Gulftown, Westmere, Nehalem microcode update guide

[reukiodo]

At last, my ROM microcode editing application is complete! It took me a lot longer than I anticipated to write this, but here it is, a fully interactive GUI that can add/extract/replace microcodes in your system ROM dump! This is how it works:

- Open the program, and select a dumped ROM.
- From here, you can simply right-click in the table to perform actions, or use the Menu Bar items.
- To extract a microcode from your ROM, simply right-click on the microcode you wish to extract, and select "Extract Microcode". Save it to a file.
- To add a new microcode, simply right-click anywhere in the table, and select "Add Microcode". If the microcode for the same CPUID and platform ID in the microcode you're trying to add already exists in the ROM, it will replace it with the selected file. If not, it will add it.
- Microcode files can also be dragged and dropped onto the table to add them.
- Once the modifications you desire have been made, simply save the file, or do "Save as" to save it as a different file, keeping your original unmodified.

Download the application here. Source code is available on my GitHub. Microcode files can be obtained here.

Enjoy!

View attachment 766112

First, thank you dosdude1 for this tool. I am very thankful that I do not need to hex edit with a worse potential of ruining my Mac Pro.

Do you have any plans to expand the ROM editor to add EFI modules such as the NVMe driver?

When searching for more info, I see there is a newer firmware for 106A4 but for platform 3. Do the platforms 1 and 2 still need to be included? I can't seem to find if this is important or not.

According to cpu-world:
http://www.cpu-world.com/cgi-bin/CPUID.pl?SIGNATURE=67236 106A4 is mainly for i7 CPUs
http://www.cpu-world.com/cgi-bin/CPUID.pl?SIGNATURE=67237 106A5 seems to be mainly Nehalem CPUs
http://www.cpu-world.com/cgi-bin/CPUID.pl?SIGNATURE=132800 206C0 is for unknown Intel CPUs - this should be safe to remove to make space for the updates, correct?
http://www.cpu-world.com/cgi-bin/CPUID.pl?SIGNATURE=132802 206C2 seems to be mainly Westmere CPUs

 

[eksu]

what would you need to get the Xserve 3.1 accept X56xx processor?

My understanding is that you can flash a Xserve 3.1 with the Mac Pro 5,1 firmware to run with X5690's and 1333mhz memory, but some of the ram slots won't work any more and other goofiness exists (fans run 100%, air port card is reported as a GPU, etc).

You can read this thread at netkas on it.

 

[reukiodo]

Removing the 206C0 and updating the 206C2p03 seems to have worked for the MacPro5,1, as it now shows:
machdep.cpu.microcode_version: 31

Next is to do the same with the MacBookAir2,1, which currently has 3 microcodes:
10674 v405(1029) platform 80 @4K
10676 v60C(1548) p80 @4K
1067A vA07I(2567) pA0 @8K
though oddly the sysctl machdep.cpu shows an unmatching:
machdep.cpu.microcode_version: 2571

Since my MBA2,1 has the L9600 which cpu-world says is 1067A, I removed the 10674p80 and 10676p80 in order to add one of these:
https://github.com/platomav/CPUMicr...lat44_ver00000A0E_2015-07-29_PRD_A3107D75.bin
https://github.com/platomav/CPUMicr...latB1_ver00000A0E_2015-07-29_PRD_59BF808E.bin
as they are each 8K, so I can only add one.

I'm still not sure of the significance of the platform id, so at least for now I'm going to leave the 1067ApA0 in and hope it still boots.

 

[Spacedust]

How about Windows 7 in EFI mode?

 

[reukiodo]

How about Windows 7 in EFI mode?

I don't run Windows on my Macs, so I wouldn't know.

 

[reukiodo]

I'm still not sure of the significance of the platform id, so at least for now I'm going to leave the 1067ApA0 in and hope it still boots.

So after updating the ROM to include:
1067A vA07(2567) pA0 @8K
1067A vA0E(2574) p44 @8K
The MBA2,1 didn't seem to boot after selecting reboot, but after a LONG (2min?) delay, it finally played the long low 'rom update' tone and after another LONG (~3min?) delay, finally booted the OS. Running sysctl machdep.cpu still shows an unmatching:
machdep.cpu.microcode_version: 2571

I didn't think this was normal, so I tried:
1067A vA07(2567) pA0 8K
1067A vA0E(2574) pB1 8K
This still resulted in the long boot delays, and sysctl machdep.cpu still shows an unmatching:
machdep.cpu.microcode_version: 2571

I'm beginning to think the CPUID isn't correct for the L9600, but other than cpu-world, I'm not sure how to check.

 

[reukiodo]

I'm beginning to think the CPUID isn't correct for the L9600, but other than cpu-world, I'm not sure how to check.

So I determined that:
machdep.cpu.signature: 67194
actually translates from decimal to 1067A in hexidecimal, so I guess that this CPUID is correct.

I still can't figure out why the boot is so delayed though... Where does platform id come from? A0 hex translates to 160 in dec, but that isn't listed anywhere in the machdep.cpu values.

 

[reukiodo]

I still can't figure out why the boot is so delayed though...

I tried flashing back to the original, resetting NVRAM, and resetting SMC... Any other ideas on why it permanently boots into firmware update mode?

 

[tsialex]

I tried flashing back to the original, resetting NVRAM, and resetting SMC... Any other ideas on why it permanently boots into firmware update mode?

Did you tried to disconnect the battery for a minute or two?

 

[reukiodo]

Did you tried to disconnect the battery for a minute or two?

The MacBook Air isn't exactly the easiest to unplug the battery. I was going to try this on my MacBook5,2 since its battery is very easily removable, but it seems to beachball forever and need to fix that first. When I can have time and space to get around to pulling the MBA battery, I'll see if that works to get it booting normally again.

