Hopefully soon, I'm pretty broke right now but hopefully I'll have a couple Macbooks I have for sale sold and I can pick some up.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Updating a Mac (Pro)s CPU Microcode
- Thread starter LightBulbFun
- Start date
- Sort by reaction score
Hopefully soon, I'm pretty broke right now but hopefully I'll have a couple Macbooks I have for sale sold and I can pick some up.
nothing recently sadly
id still like to try someday, I must get some dual and quad core C0 stepping CPUs and give it a bash
I also want to try and get E0 stepping CPUs working in a MP3,1/XS2,1 but I don't have either of those machines to experiment with
I have an Intel® Desktop Board DG31PR. It is listed on the Delidded site as supporting Harpertown Xeons, including the E5450. I measured the resistance on pin AE3. It was not terminated to Vtt, as the Harpertown datasheet would require. This would indicate that there are no hardware changes needed to make a 5400 series Harpertown Xeon run on a motherboard intended for 5300 series Clovertown Xeons - or if a hardware change was needed, it would not include the test pins.
The good news: There is anecdotal evidence that people have been able to use one Harpertown Xeon E5450 on a Mac Pro 1,1 what it is installed in socket B with a 3 GHz Xeon X5365 in socket A. This too would indicate that no hardware changes are needed.
I have a Mac Pro 1,1 and a Xeon E5450 processor, but have not had time to experiment with processor swapping yet.
New here,
Could it be SMC related? you can boot MBPs in SMC bypass not sure if you can with a MacPro
Could it be SMC related? you can boot MBPs in SMC bypass not sure if you can with a MacPro
UNBRICKING A MAC PRO 1,1
The Mac Pro 1,1 and 3,1 firmware is located in a 16 Mbit M50FW016 flash memory chip that sits in a TSOP-40 package in the upper left corner of the logic board, under the WiFi card. The chip is pin-compatible with the 82802 Firmware Hub (FWH) released by Intel in 2000.
The chips have two programming interfaces. In manufacturing the chips are programmed similarly to flash memory chips with a parallel EPROM programmer. Intel calls the parallel programming interface Address/Address-Multiplexed (A/A Mux) interface. It uses 8 data lines, 10 address lines and a Row-Column Address Select pin.
In a PC the chips communicate with the southbridge over the Firmware Hub Interface. The FWH interface is similar in function to the Low Pin Count bus that has replaced the ISA bus as the standard communication to legacy I/O devices in newer PCs. Instead of the one serial data line of LPC the FWH uses four. Most flash memory chips made for the FWH interface also support LPC or have alternate versions for LPC.
Only 32 of the 40 pins of the TSOP-40 package are in use. The M50FW016 chip also comes in a socketed 32-pin PLCC package.
To program a M50FW016 chip offline one needs a 40 pin EPROM programmer like the TL866II. One can be bought from AliExpress or Gearbest for about $50. The adapters for TSOP-40 or PLCC-32 packages cost another 10 to 20 dollars. It is evidently also possible to program a chip in a PLCC-32 package by hot swapping the chip into a PC motherboard that uses a similar chip. (I guess there are also motherboards with dual BIOS chips in PLCC-32 packages. One can also imagine a switchable dual chip adapter that plugs into a PLCC-32 socket and provides two similar sockets. I could not find one online.) It does not seem possible to program the chips with a 8-pin EPROM programmer through the FWH or the Low Pin Count interfaces.
The TSOP-40 package has a 0.5 mm pitch. It is possible to solder or desolder TSOP chips by hand, but it's not trivial and a reasonable amount of soldering skills are required. The preferred method may be to add a bit of solder paste to all the pins and heat with a heat gun.
Dual BIOS
Note: Before attempting any flash programming operations on the Mac Pro it may be advisable to write protect the original flash rom chip by setting the write protect (WP) pin 19 and the Top Block Lock (TBL) pin 20 to low ie. grounding them. If the pins are actively set to high (instead of floating) then it may be necessary to unsolder them. The placement in the corner position makes this possible.
The easiest way to achieve a dual BIOS on the Mac Pro may be to a solder another identical M50FW016 memory chip on top of the original ROM chip in piggyback style and selecting which chip is in use by toggling the chip select pins. At a minimum 10 of the pins need to be tied together but alternatively all but one may be tied together.
