Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0
- Thread starter tsialex
- WikiPost WikiPost
- Start date
- Sort by reaction score
- Status
I'm reconstructing MP51.007F.B03 (first MP5,1 firmware update and no APFS support) right now, I'll have it flashed and checked later today on my mid-2012 (model F4MC).
Would be also interesting to check MP41.0081.B08, the never public released MacPro4,1 firmware for the last manufactured early-2009s, this one is a very unique MP41 firmware.
Right. The firmware features there are consistent with the values here. However, the mask value is indeed different...
Another Data Point, a 5.1 born as a 4.1
Big Sur 11.6.3, OCLP Spoofless
4.1->5.1 but made by reconstruction, 144.0.0.0 Firmware
Big Sur 11.6.3, OCLP Spoofless
4.1->5.1 but made by reconstruction, 144.0.0.0 Firmware
Code:
dmidecode | grep Firmware
FirmwareFeatures: 0xC00C1403
FirmwareFeaturesMask: 0xFF1FFF3FThis will be an interesting test. Bit 19 should disappear, but I wonder if bit 18 will do the same, or even if bit 12 will reappear...
Besides downgrading the original 140.0.0.0.0 BootROM image dump from when I bought this mid-2012 (model F4MC) to MP51.007F.B03, I'm gonna also investigate some other possibilities:
- original BootROM image dump, 140.0.0.0.0 and Fsys 0x05 version, this is the baseline and not checked yet.
- original BootROM image dump upgraded by Mojave installer to 144.0.0.0.0.
- cleaned and reconstructed to 144.0.0.0.0 still with Fsys 0x05 version, to check if a clean NVRAM and reconstruction affects anything.
- cleaned, upgraded to Fsys 0x0D and reconstructed to 144.0.0.0.0, to check if Fsys 0x0D affects anything.
If anyone have another test suggestion, please do it.
This way we can start to validate/disprove some ideas. It would be better to methodically test all complete EFI releases with an early-2009 starting with @Edge MP41.0081.B03, but I can't do it until I get my spare parts assembled.
Baseline 140.0.0.0.0 (original BootROM image dump, 140.0.0.0.0 and Fsys 0x05 version):
Baseline MP51.007F.B03 (original BootROM image dump downgraded to MP51.007F.B03, same NVRAM volume, same Fsys 0x05 version):
Code:
HighSierra:~ tsialex$ system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: Mac Pro
Model Identifier: MacPro5,1
Processor Name: 6-Core Intel Xeon
Processor Speed: 3,46 GHz
Number of Processors: 1
Total Number of Cores: 6
L2 Cache (per Core): 256 KB
L3 Cache: 12 MB
Memory: 32 GB
Boot ROM Version: 140.0.0.0.0
SMC Version (system): 1.39f11
SMC Version (processor tray): 1.39f11
Serial Number (system): xxxxxxxxF4MC
HighSierra:~ tsialex$ sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU X5690 @ 3.47GHz
HighSierra:~ tsialex$ ./dmidecode | grep FirmwareFeatures
FirmwareFeatures: 0xC00C1403
FirmwareFeaturesMask: 0xFF1FFF3F
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures</key>
<data>
A1QMwA==
</data>
</dict>
</plist>
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask</key>
<data>
P/8f/w==
</data>
</dict>
</plist>Baseline MP51.007F.B03 (original BootROM image dump downgraded to MP51.007F.B03, same NVRAM volume, same Fsys 0x05 version):
Code:
HighSierra:~ tsialex$ system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: Mac Pro
Model Identifier: MacPro5,1
Processor Name: 6-Core Intel Xeon
Processor Speed: 3,46 GHz
Number of Processors: 1
Total Number of Cores: 6
L2 Cache (per Core): 256 KB
L3 Cache: 12 MB
Memory: 32 GB
Boot ROM Version: MP51.007F.B03
SMC Version (system): 1.39f11
SMC Version (processor tray): 1.39f11
Serial Number (system): xxxxxxxxF4MC
HighSierra:~ tsialex$ sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU X5690 @ 3.47GHz
HighSierra:~ tsialex$ ./dmidecode | grep FirmwareFeatures
FirmwareFeatures: 0xC0001403
FirmwareFeaturesMask: 0xC000FFFF
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures</key>
<data>
F1QAwA==
</data>
</dict>
</plist>
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask</key>
<data>
//8AwA==
</data>
</dict>
</plist>| Mac Pro model: | EFI release: | Fsys: | BootROM: | SMBIOS FF: | SMBIOS FFM: | NVRAM FF: | NVRAM FFM: |
