Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

Dayo

macrumors 68020
Dec 21, 2018
2,257
1,279
nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
For the SMBIOS ones, you can use dmidecode.
@Macschrauber might be able to help get the features flags and mask from MP51 and MP31
 

joevt

macrumors 604
Jun 21, 2012
6,967
4,262
I've investigated several dumps and not yet found a way to extract the FirmwareFeatures or FirmwareFeaturesMask from the dump of the BootROM image, while I can get AAPL,PathProperties0000 from all dumps I've looked.

Usually the only entry with GUID 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14 present is AAPL,PathProperties0000.

I'm clearly missing something.

Edit:

I'm not missing it, it's really not an entry stored inside the NVRAM volume, I've scanned hundreds of dumps for the full GUID and also the FirmwareFeatures value itself with base64, little-endian, big-endian. It's is stored, probably generated, elsewhere. I even read the efi.h to try to understand where this could be generated, but no clues yet.
Check dmpstore in UEFI Shell. FirmwareFeatures and FirmwareFeaturesMask are not non-volatile (NV) so you won't see them in nvram.
Code:
Variable RT+BS '4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask' DataSize = 4
  00000000: FF 3F 00 C0                                      *.?..*
Variable RT+BS '4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures' DataSize = 4
  00000000: 03 14 00 C0                                      *....*
 
  • Like
Reactions: cdf and tsialex

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Check dmpstore in UEFI Shell. FirmwareFeatures and FirmwareFeaturesMask are not non-volatile (NV) so you won't see them in nvram.
Code:
Variable RT+BS '4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask' DataSize = 4
  00000000: FF 3F 00 C0                                      *.?..*
Variable RT+BS '4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures' DataSize = 4
  00000000: 03 14 00 C0                                      *....*

Thx for confirming it, I did not thought looking the dmpstore. This is an easy way to see which entries/variables are stored inside the NVRAM volume or not.
 

joevt

macrumors 604
Jun 21, 2012
6,967
4,262
Also in UEFI Shell is the smbios -a command.

Code:
=========================================================
Type=128, Handle=0x13F
Dump Structure as:
Index=63,Length=0x5A,Addr=0x7F67FA14
00000000: 80 58 3F 01 03 00 00 00-03 14 00 C0 FF 3F 00 C0  *.X?..........?..*
00000010: 01 02 03 00 00 00 00 00-00 00 FC FF FF FF FF FF  *................*
00000020: 00 00 E0 FF FF FF F7 FF-00 00 F9 FF FF FF FB FF  *................*
00000030: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  *................*
00000040: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  *................*
00000050: 00 00 00 00 00 00 00 00-00 00                    *..........*

Structure Type:Undefined Value
Format part Len : 88
Structure Handle: 319
Structure Type undefined!
The bytes here match the dmpstore values.
These were taken from November 2020 on my MacPro3,1 before OpenCore.
 
Last edited:
  • Like
Reactions: cdf and Dayo

Dayo

macrumors 68020
Dec 21, 2018
2,257
1,279
The bytes here match the dmpstore values.
I suppose we can expect the same on a real MP51 (would be nice to confirm). If so, then the diffference @cdf observed would be down to MP41->MP51 cross flashing.

I think I have read @tsialex mention that the cross flashing is not a total/complete thing. Therefore, if MP41 orignally has 0xC0001403, similar to MP31, this artefact could have been left behind.

Other interesting thing would be to see whether older MP51 firmware give different flags/masks to recent ones ... thinking about Bits 19/18 (APFS).
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
I suppose we can expect the same on a real MP51 (would be nice to confirm). If so, then the diffference @cdf observed would be down to MP41->MP51 cross flashing.

I think I have read @tsialex mention that the cross flashing is not a total/complete thing. Therefore, if MP41 orignally has 0xC0001403, similar to MP31, this could have been left hanging around.
Cross-flashing is a real mess. Talking just about the NVRAM volume, depending on the original MacPro4,1 BootROM version, the NVRAM volume behaves differently. Early-2009 Mac Pros that had up to B04 from factory have just one working VSS store (yep, I did not believe when I first saw it and checked/rechecked multiple times with dumps from several early-2009 Mac Pros) and the FTW store works exactly like MacPro3,1, while B07/B08 behave like a real MacPro5,1 and no logs are saved inside the FTW store at all.

When @cdf wrote about that, I've found other inconsistencies besides the FirmwareFeatures. Seems I have to install each BootROM version and check the evolution of FirmwareFeatures from the NVRAM and SMBIOS - I've started to do that back then, but got sidetracked with other more urgent issues.
 
