Become a MacRumors Supporter for $25/year with no ads, private forums, and more!

MP 1,1-5,1 MP5,1: BootROM thread | 144.0.0.0.0

Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
This is a work in progress

These identifiers are used by Apple to fully identify and validate your Mac, without them you can't login with iCloud/iMessage/FaceTime.

Identifier:Definition:
SSNSystem Serial Number
HWCHardware Code
SONSystem/Sales Order Number
LBSNLogic Board Serial Number
BDLogic Board Build Date
UUIDUniversally Unique Identifier

Logic Board Serial Number (LBSN) and Build Date (BD):

This two Mac Pro identifiers are stored at the last bytes of the BootROM. They have the same format, size and are stored at the same address on every Mac Pro 2009 to 2012. On a 2008, they're at the end of the BootROM too, but MP31 has only half of the SPI flash size of a 2009/2010/2012. On a 2013, it's at the last bytes too, but the SPI Flash has the double size of a 2009/2010/2012.

You can extract the complete LBSN_BD sector with UEFITool, it's the last RAW section of the 1BA0062E-C779-4582-8566-336AE8F78F09 GUID.

How-to check MP5,1 LogicBoardSerialNumber and BuildDate:


On the MP5,1 Logic Board:

LBSN is printed on a black/white label near the AirPort connector and the male CPU tray connector. It's usually to the left of the male CPU tray connector, but can be placed to the right too.

Example picture:
MP51 - LBSN_SKU.jpg


In the picture above, LBSN is J5911053Q1LTC and the part number/SKU of this logic board is 630-9399. BD is not present on the labels of the logic board.


On the MP5,1 BootROM:

LBSN and BD don't have ASCII labels showing their location in the BootROM, they have fixed positions and are used to calculate the Mac Pro Hardware UUID:
Identifier:Start address:End address:
LBSN0x3FFF080x3FFF14
BD0x3FFF500x3FFF5B

Example picture:
MP51 - BootROM LBSN sector - J5911053Q1LTC.png


In the picture above, LBSN (cyan) is J5911053Q1LTC and BD (yellow) is 090216090216. It's easy to find the LBSN and BD position, it's at the very end of the BootROM.

The alphanumerical char (p) at the end of the BD, position 0x3FFF5C, it's a delimiter and can be alphanumerical char (7) too. Sometimes Apple uses this, sometimes not - seems to be a checksum thing.

About the BD:

Build date it's the date that the logic board was made and has this unusual format:

YYMMDDYYMMDD​

While you don't need the exact real date of manufacture from your Mac Pro to validate it with Apple, a correctly formatted date no later than the date you can get from the SSN will work and must be present at the LBSN_BD sector, but try your best to use a near enough date or Messages will not authenticate. It's a salt needed when creating UUID.

One trick that I use is to decode the SSN manually, or with internet serial number decoders, and use that date. It's not exactly correct, at best it's the same week that the backplane was made, but near enough and probably will do.

Btw, this some times needs little adjusts to validate Messages correctly.

About the part number/SKU:

Part number/SKU is only of interest if somehow your BootROM misses the SON, then you replace it with the part number/SKU to create a valid Hardware UUID. A symptom of missing SON is rejected logins with iCloud/iMessage/FaceTime.

I prefer to use the Mac Pro part numbers/SKU in the BootROMs I reconstructed, like Apple do for retail Mac Pros, but you can use the logic board part number/SKU too.

Apple changes a little the part number/SKU of the Mac Pros to use it as SON on the BootROM. This happens with 4,1, 5,1 and 6,1 models but not with the 3,1 (has only one retail model and another one made specifically for the EDU channel, the single processor one).

Examples I've found:

Mac Pro Model:Mac Pro Part Number:SON:
MP31MA970LL/AMA970LL/A
MP41MB535BZ/ARMB535BZ/
MP41MB535LL/AFMB535LL/
MP41MB535LL/AGMB535LL/
MP41MB871LL/AFMB871LL/
MP41MB871LL/A0MB871LL/
MP51MC250LL/ARMC250LL/
MP51MC561LL/ARMC561LL/
MP51MD770LL/AD770LL/A
MP51MD772LL/AD772LL/A
MP61ME253LL/AME253B/

The Hardware UUID calculated with the logic board part number/SKU will validate with Apple.
 
Last edited:
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
@tsialex is there a way I can donate to you and support your valuable work and research?

I'm doing this basically for knowledge and to help the community.

Later on, I gonna try to make a little circuit board to connect directly to the FRANK (LPC/SPI connector name) on the logic board (like MATT cards or J6100 do for MacBooks) to flash corrupted Mac Pros without the need to desolder the SPI-flash. I'll need some funds to develop this (I'll need a better oscilloscope/bigger logic analyser), it'll be OSH (OpenSourceHardware).

If you wanna help my research, I can PM you my PayPal account.
[doublepost=1535257492][/doublepost]Connecting directly to the FRANK will be useful to my research, at least a lot less risky to test BootROM mods. I know that big Apple repair centres have a programmer that go in the FRANK connector and reflashes everything on the board (BootROM/Ethernet firmware and even SMC). I'd love to understand how they do it.
 
Last edited:
Comment

UCDHIUS

macrumors regular
Nov 16, 2017
195
60
CC Texas
I'm doing this basically for knowledge and to help the community. I gonna try to make a little circuit board to connect directly to the FRANK connector on the logic board (like MATT cards or J6100 for MacBook ones) to flash corrupted MacPros without the need to desolder the SPI-flash. I'll need some funds to develop this. It will be OSH (OpenSourceHardware).

If you wanna help, I can PM you my PayPal account.
[doublepost=1535257492][/doublepost]Connecting directly to the FRANK connector will be useful to research too. I know that Apple repair centres have a programmer that go in the FRANK connector and reflashes everything on the board (BootROM/Ethernet firmware and even SMC). I'd like a lot to understand how they do it.

@tsialex You are a genius keep on doing what you're doing !
 
  • Like
Reactions: tsialex
Comment

AliGT83

macrumors member
Jul 17, 2018
71
43
I'm doing this basically for knowledge and to help the community.

Later on, I gonna try to make a little circuit board to connect directly to the FRANK (LPC/SPI connector name) on the logic board (like MATT cards or J6100 do for MacBooks) to flash corrupted Mac Pros without the need to desolder the SPI-flash. I'll need some funds to develop this (I'll need a better oscilloscope/bigger logic analyser), it'll be OSH (OpenSourceHardware).

If you wanna help my research, I can PM you my PayPal account.
[doublepost=1535257492][/doublepost]Connecting directly to the FRANK will be useful to my research, at least a lot less risky to test BootROM mods. I know that big Apple repair centres have a programmer that go in the FRANK connector and reflashes everything on the board (BootROM/Ethernet firmware and even SMC). I'd love to understand how they do it.

Please do
 
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
Anyone has Mac Pros 1,1, 2,1 or 6,1?

I'd like BootROM dumps from them, I only have one for 6,1, none for 1,1 and 2,1.
 
  • Like
Reactions: handheldgames
Comment

handheldgames

macrumors 68000
Apr 4, 2009
1,793
1,054
Pacific NW, USA
I'm doing this basically for knowledge and to help the community.

Later on, I gonna try to make a little circuit board to connect directly to the FRANK (LPC/SPI connector name) on the logic board (like MATT cards or J6100 do for MacBooks) to flash corrupted Mac Pros without the need to desolder the SPI-flash. I'll need some funds to develop this (I'll need a better oscilloscope/bigger logic analyser), it'll be OSH (OpenSourceHardware).

If you wanna help my research, I can PM you my PayPal account.
[doublepost=1535257492][/doublepost]Connecting directly to the FRANK will be useful to my research, at least a lot less risky to test BootROM mods. I know that big Apple repair centres have a programmer that go in the FRANK connector and reflashes everything on the board (BootROM/Ethernet firmware and even SMC). I'd love to understand how they do it.

Can you leverage the existing designs of products that already hook up to the little frank connector? There are already 2 manufactured versions of this product available In today’s market. It should be easy to trace the lines from the flash to the contacts on the connector.
 
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
And I've got a 2,1. However, it has an apparent SMC issue where it lets the CPU temp run away under load w/o even nudging the fans. Would that present a problem for the BootROM for you?
I don't think that will cause a problem, SMC controller ROM is located in the micro-controller and independent from the BootROM.
[doublepost=1535320691][/doublepost]
Can you leverage the existing designs of products that already hook up to the little frank connector? There are already 2 manufactured versions of this product available In today’s market. It should be easy to trace the lines from the flash to the contacts on the connector.
Chipmunk has a Molex version, but I don't think they tested with MP5,1 ones. The Korean one don't have a molex one.

I already know the pinout of the SPI-Flash signals on the FRANK connector, that was easy, but I want the whole thing with full LPC access.
[doublepost=1535320998][/doublepost]
@tsialex, sorry for asking that offtopic question, but do you think it is possible to disable the ram check at POST in the bootrom, so that the chime comes up faster?
I never checked this in detail, but If I remember correctly, it's not the RAM that takes a long time to scan, but the PCIe and drives.
[doublepost=1535321516][/doublepost]
Very interesting article, has some relation to thread topic..

https://eclecticlight.co/2018/08/24/whats-stored-in-nvram/

Gee, I didn't know NVRAM held the UUID of the last booted system..

NVRAM stores more things in the private part of it. Your full name, your Wi-Fi credentials, the previous UUID from your Mac, etc.
 
  • Like
Reactions: cococheaf
Comment

handheldgames

macrumors 68000
Apr 4, 2009
1,793
1,054
Pacific NW, USA
Chipmunk has a Molex version, but I don't think they tested with MP5,1 ones. The Korean one don't have a molex one.