| mid-2012 F4MC | 140.0.0.0.0 | 0x05 | unmodified | 0xC00C1403 | 0xFF1FFF3F | A1QMwA== 0xC00C5403 | P/8f/w== 0xFF1FFF3F |
| mid-2012 F4MC | MP51.007F.B03 | 0x05 | unmodified downgraded | 0xC0001403 | 0xC000FFFF | F1QAwA== 0xC0005417 | //8AwA== 0xC000FFFF |
Baseline MP51.007F.B03 upgraded to 144.0.0.0.0 by Mojave installer (original BootROM image dump same NVRAM volume, same Fsys 0x05 version):
Code:
HighSierra:~ tsialex$ system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: Mac Pro
Model Identifier: MacPro5,1
Processor Name: 6-Core Intel Xeon
Processor Speed: 3,46 GHz
Number of Processors: 1
Total Number of Cores: 6
L2 Cache (per Core): 256 KB
L3 Cache: 12 MB
Memory: 32 GB
Boot ROM Version: 144.0.0.0.0
SMC Version (system): 1.39f11
SMC Version (processor tray): 1.39f11
Serial Number (system): xxxxxxxxF4MC
HighSierra:~ tsialex$ sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU X5690 @ 3.47GHz
HighSierra:~ tsialex$ ./dmidecode | grep FirmwareFeatures
FirmwareFeatures: 0xC00C1403
FirmwareFeaturesMask: 0xFF1FFF3F
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures</key>
<data>
A1QMwA==
</data>
</dict>
</plist>
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask</key>
<data>
P/8f/w==
</data>
</dict>
</plist>Identical to 140.0.0.0.0.
| Mac Pro model: | EFI release: | Fsys: | BootROM: | SMBIOS FF: | SMBIOS FFM: | NVRAM FF: | NVRAM FFM: |
| mid-2012 F4MC | 140.0.0.0.0 | 0x05 | unmodified | 0xC00C1403 | 0xFF1FFF3F | A1QMwA== 0xC00C5403 | P/8f/w== 0xFF1FFF3F |
| mid-2012 F4MC | MP51.007F.B03 | 0x05 | unmodified downgraded | 0xC0001403 | 0xC000FFFF | F1QAwA== 0xC0005417 | //8AwA== 0xC000FFFF |
| mid-2012 F4MC | 144.0.0.0.0 | 0x05 | unmodified downgraded & upgraded by Mojave installer | 0xC00C1403 | 0xFF1FFF3F | A1QMwA== 0xC00C5403 | P/8f/w== 0xFF1FFF3F |
Last edited:
Reconstructed 144.0.0.0.0 (reconstructed 144.0.0.0.0, clean NVRAM, Fsys upgraded to 0x0D version):
Identical to unmodified 140.0.0.0.0 and 144.0.0.0.0. I'll do the "cleaned and reconstructed to 144.0.0.0.0 still with Fsys 0x05 version, to check if a clean NVRAM and reconstruction affects anything" tonight to confirm that the Fsys don't change anything related to the FF & FFM.
Code:
HighSierra:~ tsialex$ system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: Mac Pro
Model Identifier: MacPro5,1
Processor Name: 6-Core Intel Xeon
Processor Speed: 3,46 GHz
Number of Processors: 1
Total Number of Cores: 6
L2 Cache (per Core): 256 KB
L3 Cache: 12 MB
Memory: 32 GB
Boot ROM Version: 144.0.0.0.0
SMC Version (system): 1.39f11
SMC Version (processor tray): 1.39f11
Serial Number (system): xxxxxxxxF4MC
HighSierra:~ tsialex$ sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU X5690 @ 3.47GHz
HighSierra:~ tsialex$ ./dmidecode | grep FirmwareFeatures
FirmwareFeatures: 0xC00C1403
FirmwareFeaturesMask: 0xFF1FFF3F
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures</key>
<data>
A1QMwA==
</data>
</dict>
</plist>
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask</key>
<data>
P/8f/w==
</data>
</dict>
</plist>| Mac Pro model: | EFI release: | Fsys: | BootROM: | SMBIOS FF: | SMBIOS FFM: | NVRAM FF: | NVRAM FFM: |
| mid-2012 F4MC | 140.0.0.0.0 | 0x05 | unmodified | 0xC00C1403 | 0xFF1FFF3F | A1QMwA== 0xC00C5403 | P/8f/w== 0xFF1FFF3F |
| mid-2012 F4MC | MP51.007F.B03 | 0x05 | unmodified downgraded | 0xC0001403 | 0xC000FFFF | F1QAwA== 0xC0005417 | //8AwA== 0xC000FFFF |
| mid-2012 F4MC | 144.0.0.0.0 | 0x05 | unmodified downgraded & upgraded by Mojave installer | 0xC00C1403 | 0xFF1FFF3F | A1QMwA== 0xC00C5403 | P/8f/w== 0xFF1FFF3F |
| mid-2012 F4MC | 144.0.0.0.0 | 0x0D | cleaned, upgraded to 0x0D and reconstructed | 0xC00C1403 | 0xFF1FFF3F | A1QMwA== 0xC00C5403 | P/8f/w== 0xFF1FFF3F |
Last edited:
I think this makes sense. The firmware features may be toggled by software (if I recall my earlier testing correctly, using Boot Camp Assistant to prepare a Windows installation will actually set bit 29 of the NVRAM firmware features), but the mask has the last say.