Last edited:
  • Like
Reactions: Dayo

PittiePanda

macrumors newbie
Feb 17, 2022
6
0
I need help with my mac pro 2012. it had RX570 installed. I was updating it from High Sierra to Mojave, it said it had to upgrade the firmware, I forgot if I had pressed and holden the power button to enter firmware flash mode. It was restarted and booted into Mojava installation page, and it looked like it was installing successfully, then it was showing about 27 minutes remaining, but it never finished. It didn't boot after a restart during the Mojava installation.
At beginning, I thought it was the RAM or Graphics card issue, but it was still not bootable after I swapped them all.

Then I made a firmware recovery cd, it didn't help.
I have a ch341a programmer, heat gun, soldering Iron. I read a part of this thread and found that I should flash the MP51.fd from Mojava's installation dmg, the SPI on my backboard was MX25L3205D, I bought two MX25L2306E, then I flashed the firmware to the chip, I still could not hear the chime.

can anyone help?

 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
I need help with my mac pro 2012. it had RX570 installed. I was updating it from High Sierra to Mojave, it said it had to upgrade the firmware, I forgot if I had pressed and holden the power button to enter firmware flash mode. It was restarted and booted into Mojava installation page, and it looked like it was installing successfully, then it was showing about 27 minutes remaining, but it never finished. It didn't boot after a restart during the Mojava installation.
At beginning, I thought it was the RAM or Graphics card issue, but it was still not bootable after I swapped them all.
When installing Mojave, you brick when it's flashing the current BootROM version, right when it asks you to enter Firmware programming Mode, not after it rebooted and started to do the install.

While it's possible that your SPI flash was failing already and the flurry of NVRAM updates for the Mojave installation was the killing blow, it's not a common failure mode and I will be surprised if it's the cause. You can dump the original SPI and send me to see if it's the case.

Usually EFI_DONE remains off when pressing the DIAG button if it's a brick.

Could be a PSU failure, a disk that shorted itself, the backplane south bridge or the CPU tray northbridge that failed. Lot's of thing to check, too many things could have happened.
Then I made a firmware recovery cd, it didn't help.
I have a ch341a programmer, heat gun, soldering Iron. I read a part of this thread and found that I should flash the MP51.fd from Mojava's installation dmg, the SPI on my backboard was MX25L3205D, I bought two MX25L2306E, then I flashed the firmware to the chip, I still could not hear the chime.

can anyone help?

A bricked backplane will work again with MP51.fd flashed to the correct replacement SPI flash.

If you have access to a MATT card, you can check if you did something wrong flashing MP51.fd or replacing the SPI chip.
 

PittiePanda

macrumors newbie
Feb 17, 2022
6
0
Thanks Alex,

the EFI done is green. I will check the PSU later today.
I am not sure if this was what I dumped from the CH341A.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
the EFI done is green. I will check the PSU later today. Thanks Alex.
PSU, GPU, any SATA or PCIe cards, check literally everything. Just a week or so ago someone here had a SSD that failed/short-circuited and he thought that his Mac Pro bricked.

I'm gonna ask moderation to move these messages to the BootROM thread, this one is not really the correct thread for this.
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Thanks Alex,

the EFI done is green. I will check the PSU later today.
I am not sure if this was what I dumped from the CH341A.
Never post a BootROM dump publicly - there are lot's of private information stored there. This is not a BootROM dump, since it's just 5KB, a BootROM image dump should be exactly 4MB (4.194.304 bytes).
 

PittiePanda

macrumors newbie
Feb 17, 2022
6
0
Never post a BootROM dump publicly - there are lot's of private information stored there. This is not a BootROM dump, since it's 5KB, a dump should be exactly 4MB (4.194.304 bytes).
It is zipped, if you unzip it, it will be 4096kb
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
It is zipped, if you unzip it, it will be 4096kb
BootROMs can be compressed a lot, to ~1,7MB, not 5KB. :p Double check the zip you uploaded, send it by PM.
 

Attachments

  • Screen Shot 2022-02-17 at 15.13.05.png
    Screen Shot 2022-02-17 at 15.13.05.png
    26.5 KB · Views: 71

PittiePanda

macrumors newbie
Feb 17, 2022
6
0
my bad, it is 5kb that means I dumped it after I wiped it.
I am updating my second mac pro (2009), I am afraid I will brick this one as well..
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
my bad, it is 5kb that means I dumped it after I wiped it.
I am updating my second mac pro (2009), I am afraid I will brick this one as well..
A BootROM reconstruction service will get you 144.0.0.0.0 and a pristine image, just to you know.
 