On the FWH interface the chip selection is different from most memory chips. Instead of an active chip select pin the chip has four Identification Inputs (ID0-ID3) that are permanently soldered to high or low before the chip is powered on. By convention the boot memory must have address ‘0000’ and all additional memories take sequential addresses starting from ‘0001’. Leaving the pins floating is equal to low ie. ‘0’.
One of the floating ID pins of the original ROM must be connected to a microswitch. The corresponding pin on the piggybacked ROM should be connected to the same switch. Depending on the position of the switch a 3.3 volt signal would be sent to either one of the chips. By convention, the pin to toggle should be ID0, but in practice any of the four pins can be used. What is required is that only one of the chips has the ID pins set to 0000 at any one time.
Looking at photographs of the ROM chips on Mac Pro 1,1 and 3,1 logic boards I see that ID pins ID0 and ID1 have traces connected to them. It is unclear what the purpose of these connections is. If the trace to ID1 is left floating on the motherboard, then it is possible to solder a pin or wire into the hole in the via located near the chip. If the trace is grounded, then it may be better to toggle some other ID pin that is or can be made floating. The obvious candidate is ID3 at the corner pin position 21.
If the secondary ROM is soldered in place, we need a method for programming it from software. I believe Flashrom would be able to connect to the right chip and flash it even when two rom chips are present. If not, we may have to somehow hot swap the active ‘0000’ chip by toggling the ID line and reseting both chips.
I searched the web for previous uses of a piggyback BIOS mod. The only common use seems to be in modding SEGA Dreamcast game consoles.
The alternative approach is to use a M50FW016 or a compatible chip in a 32-pin PLCC package and a PLCC adapter. Any chip that is read-compatible with the Intel® 82802 Firmware Hub and its FWH interface may do, even one with a lower capacity. Eight wires need to be connected to the PLCC 32 socket. Five of these need to be taken from the M50FW016 chip or from the ICH10 southbridge (or from some trace in between). These are the Input/Output Communications (FWH0-FWH3) at pins 25-28 and Input Communication Frame (FWH4) at pin 38. Most of the other pins needed for communication over the FWH interface are static or can be manually toggled. The 33 MHz PCI clock on pin 9 is mandatory, but might also be found on some other connector on the motherboard.
The other signals needed are Vss, Vcc, and a toggle switch for ID0. If the secondary ROM is to be in daily use, it may also benefit from Interface Reset (RP) and CPU Reset (INIT).
The M50FW016 chips also has five General Purpose Inputs (FGPI0-FGPI4). These can be used for reading jumper settings. Their status can be programmatically read from the General Purpose Input Register. I assume that these pins are not used in a Mac Pro. If they are, then the corresponding pins in the PLCC adapter must be set to the same values as the primary ROM.
If no Bluetooth or Wifi card is installed, then the standoffs may used to secure the PLCC adapter in place. It is unlikely that Wifi is needed when doingBIOS development, but it may be useful to place a POST diagnostic card in the empty mini PCIe slot.
What to test?
Before making any major changes to the Mac Pro firmware one must have means of recovering from nonworking firmware. Once a working firmware test setup is in place I would use BIOS files for Intel and SuperMicro motherboards and see if they POST or boot. The boards to try are dual LGA771 boards with the Intel® 5000X Greencreek memory controller that support Xeon 5400-series Harpertown processors.
The Mac Pro 1,1 and 3,1 firmware is located in a 16 Mbit M50FW016 flash memory chip that sits in a TSOP-40 package in the upper left corner of the logic board, under the WiFi card. The chip is pin-compatible with the 82802 Firmware Hub (FWH) released by Intel in 2000.
The chips have two programming interfaces. In manufacturing the chips are programmed similarly to flash memory chips with a parallel EPROM programmer. Intel calls the parallel programming interface Address/Address-Multiplexed (A/A Mux) interface. It uses 8 data lines, 10 address lines and a Row-Column Address Select pin.
