MP51.0084.B00 Rom Dump Request

[dosdude1]

Just for my own clarity (because post #13 gave me a brain-fog), let me see if I’ve got a grip on this...

I can make a folder on my desktop (let’s call it injection), then...

* download the new tool zip file and place the extracted contents in th injection folder

* using pacifist, find the NVMe FFS and copy it into the injection folder

* boot machine to recovery mode terminal and disable SIP, then reboot to desktop

* open a terminal session and cd into the injection folder

* run the posted terminal command (w/o usb3 instruction on end)

* when tool is finished, it will have dumped, injected, and flashed new file to boot rom

* reboot and enjoy native NVMe boot support

No doubt I probably got something wrong, so please correct me so I can understand exactly what needs to be done here.

Also, has anyone actually tried adding the usb3 support yet?

No, all this tool does is modify the ROM. For flashing and dumping, you can use ROMTool. I may bundle the command line tool into a GUI-based app in the near future if that would make it easier. Basically, you'd just dump your ROM using ROMTool, run the DXEInjector tool as described, and it will create a modified ROM at the path you specify for the save file argument. Then, you can flash the resulting file using ROMTool to your system.

 

[crjackson2134]

You forgot dumping your bootrom and writing it back after injecting it into to saved bootrom file.

Okay, I hoped that this tool was handling that when the command was executed.

So I still need to use a different tool to dump, then another to reflash?
[doublepost=1527747882][/doublepost]

No, all this tool does is modify the ROM. For flashing and dumping, you can use ROMTool. I may bundle the command line tool into a GUI-based app in the near future if that would make it easier. Basically, you'd just dump your ROM using ROMTool, run the DXEInjector tool as described, and it will create a modified ROM at the path you specify for the save file argument. Then, you can flash the resulting file using ROMTool to your system.

Thanks, got it now I think...

Yeah, a GUI front end to control these tools from a single UI would be awesome for us neophytes.

 

[rippiedoos]

OK, we now have means to inject the current ROM and insert NVMe-drivers and other stuff. But we also need some kind of fallback-solution or maybe even a more upfront solution to fix the bootROM in case Apple decides to update the bootROM once more in the future. Because by then we have loads of people dropping their NVMe-disks in there and pulling out the really native working drives. In that case, if Apple overwrites the injected bootROM with one that hasn't NVMe in it, you won't be able to boot and to fix the bootROM to inject it once more with NVMe-drivers.

I was thinking along some sort of solution where you prep a USB-drive with the correct NVMe-drivers, maybe other stuff like the USB3 and GOP-drivers from within mac OS X. Then reboot into that USB-drive and automatically there runs a script which uses flashrom to read the bootROM, injects it with all the drivers you prepped from within mac OS X, flashes it back to the bootROM and reboots again to boot with NVMe-support.

Otherwise you have to have a HDD Spinner laying around or some other installed mac OS X drive just for flashing sake.

 

[Lord_Gareth]

Is there any chance for such a ROM modification to force the boot menu on not-apple-blessed graphics cards?

 

[MIKX]

Due to time & work contraints I feel that I should wait until High Sierra goes GM before flashing my 4,1>5,1.

I have my Samsung M.2 960 EVO booting in Sierra 10.12.6 foxfoobar's fusion mod which FIRST requires deleting the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext just to get the NVMe M.22 to be seen in Sierra 10.12.6.

Also, the "format the Samsung M.2 960 EVO to 4k sectors" issue has been raised.
I believe that Samsung Magician can do that but haven't had time to check that properly

I imagine that High Sierra will probably go GM in 10.13.6. .

Sierra is done. High Sierra is not.

I can wait a bit longer. " Measure twice .. cut once".

I wonder if Gilles NVMe booted into Sierra or High Sierra 10.13.4 .. probably the latter as NVMe SSD's are seen natively.

Having said all that, I'm enthralled at all the lightning fast developments happening on a daily basis and Gilles and dosdude1 are destined to become a cMP legends.


EDIT :
I've looked all over the net but am yet to find any videos of an actual firmware restoration using the official Apple Firmware Restore CD's. I'd be grateful for anyone who can point me to one. I'm curious because as one thread member has pointed out .. if the cMP bootROM is damaged and won't start at all . . how does the official Firmware Restore CD overcome this?
There must be some cunning little piece of software somewhere in the CD that forces the cMP to boot up enough to allow the CD to do it's thing.