The mask for bit 29 is 1. For instance on MBP all bits are allowed:
Code:
Apple specific FirmwareVolume
FirmwareFeatures: 0xFF0BF576
FirmwareFeaturesMask: 0xFFFFFFFF
Region Type: 0x02 Start: 0xFF990000 End: 0xFFAFFFFFRegion Type: 0x00 Start: 0xFFB00000 End: 0xFFD4FFFFRegion Type: 0x03 Start: 0xFFD70000 End: 0xFFD9FFFF
Handle 0xFEFF, DMI type 127, 4 bytes
0000: 7F 04 FF FELooking for clues, just tested an early-2009 CPU tray with two E5520 Nehalem Xeons with the same mid-2012 F4MC as I'm testing, no changes (besides the jet engine noise of the SMC mismatch).
Code:
HighSierra:~ tsialex$ system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: Mac Pro
Model Identifier: MacPro5,1
Processor Name: Quad-Core Intel Xeon
Processor Speed: 2,26 GHz
Number of Processors: 2
Total Number of Cores: 8
L2 Cache (per Core): 256 KB
L3 Cache (per Processor): 8 MB
Memory: 12 GB
Boot ROM Version: 144.0.0.0.0
SMC Version (system): 1.39f11
SMC Version (processor tray): 1.39f5
Serial Number (system): xxxxxxxF4MC
HighSierra:~ tsialex$ sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU E5520 @ 2.27GHz
HighSierra:~ tsialex$ ./dmidecode | grep FirmwareFeatures
FirmwareFeatures: 0xC00C1403
FirmwareFeaturesMask: 0xFF1FFF3F
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures</key>
<data>
A1QMwA==
</data>
</dict>
</plist>
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask</key>
<data>
P/8f/w==
</data>
</dict>
</plist>Also no changes with my mid-2010 single CPU tray with Nehalem W3565, same mid-2012 F4MC as today's previous tests.:
Didn't thought that would change anything, but covering all angles.
Code:
HighSierra:~ tsialex$ system_profiler SPHardwareDataType
Hardware:
Hardware Overview:
Model Name: Mac Pro
Model Identifier: MacPro5,1
Processor Name: Quad-Core Intel Xeon
Processor Speed: 3,2 GHz
Number of Processors: 1
Total Number of Cores: 4
L2 Cache (per Core): 256 KB
L3 Cache: 8 MB
Memory: 16 GB
Boot ROM Version: 144.0.0.0.0
SMC Version (system): 1.39f11
SMC Version (processor tray): 1.39f11
Serial Number (system): xxxxxxxxF4MC
HighSierra:~ tsialex$ sysctl -n machdep.cpu.brand_string
Intel(R) Xeon(R) CPU W3565 @ 3.20GHz
HighSierra:~ tsialex$ ./dmidecode | grep FirmwareFeatures
FirmwareFeatures: 0xC00C1403
FirmwareFeaturesMask: 0xFF1FFF3F
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeatures</key>
<data>
A1QMwA==
</data>
</dict>
</plist>
HighSierra:~ tsialex$ nvram -x 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:FirmwareFeaturesMask</key>
<data>
P/8f/w==
</data>
</dict>
</plist>Didn't thought that would change anything, but covering all angles.
My comment about the mask having the last say was not about bit 29 specifically. Bit 29 was an example of software being able to modify the firmware features.
Last edited:
Apple hasn't exactly been top of the class in terms of getting these settings right through time. Quite an eye opener.
At this stage, I am pretty sure the reason for the Bit 14 discrepancy is a good old fashioned bug and it looks nothing more than that it was just plain forgotten. Could be wrong but it's the only explanation that makes sense I can see and it fits the pattern.