 

[reukiodo]

Did you tried to disconnect the battery for a minute or two?

Finally got around to doing this, but still get the blinking power light and then the long low tone indicating ROM flashing mode. I tried leaving the power and battery out for quite a while but still no change. It seems to be permanently in ROM flashing boot mode now.

Now I'm thankful that I didn't do this on my main MacBook Pro first, and a bit leery to do it now until I find a solution to the MBA booting.

 

[reukiodo]

I took the MBA to the Apple Store and the genius booted it from their network to run diagnostics because he thought it was a motherboard problem, and their tool didn't find any issues. So, as a warning to other MBA users, once you boot into ROM flashing mode, be prepared for it to ALWAYS boot that way after that, which means incredibly slow boots (minutes, not seconds).

 

[reukiodo]

Ouch! I tried to update the EFI on my MacBook5,2 (it's a MacBook 2009 logic board in a black MacBook case) and everything seemed successful (read ROM, update microcodes, flash ROM) until reboot... now it no longer boots, only lights up the power/sleep light. I tried removing the battery, resetting SMC, reseting NVRAM... no change. I think my beloved blackbook is dead now.

I looked for a MacBook5,2 Firmware Restoration CD but nothing... Any help?

 

[reukiodo]

Could it be something to do with the fact that my Mac Pro is running High Sierra when reading, editing, and writing the ROM?

The MacBook Air 2,1 only has 10.11 El Capitan, and the now dead MacBook 5,2 only had 10.9 Mavericks. Are the ROM Tools supposed to be used on a newer MacOS version?

 

[tsialex]

Could it be something to do with the fact that my Mac Pro is running High Sierra when reading, editing, and writing the ROM?

The MacBook Air 2,1 only has 10.11 El Capitan, and the now dead MacBook 5,2 only had 10.9 Mavericks. Are the ROM Tools supposed to be used on a newer MacOS version?

Did you used dosdude1 ROMTool? V1.x had a problem identifying the SPI-flash. You need to reprogram it with a external programmer like the el cheapo CH341a.

Read here to know how to use CH341 to flash MacBooks Pro#1801. You can use more or less the same procedure with MacBooks, but you will need a SOIC 8 clip and inject 3v3 on VDD/PP3V3_SUS.
[doublepost=1534563866][/doublepost]

 

[reukiodo]

Did you used dosdude1 ROMTool? V1.x had a problem identifying the SPI-flash. You need to reprogram it with a external programmer like the el cheapo CH341a.

Read here to know how to use CH341 to flash MacBooks Pro#1801. You can use more or less the same procedure with MacBooks, but you will need a SOIC 8 clip and inject 3v3 on VDD/PP3V3_SUS.

Yes, I just used disdude's ROMTool. I'll need to pull the hard drive out and look at the contents to determine which version.

I have thought it might be possible to flash it if I disassemble the MacBook and find the flash chip. I have a 8 pin clip I intended to use with a Raspberry Pi in flashing my ThinkPad X230T BIOS to remove the stupid wifi restrictions, but hadn't gotten around to that project yet. At least it has relatively explicit howto instructions to follow.

Would I be able to just flash the original ROM dumped from ROMTool back to the chip in the MacBook, or is that no good now either? I assume that I can just follow the chip flashing guides for the Lenovos...

 

[tsialex]

You can try first with Pi+flashrom+SOIC clip, that thread have some pointers on that, but usually people need to desolder to flash with Pi+flashrom.

If you have a working dump on your HDD it will be easier, just use that. If you don't have, read the corrupt one and maybe we can extract the info needed or get from another means (labels etc):

SSN = System Serial Number
HWC = Hardware Code
SON = System Order Number
LBSN = Logic Board Serial Number
BD = Build Date

 

[Pentaxer]

Hi to everybody!

I am very interesting in this topic. But can't download ROMTool - all links are broken. Can you help me?

Is there any improvements in stability or performance after microcode update?

 

[tsialex]

Hi to everybody!

I am very interesting in this topic. But can't download ROMTool - all links are broken. Can you help me?

Read #1783

Is there any improvements in stability or performance after microcode update?

140.0.0.0.0 already has the most recent Xeon microcode updates.

 

[Pentaxer]

Thank you!

 

[*TLF*]

What the the password for the ROMTool.zip file? As you can see from the picture i have attached.

 

[tsialex]

What the the password for the ROMTool.zip file? As you can see from the picture i have attached.

Password is “rom”.

https://forums.macrumors.com/threads/mp5-1-bootrom-thread-140-0-0-0-0.2132317/page-99#post-26824843

 

[*TLF*]

Thanks for the timely response.

TLF

 

[nos1609]

You can try first with Pi+flashrom+SOIC clip, that thread have some pointers on that, but usually people need to desolder to flash with Pi+flashrom.

If you have a working dump on your HDD it will be easier, just use that. If you don't have, read the corrupt one and maybe we can extract the info needed or get from another means (labels etc):

SSN = System Serial Number
HWC = Hardware Code
SON = System Order Number
LBSN = Logic Board Serial Number
BD = Build Date

Is that the info I need to spoof to macOS from original firmware to make iMessage work again? Once I falshed a clean fd onto my logic board and this info is empty

 

[tsialex]

Is that the info I need to spoof to macOS from original firmware to make iMessage work again? Once I falshed a clean fd onto my logic board and this info is empty

No, a backplane flashed with the generic image for upgrades don't have the last sector of the BootROM (MLB sector, where LBSN and BD are stored), plus the 3rd (Fsys) and 4th (Gaid) stores of the NVRAM (where all the hardwareIDs and the hardware descriptor are stored).

Spoofing using data generated by Clover/etc can work for sometime for iMessage/FaceTime identification, but the missing Fsys and Gaid stores have other implications.