MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0

[Pointy-Head]

Hi @tsialex could I pay you for a BootROM reconstruction?
If you're able to do that, could you PM me the instructions? Really appreciate your amazing contribution and support here!!
Many thanks.

 

[tsialex]

Got that. It's not clear for me though whether the BootROM reconstruction is just a matter of copying the board specific values (Serial Nr etc.) to the right locations and fixing the checksum or whether it involves more work.

It's not just that - you have to know where to do, how to do and how to correctly calculate the checksums, since the BootBlock volume checksum is nested.

Besides all that you also need access to the most updated modules/volumes/blobs to upgrade the various components of the image that are not EFI related and not present inside the generic firmware upgrade image, like for example the hardware descriptor where you still have the base_20 compressed blob instead of the most recent base_21.

 

[tsialex]

Hi @tsialex could I pay you for a BootROM reconstruction?
If you're able to do that, could you PM me the instructions? Really appreciate your amazing contribution and support here!!
Many thanks.

PM sent, please follow the instructions to the letter and I'll get back to you ASAP.

 

[RolfNoot]

It's not just that - you have to know where to do, how to do and how to correctly calculate the checksums, since the BootBlock volume checksum is nested.

Besides all that you also need access to the most updated modules/volumes/blobs to upgrade the various components of the image that are not EFI related and not present inside the generic firmware upgrade image, like for example the hardware descriptor where you still have the base_20 compressed blob instead of the most recent base_21.

Thanks for the detailed reply. Involves a bit more than I initially thought. Will take the route from the instructions in the first post.

Greetings from the Netherlands.

 

[MarkAllread]

The only thing I am curious about is the price of it. But I'll leave it to tsialex himself. It seems it's not that much. He is a decent and a helping man, and reading the forum posts, he delivers what he promises with his services.

As a happy client I can certainly attest to that. He breathed life into my 2010 after a catastrophic bootrom failure. tsialex did exactly what he said he would. Worth every penny.

 

[leecox1]

As a happy client I can certainly attest to that. He breathed life into my 2010 after a catastrophic bootrom failure. tsialex did exactly what he said he would. Worth every penny.

Same!

 

[MacNB2]

Same here.
I just added EnableGop to previously reconstructed BootROM by @tsialex and now have native boot screen and access to Startup Manager via Alt/Option key on any one my 4 different GPU's I can throw into the cMP.

 

[longster23]

Hi @tsialex could I pay you for a BootROM reconstruction?
If you're able to do that, could you PM me the instructions? Really appreciate your amazing contribution and support here!!
Many thanks. MacPro 5.1 2012

 

[tsialex]

Hi @tsialex could I pay you for a BootROM reconstruction?
If you're able to do that, could you PM me the instructions? Really appreciate your amazing contribution and support here!!
Many thanks. MacPro 5.1 2012

Sure, check your PMs for the instructions, get everything ready and I'll get back to you ASAP.

 

[dunnomac]

Hi Tsialex. Could you pm me for a BootROM reconstruction?
I got a MP 2010 dual 3,46 with 8 DIMMs.
A Mac schraubers rom tool which I made pre OC when still on a fresh Mojave showed a bit over 28000 free space, and some other issue's
I am on ssd with original Mojave from apple site and try to go forward with opencore to upgrade to Monterey and have just stumbled again over your posts about being very careful about the BootROM's free space. I did a deep NVRAM reset (4 chimes), then did other boot room test- free space drops to 23000
No more experiments without BootRoom reconstruction file!
Need your help!

 

[equals]

Hi @tsialex,
Would you kindly PM me for a BootROM reconstruction service please?
My cMP (config to be found in my signature) still works okayish, but I'm going to future-proof everything by replacing the SPI memory chip with a SOP-8 socket, buying a bunch of spare replacement chips and programming them with a fresh and never booted firmware. Well, in the context of possible chip and socket pins oxidization, I'm aware of it, so I'm just going to clean them once in a while. I just find it more safe, easy and reliable for myself.
Thanks!

 

[JonFreeman]

Hi @tsialex.
Could you pm me for a BootROM reconstruction?
I just checked my BootROM dump and in the free space it says 20800. After deep NVRAM reset it was 39000.
Thank you in advance!