In the end, it didn't matter because the most interesting observation is actually that the values are not critical for most things and that apart from a few instances such as LargeBaseSystem, these values are not used for much.
APFS flags being off on MP31 makes zero difference to the ability to boot APFS while OpenCore can have a totally made up and completely unrelated value in its database for MP51 and this currently makes zero difference.
This might change in the future though. Apple could easily decide to artificially set the next OS release or the APFS driver to look for the APFS flags as a load condition, which would break boot loaders that cannot set these flags.
Incorrect FirmwareFearures may break Bootcamp blessing (selection from startup disk), system updates etc.
Just for fun (which tells you what sort of person I am), I took a look at the 144.0.0.0.0 (and some other) EFI code. The NVRAM variables
The protocol sets
In the samples I looked at, the protocol sets a working copy of
The USB2 code gets a list of all handles that claim to support the USB2_HC_PROTOCOL (
(If I find some time later, I may dig deeper into this to see what each of those tests actually involves. Tracing through EFI is a lot less fun than wading through the kernel, though...)
FirmwareFeatures and FirmwareFeaturesMask (as well as ExtendedFirmwareFeatures and ExtendedFirmwareFeaturesMask) are set by the AppleFirmwareFeatures Protocol (998C6D8C-5500-4145-953E-B875517A7A34), which is in the BootROM PE32 image at CC582C73-F48F-4B62-83E8-A586B4C88F84.The protocol sets
FirmwareFeaturesMask explicitly, meaning a given BootROM version should always have the same value for FirmwareFeaturesMask, regardless of MacOS version or hardware configuration.In the samples I looked at, the protocol sets a working copy of
FirmwareFeatures to the constant 0xC0000002, then tests the availability of various other protocols (mostly proprietary Apple ones that I haven't delved into), setting individual bits in FirmwareFeatures as it goes. Once it's done with its tests, it writes FirmwareFeatures, FirmwareFeaturesMask,ExtendedFirmwareFeatures, and ExtendedFirmwareFeaturesMask to NVRAM. (EDIT: not to NVRAM, but to the local NVRAM cache. MacOS sees these variables as NVRAM, but they're never actually written to flash memory.)The USB2 code gets a list of all handles that claim to support the USB2_HC_PROTOCOL (
3E745226-9818-45B6-A2AC-D7CD0E8BA2BC), then loops through those handles to see which ones are actually capable of supporting the protocol. At first blush, the way it's coded makes it look like bit 14 will only get set if ALL of those handles pass the test - that may be why we rarely (never?) see bit 14 set on a working system.(If I find some time later, I may dig deeper into this to see what each of those tests actually involves. Tracing through EFI is a lot less fun than wading through the kernel, though...)
Last edited:
Thanks for the insight. This makes sense actually as the resulting values are therefore not what determine everything but are determined themselves to an extent. That is, a reflection of what is there ... at least in some aspects. That is an important re-framing of mindset.
Could mean something like the APFS flags depend on whether an APFS driver has been loaded or not (protocol installed on some handle). Not sure if that particular one is something you can see.
Another quick look suggests that bits 18 (unknown) and 19 (APFS support) on MP4,1/5,1 are always set, no testing required; MP3,1 does nothing with those bits. MP4,1/5,1 seems to always clear (zero) bit 20, APFS_EXTRA. MP3,1 does not seem to set the NVRAM variables
ExtendedFirmwareFeatures and ExtendedFirmwareFeaturesMask.Very interesting. Any indication of where the SMBIOS values are being set? Bit 14 is present in the NVRAM, but missing in the SMBIOS.
Just to be clear, you are referring to the area of the RAM where the NVRAM is loaded, no? This is not stored on the SPI flash itself.
Little inside info on the setting of the NVRAM variables during boot, although in this case is for the
apple.stackexchange.com
csr-active-config:
Modify SIP in normally booted system
I have MacBook Pro (2017) with macOS High Sierra (10.13.6). I have SIP and amfi disabled. I want to enable a part / the majority of SIP (e.g. csrutil enable --without fs) without having to reboot i...
I haven't yet looked at the SMBIOS code at all. I guess that should be next.
The code calls
gRT->SetVariable(), which is used for all EFI storage. A closer look reveals that in this case, the EFI_VARIABLE_NON_VOLATILE bit is not set, meaning FirmwareFeatures et al are stored only in the local cache. From MacOS' perspective, there is no difference; all EFI variables look like NVRAM. You are correct, though, these never seem to get written to flash.