This is the contents of CD 1.8 for the cMP 4,1

 

[edgerider]

Hi to all!
once again many, many thank to all of you guy’s.
It really show how Apple is pushing planed obsolescence as much as possible. It is a stupid communication mistake. They sould have done that FW update with suport with all the new stuff, because after all there is not that much of us that still use cheesegrater (they know exactelly how much!) an comunicate about how they try to helps pro to get more from their investment.
it would have costed them nothing, and all of us would have said “that is why i spend 2x the price on a mac.
I have a spare 4.1 and a spare xserve 3.1 that could serve the community for test bench.
like many here I’m running a squid but with 3 sm951 256 ahci because i cant find the 4th one at a decent price from a reputable source.... and being able to put 4x 1tb would be very sweet because i need to be able to work on several project at the same time.
I clearly think that one way or the other Apple inc. is going to know about this exploit, and then they have 3 choice : - either they introduce it in next FW update.
- they just put a check before install on software update and prevent update.
-Do as usual, pretend nothing has never happened.

truth is I’m almost a 1000% certain that even thunderbolt ad on card could be added to our workhorses if Apple wanted to, after all it is just a chip bonding pcie with other signal in one plug.

enough literrature,

so as you guy basically paved the way to the next 2 years, please consider the Xserve 3.1 also.
they are very affordable used, and they have 12 memory slot....
supermicro chassis sc848 are cheaper than ever at 500$ a piece, and they make absolutely gorgeous expension bay...
all you need is a Cyclone microsystem PCIE expender in x16, they work out of the box!
here is my setup :
xserve 3.1 2,93
sc846 1200 houssing the expender
with 2 areca 1882ix12 and 24 4tb hsgtSAS drive and 3 titanXp

the macpro 4.1/5.1 have dual X5690,128gb,squid with 3 sm951, GTX 780 6gb areca 1882i8 with 8 850pro.

still need to connect the two by 10gbe to do render online.
if anyone need some setup advice please feel free to PM me.

 

[HaypurTiryading]

...

This is the contents of CD 1.8 for the cMP 4,1

View attachment 763847

Can't we inject/replace the stock B00 HS firmware into a Firmware Restoration CD for unwanted situations?

 

[xxx-xxxxx]

@dosdude1 I get a

-bash: DXEInject: command not found

error. What am I doing wrong?

Edit: Solved it myself. I followed @gilles_polysoft (otherwise very elaborated and excellent) manual but I did not use the extract as is function in UEFITool but extract body (I think there is a slight error between the options in Pacifist and UEFITool within the manual) and therefor never got the proper DXE file which resulted in the error (I therefor never had the option to save as a .ffs file in UEFITool which kept me wondering, too what is going wrong). Now with the correct NVMe DXE file I could manually but as well with your nice command line tool insert the driver into my ROM.

Thanks a lot!

 

[rippiedoos]

@dosdude1 I get a

-bash: DXEInject: command not found

error. What am I doing wrong?

Put ./ before the command. Also you should be in the directory where that file actually is.

./DXEInject <rest of the command>

 

[mikeboss]

truth is I’m almost a 1000% certain that even thunderbolt ad on card could be added to our workhorses if Apple wanted to, after all it is just a chip bonding pcie with other signal in one plug.

nope, not possible. even if Apple wanted to implement it.

 

[MIKX]

I just noticed on Gilles Twitter page https://twitter.com/gillesaurejac that his NVMe booted into Sierra !

Something in his bootROM allows Sierra to SEE NVMe ?

============================================
I wonder if prior to his new NVMe DXE bootROM flash .. . that the installed PCIe M.2 blade he was using WAS NOT VISIBLE in Sierra until AFTER the flash ?
============================================
My 960 EVO M.2 was not visible until I did the kext replacement hack shown below.
( In Sierra. deleting the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext ).
===========================================
Also, this from Gilles #13 post in this thread .. .

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.
===============================================================

I might UNDO the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext hack on another drive SSD 2.5" drive and try the flash after quizzing poor busy Gilles re my Sierra setup.

From Gilles : How to format NVMe SSD to 4k

 

[h9826790]

I just noticed on Gilles Twitter page https://twitter.com/gillesaurejac that his NVMe booted into Sierra !

Something in his bootROM allows Sierra to SEE NVMe ?

============================================
I wonder if prior to his new NVMe DXE bootROM flash .. . that the installed PCIe M.2 blade he was using WAS NOT VISIBLE in Sierra until AFTER the flash ?
============================================
My 960 EVO M.2 was not visible until I did the kext replacement hack shown below.
( In Sierra. deleting the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext ).
===========================================
Also, this from Gilles #13 post in this thread .. .

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.
===============================================================

I might UNDO the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext hack on another drive SSD 2.5" drive and try the flash after quizzing poor busy Gilles re my Sierra setup.

