MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0

[getdown71]

Hi All,

Somewhat a Mac BootRom hacking noob here. (plenty of other firmware experience) I have a real 5,1 MacPro running 10.14.1 with MP51.0089.B00. Mojave wont upgrade to 140.0.0.0.0 with DP3. So I'm in need of suggestion how I get a dumped MP51.fd for 140.0.0.0.0 and how I manually load into hardware as dosdude1 ROMTool is no longer online......

 

[dennisausbremen]

Please see @tsialex post #1783

 

[startergo]

Hi All,

Somewhat a Mac BootRom hacking noob here. (plenty of other firmware experience) I have a real 5,1 MacPro running 10.14.1 with MP51.0089.B00. Mojave wont upgrade to 140.0.0.0.0 with DP3. So I'm in need of suggestion how I get a dumped MP51.fd for 140.0.0.0.0 and how I manually load into hardware as dosdude1 ROMTool is no longer online......

To dump your ROM you can try the DarwinDumper:
https://bitbucket.org/blackosx/darwindumper/downloads/
You should only "binwalk" the ROM and post the result here. I believe only @tsialex can help you with the ROM, but it looks like he is pretty busy at the moment and you will be on his todo list.

 

[Spacedust]

I just updated to 140.0.0.0 - thanks to tsialex

All works well, boots fast and Windows 7 legacy is working as it should.

 

[tsialex]

Just checked all my saved MP5,1 ROMs and I have also this "XML document, version: "1.0" line in each of them. Is there any easy way to get rid of this potential threat?

It's not a threat per se, it's just a plist that tells Apple that you had a botched macOS install.

Let's be clear: the plist will not do any damage to your Mac Pro, but it's presence in your NVRAM volume shows that your Mac have/had a problem.

When I found the InstallPhaseList or multiple SecureBoot certificates, I do these steps to clean up the BootROM:

1. extract the LBSN_BD from the BootROM dump, save it,
2. check both checksum of the parts 3 and 4 of the NVRAM volume,
3. check if any hardwareIDs are out of place or incorrect,
4. extract parts 3 and 4 of the NVRAM volume, update Base_xx to Base_21 if needed, correct any wrong hardwareIDs, correct the checksum,
5. insert parts 3 and 4 into the empty NVRAM volume extracted from MP51.fd, save it,
6. insert both the NVRAM edited volume and the LBSN_Bd sector into the MP51.fd. Done.

It's not a process that a end user can do, involves heavy hex editing. You have to know how to check and make checksums with big endian format - and know what are the start and end points of what you need to cheksum.

If you have lots of firmware editing experience, maybe. If not, ask me and I'll PM instructions for you to send all I need to create the intermediate files for your Mac Pro.

 

[Chrisf1977]

i can confirmed it work with cMP 4,1/5,1 , i order one and it arrived today , tested it with my 4,1>5,1 , installed to the x16 lane slot , show running at x4 8GT/s , i only have SM951 to test, and even with only one SSD installed, the speed is faster then the x4 adapter i used before , tested with RAID 0 SM951, speed is close to the 7101A , very happy now .
[doublepost=1539780329][/doublepost]
confirmed this card work

2600Mb/sec ist not the fastest i have seen. Is the SM951 slower than a 970 Evo or Pro? On the 7101A Card with two 970 Evo or 970 Pro the Raid 0 has >5000Mb/sec.

 

[tsialex]

2600Mb/sec ist not the fastest i have seen. Is the SM951 slower than a 970 Evo or Pro? On the 7101A Card with two 970 Evo or 970 Pro the Raid 0 has >5000Mb/sec.

SM951-AHCI is a PCIe AHCI blade from early 2015, second model released by Samsung, tops around 2150MB/s read and 1500MB/s write for the 512GB model.

ASMedia PCIe switch is a 8x one with 24 lanes. It's half the PLX one, with half the total throughput.

 

[marcoscc]

2600Mb/sec ist not the fastest i have seen. Is the SM951 slower than a 970 Evo or Pro? On the 7101A Card with two 970 Evo or 970 Pro the Raid 0 has >5000Mb/sec.

The maximum speed I can get on the 7101A with 3 EVO 960 in RAID0 is that of the attached image. If I put 4 blades EVO 960 in RAID0 the performance continues the same because I believe it is the maximum speed of the PCIe 2.0 slot. Maybe with 970 PRO the speed is better !!

 

[getdown71]

Got the ROM Tool. Thanks all. Will disable SIP on weekend and give this Mac a crack......

 

[handheldgames]

The maximum speed I can get on the 7101A with 3 EVO 960 in RAID0 is that of the attached image. If I put 4 blades EVO 960 in RAID0 the performance continues the same because I believe it is the maximum speed of the PCIe 2.0 slot. Maybe with 970 PRO the speed is better !!

I hit around 6000 mb/sec with 2 970pros in raid 0 on the Highpoint SSD 7101-A.

FWIW... Three ahci 256gb sm951’s also topped out around 6000 mb/sec. adding a fourth drive to the array failed to add any additional speed.

It's probably safe to say that an x16 PCIe 2.0 connection tops out around 6000 MB/s. Which happens to be the speed of a PCIe x4 connection of 1500 MB/S * 4 ~ 6000 mb/s

 

[tsialex]

Off topic:

Look what arrived today, X5680 super fast from China - bought with last month eBay Promo for $41.64.
[doublepost=1539880916][/doublepost]I bought two with two separate purchases (easier with Brazilian customs), one a day later. The second one arrived first, still waiting on the first one.

Both will go to my dual MP4,1, but I’ll test for a week installed into my single before doing the de-lid.

Update:



Already working

 

[AliGT83]

Off topic:

Look what arrived today, X5680 super fast from China - bought with last month eBay Promo for $41.64
[doublepost=1539880916][/doublepost]I bought two with two separate purchases (easy with Brazilian customs) one a day later, the second one arrived first. Waiting on the first.

Both will go to my dual MP4,1, but I’ll test for a week in my single before doing the de-lid.

Will you delid them or use washers method?

 

[tsialex]

Will you delid them or use washers method?

De-lid, after testing throughly. I never had much luck with washers. It’s easy to de-lid with a little blowtorch after you cut the glue.

 

[MriX]

@tsialex Could you please also check my bootrom? It isn’t urgent, so you can take as much time as you need.

 

[mikeboss]

@tsialex

with a blowtorch it's almost impossible to control the heat. I googled at which temperature solder starts to melt. using an infrared temperature gun I measured the temp of my stove top (hotplate) and placed the CPU upside down onto it. before delidding I also inserted razorblades between the IHS and CPU carrier.

 

[tsialex]

@tsialex

with a blowtorch it's almost impossible to control the heat. I googled at which temperature solder starts to melt. using an infrared temperature gun I measured the temp of my stove top (hotplate) and placed the CPU upside down onto it. before delidding I also inserted razorblades between the IHS and CPU carrier.

It's a cooking torch, not a blowtorch .

I have two hot air stations and a IR pre-heater too, but it's easier with the little torch and the razorblades. Your idea is interesting, maybe I'll do it with the pre-heater and just use the cooking torch to do the pop.
[doublepost=1539885823][/doublepost]

@tsialex Could you please also check my bootrom? It isn’t urgent, so you can take as much time as you need.

Sure. I'll PM the instructions.

 

[tsialex]

This is a BootROM nightmare, multiple SecureBoot certificates and InstallPhaseList:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             UEFI PI firmware volume
16524         0x408C          UEFI PI firmware volume
24972         0x618C          CRC32 polynomial table, little endian
35787         0x8BCB          mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
49948         0xC31C          UEFI PI firmware volume
524288        0x80000         UEFI PI firmware volume
540812        0x8408C         UEFI PI firmware volume
549260        0x8618C         CRC32 polynomial table, little endian
560075        0x88BCB         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
574236        0x8C31C         UEFI PI firmware volume
1048576       0x100000        UEFI PI firmware volume
1114112       0x110000        UEFI PI firmware volume
1182663       0x120BC7        Certificate in DER format (x509 v3), header length: 4, sequence length: 986
1248199       0x130BC7        Certificate in DER format (x509 v3), header length: 4, sequence length: 986
1260520       0x133BE8        XML document, version: "1.0"
1343511       0x148017        bzip2 compressed data, block size = 100k
1376256       0x150000        UEFI PI firmware volume

Descriptor version before the compressed blob and wrong checksum for part 3:

Something went very wrong with this Mac Pro, at least is still booting.

 

[VaZ]

Anyone manage to test out the X5687 (3.6GHz quad-core) and the X5698 (4.4GHz dual-core) with the latest BootROMs ?

 

[Macschrauber]

Alex, just did 2 x5680 in a dual 4.1, delid

Set 180 Celsius to the hot air station, heated up the xeons caps and did the vice Method. Popped a lot easier off than with no heating.

Scratched metal off and polished with a fiber glass pen, took off the glue with scalpel and isopropyl

Hth

 

[getdown71]

Hi all - thanks for the pointers to date.

I have got upgraded to 138.0.0.0.0 so far.

I have found the separate packages from 10.14.1 DP3;

SecureBoot_3.pkg
EmbeddedOSFirmware_3.pkg
FullBundleUpdate_3.pkg
FirmwareUpdate_3.pkg (I assume this 140.0.0.0)

I have tried to apply FirmwareUpdate but I get the error "The installation failed etc..."

Any suggestions ?

 

[tsialex]

Hi all - thanks for the pointers to date.

I have got upgraded to 138.0.0.0.0 so far.

I have found the separate packages from 10.14.1 DP3;

SecureBoot_3.pkg
EmbeddedOSFirmware_3.pkg
FullBundleUpdate_3.pkg
FirmwareUpdate_3.pkg (I assume this 140.0.0.0)

I have tried to apply FirmwareUpdate but I get the error "The installation failed etc..."

Any suggestions ?

Posts #1554 and #1569.

 

[getdown71]

Maximum respect to tsialex - running 140.0.0.0 now!

 

[MisterBiro]

Did anyone booting from NVMe with 140.0.0.0 find that after updating to DP4 that your machine would no-longer boot?

As soon as I updated I got the 'stop' icon screen and had to boot into recovery and re-set the start-up disk.

No issues since then, but slightly concerning as the lack of boot screens made it irritating to troubleshoot.

 

[MisterAndrew]

Oh my. That's not good news!

 

[tamarro]

It's not a threat per se, it's just a plist that tells Apple that you had a botched macOS install.

Let's be clear: the plist will not do any damage to your Mac Pro, but it's presence in your NVRAM volume shows that your Mac have/had a problem.

When I found the InstallPhaseList or multiple SecureBoot certificates, I do these steps to clean up the BootROM:

1. extract the LBSN_BD from the BootROM dump, save it,
2. check both checksum of the parts 3 and 4 of the NVRAM volume,
3. check if any hardwareIDs are out of place or incorrect,
4. extract parts 3 and 4 of the NVRAM volume, update Base_xx to Base_21 if needed, correct any wrong hardwareIDs, correct the checksum,
5. insert parts 3 and 4 into the empty NVRAM volume extracted from MP51.fd, save it,
6. insert both the NVRAM edited volume and the LBSN_Bd sector into the MP51.fd. Done.

It's not a process that a end user can do, involves heavy hex editing. You have to know how to check and make checksums with big endian format - and know what are the start and end points of what you need to cheksum.

If you have lots of firmware editing experience, maybe. If not, ask me and I'll PM instructions for you to send all I need to create the intermediate files for your Mac Pro.

I do not recall issues with any macOS installs on my MP. But maybe I just forgot.

Concerning the LBSN_BD - everything seems to be at the right place, no corruptions, nothing conspicuous, no changes between different ROM dumps. Never had any problems with logging into iC/iM/FT either. Guess, no reason to worry then.