MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0

[0134168]

Hello, running an early 2009 Mac Pro with BootROM 144.0.0.0.0 and have some concerns over system stability, etc. I've dumped the ROM and would really appreciate any light that can be shed or action I need to take, thanks.

First dump i made, SIP enabled, got nothing in common with the right made with SIP disable. Follow @tsialex instructions.

 

[tsialex]

First dump i made, SIP enabled, got nothing in common with the right made with SIP disable. Follow @tsialex instructions.

I think that you wanted to write OpenCore and wrote SIP perhaps?

SIP being disabled (or inexistent like when running Mavericks) is a requirement for accessing the SPI flash memory.

Several dumps made with OpenCore running were full of issues to the point that I can't trust dumps made with OC running, System Information reports saved when using spoofing are also useless for diagnostic purposes.

Always dump/flash your Mac Pro BootROM from a fully supported macOS release running without OpenCore - it's a little troublesome to do it, but it's safe. You really don't want to mess with this operation.

 

[G°LLY]

Normal behavior of Apple Wireless keyboards, a lot of older wired Microsoft (older Microsoft 500/600 need to be disconnected and reconnected).

Most wired keyboards work for deep NVRAM resets, but some don't. When you have a keyboard that work with other Macs and still don't complete a deep reset, it's usually a sure sign of a problem.

Hi.
By the way, I was able to validate this information. I connected an old Apple plastic keyboard (instead of my SATECHI USB keyboard with which I could only make one chime..) to one of the front cMP USB ports - deep NVRAM resets are now possible again (but I stopped after 7 chimes 😉.
Whether this is now also because tsialex rebuilt the boot ROM doesn't matter to me, because I'm really thankful that tsialex was able to get rid of the mixed 4.1/5.1 crossflashed stuff on my (old refurbished 2009 cMP 4.1<5.1) boot ROM, which is/was not healthy at all!

*May the force be with you tsialex!

P.S.: I hereby express the clear recommendation for your service!(!!)

 

[Avalon74]

Ok... Ive installed a copy of High Sierra on a small partition on one of my drives and booted into it without using OpenCore (atleast I dont think OpenCore is active as the bootrom version correctly identifies as 144.0.0.0.0 rather than the 9144.x.x.x.x number that I see in Big Sur).

So what do I need to do to dump a good copy of the bootrom other than disabling SIP? Ive dumped a copy now, which shows my first VSS store free space at 9470 (and the 2nd VSS Store is still there), but I did nothing special other than botting into High Sierra after disabling SIP.

EDIT: Did some further research and did a deep NVRAM reset, (Cmd-Opt-P-R until the 5th chime), redisabled SIP and now the first VSS store reports free space of 40085. Second VSS store of 65448. This looks much better than the original dump, which I assume means I did it wrong the first time. Not sure what this means for my boot rom though. Should I investigate recontruction? Or just save this dump as one to reflash every 3 months or so?

 

[tsialex]

Ok... Ive installed a copy of High Sierra on a small partition on one of my drives and booted into it without using OpenCore (atleast I dont think OpenCore is active as the bootrom version correctly identifies as 144.0.0.0.0 rather than the 9144.x.x.x.x number that I see in Big Sur).

So what do I need to do to dump a good copy of the bootrom other than disabling SIP? Ive dumped a copy now, which shows my first VSS store free space at 9470 (and the 2nd VSS Store is still there), but I did nothing special other than botting into High Sierra after disabling SIP.

It's enough for the purposes of checking the available space.

EDIT: Did some further research and did a deep NVRAM reset, (Cmd-Opt-P-R until the 5th chime), redisabled SIP and now the first VSS store reports free space of 40085. Second VSS store of 65448. This looks much better than the original dump, which I assume means I did it wrong the first time. Not sure what this means for my boot rom though.

You forced the garbage collection, so at this time it worked.

Should I investigate recontruction? Or just save this dump as one to reflash every 3 months or so?

There are lot's of other things to investigate, you did the most basic check.