In a PC the chips communicate with the southbridge over the Firmware Hub Interface. The FWH interface is similar in function to the Low Pin Count bus that has replaced the ISA bus as the standard communication to legacy I/O devices in newer PCs. Instead of the one serial data line of LPC the FWH uses four. Most flash memory chips made for the FWH interface also support LPC or have alternate versions for LPC.
Only 32 of the 40 pins of the TSOP-40 package are in use. The M50FW016 chip also comes in a socketed 32-pin PLCC package.
To program a M50FW016 chip offline one needs a 40 pin EPROM programmer like the TL866II. One can be bought from AliExpress or Gearbest for about $50. The adapters for TSOP-40 or PLCC-32 packages cost another 10 to 20 dollars. It is evidently also possible to program a chip in a PLCC-32 package by hot swapping the chip into a PC motherboard that uses a similar chip. (I guess there are also motherboards with dual BIOS chips in PLCC-32 packages. One can also imagine a switchable dual chip adapter that plugs into a PLCC-32 socket and provides two similar sockets. I could not find one online.) It does not seem possible to program the chips with a 8-pin EPROM programmer through the FWH or the Low Pin Count interfaces.
The TSOP-40 package has a 0.5 mm pitch. It is possible to solder or desolder TSOP chips by hand, but it's not trivial and a reasonable amount of soldering skills are required. The preferred method may be to add a bit of solder paste to all the pins and heat with a heat gun.
Dual BIOS
Note: Before attempting any flash programming operations on the Mac Pro it may be advisable to write protect the original flash rom chip by setting the write protect (WP) pin 19 and the Top Block Lock (TBL) pin 20 to low ie. grounding them. If the pins are actively set to high (instead of floating) then it may be necessary to unsolder them. The placement in the corner position makes this possible.
The easiest way to achieve a dual BIOS on the Mac Pro may be to a solder another identical M50FW016 memory chip on top of the original ROM chip in piggyback style and selecting which chip is in use by toggling the chip select pins. At a minimum 10 of the pins need to be tied together but alternatively all but one may be tied together.
On the FWH interface the chip selection is different from most memory chips. Instead of an active chip select pin the chip has four Identification Inputs (ID0-ID3) that are permanently soldered to high or low before the chip is powered on. By convention the boot memory must have address ‘0000’ and all additional memories take sequential addresses starting from ‘0001’. Leaving the pins floating is equal to low ie. ‘0’.
One of the floating ID pins of the original ROM must be connected to a microswitch. The corresponding pin on the piggybacked ROM should be connected to the same switch. Depending on the position of the switch a 3.3 volt signal would be sent to either one of the chips. By convention, the pin to toggle should be ID0, but in practice any of the four pins can be used. What is required is that only one of the chips has the ID pins set to 0000 at any one time.
Looking at photographs of the ROM chips on Mac Pro 1,1 and 3,1 logic boards I see that ID pins ID0 and ID1 have traces connected to them. It is unclear what the purpose of these connections is. If the trace to ID1 is left floating on the motherboard, then it is possible to solder a pin or wire into the hole in the via located near the chip. If the trace is grounded, then it may be better to toggle some other ID pin that is or can be made floating. The obvious candidate is ID3 at the corner pin position 21.
If the secondary ROM is soldered in place, we need a method for programming it from software. I believe Flashrom would be able to connect to the right chip and flash it even when two rom chips are present. If not, we may have to somehow hot swap the active ‘0000’ chip by toggling the ID line and reseting both chips.
I searched the web for previous uses of a piggyback BIOS mod. The only common use seems to be in modding SEGA Dreamcast game consoles.
The alternative approach is to use a M50FW016 or a compatible chip in a 32-pin PLCC package and a PLCC adapter. Any chip that is read-compatible with the Intel® 82802 Firmware Hub and its FWH interface may do, even one with a lower capacity. Eight wires need to be connected to the PLCC 32 socket. Five of these need to be taken from the M50FW016 chip or from the ICH10 southbridge (or from some trace in between). These are the Input/Output Communications (FWH0-FWH3) at pins 25-28 and Input Communication Frame (FWH4) at pin 38. Most of the other pins needed for communication over the FWH interface are static or can be manually toggled. The 33 MHz PCI clock on pin 9 is mandatory, but might also be found on some other connector on the motherboard.
