Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

zzzippp

macrumors member
Jan 27, 2006
51
47
Portland, Oregon
Your BootROM dump contains sensitive data like iCloud email/credentials and all credentials for Wi-Fi networks that you connect with your iPhone/iPad/MacBook that are synced via iCloud, besides all the hardwareIDs for your Mac Pro and sometimes the keys/authorization for apps that you paid.

Do the reconstructed never-booted BootROM images that you create for users include iCloud and other credentials? Or do they only include hardwareIDs?
 

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
I'd like to point out that they can flash a BootROM image to the MATT Card before shipping it to you. From the MATT Card webpage:



EDIT: As @tsialex pointed out in the next message, if you dump your active BootROM, it can contain iCloud credentials, Wi-Fi network credentials, and other sensitive data which anyone with the BootROM dump file can view. Even if you send a reconstructed, clean, and never-booted BootROM image, it will still contain hardwareIDs for your Mac Pro, so keep that in mind if you decide to send your BootROM image to cmizapper to flash to a MATT Card that you're ordering.

I have a never-booted image, courtesy of @tsialex, and I'm presuming I could have that flashed to the MATT card before shipping to me, which would be very advantageous.
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
I have a never-booted image, courtesy of @tsialex, and I'm presuming I could have that flashed to the MATT card before shipping to me, which would be very advantageous.
I'm trying to understand why it would be very advantageous to you?

Just to not have to install the MATT card, boot Recovery, disable SIP, shutdown, power up in Firmware Programming Mode and then run ROMTool? You already do exactly that whenever you need to re-flash the never booted BootROM image.
 
  • Like
Reactions: trifero

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
ah alright... I wasn't sure if I would be able to boot up with the default MATT card as delivered, without first flashing it with something. That makes sense then..thanks for the clarification! And thanks again for the never-booted image...really glad I got that.. I'm much less worried now about what happens if my rom burns out..
 

MacNB2

macrumors 6502
Jul 21, 2021
310
238
I'm trying to understand why it would be very advantageous to you?

Just to not have to install the MATT card, boot Recovery, disable SIP, shutdown, power up in Firmware Programming Mode and then run ROMTool? You already do exactly that whenever you need to re-flash the never booted BootROM image.

Can a never-booted-BootROM image be flashed to a new MXIC MX25L3206E chip instead of the MP51.fd image ?
That is, de-solder the older (potentially end-of-life SPI chip), flash a new MXIC MX25L3206E with your never-booted-BootROM image and solder the new chip onto the logic board ?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Can a never-booted-BootROM image be flashed to a new MXIC MX25L3206E chip instead of the MP51.fd image ?
That is, de-solder the older (potentially end-of-life SPI chip), flash a new MXIC MX25L3206E with your never-booted-BootROM image and solder the new chip onto the logic board ?
Yes, no problem. Please read the 1st post of the thread.
 
  • Like
Reactions: skodises

MacNB2

macrumors 6502
Jul 21, 2021
310
238
Yes, no problem. Please read the 1st post of the thread.
Thanks Alex. I did read the first post and it mentions:
  • program MP51.fd to the replacement SPI flash memory (Macronix MX25L3205A/MX25L3205D/MX25L3206E, SST 25VF032B),
It did not mention that if you have a never-booted-BootROM image, then you can program that into the replacement SPI Chip instead. May be change that step to (?) :
  • program MP51.fd (or a never-booted-BootROM image if you have one) to the replacement SPI flash memory (Macronix MX25L3205A/MX25L3205D/MX25L3206E, SST 25VF032B),
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Thanks Alex. I did read the first post and it mentions:
  • program MP51.fd to the replacement SPI flash memory (Macronix MX25L3205A/MX25L3205D/MX25L3206E, SST 25VF032B),
It did not mention that if you have a never-booted-BootROM image, then you can program that into the replacement SPI Chip instead. May be change that step to (?) :
  • program MP51.fd (or a never-booted-BootROM image if you have one) to the replacement SPI flash memory (Macronix MX25L3205A/MX25L3205D/MX25L3206E, SST 25VF032B),
If you have a saved dump, or better yet reconstructed image, use it, no problem. I'll edit the first post to be clear, btw, if you already have a never booted BootROM image, you don't need to take the pictures or contact a firmware engineer for a reconstruction.