 

[mrkapqa]

hello , please PM me aswell,
Full size: 289Dh (10397)
thanks

 

[tsialex]

PMs sent to everyone, please get everything as instructed and I'll get back to you ASAP.

 

[crjackson2134]

PMs sent to everyone, please get everything as instructed and I'll get back to you ASAP.

Very busy these days I see

 

[DarrenHnLA]

How to check the health of the NVRAM/if the garbage collection is still working:​

There is a extremely simple way (simple here as in not need to know how the NVRAM works/check free space indicators/validate checksums and etc) to check if the garbage collection failed and the need to reflash with the clean dump:

• Dump the BootROM with ROMTool
• Open the dump with the most recent release of UEFITool NE (right now is UEFITool NE A59)
• Go to EFISystemNvDataFvGUID, open it
  
  
  
• Go to the first VSS store, open it:
  
• Click Free space, it's after the last variable/VSS entry:
  
• Check on the right panel the Full size:
  

A clean reconstructed never booted image have the Free Space Full Size as 65448 - this is for a fully empty store:

A normal working single CPU Mac Pro with 3 DIMMs have the Free Space Full Size usually around 45000 to 40000 - this is for a healthy working dump:

A normal working dual CPU Mac Pro with 8 DIMMs (DIMM configuration data and SPD caches stored by MemoryConfig NVRAM entries are what takes the most space inside the VSS store) have the Free space Full size around 35000 to 30000 - this is for a healthy working dump:

A Mac Pro that the garbage collection is not working anymore will have less than 1/3 of Free Space Full Size available, less than 22000 bytes available. Any less than this and you usually start having problems and could even brick your Mac Pro. This is critical with Big Sur and Monterey OTA Software Updates, but also happened in the past with previous macOS versions (examples #1, #2) because the number of variables saved while staging the software updates.

This one has just 8921 and already corrupted the NVRAM volume:

Examples of corruption:​

Where is the secondary VSS store?

This dump below had two different failures, a corrupt circular log and failed garbage collection on primary VSS store where after the corrupt point the circular log was identified as padding, and the secondary VSS store completely trashed and not even being identified by UEFITool anymore. The owner of this early-2009 got it repaired in the nick of time before bricking it.

If you found that your NVRAM volume have any of the issues above and you need a BootROM reconstruction service, send me a PM.

Advice after several bricks over the years:​

First a fact, MacPro5,1 NVRAM was designed back in 2008ish, when the NVRAM was used sparingly. Now we are in 2022 and the NVRAM is used constantly for all sort of things, like all sort the iCloud variables (for example, the Wi-Fi credentials for the wireless networks that you connect with your iPhone and MacBooks are also saved inside the Mac Pro NVRAM) to the several variables needed to bootstrap software updates when you have sealed containers (BigSur and Monterey).

The NVRAM is now the Achilles heel of our MacPro5,1 and I personally don't wait for the garbage collection to fail. Now I have a recurring appointment on my Calendar to flash the never booted BootROM image every 3 months. Since starting doing it, I never had a brick or any NVRAM problems - even with all my crazy tests that bricked so much times my backplanes in the past. Do the same.

Btw, flashing a clean dump is a process that is a lot less wear intensive to the NAND cells than the whole garbage collection process. Only the sectors that need to be erased/re-written will be when you flash the clean dump, while the garbage collection process have to copy the valid circular log to the secondary VSS store, erase the primary, write to it, erase the secondary and etc.