The other signals needed are Vss, Vcc, and a toggle switch for ID0. If the secondary ROM is to be in daily use, it may also benefit from Interface Reset (RP) and CPU Reset (INIT).
The M50FW016 chips also has five General Purpose Inputs (FGPI0-FGPI4). These can be used for reading jumper settings. Their status can be programmatically read from the General Purpose Input Register. I assume that these pins are not used in a Mac Pro. If they are, then the corresponding pins in the PLCC adapter must be set to the same values as the primary ROM.
If no Bluetooth or Wifi card is installed, then the standoffs may used to secure the PLCC adapter in place. It is unlikely that Wifi is needed when doingBIOS development, but it may be useful to place a POST diagnostic card in the empty mini PCIe slot.
What to test?
Before making any major changes to the Mac Pro firmware one must have means of recovering from nonworking firmware. Once a working firmware test setup is in place I would use BIOS files for Intel and SuperMicro motherboards and see if they POST or boot. The boards to try are dual LGA771 boards with the Intel® 5000X Greencreek memory controller that support Xeon 5400-series Harpertown processors.
Last edited:
I am currently working on a mac pro to support sierra and up but I need someone to add the E5440 SLANS microcode to a bootrom because I can't dump my rom using romtool
@LightBulbFun
@LightBulbFun
Another possible option instead of piggy back.. is perhaps if there is enough space for Two copies
Do it via 1 chip & the highest address line.... by toggling the highest address line & having the boot code on its boundary
Do it via 1 chip & the highest address line.... by toggling the highest address line & having the boot code on its boundary
You might kindly ask @dosdude1 if he could do this ;-)
@dosdude1 I have bought 2 E5440 SLANS cpu's which were used in the MP3.1 and I want to test them in a MP1.1 flashed to a MP2.1 (with stock smc) can you make a bootrom with added microcode for this cpu? I was researching how to do it myself but because of a slight hiccup i'm not able to dump the rom and I can't get access to a 3.1 rom for the microcode (and maybe some snooping around). If you got some free time on your hands let me know. Thanks in advance!
[automerge]1580943054[/automerge]
Something else I was looking at the cpuid's for woodcrest and clovertown. The part that stood out was that they start with the same number 06fX. Maybe that's why a stock bootrom boots with a clovertown cpu because that part is written somewhere in the system but I don't know where yet. The cpuid for harpertown is 1067X.
[automerge]1580943054[/automerge]
Something else I was looking at the cpuid's for woodcrest and clovertown. The part that stood out was that they start with the same number 06fX. Maybe that's why a stock bootrom boots with a clovertown cpu because that part is written somewhere in the system but I don't know where yet. The cpuid for harpertown is 1067X.
Last edited:
sadly its more or less not possible to add microcode to the MP1,1/2,1 bootrom
for some reason it causes a CPU Error during POST, even with otherwise supported CPUs like the G0 Clovertowns which work but don't have microcode in the Firmware
but the moment you add the microcode it stops POSTing sadly
if your looking for a MP3,1 BootROM to snoop around in then you can find a copy here
github.com
(I still want/need to get an Xserve2,1 or MP3,1 to play around with I wanna see if I can get E0 stepping CPUs working )
and on that note another thing I want to try is a Wolfdale-DP CPU in a MP1,1-2,1
I know of a couple motherboards, that work with Quad core 65Nm CPUs but only Dual Core 45Nm CPUs, and I wonder if the MP1,1/2,1 may have a similar trait
for some reason it causes a CPU Error during POST, even with otherwise supported CPUs like the G0 Clovertowns which work but don't have microcode in the Firmware
but the moment you add the microcode it stops POSTing sadly
if your looking for a MP3,1 BootROM to snoop around in then you can find a copy here
firmware_vault/EFI/MacPro/MP31_006C_05B_LOCKED.fd at master · gdbinit/firmware_vault
A repo for all Apple EFI firmware files. Contribute to gdbinit/firmware_vault development by creating an account on GitHub.
github.com
(I still want/need to get an Xserve2,1 or MP3,1 to play around with I wanna see if I can get E0 stepping CPUs working
)and on that note another thing I want to try is a Wolfdale-DP CPU in a MP1,1-2,1
I know of a couple motherboards, that work with Quad core 65Nm CPUs but only Dual Core 45Nm CPUs, and I wonder if the MP1,1/2,1 may have a similar trait
I put the E5440 in socket a and socket b. But as expected the system didn't boot. The difference between the sockets A and B is when you put the CPU in socket B the fans ramp up to max and in socket A the fans stay at normal speed. This is probably because socket B is the primary one.