I think that I already explained why I do it this way - I always flash the MP51.fd with the external programmer for a series of reasons that probably matter most to me or someone that does this repairs with some frequency:

  • easier to boot than a previously saved backup dump (that could have failed GC or other issues)
  • always the same checksum
  • it's the image I use to test the SPI flash lot when it arrives
  • faster and practical, several SPI can be flashed sequentially
  • I can pick a SPI from the already flashed stash and install immediately to the backplane.

After the Mac Pro is booting, I flash it's own reconstructed image via ROMTool or flashrom.
 
Last edited:

Warrington

macrumors member
Dec 13, 2021
69
21
I try to upgrade a MP4,1 and I saved a backup dump, looking pretty good:

initial.png


After SMC reset and NVRAM reset (5 chimes) it looked a bit worse:

nvreset.png


and after updating with the latest 4,1 firmware from Apple it was even worse:

4,1final.png


Is this normal? I was expecting to see a rather bad one in the beginning and a much better one after the Apple update.
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Is this normal? I was expecting to see a rather bad one in the beginning and a much better one after the Apple update.
MemoryConfig variable format changes between EFI releases, so it's somewhat expected. 21 MemoryConfig entries are a problem and not ok and it's usually a sign of failed garbage collection.

You can force a deep NVRAM reset (with a wired keyboard press continuously CMD-Option-P-R until the 5th chime) and see if garbage collection is really working.

Btw, a lot of MP5,1 knowledge don't directly apply to the MP4,1 NVRAM volume, since the MP4,1 NVRAM is only similar - also MP4,1 firmwares are deprecated since 2010 and it's not really meaningful to actively track any MP4,1 only
issues.
 
  • Like
Reactions: trifero

Warrington

macrumors member
Dec 13, 2021
69
21
Thank you for your quick reply. I didn't do another deep NVRAM reset, since the first one (after the initial dump) was rather disappointing.

However, the worst is yet to come. After updating to MP51.007F.B03 it was really bad:

MP51.007F.B03.png


After that, I installed High Sierra and it updated the firmware again, which looked a bit better:

89b00.png


My intentions now are to update it to 144.0.0.0.0 and I think this would be a good moment to follow your advice, to force a deep NVRAM reset. Before updating it to 144.0.0.0.0 or after?

What exactly means "if garbage collection is working"? The amount of free space will / should increase?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Thank you for your quick reply. I didn't do another deep NVRAM reset, since the first one (after the initial dump) was rather disappointing.

However, the worst is yet to come. After updating to MP51.007F.B03 it was really bad:

View attachment 1928101

After that, I installed High Sierra and it updated the firmware again, which looked a bit better:

View attachment 1928102

My intentions now are to update it to 144.0.0.0.0 and I think this would be a good moment to follow your advice, to force a deep NVRAM reset. Before updating it to 144.0.0.0.0 or after?

Before the upgrade and after it's done.

What exactly means "if garbage collection is working"? The amount of free space will / should increase?

NVRAM volume and garbage collection work in a very counterintuitive way, to get a better understanding of why/how start reading from the post below:


Also there are several posts, some pages ago on this thread, that I explain all the issues and doubts people have.

Btw, hybrids (early-2009 cross-flashed to MP5,1 frimwares) are extremely prone to bricking, you are seeing the problem right now.

No one should use a MP4,1>5,1 with modern macOS releases, reconstruction is obligatory to anyone with a dual CPU tray.
 

