Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
does this actually mean anything?

its there, but does it have any effect and can it be cleared by PRAM?

just mentioning this because its easy for people to get fear mongered into things that might not actually mean anything especially if people dont understand what they are looking at
First, MP4,1/5,1 don't have PRAM, let's stop using wrong terminology.

Clear NVRAM don't remove MemoryConfigs. The first and more common adverse effect is not recognising DIMMs speed, but this can be resolved with a 3-step clear NVRAM forcing reconfiguration of the DIMMs.

The real problem is space occupied, all these entries not being removed plus IASInstallPhaseList and SecureBoot certificates are making the NVRAM full, it's just 64KB.

Some Mac are now incapable of even changing the boot disk, it's the most common noticed collateral effect. Other problem is not being capable of setting up the NVRAM setting of NVIDIA web drivers.
 
Last edited:

crjackson2134

macrumors 601
Mar 6, 2013
4,847
1,957
Charlotte, NC
does this actually mean anything?

its there, but does it have any effect and can it be cleared by PRAM?

just mentioning this because its easy for people to get fear mongered into things that might not actually mean anything especially if people dont understand what they are looking at



Did you miss post #3221
Multiple memory configs + SecureBoot certificates (they are big) + IASInstallPhaseList (can be very long sometimes) can make a NVRAM full and a Mac practically non functional.
 
Last edited:
  • Like
Reactions: tsialex

mrtang42

macrumors member
Apr 19, 2019
73
18
First, MP4,1/5,1 don't have PRAM, let's stop using wrong terminology.

Clear NVRAM don't remove MemoryConfigs. The first and more common adverse effect is not recognising DIMMs speed, but this can be resolved with a 3-step clear NVRAM forcing reconfiguration of the DIMMs.

The real problem is space occupied, all these entries not being removed plus IASInstallPhaseList and SecureBoot certificates are making the NVRAM full, it's just 64KB.

Some Mac are now incapable of even changing the boot disk, it's the most common noticed collateral effect. Other problem is not being capable of setting up the NVRAM setting of NVIDIA web drivers.

Will removing the motherboard battery help to clean the NVRAM?
 

LightBulbFun

macrumors 68030
Nov 17, 2013
2,900
3,195
London UK
First, MP4,1/5,1 don't have PRAM, let's stop using wrong terminology.

Clear NVRAM don't remove MemoryConfigs. The first and more common adverse effect is not recognising DIMMs speed, but this can be resolved with a 3-step clear NVRAM forcing reconfiguration of the DIMMs.

The real problem is space occupied, all these entries not being removed plus IASInstallPhaseList and SecureBoot certificates are making the NVRAM full, it's just 64KB.

Some Mac are now incapable of even changing the boot disk, it's the most common noticed collateral effect. Other problem is not being capable of setting up the NVRAM setting of NVIDIA web drivers.

has anyone done some actual testing by manually filling up NVRAM sections and seeing what happens? doing some controlled testing is always a good thing :)

also start up disk settings I know are stored in the "user" part of NVRAM that can be reset via a PRAM reset (thats what apple calls it not me!) so im not sure how a Full NVRAM could break that, since all the user would have to do is a PRAM reset and then that section of NVRAM At least would be clear

your digging into the ROMs has been very interesting, but I just feel like it might be worth posting things a bit better

then just "look at all these memory configurations!"

most people wont really know what they are looking at and can get unnecessarily scared about things

(especially as its clear no one has 100% understanding of how the BootROM works and is put together and we are still learning as we go along)

BTW Have you done any testing with NVRAM in Linux? since I know linux can poke at NVRAM (People used linux to set NVRAM variables to disable the dGPU in 2011 MBPs)
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
I've been working on something…

binwalk_bugout.png binwalk_Eschers.b.png binwalk_Riff_Al.png binwalk_Sharky II.png

I'll be adding more signatures (SecureBoot/AHT/NVIDIA blobs/etc) and will test a lot before making it public, so please don't ask for it before release.


I'll make the binwalk signatures file available when done and tested, don't ask for it now.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
I was thinking that one way to check for an already messed dump was for searching the GUID of NVMe EFI module. If the dump is <140.0.0.0.0 and have NVMe EFI module, it's not an original dump anymore.

So, I implemented it after some trouble with the weird GUID endianness. Works nicely, but look at this:


Screen Shot 2019-04-27 at 22.58.29.png

If anyone knows a plausible explanation, besides the user injecting the NVMe EFI module twice, I'm all ears.



I'll make the binwalk signatures file available when done and tested, don't ask for it now.
 
Last edited:
  • Like
Reactions: h9826790

LightBulbFun

macrumors 68030
Nov 17, 2013
2,900
3,195
London UK
iv not checked EFI drivers/modules

but i do know with the MacPro4,1/5,1 Firmware (and most EFI64 Macs in general) the Microcodes are repeated twice in firmware for some reason

I wonder if its to do with some sort of self recovery system or something? im not sure why else the microcodes would be repeated twice
 

crjackson2134

macrumors 601
Mar 6, 2013
4,847
1,957
Charlotte, NC
I was thinking that one way to check for an already messed dump was for searching the GUID of NVMe EFI module. If the dump is <140.0.0.0.0 and have NVMe EFI module, it's not an original dump anymore.

So, I implemented it after some trouble with the weird GUID endianness. Works nicely, but look at this:

View attachment 834201

If anyone knows a plausible explanation, besides the user injecting the NVMe EFI module twice, I'm all ears:

That was my conclusion too...
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
AHT signature done, with date of test and version of AHT:

Screen Shot 2019-04-28 at 02.29.40.png

Later I'll check if the AHT completed without error, but I need to find more AHT examples before refining too much the parsing signatures. It's not exactly common in my dump stash and has more than one version - need to check if the log syntax are the same between versions.