View attachment 763868

My understanding is if the Mac can boot from it, even no driver support at OS level, the firmware can still provide basic support for the hardware to let it run inside the OS.

Just like an EFI Maxwell / Pascal GPU. As long as the EFI is there, the graphic card still display without web driver.

 

[edgerider]

nope, not possible. even if Apple wanted to implement it.

sorry I was to quick for the sake of not dig too deep :
what i meen is they could do an ad-on card with a physical thundebolt prong that caries pciex4 lane to pcie expender... most pro thunderbolt gear are just basic regular pcie card tied to a thunderbolt to pcie addapter...
We dont care if you can not have display and network and usb, like a true thunderbolt machine, but if it would carry pcie signal all drive such as promise pegasus would work.

 

[rippiedoos]

I just noticed on Gilles Twitter page https://twitter.com/gillesaurejac that his NVMe booted into Sierra !

Something in his bootROM allows Sierra to SEE NVMe ?

============================================
I wonder if prior to his new NVMe DXE bootROM flash .. . that the installed PCIe M.2 blade he was using WAS NOT VISIBLE in Sierra until AFTER the flash ?
============================================
My 960 EVO M.2 was not visible until I did the kext replacement hack shown below.
( In Sierra. deleting the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext ).
===========================================
Also, this from Gilles #13 post in this thread .. .

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.
===============================================================

I might UNDO the IONVMeFamily.kext " and replacing it with the" HackrNVMeFamily-10_12_3.kext hack on another drive SSD 2.5" drive and try the flash after quizzing poor busy Gilles re my Sierra setup.

View attachment 763868

The bootROM isn't doing anything to Sierra or HS to let the OS see a NVMe-disk or not. That's the job of the OS kext. The job of the bootROM is to load the bootloader, which in turn can see or don't see a disk with partitions or not. The bootROM is enabling the MacPro to read NVMe-drives, to actually load the EFI-partion from it and load the bootloader.

After to bootROM has loaded the bootloader from the now readable NVMe-drive (the original doesn't have the ability to read the NVMe-drive because of the lack of NVMe-support), the bootloader from Sierra or High Sierra takes over to read the OS X partition. That bootloader also needs a driver, which is probably built into to bootloader. And because Sierra itself can see and read a 4K compatible and formatted NVMe-drive it can actually load the OS from it and LATER load some extra kext for other devices. High Sierra on the other hand can see and read 512b NVMe-drives, like any Samsung SSD.

You can try using the hacked NVMe-kext but I don't think the bootloader from Sierra can actually read a 512b drive (like your Samsung) because the native OS-drivers (which are probably built into the bootloader) cannot see and/or read it. High Sierra however can see and/or read 512b SSD's.

And as you already mentioned, gilles used a 4K compatible and formatted NVMe-drive to boot Sierra and zozomester used High Sierra, which has 512b support.

So unless you can reformat your Samsung somehow to 4K sector size and to use it in Sierra WITHOUT the hacked NVMe-driver, your stuck with High Sierra if you want to boot from that SSD. Or buy a Toshiba XG3, XG4 or XG5 or any other SSD that gilles mentioned.

@zozomester: just to be sure, did you reformat your Toshiba SSD's to 4K sector size or are they still 512b?

 

[MIKX]

rippledoes

You nailed it ! I 100% concur, it makes sense.

My homework will be . . of course. . 4k formatting ( scary ),

Assuming that High Sierra will read BOTH 4k & 512 . . .

I'll wait 'til High Sierra is finalised ( for the time being or until my curiosity becomes insatiable.)

 

[zozomester]

The bootROM isn't doing anything to Sierra or HS to let the OS see a NVMe-disk or not. That's the job of the OS kext. The job of the bootROM is to load the bootloader, which in turn can see or don't see a disk with partitions or not. The bootROM is enabling the MacPro to read NVMe-drives, to actually load the EFI-partion from it and load the bootloader.

After to bootROM has loaded the bootloader from the now readable NVMe-drive (the original doesn't have the ability to read the NVMe-drive because of the lack of NVMe-support), the bootloader from Sierra or High Sierra takes over to read the OS X partition. That bootloader also needs a driver, which is probably built into to bootloader. And because Sierra itself can see and read a 4K compatible and formatted NVMe-drive it can actually load the OS from it and LATER load some extra kext for other devices. High Sierra on the other hand can see and read 512b NVMe-drives, like any Samsung SSD.