Warrington

macrumors member
Dec 13, 2021
69
21
Thanks. I'll read the entire thread, it will probably take two or three days :)

In the end, I'd like to install Open Core and Big Sur on this MP and I try to make sure I understand what I'm doing.
 

trifero

macrumors 68030
May 21, 2009
2,956
2,796
Thanks. I'll read the entire thread, it will probably take two or three days :)

In the end, I'd like to install Open Core and Big Sur on this MP and I try to make sure I understand what I'm doing.
I truly recommend you to obtain a reconstructed ROM from @tsialex. It´s almost a must in 4,1->5,1 Mac Pro.
 
Last edited:

Warrington

macrumors member
Dec 13, 2021
69
21
21 MemoryConfig entries are a problem and not ok and it's usually a sign of failed garbage collection.

I understand that, but I suppose those 21 MemoryConfig entries were not real. This dump was right after updating the firmware to the latest 4,1 from Apple, I guess they were included in that image.

The same applies to the 27 MemoryConfig entries that just appeared after updating to MP51.007F.B03

I didn't change anything related to RAM, it has 3 x 8GB and had them in the same slots since the initial dump. Maybe I'm wrong, but I was under the impression that a MemoryConfig entry is added only if something changed about the RAM.
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Maybe I'm wrong, but I was under the impression that a MemoryConfig entry is added only if something changed about the RAM.
Yes, you are mistaken - learn how the circular log works. Btw, I even explained that the MemoryConfig format changes between EFI releases on post #4,866. See for yourself with UEFITool.

Also the exactly same issue, variable multiplication, also happens with BT related entries/variables - but these variable syntax changes happens between macOS releases while MemoryConfig syntax was changed with EFI releases.
 

prefuse07

Suspended
Jan 27, 2020
895
1,073
San Francisco, CA
Paging @Macschrauber

First off, thank you for your help in the OC thread! I got my machine back!!!!!

Here are my 3 BootROM entries:

1.png


2.png


3.png



Based on the above, is my BootROM all good?

I haven't yet installed OpenCore -- just running Mojave 10.14.6, but so far everything has been stable.

If I receive yours or @tsialex blessing [basically someone who understands BootROMS] that my BootROM is good to go, then I will put OpenCore 0.7.6, and then just need to figure out Windows.


@KeesMacPro @zzzippp Thank you guys as well for your help/comments!!!
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Paging @Macschrauber

First off, thank you for your help in the OC thread! I got my machine back!!!!!

Here are my 3 BootROM entries:

View attachment 1928584

View attachment 1928585

View attachment 1928586


Based on the above, is my BootROM all good?

I haven't yet installed OpenCore -- just running Mojave 10.14.6, but so far everything has been stable.

If I receive yours or @tsialex blessing [basically someone who understands BootROMS] that my BootROM is good to go, then I will put OpenCore 0.7.6, and then just need to figure out Windows.


@KeesMacPro @zzzippp Thank you guys as well for your help/comments!!!
Static binary analysis is just a tool to help you catch the most common failures. It's not a way to say that a dump is free of problems - at best, it's free of the most common problems. Failures frequently happen in unpredictable ways that you cannot catch just with static binary analysis.

For example, a cross flashed Mac Pro (an early-2009 that had the EFI upgraded to MP5,1 via MacEFIROM tool), fails not just because of the usual NVRAM problems, but also because several deprecated MP4,1 variables continue to be stored inside the VSS store, the circular log have less space to work or is fragmented and garbage collection is forced to work more and with less space (same issue of Windows SecureBoot certificates). This overtime leads to NAND cell exhaustion failure and binary static analysis can't catch it because the variables are correctly stored and valid, but shouldn't be there taking valuable space anymore. Also, the MP4,1 NVRAM volume, and the MP4,1 BootBlock, are slightly incompatible with the MP5,1 EFI and overtime this will result on the corruption of the NVRAM volume. All cross-flashed early-2009 Mac Pro need to be correctly and fully upgraded to the 0x0D firmware standard that Apple sent with the last run of mid-2012s made. This is crucial for early-2009s with dual CPU trays where the NVRAM volume have much less available space (two memory controllers, more DIMMs to have the configuration and the DIMM SPD cached stored = less available VSS store space).