I already know the pinout of the SPI-Flash signals on the FRANK connector, that was easy, but I want the whole thing with full LPC access.

The connector on the 4,1 / 5,1 is shared with MacBook Pros from the 2009/2010 timeframe. Early production 2009's only have one connector on the logic board. Newer 2009's and beyond also feature the same connector on the CPU tray.

While I currently forget the exact molex connector name, I've posted the details in this forum the past when I first brought up the product as an option that's far too costly for it's own good.
 
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
Early production 2009's only have one connector on the logic board. Newer 2009's and beyond also feature the same connector on the CPU tray.

About the CPU tray molex connector, I don't think that is correct. My dual 4,1 B08 with logic board build date 20100626 only has the pads on the tray and my 4,1 single with build date 20091209 don’t have the connector soldered too.

Btw, my B08 isn’t a refurb one.
 
Comment

handheldgames

macrumors 68000
Apr 4, 2009
1,793
1,054
Pacific NW, USA
About the CPU tray molex connector, I don't think that is correct. My dual 4,1 B08 with logic board build date 20100626 only has the pads on the tray neither my 4,1 single with build date 20091209 has the connector soldered.

Btw, my B08 one isn’t a refurb one.

My 2009, purchased shortly after introduction does not have any molex connectors on it. The pads are there for placement, but there are no connectors.
The 2009 replacement I picked up in 2013, has a molex connector on the cpu tray.
The replacement cpu tray I purchased from Ebay does not.
Most CPU trays do not have the connector.
Looking at a spare 5,1 dual tray, there are no connectors mounted.

I wonder what's up with that? Perhaps a refurb tray?

2438E006-8178-4026-8940-94CF2EAECDF3.jpeg
 
Last edited:
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
My 2009, purchased shortly after introduction does not have any molex connectors on it. The pads are there for placement, but there are no connectors.
The 2009 replacement I picked up in 2013, has a molex connector on the cpu tray.
The replacement cpu tray I purchased from Ebay does not.
Most CPU trays do not have the connector.
Looking at a spare 5,1 dual tray, there are no connectors mounted.

I wonder what's up with that? Perhaps a refurb tray?

I think that beyond some date all trays are factory programmed to 1.39f11, trays for 2009 models were made for little more than a year, almost 4 years for 1.39f11.

If Apple needs 1.39f5, the repair centre installs it soldering the molex connector and reprogram it. Trays refurbished needs the connector on the pads for diagnostics too.

Btw, that's BIG FRANK on your tray. Can you see any flux residue?
 
Last edited:
Comment

h9826790

macrumors P6
Apr 3, 2014
15,136
7,436
Hong Kong
I never checked this in detail, but If I remember correctly, it's not the RAM that takes a long time to scan, but the PCIe and drives.

It's tested. There was a post about this, same Mac, same hardware, but just different memory size. The larger, the slower. And from memory the difference can be more than 10s if compare a 4GB system to a 128GB system.
 
Comment

tsialex

macrumors G3
Original poster
Jun 13, 2016
8,797
9,376
It's tested. There was a post about this, same Mac, same hardware, but just different memory size. The larger, the slower. And from memory the difference can be more than 10s if compare a 4GB system to a 128GB system.

I don't dispute this, but scanning all ROMs in the PCIe slots, all USB/FireWire ports and the 6 SATA ports takes more time than the RAM initialising even on a big RAM Mac Pro.
[doublepost=1535336659][/doublepost]
Interesting, the IOH ITP pads are tinned on your board, on my trays none are.
 
Comment

handheldgames

macrumors 68000
Apr 4, 2009
1,793
1,054
Pacific NW, USA
I think that beyond some date all trays are factory programmed to 1.39f11, trays for 2009 models were made for little more than a year, almost 4 years for 1.39f11.

If Apple needs 1.39f5, the repair centre installs it soldering the molex connector and reprogram it. Trays refurbished needs the connector on the pads for diagnostics too.

Btw, that's BIG FRANK on your tray. Can you see any flux residue?

No residue. It looks like a clean surface mount job on par with all other components on the cpu tray.

The connector is hooked up to the CPU ITP, not the IOH ITP.
 
Comment

MisterAndrew

macrumors 68020
Sep 15, 2015
2,178
1,688
Portland, Ore.
Checked 17 different MP51 so far. Found some things in this dataset:

  • Base_17 was used in February 2009
  • Base_18 was used from March to May 2009
  • Base_19 was used in October 2009
  • Base_20 was used from December 2009 to January 2011
  • Two Refurbished 2009 ones got Base_20
  • Base_21 was used from July 2011 to May 2012
  • Three were build at the same day, one a day earlier, maybe was the last day logic boards for new MP51 were produced?
View attachment 777565

Looking at my firmware, mine is Base_20, EUH, manufactured May 2011.

Update: I searched for all the identifiers you listed in your post #601. They are all present and look good. :)
 
Last edited:
  • Like
Reactions: tsialex
Comment
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.