I'll make the binwalk signatures file available when done and tested, don't ask for it now.
 
Last edited:

norda72

macrumors member
May 27, 2016
48
6
Bollnäs, Sweden
It's not a 17G5019 correction, but something with the MAS backend. I had 17G5019 already installed into my home MP5,1 when I noticed, sometime later in the past week Apple corrected it.
To get 141.0.0.0.0, do I have to erase my SSD and install everything from scratch? I have 140.0.0.0.0 now in my old Mac Pro. Why doesn’t it install firmware updates when they come in MacOS? Is it too old?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
To get 141.0.0.0.0, do I have to erase my SSD and install everything from scratch? I have 140.0.0.0.0 now in my old Mac Pro. Why doesn’t it install firmware updates when they come in MacOS? Is it too old?
Answered in the first post of the thread, at the beginning.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
Checking some old dumps that users here sent me, searching for good signature test cases. Thought of showing some examples of the weird ones on the thread.

Another example with double NVMe EFI module:

binwalk.highvoltage12v.png


Double injected and messed up:

binwalk.EarlUrley.MP51.0087.B00.png


This one is really messed up with three IASInstallPhaseList plists and with five IASCurrentInstallPhaseBoot entries. The weirdest thing for me is that it have so much incomplete macOS installs and not one PanicLog.

binwalk.bookemdano.138.0.0.0.0.png


I'll make the binwalk signatures file available when done and tested, don't ask for it now.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
My guess for all those memory configs is unstable linking to ram sticks due to bad contacts. In CPU sockets and or ram slots.

I don't think so. Bad contacts would made sense if the dumps always had the same serial numbers/same memory config formats and with bad contacts the dump should have KPs, most don't have.

If you check a dump with multiple memory configs you will notice different memory serial numbers, different formats of memoryconfig ( g, h, i and j) and different numbers of DIMMs. Some you clearly see that the CPU tray was upgraded from single CPU to dual, from 3 DIMMs to 8 DIMMs.

This seems more a bug that make old entries not being deleted than anything. This behaviour makes total sense with Macs that have soldered RAM, but none whatsoever with a Mac Pro.
 
Last edited:
  • Like
Reactions: Eschers

Mac_User 0101

macrumors regular
Oct 8, 2017
133
43
First, MP4,1/5,1 don't have PRAM, let's stop using wrong terminology.

Clear NVRAM don't remove MemoryConfigs. The first and more common adverse effect is not recognising DIMMs speed, but this can be resolved with a 3-step clear NVRAM forcing reconfiguration of the DIMMs.

The real problem is space occupied, all these entries not being removed plus IASInstallPhaseList and SecureBoot certificates are making the NVRAM full, it's just 64KB.

Some Mac are now incapable of even changing the boot disk, it's the most common noticed collateral effect. Other problem is not being capable of setting up the NVRAM setting of NVIDIA web drivers.
Is this an isolated incident or something happening across the board with cMP MemoryConfigs in NVRAM?
 

Mac_User 0101

macrumors regular
Oct 8, 2017
133
43
It's what we are trying to determine. No one shouldn't worry with things posted here, for now, everything is an edge case being researched.
Ok, I'll be following the thread to see what is determined. When I read the post stating the side effects of not being able to change boot disks or setup NVRAM it made me paranoid that it may be intentional design.

I have an actual mid 2010 5,1 that came with the duel quad core 2.4 GHz Xeon. I did upgrade the CPU's and I'm not running Mojave but I'd be happy to provide you with a BootROM dump if that helps you. Thank you for all your hard work.
 

MIKX

macrumors 68000
Dec 16, 2004
1,815
691
Japan
1,
What is the difference to resetting NVRAM ONCE compared to resetting NVRAM FOUR times consecutively.

2. Can older NVRAM entries be safely removed ?

I have usually reset NVRAM TWICE consecutively in the past.
 

crjackson2134

macrumors 601
Mar 6, 2013
4,847
1,957
Charlotte, NC
1,
What is the difference to resetting NVRAM ONCE compared to resetting NVRAM FOUR times consecutively.

2. Can older NVRAM entries be safely removed ?

I have usually reset NVRAM TWICE consecutively in the past.

1) Often resetting the NVRAM doesn't take on the initial attempts (on some machines).

2) Sometimes The 1st chime is the RAM POST (generally speaking), the succeeding 2nd two chimes, ensures a successful reset of the NVRAM. Sometimes, when holding down the keys to ensure you get the 3rd chime, the cMP will continue on during the boot process to a 4th chime if you didn't release the keys quickly enough. The idea it to ensure that you get the NVRAM reset without question.

I've done the 2 chimes reset (as mentioned by Apple's own documents) and it didn't really reset. A call (when the machine was new) to Apple TS and I was instructed to carry out the the process for 3 Full chimes, as 1 of them often has nothing to do with the reset, but rather the POST. So it's just a good measure to make sure it's actually reset. No special magic here...
 
Last edited:

LightBulbFun

macrumors 68030
Nov 17, 2013
2,900
3,195
London UK
10.14.5 beta 4 (18F127a) has a new firmware. Version 144.0.0.0.0.

ohh 144, what happened to 143? :D

I wonder what changes it brings, especially in light of the whole 142 episode
[doublepost=1556560105][/doublepost]Woo updated and it did not brick my Dual CPU! machine :)

sadly no boot screens on my Radeon HD 7950 in PC UEFI mode (always hopeful LOL)

it took a fair amount of time to install, so they must of changed something
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.