Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

MP 1,1-5,1 MP5,1: BootROM thread | 144.0.0.0.0

Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,798
9,376
If I get the MP6,1 ROM dump, I'll decompress the hardware descriptor from the private part of the NVRAM and add another four ports to the MP5,1 one, for the FL1100 chipset, with the same syntax used in the trashcan.

I've already decompressed the descriptor from my rMBP and mini late2012, got some ideas about how to do the same on the cMP.

rMBP 15"
Code:
ADD_DEVICE    ()    [class="USBPort",location="left",speed="5000",xhci-id="0x14900000",xhci-legacy-id="0x14100000",ehci-id="0x1d110000",hs-port-number="0",port-number="1"]

ADD_DEVICE    ()    [class="USBPort",location="right",speed="5000",xhci-id="0x14a00000",xhci-legacy-id="0x14200000",ehci-id="0x1a120000",hs-port-number="9",port-number="2"]
 
Last edited:
Comment

h9826790

macrumors P6
Apr 3, 2014
15,136
7,436
Hong Kong
I have Mojave installed with no issues with my 7950
[doublepost=1534753526][/doublepost]
I disagree.
[doublepost=1534753826][/doublepost]
Im a bit confused. So now you can put 2 Pci express and negotiate fiull speed at RAID 0?


Thanks

Correct, with only those low cost adaptors.
 
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,798
9,376
Nice! Just do a ROM dump of the MP6,1 BootROM.

  • First disable SIP. Boot the Recovery partition, open Terminal, run "csrutil disable", reboot
  • Download ROMDump: ROMDump.zip
  • Right click to open ROMDump, open it, then save the BootROM dump
  • Compress the dump and send by email (I think that 6,1 dumps are bigger than what MacRumors accepts by PM)
  • You can re-enable SIP now. Boot the Recovery partition, open Terminal, run "csrutil enable", reboot
Thx a lot! :)
[doublepost=1534778841][/doublepost]@krakman dumped his trashcan, thx again!

Now we have the correct syntax, addresses are different from my rMBP:
Code:
ADD_DEVICE    ()    [class="USBPort",location="top-right",speed="5000",xhci-id="0x21200000",xhci-legacy-id="0x20200000",ehci-id="0x20200000",port-number="2",hs-port-number="2"]

ADD_DEVICE    ()    [class="USBPort",location="top-left",speed="5000",xhci-id="0x21400000",xhci-legacy-id="0x20400000",ehci-id="0x20400000",port-number="4",hs-port-number="4"]

ADD_DEVICE    ()    [class="USBPort",location="bottom-right",speed="5000",xhci-id="0x21100000",xhci-legacy-id="0x20100000",ehci-id="0x20100000",port-number="1",hs-port-number="1"]

ADD_DEVICE    ()    [class="USBPort",location="bottom-left",speed="5000",xhci-id="0x21300000",xhci-legacy-id="0x20300000",ehci-id="0x20300000",port-number="3",hs-port-number="3"]

Another interesting thing, I saw the same on the rMBP, maybe we can enable low power state on PCIe SSDs?!?

Code:
SET_PROPERTY    (class="HardDrive"&type="SSD")    [throttling-support="TRUE"]

I have to investigate and learn more about the MP6,1 BootROM.
 
Last edited:
Comment

MisterAndrew

macrumors 68020
Sep 15, 2015
2,178
1,688
Portland, Ore.
It's not a easy task, since the NVRAM space, SSN_HWC_SON block and the LBSN_BD sector are not present in the LOCKED.fd files. You can't just check your DUMP with the LOCKED.fd one.

I'm using HexFiend, binwalk, UEFITool to inspect the dumps.