[automerge]1581008324[/automerge]
[automerge]1581008324[/automerge]
The Wolfdale-DP also differs from the woodcrest cpuid 1067X From 06fx so I guess it's not going to work but might be worth a shot! Keep us updated.sadly its more or less not possible to add microcode to the MP1,1/2,1 bootrom
for some reason it causes a CPU Error during POST, even with otherwise supported CPUs like the G0 Clovertowns which work but don't have microcode in the Firmware
but the moment you add the microcode it stops POSTing sadly
if your looking for a MP3,1 BootROM to snoop around in then you can find a copy here
firmware_vault/EFI/MacPro/MP31_006C_05B_LOCKED.fd at master · gdbinit/firmware_vault
A repo for all Apple EFI firmware files. Contribute to gdbinit/firmware_vault development by creating an account on GitHub.
(I still want/need to get an Xserve2,1 or MP3,1 to play around with I wanna see if I can get E0 stepping CPUs working
and on that note another thing I want to try is a Wolfdale-DP CPU in a MP1,1-2,1
I know of a couple motherboards, that work with Quad core 65Nm CPUs but only Dual Core 45Nm CPUs, and I wonder if the MP1,1/2,1 may have a similar trait
On a dual-CPU cMP, CPU B is on the left - CPU A is on the right. You can run with just one CPU in a dual-CPU cMP, however it must be placed in CPU A. You can't run with just one CPU if it's in CPU B.
the MacPro1,1 is a bit weird in that IIRC the CPU Socket marked "B" is actually the primary socket
(aka if you want to run with just 1 CPU you must have the CPU in Socket B)
what you have shown there is for a MP4,1/5,1
I can't use those files since they are encrypted and to decrypt them I need a device with at least macos 10.13 which I don't have.sadly its more or less not possible to add microcode to the MP1,1/2,1 bootrom
for some reason it causes a CPU Error during POST, even with otherwise supported CPUs like the G0 Clovertowns which work but don't have microcode in the Firmware
but the moment you add the microcode it stops POSTing sadly
if your looking for a MP3,1 BootROM to snoop around in then you can find a copy here
firmware_vault/EFI/MacPro/MP31_006C_05B_LOCKED.fd at master · gdbinit/firmware_vault
A repo for all Apple EFI firmware files. Contribute to gdbinit/firmware_vault development by creating an account on GitHub.
(I still want/need to get an Xserve2,1 or MP3,1 to play around with I wanna see if I can get E0 stepping CPUs working
and on that note another thing I want to try is a Wolfdale-DP CPU in a MP1,1-2,1
I know of a couple motherboards, that work with Quad core 65Nm CPUs but only Dual Core 45Nm CPUs, and I wonder if the MP1,1/2,1 may have a similar trait
Is it possible for the Mp that it runs a mda5 check on the bootrom before booting that would explain why the system doesn't boot when adding a new micro code. If someone has a lot of knowledge and time maybe they could fully reverse engineer the bootrom and hopefully find the issues with harpertown cpu's
its a common misconception they are encrypted, they are BootROMs in full, just without any serial numbers etc, i have flashed them directly to my Macs before when testing out stuff (as for testing it does not matter if the serial numbers etc are all missing etc)
like did you know MacMini1,1/2,1 firmware works on a MB2,1? LOL
it would be fun with a scrap MP1,1/2,1 that still POSTs at least, to flash MP3,1 firmware to it just for giggles to see what will happen
funnily enough no I dont think so, as if I swap the CPUs out for a diffrent type, the machine POSTs again and im able to recover the firmware back to a workable version, if it was a checksum thing, then nothing would work and the machine would be bricked (hence why I tested this initially with a MB2,1 test machine I have, since if bricked it, no big loss and its MUCH easier to recover via an external programmer then the TSOP nightmare that is the MP1,1-3,1 BootROM chip)
I had fully expected there to be some sort of checksum or such, but no it doesn't look like it, as documented in this thread apart from this specific MP1,1/2,1/XS1,1 oddity im able to change microcodes no problem in other macs etc
If I were to flash MP3.1 firmware on it and it no longer posts would that mean it is bricked and the only way to recover it is with desoldering the eeprom? Or just change CPU and reflash?
it would be bricked in this case, so I would only do it with a machine/mobo you can afford to lose!
