You may find multiple matches. The one you are looking for is not split over multiple sections (for example, this is not the framebuffer: A00E0000 81380800 2E0A7511 498B8424). From there you will need to locate the LVDS connector and change the appropriate bytes.

 

[RehabMan]

[Guide] Lenovo Y50

@RehabMan,

Very handy indeed

@niceidiot,

If we want to try changing the byte, AppleIntelFramebufferAzul.sh can't help us with that, as there is no option. (see attached screenshot) We'll need to use a hex editor. I use iHex, which is available for free from the Mac App Store. You will need to open the file /System/Library/Extensions/AppleIntelFramebufferAzul.kext/Contents/MacOS/AppleIntelFramebufferAzul.

To find the framebuffer to patch, press Command + F and search for the framebuffer sequence in reverse.

Example: 0x0a2e0008 -> 08 00 2e 0a

You may find multiple matches. The one you are looking for is not split over multiple sections (for example, this is not the framebuffer: A00E0000 81380800 2E0A7511 498B8424). From there you will need to locate the LVDS connector and change the appropriate bytes.

You can also construct a Clover patch. Makes for easier experimentation...

Name: AppleIntelFramebufferAzul
Find: 0800 2e0a 0103 0303 0000 0004 0000 2002 0000 5001 0000 0060 6c05 0000 6c05 0000 0000 0000 0000 0000 0000 0800 0200 0000 3000 0000
Repl: 0800 2e0a 0103 0303 0000 0004 0000 2002 0000 5001 0000 0060 6c05 0000 6c05 0000 0000 0000 0000 0000 0000 0800 0200 0000 30[B]02[/B] 0000

I grabbed the entire platform-id header up to the end of the first connector (the LVDS connector).

The Clover patch would allow you to change the data for BIOS memory/framebuffer memory/cursor bytes/or LVDS data.

Note: Not all LVDS connectors use port 0... (as demonstrated by the Capri 01660003/0004). Just another possibility...

 

[niceidiot]

[Guide] Lenovo Y50

You can also construct a Clover patch. Makes for easier experimentation...

A bit out of my depth here. Does this replace the Clover patch referenced in the guide at the beginning of this thread?

I seem to remember Piker Alpha or some other breakdown of what the specific chunks most likely referenced... I think I may need something like that if possible.

 

[RehabMan]

[Guide] Lenovo Y50

A bit out of my depth here. Does this replace the Clover patch referenced in the guide at the beginning of this thread?

Yes. Because it is for a completely different ig-platform-id.

I seem to remember Piker Alpha or some other breakdown of what the specific chunks most likely referenced... I think I may need something like that if possible.

It is a good idea to play with Pike's script as a learning tool.

 

[valued17]

[Guide] Lenovo Y50

@valued17,

Attached is an edited version of my config.plist. (I removed my MLB, ROM, System-ID, Serial #, and Board ID values and generated a new SMBIOS) Remember to change GUI > Theme to any folder name in [SYSTEM_DRV]/EFI/CLOVER/themes.

Thanks a lot, my friend!