PittiePanda

macrumors newbie
Feb 17, 2022
6
0
A BootROM reconstruction service will get you 144.0.0.0.0 and a pristine image, just to you know.
Thanks, Alex, I know that, but the first thing is I need to get the bricked mac running. I will try to flash MP51.fd and see if it can back to live.
 
Last edited:

Macschrauber

macrumors 68030
Dec 27, 2015
2,980
1,487
Germany
@Macschrauber might be able to help get the features flags and mask from MP51 and MP31


I guess these two, found in a nvram.vol of a MP2012

Screenshot 2022-02-17 at 22.04.38.png


Screenshot 2022-02-17 at 22.05.12.png



Code:
4D 1E DE 05 - 38 C7 - 4A 6A - 9C C6 - 4B CC A8 B3 8C 14

is
05 ED 1E 4D - C7 38 - 6A 4A - 9C C6 - 4B CC A8 B3 8C 14


if someone wants to help to decode:

Code:
4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures	%03D%0c%c0
4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask	?%ff%1f%ff
 
Last edited:

cdf

macrumors 68020
Jul 27, 2012
2,256
2,583
I guess these two, found in a nvram.vol of a MP2012
Since you have a real 5,1, would it be possible to boot without OC and post the output of

nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures

and

nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask

as well as the two lines

FirmwareFeatures: ...
FirmwareFeaturesMask: ...

listed in the output of dmidecode?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
I guess these two, found in a nvram.vol of a MP2012

View attachment 1960470

View attachment 1960469


Code:
4D 1E DE 05 - 38 C7 - 4A 6A - 9C C6 - 4B CC A8 B3 8C 14

is
05 ED 1E 4D - C7 38 - 6A 4A - 9C C6 - 4B CC A8 B3 8C 14


if someone wants to help to decode:

Code:
4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures    %03D%0c%c0
4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask    ?%ff%1f%ff
It’s not a that, it’s a generated value. See @joevt confirming what I was thinking with the dmpstore.
 

Macschrauber

macrumors 68030
Dec 27, 2015
2,980
1,487
Germany
Since you have a real 5,1, would it be possible to boot without OC and post the output of

nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures

and

nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask

as well as the two lines

FirmwareFeatures: ...
FirmwareFeaturesMask: ...

listed in the output of dmidecode?

can give dmidecode output without OC as I run Mavericks atm, machine never seen OC, rebuilt firmware:

FirmwareFeatures: 0xC00C0403
FirmwareFeaturesMask: 0xFF1FFF3F


as I run some long term tests in Mavericks I can give xml output of the FirmwareFeatures tomorrow. (Mavericks nvram cli command does not list xml of given vars)
 
Last edited:

cdf

macrumors 68020
Jul 27, 2012
2,256
2,583
FirmwareFeatures: 0xC00C0403
FirmwareFeaturesMask: 0xFF1FFF3F
Interesting. Not only is bit 14 (USB 2.0 firmware support) missing here, but so is bit 12 (tamper resistant boot). It will be interesting to see the value of the corresponding NVRAM variables.
 

Dayo

macrumors 68020
Dec 21, 2018
2,257
1,279
Not only is bit 14 (USB 2.0 firmware support) missing here, but so is bit 12 (tamper resistant boot).
Yeah. Seems Apple is completely all over the place on this.
Starting to think it will need querying vanilla firmware to be 100% certain of what's going on.
can give dmidecode output without OC ... rebuilt firmware:
FirmwareFeatures: 0xC00C0403
FirmwareFeaturesMask: 0xFF1FFF3F
0xC00C0403 suggests Bit 35 has been added here. Can we be certain nothing else has changed?
Checked and not added
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Does this mean EFI is ok?



View attachment 1960568
EFI_DONE LED being on literally means that the EFI was loaded successfully by the SEC (BootBlock/X86 ResetVector -> SEC -> EFI -> POST).

EFI_DONE doesn't mean that your Mac Pro is completing POST. For example, a corrupt NVRAM volume makes your Mac Pro un-bootable and the EFI_DONE LED is perfectly lit. Also, the problem could be elsewhere on the hardware.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,454
13,601
Mac Pro Server mid-2010, running El Capitan (nvram -x don't work yet):

Code:
ElCap:~ tsialex$ ./dmidecode |grep FirmwareFeatures
	FirmwareFeatures: 0xC00C1403
	FirmwareFeaturesMask: 0xFF1FFF3F
ElCap:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures	%17T%0c%c0
ElCap:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask	?%ff%1f%ff
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.