For example, even with GC working, an early-2009 is extremely vulnerable to corruption and all MP4,1>5,1 needs reconstruction. Other thing, mid-2010s BootROMs images are extremely different from mid-2012s and most of them have BootBlock releases that are partially incompatible with PCIe switched adapters. Another issue, dual CPU boards that don't have base_21 from factory work very hot compared to the dual CPU Mac Pros that already have it. This goes on, so it's not an easy answer.

Even mid-2012 Mac Pros BootROMs images are different between production dates, it was a constant process of evolution. The last mid-2012s manufactured around September/October 2013 have the 0x0D BootROM version that is considered the golden Mac Pro BootROM, with all the refinements of almost 5 years of production run.

P.S.:

Forgot to write that one of the goals of the BootROM reconstruction process is to upgrade all the BootROM image components to the most recent release, so, even an early-2009 will have base_21, BootBlock APLEFI1.88Z.0005.I00.1904121247, 0x0D and etc after the reconstruction is done.

 

[Avalon74]

There are lot's of other things to investigate, you did the most basic check.

For example, even with GC working, an early-2009 is extremely vulnerable to corruption and all MP4,1>5,1 needs reconstruction. Other thing, mid-2010s BootROMs images are extremely different from mid-2012s and most of them have BootBlock releases that are partially incompatible with PCIe switched adapters. Another issue, dual CPU boards that don't have base_21 from factory work very hot compared to the dual CPU Mac Pros that already have it. This goes on, so it's not an easy answer.

Even mid-2012 Mac Pros BootROMs images are different between production dates, it was a constant process of evolution. The last mid-2012s manufactured around September/October 2013 have the 0x0D BootROM version that is considered the golden Mac Pro BootROM, with all the refinements of almost 5 years of production run.

P.S.:

Forgot to write that one of the goals of the BootROM reconstruction process is to upgrade all the BootROM image components to the most recent release, so, even an early-2009 will have base_21, BootBlock APLEFI1.88Z.0005.I00.1904121247, 0x0D and etc after the reconstruction is done.

Theres quite a bit in there that went over my head, but thats fine. But what Id like to know, for right now, is should I have it looked at and get it reconstructed, or will this dump be sufficient for operation (the machine is not a critical machine, just a media server), if I reflash it every few months. (I understand the the flash chip itself could be nearing the end of its usable life, and I'll cross that bridge when I inevitably get to it).

 

[tsialex]

Theres quite a bit in there that went over my head, but thats fine. But what Id like to know, for right now, is should I have it looked at and get it reconstructed, or will this dump be sufficient for operation (the machine is not a critical machine, just a media server), if I reflash it every few months. (I understand the the flash chip itself could be nearing the end of its usable life, and I'll cross that bridge when I inevitably get to it).

What Mac Pro is this one?

 

[Avalon74]

What Mac Pro is this one?

Its a single CPU 4,1>5,1.

 

[tsialex]

Its a single CPU 4,1>5,1.

Early-2009 cross flashed to MP5,1 firmware need reconstruction to upgrade the MP4,1 BootROM image components to MP5,1 and remove all the useless MP4,1 variables from the NVRAM volume, I've sent you a PM with instructions.

 

[lxmeta]

I (think) I might have a new question. (Did not find this topic in the forum yet). I thought it must have been discussed somewhere already, but I just did not find it yet. Apologies if I missed something obvious!

It looks like I could get my hands on an old 4.1 with most likely a fried CPU board. LEDs at least show the CPU is not recognised. (might still be just the CPU).
This Mac has not yet been upgraded to the 5.1 and the new bootrom! So far I have only seen pictures of the red glowing LED in the riser board.

I did upgrade quite a few 4.1, 1x and 2x CPU to the "max" configuration, so I am very familiar with that.
(anyone in need of a delidder? 😉)

Situation:
I have a spare 4.1 single CPU Riser from an upgraded to 5.1 in working condition as a backup.
What would happen if I would put this into the old 4.1, that has not seen any upgrades yet?
I know that a 5.1 Riser does not really work in the 4.1, upgraded or not.
But what's with an upgraded 4.1 in a none upgraded mainboard?
I'm sure that I would have to change the X5690 to an old Nehalem to start with (which I have plenty laying around) to be compatible with the 4.1.

Another way to ask this question:
When flashing a 4.1 to a 5.1 and the latest bootrom, that flash is located on the mainboard. Is there anything that gets flashed on the 4.1 tray as well? If not, I can simply swap the CPU, boot (if this indeed was the problem), do the 4.1 to 5.1 to 144.0.0.0 thing, swap the CPU back, and have revived another old MPc... and I'll make another student super happy 😜

Many thanks for your help!

 

[tsialex]

I (think) I might have a new question. (Did not find this topic in the forum yet). I thought it must have been discussed somewhere already, but I just did not find it yet. Apologies if I missed something obvious!

It looks like I could get my hands on an old 4.1 with most likely a fried CPU board. LEDs at least show the CPU is not recognised. (might still be just the CPU).
This Mac has not yet been upgraded to the 5.1 and the new bootrom! So far I have only seen pictures of the red glowing LED in the riser board.

I did upgrade quite a few 4.1, 1x and 2x CPU to the "max" configuration, so I am very familiar with that.
(anyone in need of a delidder? 😉)

Situation:
I have a spare 4.1 single CPU Riser from an upgraded to 5.1 in working condition as a backup.
What would happen if I would put this into the old 4.1, that has not seen any upgrades yet?
I know that a 5.1 Riser does not really work in the 4.1, upgraded or not.
But what's with an upgraded 4.1 in a none upgraded mainboard?
I'm sure that I would have to change the X5690 to an old Nehalem to start with (which I have plenty laying around) to be compatible with the 4.1.

Another way to ask this question:
When flashing a 4.1 to a 5.1 and the latest bootrom, that flash is located on the mainboard. Is there anything that gets flashed on the 4.1 tray as well?

Nothing whatsoever.

It's the backplane's BootROM that defines processor support - only MP5,1 firmwares can boot Westmere Xeons.

If not, I can simply swap the CPU, boot (if this indeed was the problem), do the 4.1 to 5.1 to 144.0.0.0 thing, swap the CPU back, and have revived another old MPc... and I'll make another student super happy 😜

Like I said multiple times, the cross-flashing process makes hybrids that are extremely prone to BootROM corruption, do your future self a favor and do a BootROM reconstruction instead of cross-flashing an early-2009.

Many thanks for your help!

=)

 

[lxmeta]

<snip>

Like I said multiple times, the cross-flashing process makes hybrids that are extremely prone to BootROM corruption, do your future self a favor and do a BootROM reconstruction instead of cross-flashing an early-2009.

Many thanks for your quick answer!
On the BootROM reconstruction: I currently don't feel comfortable doing this myself. If it was as simple as the other option, I would give it a try.
So far I was lucky, and all my conversions are running well with no evident corruption according to the checks you suggested.

 

[basslik]

Many thanks for your quick answer!
On the BootROM reconstruction: I currently don't feel comfortable doing this myself. If it was as simple as the other option, I would give it a try.
So far I was lucky, and all my conversions are running well with no evident corruption according to the checks you suggested.

Evidence is there if you look using a utility. When discovered I had Alex hook me up, thanks Alex.

 

[golgotrece]

Look, this image is useless and means nothing without the context. Context here as how you did the dump, the free space available in the VSS stores and the type of invalid entries.

Anyway, all cross-flashed early-2009 Mac Pros need a BootROM reconstruction, since the cross-flashing process results on a BootROM image made of MP4,1 and MP5,1 components and extremely prone to corruption. Also, the BootROM don't need to corrupt to brick a Mac Pro, it's very common to have SPI flash memory failure just from overuse of the NVRAM region of the SPI, since the MP4,1 NVRAM store lots of now invalid entries that only matter for MP4,1 firmwares.

I'll send you a PM on how to correctly dump the BootROM image and how to get all the necessary files/data.

Hi! I also have a MBP4,1 cross-flashed to MBP5,1 I want to reconstruct the bootrom. Could you please also send me the instructions? I also have a question: I'm currently in version MP51.007F.B03 which is vulnerable to spectre but the performance of the processor is better than the later versions. Would be possible to update to 144 with all the advantages (ie. boot from nvme devices) but without the microcode that fixes the spectre bug, to have better performance?

 

[tsialex]

Hi! I also have a MBP4,1 cross-flashed to MBP5,1 I want to reconstruct the bootrom. Could you please also send me the instructions?

Are you sure you are talking about a MacBookPro4,1? The cost of repairing a MBP4,1 BootROM will be probably over the price of a new logic board. Sorry, can't help you with this case.

I also have a question: I'm currently in version MP51.007F.B03 which is vulnerable to spectre but the performance of the processor is better than the later versions. Would be possible to update to 144 with all the advantages (ie. boot from nvme devices) but without the microcode that fixes the spectre bug, to have better performance?

Everything is possible, but the performance loss with Spectre/Meltdown mitigations is minimal and for most use cases imperceptible.

macOS has a service (/usr/libexec/ucupdate) that loads the current/mitigated microcode to the processors on-the-fly even if the BootROM itself have a previous release. No firmware engineer will accept a job like that, don't make sense.

 

[Dayo]

I'm currently in version MP51.007F.B03 which is vulnerable to spectre but the performance of the processor is better than the later versions. Would be possible to update to 144 with all the advantages (ie. boot from nvme devices) but without the microcode that fixes the spectre bug, to have better performance?

Not advising you to stick with the vulnerable BootROM and you should update to the secure version but if you do want to stick with the dodgy version for whatever reason, you can get the equivalent of the 144 BootROM feature set (save the protection of course) with a RefindPlus/OpenCore setup.

If you run MyBootMgr, it will set the two utilities up to provide NVMe and APFS Support along with some other stuff similar to how a cMP3,1 is set up. You will have to run it the first time outside an OpenCore instance so that it can detect things without OpenCore Spoofing.

As said though, you might want to reconsider the decision not to upgrade the BootROM instead.

 

[MarkAllread]

Getting desperate now.

Hi there folks…newbie forum member.

Can anyone tell me if there is a way to determine if a dumped BootRom is corrupt?

A couple of weeks ago my 2010 5.1 server stopped working after a security update to Mojave.
Symptoms strongly pointed at a bad BootRom chip. Power led comes on, but no video, fans working gently, no startup chime or hard drive loading sounds. Inability to reset NVRAM (or any kbd activity)…basically almost dead like so many others I’ve read about here.

5V STBY led on when debug buttons pressed with power applied.
PSU PWROK, 5V STB and SYS PG leds on when debug buttons pressed when powered on.

I did all the usual stuff by swapping/removing parts and trying them in my working 2012. I even removed and tried the PS and the CPU tray in the 2012 and they worked just fine.

With a lot of help and advice through reading this forum I made a decision to remove the BootRom IC, and try to dump the ROM (which seemed to dump just fine) using my CH341a programmer.
So I dumped the original 25L3205D and burned it back into a fresh 25L3206E. I compared the two and they were identical.

Put it back onto my motherboard, …..started the Mac and exactly the same situation as before.

Can someone tell me if there is a way to determine that the ROM is corrupt or ok…it will help me decide where to go next.

Many thanks for all the knowledge that people have contributed here. Especially @tsialex.

Mark.

 

[tsialex]

Getting desperate now.

Hi there folks…newbie forum member.

Can anyone tell me if there is a way to determine if a dumped BootRom is corrupt?

A couple of weeks ago my 2010 5.1 server stopped working after a security update to Mojave.
Symptoms strongly pointed at a bad BootRom chip. Power led comes on, but no video, fans working gently, no startup chime or hard drive loading sounds. Inability to reset NVRAM (or any kbd activity)…basically almost dead like so many others I’ve read about here.

5V STBY led on when debug buttons pressed with power applied.
PSU PWROK, 5V STB and SYS PG leds on when debug buttons pressed when powered on.

I did all the usual stuff by swapping/removing parts and trying them in my working 2012. I even removed and tried the PS and the CPU tray in the 2012 and they worked just fine.

With a lot of help and advice through reading this forum I made a decision to remove the BootRom IC, and try to dump the ROM (which seemed to dump just fine) using my CH341a programmer.
So I dumped the original 25L3205D and burned it back into a fresh 25L3206E. I compared the two and they were identical.