You can try using the hacked NVMe-kext but I don't think the bootloader from Sierra can actually read a 512b drive (like your Samsung) because the native OS-drivers (which are probably built into the bootloader) cannot see and/or read it. High Sierra however can see and/or read 512b SSD's.

And as you already mentioned, gilles used a 4K compatible and formatted NVMe-drive to boot Sierra and zozomester used High Sierra, which has 512b support.

So unless you can reformat your Samsung somehow to 4K sector size and to use it in Sierra WITHOUT the hacked NVMe-driver, your stuck with High Sierra if you want to boot from that SSD. Or buy a Toshiba XG3, XG4 or XG5 or any other SSD that gilles mentioned.

@zozomester: just to be sure, did you reformat your Toshiba SSD's to 4K sector size or are they still 512b?

On Raid0-64kb Blocks.

 

[rippiedoos]

On Raid0-64kb Blocks.

Yes, thats the RAID-block-size, not the physical disk block size, which is the important one.

Could you run the following command in terminal for the NVMe-SSD-drives:

diskutil info /dev/disk1 | grep "Device Block Size"

Where /dev/disk1 is the disk-number of the separate NVMe-SSD's, not the RAID-block-device.

 

[zozomester]

Yes, thats the RAID-block-size, not the physical disk block size, which is the important one.

Could you run the following command in terminal for the NVMe-SSD-drives:

diskutil info /dev/disk1 | grep "Device Block Size"

Where /dev/disk1 is the disk-number of the separate NVMe-SSD's, not the RAID-block-device.

Ok, I accept. I have default Block size. I'll see if I get home....

 

[ActionableMango]

if the cMP bootROM is damaged and won't start at all . . how does the official Firmware Restore CD overcome this?

I can't speak for the Mac Pro, but I've worked with computers that had three boot firmwares:

1. The currently running bootROM, which is routinely updated.
2. A backup bootROM, which can also be updated and is usually the prior version of the currently running firmware. If #1 doesn't work, then the computer uses #2.
3. A failsafe bootROM, which is the original and cannot normally be changed except with physical tools at the factory. If neither #1 or #2 work, then the computer uses #3.

So I'd speculate that the Mac Pro has a similar "failsafe bootROM" whose purpose is to boot the CD. Otherwise there would be no point in having a Firmware Restore CD.

 

[zozomester]

Blocksize my Toshiba XG5 256gb NVME

 

[DearthnVader]

I run a 960 EVO NVME M.2 in PCI Passthrough with tianocore uefi, works just fine in 10.12.x, 512k mode.

 

[rippiedoos]

Blocksize my Toshiba XG5 256gb NVME

Thank you! That confirms that the BIOS-mod can read 512b drives and confirmation of Gilles findings.

@MIKX : your drive should work just fine under High Sierra.

And it tells me I can go ahead and use the XG5-SSD that is underway without tampering with block sizes of the SSD.

 

[rippiedoos]

I run a 960 EVO NVME M.2 in PCI Passthrough with tianocore uefi, works just fine in 10.12.x, 512k mode.

Did you install the hacked NVMe-driver?

 

[DearthnVader]

Did you install the hacked NVMe-driver?

No, stock system.

Never tried to boot from it in 10.12 and it takes a few seconds to mount the desktop after the other drives mount, but it seems to work fine. I assume Apple's NVME EFI driver and TC's NVME driver are built from the same source, I'm pretty sure Apple's been building a lot of there drivers in TC for quite some time.

I did some work building an OHCI driver for my MPC79A motherboard, and some of the EFI USB drivers from Apple are the same binaries used in TC. Mostly you can tell because the EFI drivers that have a name in Apple's firmware images rather than just a GUID were built from TC's source code. Tho Apple may have made a few changes to it.

 

[rippiedoos]

No, stock system.

Never tried to boot from it in 10.12 and it takes a few seconds to mount the desktop after the other drives mount, but it seems to work fine. I assume Apple's NVME EFI driver and TC's NVME driver are built from the same source, I'm pretty sure Apple's been building a lot of there drivers in TC for quite some time.

I did some work building an OHCI driver for my MPC79A motherboard, and some of the EFI USB drivers from Apple are the same binaries used in TC. Mostly you can tell because the EFI drivers that have a name in Apple's firmware images rather than just a GUID were built from TC's source code. Tho Apple may have made a few changes to it.

Well, the TianoCore EFI explains the boot loader part. But why you successfully can boot the 512b NVMe-drive without patching or injecting some drivers is a complete mystery to me. Or the boot process of apple is completely different from any other OS I know.

But are you running 10.13 or 10.12? In the first post you said you are running fine under Sierra and just now you said you never tried it on Sierra. Maybe a typo?