Another common problem where binary static analysis is useless, the BootBlock AAPLEFI1.88Z.0005.I00.1010071430 that Apple installed back in the factory with mid-2010s and most mid-2012s (also installed on cross-flashed early-2009 by the MacEFIROM tool) have a cold boot hang during POST that only presents itself when you have a PCIe switched card, Apple worked for a long time with @crjackson2134 to finally solve this nasty one with 144.0.0.0.0. The problem is, you can't install the updated BootBlock without a BootROM reconstruction, since efiflasher don't upgrade anything besides the EFI firmware inside the BootROM image. So, all Mac Pros that have a BootBlock earlier than AAPLEFI1.88Z.0005.I00.1904121247 (practically all) are subject to this bug, but just people with PCIe switched cards will notice it. Btw, back then @crjackson2134 Mac Pro and mine were practically twins in every way except that his Mac Pro is a mid-2012 and mine was an early-2009 that bricked and was reconstructed with a much newer BootBlock (AAPLEFI1.88Z.0005.I00.1806081704) that was not so prone to the hang and I only had it sometimes while his almost identical config was an edge case where it had the cold boot hang frequently - I would never have bothered to track it since it was very rare to happen with my own Mac Pro and I don't shutdown daily like him.

Anyway, back to the results from @Macschrauber tool, zero MemoryConfigs being present are just impossible - it's like to say you booted without RAM being identified and configured. So, something is seriously wrong with your NVRAM volume/hardware.
 
Last edited:

prefuse07

Suspended
Jan 27, 2020
895
1,073
San Francisco, CA
Static binary analysis is just a tool to help you catch the most common failures. It's not a way to say that a dump is free of problems - at best, it's free of the most common problems. Failures frequently happen with unpredictable ways that you cannot catch just with static binary analysis.

For example, a cross flashed Mac Pro (an early-2009 that had the EFI upgraded to MP5,1 via MacEFIROM tool), fails not just because of the usual NVRAM problems, but also because several deprecated MP4,1 variables continue to be stored inside the VSS store, the circular log have less space to work or is fragmented and garbage collection is forced to work more and with less space (same issue of Windows SecureBoot certificates). This overtime leads to NAND cell exhaustion failure and binary static analysis can't catch it because the variables are correctly stored and valid, but shouldn't be there. Also, the MP4,1 NVRAM volume, and the MP4,1 BootBlock, are slightly incompatible with the MP5,1 EFI and overtime this will result on the corruption of the NVRAM volume. All cross-flashed early-2009 Mac Pro needs to be correctly and fully upgraded to the 0x0D firmware standard that Apple sent with the last run of mid-2012s. This is crucial for early-2009s with dual CPU trays.

Another common problem where binary static analysis is useless, the BootBlock Apple sent with mid-2010s and most mid-2012s (also installed on cross-flashed early-2009 by the MacEFIROM tool) have a cold boot hang during POST that only presents itself when you have a PCIe switched card, Apple worked for a long time with @crjackson2134 to finally solve this nasty one with 144.0.0.0.0. The problem is, you can't install the updated BootBlock without a BootROM reconstruction, since efiflasher don't upgrade anything besides the EFI firmware inside the BootROM image. So, all Mac Pros that have a BootBlock earlier than AAPLEFI1.88Z.0005.I00.1904121247 (practically all) are subject to this bug, but just people with PCIe switched cards will notice it.

Anyway, back to the results from @Macschrauber tool, zero MemoryConfigs present are just impossible - it's like to say you booted without RAM being identified and configured. So, something is seriously wrong with your NVRAM volume/hardware.

Thank you for the analysis!

What do you recommend I do from here on?

Also, is there any way for me to get the 2012 0x0D firmware standard that Apple sent onto my machine?
 
Last edited:
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.