(especially as the EEPROM on the MP1,1-3,1 is not your normal 8 pin SPI jobby)
speaking of playing with a MP1,1/2,1/XS1,1 fun, 2 SLAND E5240 CPUs have arrived today
Replace the micro code of other cpu's in the bootrom with your E5240 microcode. I'm also wondering which platform you use for the microcode (lga771 or lga775 microcode )it would be bricked in this case, so I would only do it with a machine/mobo you can afford to lose!
(especially as the EEPROM on the MP1,1-3,1 is not your normal 8 pin SPI jobby)
speaking of playing with a MP1,1/2,1/XS1,1 fun, 2 SLAND E5240 CPUs have arrived today
well as just mentioned that's sadly not really possible with the MP1,1/2,1/XS1,1, I might still give adding microcode a go but id not expect miracles
the E5240 is an LGA771 CPU so Id use LGA771 microcode of course
(for Platform 2 which is for Dual Core LGA771 CPUs)
initial testing with my Xserve1,1 shows that sadly the E5240's do not work, I will still test in my MP1,1 (and with 2,1 firmware) but I have to unearth it first and getting to the CPUs is a bit more involved then in an Xserve!
did find out interestingly that the Xserve1,1 has no main CPU, ie you can have a single CPU either in socket A or Socket B and it will POST just fine (assuming the CPU is one compatible with it, like the 5130's my Xserve shipped with)
did find out interestingly that the Xserve1,1 has no main CPU, ie you can have a single CPU either in socket A or Socket B and it will POST just fine (assuming the CPU is one compatible with it, like the 5130's my Xserve shipped with)
I was wondering if someone fully understands the bootrom. Maybe then we could find out why harpertown cpu's don't work in MP1.1 / MP2.1
I ordered a POST diagnostic card from AliExpress and installed it in my Mac Pro 1,1 in the mini PCIe slot in place of the Wifi card. I was hoping it would display something during the boot process. Unfortunately the card showed nothing. It only displayed a single zero when power was turned on and stayed that way.
There may be another way of monitoring the progress of the firmware. Pin AB2 on the LGA771 socket is an open drain output named IERR#. It seems that the IERR output directly controls the ERRA and ERRB status LEDs. The output is set to the error state when the CPU encounters a machine-check exception.
I have not yet tried a Xeon E5450 processor in my Mac Pro 1,1. I guess what would happen is that the processor would halt with the ERRA led on. Is it possible to figure out from disassembled firmware code where in the code this happens?
P.S. - In the photo you can also see the 30-pin programming connector for the firmware flash memory chip. It is located right above Slot 4 and marked "LPC" for "low pin count".
Update February 26, 2020: In the User's Manual for the SuperMicro X7DB8/X7DBE motherboard I find the following BIOS setting:
The Mac Pro 3,1 has a similar hidden BIOS but without any user interface. See Accessing the hidden MP3,1 BIOS setup utility?
I can read the default setting by accessing the NVRAM in the variable Setup-EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 from Linux. The IFR data description, when converted to a human readable form says:
"Variable: 0xB3" means that the setting is at at offset 0xB3 NVRAM variable. On my Mac Pro 3,1 the default setting is 0x00, i.e. the diagnostic Port 80h POST codes are sent to the Low Pin Count (LPC) bus.
To read the POST codes during boot I have two options:
Update August 12, 2020: Macs must be sending POST codes somewhere, as this Chinese POST code analyzer comes with cables and two different probes for the 30-pin J6100 connector. (At US $32.09 this must be the cheapest way. to get access to the J6100 connector.)