With HexFiend I check for things like:

  • if the SSN_HWC_SON block is correct, in the correct address in the private part of the NVRAM. I saw one totally out of place, before base_20 binary.
  • if the LBSN_BD sector is correct and in the correct address, end of the BootROM. I saw one 4 bytes out of place.
  • compare sections of the ROMDump with the LOCKED.fd
With binwalk I check for things like:
  • strange things on the NVRAM, I've found macOS install logs in plist format (that was weird, seems a botched/interrupted macOS install).
  • duplicated NVRAM.
  • volumes out of place.
  • volumes bigger/smaller than the same ones in the LOCKED.fd files.
  • added DXEs
With UEFITool I check for things like:
  • valid checksums for the volumes.
  • if all the FFS are present.
  • sizes.
  • signatures.
[doublepost=1534710678][/doublepost]Inspecting BootROMs made me find some interest, to me at least, things.

  • BTO/CTO Macs have the full build date, to the second, like ANSI 8601 YYYY-MM-DDThh:mm:ssTZD, but without separators and time zone
  • Retail/Refurb Macs have another format for the date YYMMDDYYMMDD7 (7 seems used as delimiter)
  • 2010 and 2012 BootROMs are different in the private NVRAM area. Base_20 binary block for 2010 and Base_21 for 2012.
I still don't know what the Base_20 and Base_21 codes do, tried to inspect with IDA-free but got mumbo jumbo. I'm gonna return to it when I have time and a cool head. Edit: found it, see next posts.

[doublepost=1534710890][/doublepost]Btw, I need more dumps of mid-2012 Mac Pros. I just have two.
[doublepost=1534711600][/doublepost]SSN = System Serial Number
HWC = Hardware Code
SON = System Order Number
LBSN = Logic Board Serial Number
BD = Build Date

Okay. That sounds complicated. Instead of fixing it up is there a way we can easily virginize the firmware like it is on a new logic board? Then set the serial with Apple’s CD?
 
Comment

BillyBobBongo

macrumors 68030
Jun 21, 2007
2,522
1,101
On The Interweb Thingy!
In Mac OS or Windoz or both? If Mac OS, which OS?

Lou
Here's a screenshot for my RX 580 in High Sierra, decided to take a look myself so I updated the firmware. The first time it failed to update (the system just rebooted after the flashing light/long tone) but the second time it took.
macOS High Sierra.png


And here's a screenshot from GPU-Z in Windows 10.

Windows 10 - GPU Z.gif
 
Last edited:
Comment

flowrider

macrumors 603
Nov 23, 2012
6,421
2,453
As people have said before windows and mac os

I was specifically referring to the GTX 1080. I know the RX580 shows up as 5GT/s in the Mac OS with the new FW. But the GTX 1080 does not, at least for me, as I have previously posted. Although the issue is only cosmetic.

Lou
 
Comment

trifero

macrumors 65816
May 21, 2009
1,143
823
Can someone explain to me why my MacPro 2009 4.1, flashed to 5.1 with 3 disks, one with Sierra, another with High Sierra and the third an SSD drive with Mojave has stopped being able to recognize the USB connection to my 24 " LED Cinema Display , it shows in the USB description as USB , but the monitor USB ports are no longer working or the Brightness control on the keyboard or the display window or the iSight camera either... tried zapping pram, started from Sierra or High Sierra and still no go, I believe is something that can be fixed or I need a new monitor or add a WEB Cam ... any input will be greatly apprec iated.Thanks


Not working in none of the macOS versions?
 
Comment

handheldgames

macrumors 68000
Apr 4, 2009
1,793
1,054
Pacific NW, USA
Here's a screenshot for my RX 580 in High Sierra, decided to take a look myself so I updated the firmware. The first time it failed to update (the system just rebooted after the flashing light/long tone) but the second time it took. View attachment 776919

And here's a screenshot from GPU-Z in Windows 10.

View attachment 776935

The ? looks correct. It recognizes your video card as a PCIe 3.0 device that's been initialized at PCIe 2.0 x16
 
Last edited:
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,798
9,376
Okay. That sounds complicated. Instead of fixing it up is there a way we can easily virginize the firmware like it is on a new logic board? Then set the serial with Apple’s CD?
Yes, but…


The LOCKED.fd files are the full BootROM missing:

  1. The LBSN_HWC sector at the last bytes of the BootROM. That are set at the build time by the factory.
  2. The, what I'm calling, hardware descriptor compressed blob and the SSN_HWC_SON in the private part of the NVRAM space.
You can boot from the LOCKED.fd file restored to the BootROM, then can use BlankBoardSerializer to insert the SSN. That works ok until you try to access iMessage/Facetime/iCloud. Apple will block you like they block a hackintosh, since you're still missing SON and the LBSN_BD sector and your hardware UUID is incomplete.

So you need to extract the, what I'm calling, hardware descriptor compressed blob and the SSN_HWC_SON from your corrupted BootROM and insert in the LOCKED.fd.

If you your BootROM is so corrupted that you can even extract the 5 identifiers, and you don't have a backup dump, you can get at least 3 of them:

  • SSN is the same serial number that Apple printed on the backside gray/white label.
  • HWC is the 3 last digits of the serial number on 2009/2010, 4 last digits with 2012.
  • SON can be the Apple Order Number from your sales order/receipt or the Apple SKU for your model (easy to find)
  • LBSN is printed in a black label on the logic board, next to the tray connector, you'll have to remove the CPU tray cage (some work but totally doable).
  • DB you can use the data showed by Apple Serial Number decoders on the internet. It's not correct but it's better than leaving empty. (checked various SSNs and the date that the decoders show is more or less a month wrong, but totally wrong for Refurb Mac Pros)
With all this info inserted on the LOCKED.fd you will pass Apple checks and iCloud/iMessage/FaceTime will work.
[doublepost=1534800660][/doublepost]SSN = System Serial Number
HWC = Hardware Code
SON = System/Sales Order Number
LBSN = Logic Board Serial Number
BD = Build Date
[doublepost=1534801672][/doublepost]The identifiers that are really needed are SSN and LBSN. You can insert any mumbo jumbo for SON/BD and it will work. But if you're doing, do the best you can and try to find SON from your sales receipt or the SKU for your Mac Pro, if you bought an used one.
 
Last edited:
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,798
9,376
tsialex

Do you feel confident that you will be able to enable native USB 3.0 FL1100 in either the MP51.0089.B00 or 138.0.0.0 bootrom ?
I can’t say that.

I found just info of how things are made to work by Apple. Now we know for sure the DXEs needed in the trashcan and we can start inserting the same ones in the cheesegrater.

A lot of test will be needed and I can’t guarantee that will work in the end, but today info got us one big step ahead. It’s not a guessing game anymore.
 
Comment

handheldgames

macrumors 68000
Apr 4, 2009
1,793
1,054
Pacific NW, USA
Booting between High Sierra and Mojave over the weekend, with countless memory configurations and two processor trays, I managed to disable the AMD RX480 audio driver. Sound output over DisplayPort that had surprisingly started working, had suddenly stopped, no longer showing as a sound output option and nothing would bring it back.

I'm not sure what caused it to stop working, but installing today's beta release, the AMD Audio hardware was re-enabled.
 
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,798
9,376
tsialex

Do you feel confident that you will be able to enable native USB 3.0 FL1100 in either the MP51.0089.B00 or 138.0.0.0 bootrom ?

When I started investigating the BootROM, I was for sure that we need only two ids, now I know that are 5 and learned a lot of other things. The same will happen with USB3 boot.

For now I'm focusing on the BootROM issue.
 
Last edited:
Comment

t8er8

macrumors 6502
Dec 4, 2017
251
99
Quebec, Canada
New install / update screens for the non efi crowd.

View attachment 776958
I got that too, it’s quite interesting it seems like it’s in a recovery mode or something as it has language preferences and wifi status. Anyone have further info on what this PB7/DB8 brought?

Edit: this update took a lot longer than the rest, I didn’t get any startup chime during the entire process and most of the update was spent on a black screen, the new updater seems to have promise for more.
 
Last edited:
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.