Put it back onto my motherboard, …..started the Mac and exactly the same situation as before.

Can someone tell me if there is a way to determine that the ROM is corrupt or ok…it will help me decide where to go next.

Many thanks for all the knowledge that people have contributed here. Especially @tsialex.

Mark.

Yes, but it's a very complex procedure since you need to checksum different areas of the BootROM image and compare with an image create for the same HWC, with the same BootBlock version and etc. It's definitively a firmware engineer job to know the areas that need to be checksummed and the areas that need to be discarded.

You should have flashed MP51.fd to the replacement SPI flash memory instead, it's incomplete and you can't login to Messages/FaceTime/iCloud, but your backplane can boot from it and if you can't get it booting with the MP51.fd, you have a different defect.

 

[MarkAllread]

Thanx, I use iCloud a lot so I crossed my fingers and hoped that it was a faulty chip not being able to be written to but could be read. Guess I should have crossed my toes as well. Not much more I can check to see what is wrong as I can't boot it up.
I have some thinking to do before I tear it all down again...
and may not be worth the price of a replacement backplane with the high shippings costs to Canada.
Thanks again for answering my plea so quickly.

Yes, but it's a very complex procedure since you need to checksum different areas of the BootROM image and compare with an image create for the same HWC, with the same BootBlock version and etc. It's definitively a firmware engineer job to know the areas that need to be checksummed and the areas that need to be discarded.

You should have flashed MP51.fd to the replacement SPI flash memory instead, it's incomplete and you can't login to Messages/FaceTime/iCloud, but your backplane can boot from it and if you can't get it booting with the MP51.fd, you have a different defect.

 

[tsialex]

Thanx, I use iCloud a lot so I crossed my fingers and hoped that it was a faulty chip not being able to be written to but could be read. Guess I should have crossed my toes as well. Not much more I can check to see what is wrong as I can't boot it up.
I have some thinking to do before I tear it all down again...
and may not be worth the price of a replacement backplane with the high shippings costs to Canada.
Thanks again for answering my plea so quickly.

Unfortunately, flashing back the suspected corrupt dump to a replacement flash was not exactly an informed choice. I'd even do it to a MATT card, but I'll never do it to a replacement flash memory that you gonna solder it. One wrong checksum somewhere and you have a brick.

Desolder the SPI flash memory, flash the MP51.fd BootROM upgrade image from the MAS 10.14.6 full installer, solder it back.

After you get the backplane working again, you go for a BootROM reconstruction service and you will get your Mac Pro fully working again.

 

[L2009]

Hi! @tsialex

I have a MP5,1 (Mid 2012),I want to reconstruct the bootrom. Could you please also send me the instructions?

many thanks!

 

[tsialex]

Hi! @tsialex

I have a MP5,1 (Mid 2012),I want to reconstruct the bootrom. Could you please also send me the instructions?

many thanks!

Sure, instructions sent by PM.

 

[MarkAllread]

Desolder the SPI flash memory, flash the MP51.fd BootROM upgrade image from the MAS 10.14.6 full installer, solder it back.

After you get the backplane working again, you go for a BootROM reconstruction service and you will get your Mac Pro fully working again.

Roger that!

 

[MarkAllread]

Unfortunately, flashing back the suspected corrupt dump to a replacement flash was not exactly an informed choice. I'd even do it to a MATT card, but I'll never do it to a replacement flash memory that you gonna solder it. One wrong checksum somewhere and you have a brick.

Desolder the SPI flash memory, flash the MP51.fd BootROM upgrade image from the MAS 10.14.6 full installer, solder it back.

After you get the backplane working again, you go for a BootROM reconstruction service and you will get your Mac Pro fully working again.

OK @tsialex ....just burned MP51 and soldered it back on as you rightfully recommended. Thanks. Nice clean boot with no iCloud as expected. Despite the loss of iCloud I'm very happy to have it back and a relief to know backplane is ok🙂
Any pointers on doing a reconstruction...or maybe a copy of the directions you sent to L2009?
(I know how to work with Hex....programmed in assembler for years back in the 70s
Mark

 

[Matejh]

Hi!

Could you please also send me the instructions?

tia