Update July 4, 2024: There is no universally agreed way of sending POST codes to the PCIe bus. Even if these was, it would not work, as the PCIe bridges are initialized late in the boot process. (The LPC bus works as soon as the power is switched on, even before the CPU executes its first instruction. How else would the processor access its boot code in the boot ROM that is placed on the LPC bus?)
The only reason the POST debug card in the photo exist, is because some laptop makers have decided to route the LPC bus to unused or reserved pins on the miniPCIe connector. From the LRF page selling the card:
My experiment shows that either the Mac Pro does not broadcast POST codes on the LPC bus, or more likely, Apple did not route the LPC but to the pins reserved for a SIM (Subscriber Identity Module) interface on miniPCIe connector. A more likely place for a LPC debug bus is the 6-pin unpopulated header right above the 30-pin "LPC" connector on the Mac Pro 1,1 logic board. (Seen on the top right in the photo above.) The correct way to use the card would be to connect jumper wires from the 7-pin PC header on the card to the six header pins on the Mac Pro board. (LRESET# is not needed for debugging.)
I have made some new discoveries on the LPC bus. I will write more in a new post somewhere on page 17 of this thread.
There may be another way of monitoring the progress of the firmware. Pin AB2 on the LGA771 socket is an open drain output named IERR#. It seems that the IERR output directly controls the ERRA and ERRB status LEDs. The output is set to the error state when the CPU encounters a machine-check exception.
I have not yet tried a Xeon E5450 processor in my Mac Pro 1,1. I guess what would happen is that the processor would halt with the ERRA led on. Is it possible to figure out from disassembled firmware code where in the code this happens?
P.S. - In the photo you can also see the 30-pin programming connector for the firmware flash memory chip. It is located right above Slot 4 and marked "LPC" for "low pin count".
Update February 26, 2020: In the User's Manual for the SuperMicro X7DB8/X7DBE motherboard I find the following BIOS setting:
The Mac Pro 3,1 has a similar hidden BIOS but without any user interface. See Accessing the hidden MP3,1 BIOS setup utility?
I can read the default setting by accessing the NVRAM in the variable Setup-EC87D643-EBA4-4BB5-A1E5-3F3E36B20DA9 from Linux. The IFR data description, when converted to a human readable form says:
"Variable: 0xB3" means that the setting is at at offset 0xB3 NVRAM variable. On my Mac Pro 3,1 the default setting is 0x00, i.e. the diagnostic Port 80h POST codes are sent to the Low Pin Count (LPC) bus.
To read the POST codes during boot I have two options:
- I could try to find a LPC header somewhere and connect it to the LPC pins on my POST card. (Maybe the connector marked "LPC")
- I could modify the NVRAM variable that stores the BIOS settings and hope to see the POST codes on the PCIe bus.
Update August 12, 2020: Macs must be sending POST codes somewhere, as this Chinese POST code analyzer comes with cables and two different probes for the 30-pin J6100 connector. (At US $32.09 this must be the cheapest way. to get access to the J6100 connector.)
Update July 4, 2024: There is no universally agreed way of sending POST codes to the PCIe bus. Even if these was, it would not work, as the PCIe bridges are initialized late in the boot process. (The LPC bus works as soon as the power is switched on, even before the CPU executes its first instruction. How else would the processor access its boot code in the boot ROM that is placed on the LPC bus?)
The only reason the POST debug card in the photo exist, is because some laptop makers have decided to route the LPC bus to unused or reserved pins on the miniPCIe connector. From the LRF page selling the card:
My experiment shows that either the Mac Pro does not broadcast POST codes on the LPC bus, or more likely, Apple did not route the LPC but to the pins reserved for a SIM (Subscriber Identity Module) interface on miniPCIe connector. A more likely place for a LPC debug bus is the 6-pin unpopulated header right above the 30-pin "LPC" connector on the Mac Pro 1,1 logic board. (Seen on the top right in the photo above.) The correct way to use the card would be to connect jumper wires from the 7-pin PC header on the card to the six header pins on the Mac Pro board. (LRESET# is not needed for debugging.)
I have made some new discoveries on the LPC bus. I will write more in a new post somewhere on page 17 of this thread.
Last edited: