Yep - that is a goot possibility - could that lead to a completely unbootable brick?
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0
- Thread starter tsialex
- WikiPost WikiPost
- Start date
- Sort by reaction score
- Status
Yep - that is a goot possibility - could that lead to a completely unbootable brick?
Yes, that's what bricked my dual.
The first person to ventilate this was @h9826790, he noticed that Windows was successively crashing at boot before his Mac Pro bricked. Later I found multiple certificates into dumps of bricked Mac Pros that other people sent me, that's why I'm against UEFI installs into MP5,1.
I know that Apple changed the offsets between MP51.0085.B00 and MP51.0087.B00, then again with MP51.0089.B00.
I'll need to check if MP51.0085.B00 and MP51.0089.B00 have the same offsets, I'll add this to my list.
okay -> so then i will leave uefi installs alone, i don't want my MP to get bricked...
Thanks for the input!
Since High Sierra betas last year, we had at least 8 new BootROMs (maybe we missed MP51.0086.B00/MP51.0088.B00 not checking the RecoveryUpdates betas then).
Before 2017, when the BootROM was stable, Windows installed with UEFI worked perfectly, it's not the case now.
Last edited:
was that on 0087? because thats when we tried sticking microcodes into the BRs unofficially
and we noticed it had the affect of causing existing windows installs to BSOD, im just mentioning that just in case it was that.
I got 2 Windows in EFi mode and 2 certificates. Over the weekend I will copy my windows to another drive (DT-Lycom 120 nVME) for a total of 3 and will binwalk it
You are looking this the wrong way. It's not multiple installs, it's the change of the BootROM, every time it has an update, SecureBoot will resign. If Apple changes offsets, the stupid SecureBoots signs multiple times into wrong places.
[doublepost=1542369883][/doublepost]
I initially thought that the missing microcodes was causing this, but I noticed recently that the NVRAM volume streams offsets changed between MP51.0085/87/89.B00. I'm not sure if it's one or the other, I'll probably have to try to reproduce this.
So if I revert back to an old room and update the apple way will that do the test?
You can reflash your MATT card with a SPI programmer? If not, don't test this.
I'll try to reproduce the brick and check if it's the offset change, microcodes or both when I'll have the LPC+SPI interface working.
I am running on a MATT card .That is why I am brave. You can reconstruct specific time that I can test
im not talking about the missing microcode as-such
but when we added the microcode back (or changed the ones in 0085 to ver 30 IIRC) it would cause existing windows installs to BSOD
Yep, I remember that. Probably BSODs helped, one user that was testing overclocks was having BSODs too and had multiple SecureBoot certificates. But I didn't tested the microcode insertion nor @Cecco and we both got bricks.
[doublepost=1542371082][/doublepost]
Did you tested if you can reflash the MATT card with a SPI programmer and a clip? I'm not sure if you can, confirm this first.
The simpler test is to reconstruct MP51.0085.B00, flash it to the MATT Card, trigger two SecureBoot certificates, then upgrade it via EFIUpdater to MP51.0087.B00. After that you probably will have to try to boot Windows/macOS multiple times, making dumps frequently to check any changes.
BTW, MATT card is not the best way to check this. The LPC+SPI interface will be a lot easier, since I can just turn off the Mac Pro and dump it externally, I'll probably connect the interface to a Pi to do this using a GPIO button or something.
Have you finished that product? I am not sure how can I update via EFIUpdater to MP51.0087.B00. I only have the crc and 140 bootrom in the EFI folder. (89 maybe too).
We are near the end.
Download the 10.13.5 ComboUpdate, you can get the MP51.0087.B00 from it. MP51.0085.B00 you can get from 10.13.4 ComboUpdate, this one you will reconstruct with the intermediate files that I sent you. To update, put MP51.0087.B00 into the 10.13.6 full installer.
BTW, no one else try this, we're trying to reproduce a brick…
Last edited:
So to be clear:
If I remove everything from the firmware folder:
And I put MP51.0087.B00 into the 10.13.6 full installer, and initiate 10.13.6 install this firmware over the previosly installed MP51.0085.B00 will do? The installer should put its EFIupdater and crc32 right? There is also firmware.scap in the extensions folder. Do I delete it too?
Last edited:
You have to downgrade your BootROM via ROMTool with reconstructed MP51.0085.B00, first. After all the song and dance of the UEFI install, you upgrade to MP51.0087.B00. To do that you remove MP51.0089.B00.LOCKED.fd and the crc32 file from 10.13.6 full installer, replacing with the MP51.0087.B00 + crc32 from 10.13.5 Combo, everything else stays the same.
Scap files are for Macs that use the SCAP format, like MP61.
Just for everyones info, i have now managed to install win10 legacy in csm mode directly on a nvme-ssd.
I took the route over a raw disk in vmware, wich worked flawlessly.
BootROM resides on the mainboard?
EFI, as in 4,1 -> 5,1 update resides on CPU tray?
SMC is on both mainboard and CPU tray and must match?
So the 140.0.0.0.0 update has nothing to do with 4,1 -> 5,1 update?
About to do a CPU tray swap and some 4,1-5,1 switching and hoping that 140.0.0.0 or other BootRom stuff doesn't get weird.
EFI, as in 4,1 -> 5,1 update resides on CPU tray?
SMC is on both mainboard and CPU tray and must match?
So the 140.0.0.0.0 update has nothing to do with 4,1 -> 5,1 update?
About to do a CPU tray swap and some 4,1-5,1 switching and hoping that 140.0.0.0 or other BootRom stuff doesn't get weird.
Backplane
Yes.
2009 backplanes with 2009 CPU trays
2010/2012 backplanes with 2010/2012 CPU trays
140.0.0.0.0 is a BootROM update for MP5,1. If you turn your MP4,1 into a MP5,1 hacking the BootROM, you can update it to 140.0.0.0.0
Btw, seems people didn't noticed this yet, but:
MP51.007F.B03 = 0x7F = 127
MP51.0084.B00 = 0x84 = 132
MP51.0085.B00 = 0x85 = 133
MP51.0087.B00 = 0x87 = 135
MP51.0089.B00 = 0x89 = 137
138.0.0.0.0
139.0.0.0.0
140.0.0.0.0
So, starting with 138.0.0.0.0, Apple changed the format of the EFI versioning from hex to dec.
Last edited:
Sorry, I have limited time and I have much more urgent things to address before this.
You can do it yourself, reconstruct MP51.0085.B00, install into your Mac Pro, use it a little, log into iCloud/iMessage/FNMM, boot Windows, populate the NVRAM volume. Do a BootROM dump.
Upgrade to MP51.0087.B00 via EFIFlasher, use it, then do a dump.
Upgrade to MP51.0089.B00, do the same.
Check the offsets of the NVRAM. 85 and 87 are different, check if 85 and 89 are the same.
After installing clean mojave on NVMe with ATI 7950 graphics...
sometimes i get kernel panics ... the machine have a boot loop ... after 3-50 times it boots up and shows this message
sometimes i get kernel panics ... the machine have a boot loop ... after 3-50 times it boots up and shows this message
Code:
Sat Nov 17 18:05:50 2018
*** Panic Report ***
panic(cpu 4 caller 0xffffff801bed84dd): Kernel trap at 0xffffff7f9e553f5a, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x0000000000000000, CR3: 0x000000083d130023, CR4: 0x00000000000226e0
RAX: 0xffffff8057c2b100, RBX: 0x0000000000000000, RCX: 0x0000000000000000, RDX: 0xffffffa3c82b3798
RSP: 0xffffffa3c82b3790, RBP: 0xffffffa3c82b3840, RSI: 0xffffff8059e4bc00, RDI: 0x0000000000000000
R8: 0xffffff8351d9eda8, R9: 0x00000000000000c0, R10: 0xffffff805869bda8, R11: 0x0000000000000001
R12: 0xffffff805b6813f0, R13: 0xffffff805b92eb00, R14: 0x0000000000000000, R15: 0xffffff8351d9e000
RFL: 0x0000000000010246, RIP: 0xffffff7f9e553f5a, CS: 0x0000000000000008, SS: 0x0000000000000010
Fault CR2: 0x0000000000000000, Error code: 0x0000000000000000, Fault CPU: 0x4, PL: 0, VF: 0
Backtrace (CPU 4), Frame : Return Address
0xffffffa3c82b3260 : 0xffffff801bdaca9d
0xffffffa3c82b32b0 : 0xffffff801bee6893
0xffffffa3c82b32f0 : 0xffffff801bed82ba
0xffffffa3c82b3360 : 0xffffff801bd59ca0
0xffffffa3c82b3380 : 0xffffff801bdac4b7
0xffffffa3c82b34a0 : 0xffffff801bdac303
0xffffffa3c82b3510 : 0xffffff801bed84dd
0xffffffa3c82b3680 : 0xffffff801bd59ca0
0xffffffa3c82b36a0 : 0xffffff7f9e553f5a
0xffffffa3c82b3840 : 0xffffff7f9e4a9c77
0xffffffa3c82b38b0 : 0xffffff7f9e4abe20
0xffffffa3c82b38f0 : 0xffffff7f9e5599f7
0xffffffa3c82b3910 : 0xffffff7f9e4d2230
0xffffffa3c82b3950 : 0xffffff7f9e4cfa58
0xffffffa3c82b3a70 : 0xffffff7f9e4cf5ee
0xffffffa3c82b3aa0 : 0xffffff7f9e4d4af8
0xffffffa3c82b3ae0 : 0xffffff801c4850a8
0xffffffa3c82b3b30 : 0xffffff801c48e52f
0xffffffa3c82b3c70 : 0xffffff801be92ef4
0xffffffa3c82b3d80 : 0xffffff801bdb218d
0xffffffa3c82b3dd0 : 0xffffff801bd8cb45
0xffffffa3c82b3e50 : 0xffffff801bda14fe
0xffffffa3c82b3ef0 : 0xffffff801bebfa0b
0xffffffa3c82b3fa0 : 0xffffff801bd5a486
Kernel Extensions in backtrace:
com.apple.iokit.IOAcceleratorFamily2(400.27)[5BC3E111-E908-36E8-9AFB-A39BD0D561D5]@0xffffff7f9e491000->0xffffff7f9e535fff
dependency: com.apple.driver.AppleMobileFileIntegrity(1.0.5)[66A1BDE1-514B-3B0D-87DD-8E2B9F110A8C]@0xffffff7f9cb82000
dependency: com.apple.iokit.IOSurface(255.1)[B153C6D6-2542-3D6F-A21F-B56D9E1349DF]@0xffffff7f9e46d000
dependency: com.apple.iokit.IOPCIFamily(2.9)[7DE930EC-AB73-3F5A-9D38-94D5EE90D197]@0xffffff7f9c695000
dependency: com.apple.iokit.IOGraphicsFamily(530.12)[9D1E5FA7-267E-397E-9C91-1751221A05CF]@0xffffff7f9ce1c000
dependency: com.apple.iokit.IOReportFamily(47)[6A9FF3E1-E644-3F33-8A44-8B51C44AA67C]@0xffffff7f9d198000
com.apple.kext.AMDRadeonX4000(2.0.2)[BAB
EOF
Model: MacPro5,1, BootROM 140.0.0.0.0, 6 processors, 6-Core Intel Xeon, 3,33 GHz, 32 GB, SMC 1.39f11
Graphics: AMD Radeon HD 7xxx, AMD Radeon HD 7xxx, PCIe
Memory Module: DIMM 1, 8 GB, DDR3 ECC, 800 MHz, 0x0198, 0x393936353433342D3036392E4130304C4620
Memory Module: DIMM 2, 8 GB, DDR3 ECC, 800 MHz, 0x0198, 0x393936353433342D3036392E4130304C4620
Memory Module: DIMM 3, 8 GB, DDR3 ECC, 800 MHz, 0x0198, 0x393936353433342D3036392E4130304C4620
Memory Module: DIMM 4, 8 GB, DDR3 ECC, 800 MHz, 0x0198, 0x393936353433342D3036392E4130304C4620
AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x8E), Broadcom BCM43xx 1.0 (5.106.98.102.30)
Bluetooth: Version 6.0.9f2, 3 services, 27 devices, 1 incoming serial ports
Network Service: Ethernet 1, Ethernet, en0
PCI Card: pci144d,a808, NVM Express Controller, Slot-1
PCI Card: AMD Radeon HD 7xxx, Display Controller, Slot-2
PCI Card: pci1002,aaa0, Audio Device, Slot-2
Serial ATA Device: HL-DT-ST DVD-RW GH80N
USB Device: USB 2.0 Bus
USB Device: Hub
USB Device: Gaming Mouse G400
USB Device: Hub
USB Device: Keyboard Hub
USB Device: USB Receiver
USB Device: Apple Keyboard
USB Device: Intuos5 touch M
USB Device: EIZO USB HID Monitor
USB Device: EIZO USB HID Monitor
USB Device: USB 2.0 Bus
USB Device: USB Bus
USB Device: USB Bus
USB Device: BRCM2046 Hub
USB Device: Bluetooth USB Host Controller
USB Device: USB Bus
USB Device: USB Bus
USB Device: USB Bus
USB Device: USB Bus
FireWire Device: built-in_hub, Up to 800 Mb/sec
Thunderbolt Bus:Please, open a thread for your problem or search for a more appropriable thread.
This thread is not a troubleshooting thread.
Btw, logs most of the time are useless to show what is causing the problem if you have a hardware problem. Run AHT and check for the error showed.