 

[DarrenHnLA]

Hi Alex- I need your help.
I need my NVRAM cle9ned 9nd rebuilt. G9rb9ge collection doesnʼt seem to be working 9nd it h9s less th9n recommended free sp9ce.
M9cschr9uberʼs CMP Rom Dump:
File s9ved in Downlo9ds with n9me ~/downlo9ds/YM1xxxxx9EUE_144.0.0.0.0_MX25L3205D_13.03.2023_00-58-29.bin
An9lysis:
Seri9l from firmw9re: YM1xxxxx9EUE
Firmw9re 144.0.0.0.0 (l9test)
CRC32 checksums: ok
Old bootblock of MP51.007F.B03
b9se_21 h9rdw9re descriptor
Boot0001 is EFI\OC\OpenCore.efi (L9uncherOption: Full) Assumed 6 boots since l9st g9rb9ge collection
7 (1 9ctive) + 1 Memory Configs g (ok)
7 (1 9ctive) + 0 Memory Configs h (ok)
1 (1 9ctive) + 1 Memory Configs i (ok)
1 (1 9ctive) + 1 Memory Configs j (ok)
1 (0 9ctive) + 0 IASInst9llPh9seList / xml (ok) 0 + 0 Microsoft certific9tes (ok)
1 (1 9ctive) + 1 BluetoothActiveControllerInfos (ok) 1 (1 9ctive) + 1 BluetoothIntern9lControllerInfos (ok) 1 (1 9ctive) + 1 current-network (ok)
2 (0 9ctive) + 1 AAPL P9th Properties (ok)
19115 bytes free sp9ce of 65464
VSS1 (Form9tted) (He9lthy)
VSS2 (Form9tted) (He9lthy)
H"rdw"re Overview:
Model N9me: M9c Pro
Model Identifier: M9cPro5,1 ProcessorN9me: 6-CoreIntelXeon Processor Speed: 3.46 GHz Number of Processors: 1
Tot9l Number of Cores: 6

L2 C9che (per Core): 256 KB
L3 C9che: 12 MB
Memory: 48 GB
Boot ROM Version: 144.0.0.0.0
SMC Version (system): 1.39f11
SMC Version (processor tr9y): 1.39f11
Seri9l Number (system): YM1310G9EUE
Seri9l Number (processor tr9y): J5129053MCZJC
H9rdw9re UUID: E6ABE22B-9535-5ECE-82BA-1E612ED55C2A
Iʼve upd9ted to Monterey but I c9n only get to Montery from recovery mode- it cr9shes on norm9l boot up.
When running Monterey- the firmw9re ch9nges from 1444.00 to 9999.9999.xxxx
Also, when I 9ttempt to inst9ll M9rtin Loʼs p9ck9ge I c9nʼt dis9ble the SIP bec9use Iʼm only 9ble to boot up in t9rget mode which en9bles the SIP. When I try to st9rtup/ rest9rt I get the chime 9nd then it just shuts down 9fter 9pprox. 9 minute.

Darren Howelton
213-925-9335
dhowelton@msn.com

 

[DarrenHnLA]

Here’s more info.
‘Darren

 

[tsialex]

@DarrenHnLA PM sent.

 

[tsialex]

Very busy these days I see

Btw, did you added EnableGop to your reconstructed BootROM?

 

[tsialex]

hello , please PM me aswell,
Full size: 289Dh (10397)
thanks

You have 31 crash dumps/Kernel Panics saved (or pointed) inside your NVRAM volume. Your NVRAM VSS stores are basically just crash dump storage:

1179688       0x120028        NVRAM start of the 1st VSS store
1179766       0x120076        NVRAM MemoryConfig type: (j)
1181530       0x12075A        NVRAM bluetoothActiveControllerInfo
1188925       0x12243D        NVRAM PanicInfo Log
1189131       0x12250B        NVRAM MemoryConfig type: (g)
1191179       0x122D0B        NVRAM MemoryConfig type: (h)
1193227       0x12350B        NVRAM MemoryConfig type: (i)
1195346       0x123D52        NVRAM PanicInfo Log B
1196184       0x124098        NVRAM PanicInfo Log B
1197022       0x1243DE        NVRAM PanicInfo Log B
1197860       0x124724        NVRAM PanicInfo Log B
1198698       0x124A6A        NVRAM PanicInfo Log B
1199536       0x124DB0        NVRAM PanicInfo Log B
1200374       0x1250F6        NVRAM PanicInfo Log B
1201212       0x12543C        NVRAM PanicInfo Log B
1202050       0x125782        NVRAM PanicInfo Log B
1202381       0x1258CD        NVRAM MemoryConfig type: (g)
1204429       0x1260CD        NVRAM MemoryConfig type: (h)
1206477       0x1268CD        NVRAM MemoryConfig type: (i)
1208588       0x12710C        NVRAM PanicInfo Log
1208752       0x1271B0        NVRAM PanicInfo Log B
1209590       0x1274F6        NVRAM PanicInfo Log B
1210428       0x12783C        NVRAM PanicInfo Log B
1211266       0x127B82        NVRAM PanicInfo Log B
1212104       0x127EC8        NVRAM PanicInfo Log B
1212942       0x12820E        NVRAM PanicInfo Log B
1213780       0x128554        NVRAM PanicInfo Log B
1214618       0x12889A        NVRAM PanicInfo Log B
1215456       0x128BE0        NVRAM PanicInfo Log B
1215935       0x128DBF        NVRAM MemoryConfig type: (g)
1217983       0x1295BF        NVRAM MemoryConfig type: (h)
1220031       0x129DBF        NVRAM MemoryConfig type: (i)
1222444       0x12A72C        NVRAM MemoryConfig type: (g)
1224492       0x12AF2C        NVRAM MemoryConfig type: (h)
1226540       0x12B72C        NVRAM MemoryConfig type: (i)
1228651       0x12BF6B        NVRAM PanicInfo Log
1245255       0x130047        NVRAM start of the 2nd VSS store
1245302       0x130076        NVRAM MemoryConfig type: (j)
1247066       0x13075A        NVRAM bluetoothActiveControllerInfo
1254461       0x13243D        NVRAM PanicInfo Log
1254667       0x13250B        NVRAM MemoryConfig type: (g)
1256715       0x132D0B        NVRAM MemoryConfig type: (h)
1258763       0x13350B        NVRAM MemoryConfig type: (i)
1260882       0x133D52        NVRAM PanicInfo Log B
1261720       0x134098        NVRAM PanicInfo Log B
1262558       0x1343DE        NVRAM PanicInfo Log B
1263396       0x134724        NVRAM PanicInfo Log B
1264234       0x134A6A        NVRAM PanicInfo Log B
1265072       0x134DB0        NVRAM PanicInfo Log B
1265910       0x1350F6        NVRAM PanicInfo Log B
1266748       0x13543C        NVRAM PanicInfo Log B
1267586       0x135782        NVRAM PanicInfo Log B

I don't ever remember investigating a so messed up BootROM image that still boots.

 

[mrkapqa]

@tsialex thanks for helping out, don§t know what to make of your comment since the computer seems to function just ok.
glad if it can be fixed to better, though.
ciao.

 

[behart]

OK, Thanks for your quick, excellent, and patient response. That sounds like a good plan. I will source a couple SPI chips and give that a try.

I finally managed to get back to this. I successfully burned a new chip with MP51.fd and installed it. There has been no change in behavior. It looks like there must be some other problem with my machine. What would be a good thread for debugging at this point? If that does not exist yet, what components should I start checking? As a hardware guy, I'm kinda curious to see if I can fix what I have.

 

[tsialex]

I finally managed to get back to this. I successfully burned a new chip with MP51.fd and installed it. There has been no change in behavior. It looks like there must be some other problem with my machine. What would be a good thread for debugging at this point? If that does not exist yet, what components should I start checking? As a hardware guy, I'm kinda curious to see if I can fix what I have.

If it's not something really simple that you can quickly diagnose measuring the most obvious components, like a blown fuse or a dry cap, it's not worth to try to repair when you can get a replacement backplane for around $70 with shipping from eBay, even less for an early-2009. Just a southbridge will cost you around $50. The only people that repair a MacPro5,1 backplane today are the ones that have loads of dead boards to scavenge parts.

Even if you like the challenge and time/money do no matter at all, do yourself a favor and get a replacement backplane (or even a working Mac Pro) to be absolutely sure that everything else is 100% working. Having a working Mac Pro to test all the components one at a time is always the first step.

 

[behart]

Thanks. There are quite a few components on those boards. I will begin sourcing a new machine or backplane. I like the idea of having a second machine that is functional to check all the parts. I have upgraded the ram, processors, and video card. I'll relate my (mis)adventures here...