Updating a Mac (Pro)s CPU Microcode

[tsialex]

So you don't think that SMC 1.7/1.15 not supporting 45nm CPUs (while 1.25 does) has anything to do with the CPU being rejected even when updating the microcode to support it as has been described above in the present thread?

Mac Pro 2006-2007 Firmware Tool Released

Mac Pro 2006-2007 Firmware Tool Released

forum.netkas.org

Sorry, I should have written that just replacing the SMC for the MacPro3,1 won't bring support for newer CPUs to MacPro1,1/2,1 EFI. Also, adding the microcodes to the BootROM image won't do anything if the SEC module don't initialize and configure the newer CPUs correctly and successfully passes control to the PEI.

 

[pc297]

if the SEC module don't initialize and configure the newer CPUs correctly

What is that? (sorry for my ignorance )

 

[joevt]

What is that? (sorry for my ignorance )

Different boot stages of the EFI in a Mac.
Here's some UEFI docs which mostly apply to EFI as well:
https://edk2-docs.gitbook.io/edk-ii-build-specification/2_design_discussion/23_boot_sequence

 

[kocoman]

is it possible to use bootcamp csm mode to boot linux / freedos with applelegacyload ? thx

 

[joevt]

is it possible to use bootcamp csm mode to boot linux / freedos with applelegacyload ? thx

If your Mac is old enough to have bootcamp CSM mode, then it can boot FreeDOS and Linux with legacy load.
On My MacPro3,1 (2008), I use legacy for Windows and FreeDOS and EFI for Linux.

 

[pc297]

Silly question, but did anyone try the MP 3,1 firmware in a MP 1,1/2,1 with the 2008 RAM risers?

 

[Larsvonhier]

Silly question, but did anyone try the MP 3,1 firmware in a MP 1,1/2,1 with the 2008 RAM risers?

Yes. Does not overcome the microcode/board problem.
In fact, the 1,1/2,1 and 3,1 RAM riser cards are kind of inter-operable when you overcome the different PCB edge (rim) size that is different.
You can operate a 3,1 with i.e. 2,1 riser. Another difference (and probably why Apple designed them to be mechanically different) is the total regulated power for the RAMs. The 3,1 risers can provide more (and needs more due to 800MHz speed and initially higher total capacity supported).

 

[pc297]

Some old thread stating that Harpertowns work on pre-08 macs, not sure whether this is speculation or actual experience:

Harpertown - The Mac Pro overclockers friend...

Seems we have some new hope for extreme clocked Mac Pro's thanks to Harpertown. Being 'overclockers' and all - figured you guys might be interested! :)...

forums.overclockers.com.au

 

[pc297]

So according to this post on seti@home, it could be that the intel 5000X chip used in the MP1,1/2,1 is a custom version

V8 Optimized App for Windows and Linux

setiathome.berkeley.edu

"That being said, as Crunch3r mentioned, I always assumed the MacPro was essentially the same as an Intel S5000XVN. However, when I was researching the FBDIMM memory architecture I discovered some interesting things about it. For one, it is possible the Northbridge/MCH is an Apple customized version of the 5000 which has different firmware for the MCH more optimized for workstation applications which is the MacPro's main market niche. Apple has developed a kind of 'insider' relationship with Intel in recent years, so I wouldn't be surprised if Intel doesn't give them some 'special' consideration on matters like this."

 

[Larsvonhier]

Some old thread stating that Harpertowns work on pre-08 macs, not sure whether this is speculation or actual experience:

Harpertown - The Mac Pro overclockers friend...

Seems we have some new hope for extreme clocked Mac Pro's thanks to Harpertown. Being 'overclockers' and all - figured you guys might be interested! :)...

forums.overclockers.com.au

As long as no real success-story (with how-to proofing) turns up, this has to be regarded as mere speculation.
I (and others) have tried a lot to get any SSE4.x capable CPU (Xeon or Core2Extreme) running in the 771 socket of the older MP1,1 / MP2,1. Simply does not work... yet.
I am still convinced that with the right combo of hacks it should be feasible:
- right clocking (BSEL mod)
- EFI synthesized from the the correct portions of the original 2,1 / ported 3,1 and modified parts for appropriate CPU type checks and initialisation
- adjusted core voltage setting (seemed not too critical)
- socket 775->771 mod strips (for some CPUs)

The main show stopper seems the EFI part where we have not really come closer to init the 5000 MCH chipset in the right way.
(There were plausible hints that the Intel server board -that Apple based the initial 1,1 design on- was first released in a version that required solder/trace modifications to operate with newer 45nm (thus SSE4.x capable) Xeons. A co-worker of mine got hold of a newer intel board version (which still looks like a MP1,1 board twin). This boots up with ie. the 54xx Harpertowns) out-of-the-box. We have not yet been able to either retrieve those intel mod instructions, nor seems there to be any source (even paid ones) of MP1,1..MP3,1 schematics. It's all like non-existent...)

 

[kocoman]

maybe can port to coreboot to bypass checks

 

[AnUrbanPenguin]

Interesting thread. I just picked up a 2,1 with 2x Quad Core X5365's and have been looking into the limitations.

Seems intel really screwed the pooch with leaving out SSE4.1 on these.

I actually posted today before even seeing this thread that surely a microcode update would do the trick, but it seems to not be the caseand there is more at play here.

Would it be possible to force flash a bios with updated microcode directly onto the bios chip using an EEPROM reader? Not sure if that would make a difference or not?

 

[pc297]

As long as no real success-story (with how-to proofing) turns up, this has to be regarded as mere speculation.
I (and others) have tried a lot to get any SSE4.x capable CPU (Xeon or Core2Extreme) running in the 771 socket of the older MP1,1 / MP2,1. Simply does not work... yet.
I am still convinced that with the right combo of hacks it should be feasible:
- right clocking (BSEL mod)
- EFI synthesized from the the correct portions of the original 2,1 / ported 3,1 and modified parts for appropriate CPU type checks and initialisation
- adjusted core voltage setting (seemed not too critical)
- socket 775->771 mod strips (for some CPUs)

The main show stopper seems the EFI part where we have not really come closer to init the 5000 MCH chipset in the right way.
(There were plausible hints that the Intel server board -that Apple based the initial 1,1 design on- was first released in a version that required solder/trace modifications to operate with newer 45nm (thus SSE4.x capable) Xeons. A co-worker of mine got hold of a newer intel board version (which still looks like a MP1,1 board twin). This boots up with ie. the 54xx Harpertowns) out-of-the-box. We have not yet been able to either retrieve those intel mod instructions, nor seems there to be any source (even paid ones) of MP1,1..MP3,1 schematics. It's all like non-existent...)

As in one of these?

Intel S5000PSL - Hardware Museum

Intel S5000PSL is based on the Intel 5000P chipset. Basic parameters: 2x socket 771, E-ATX 305x330 format. Supports up to 32 768MB RAM. Fastest CPU 2x Xeon X5470. Released in 2006

hw-museum.cz

Close but not nearly close enough for a mobo swap, sadly, let alone that it's ATX 😢

I guess François Piednoël (former Intel engineer) would know, I came across his posts on setiathome about modded S5000VXN boards

Who? optimizations Part 2

setiathome.berkeley.edu

Here is where he mentions the prototype board that works with 45nm Penryns/Yorkfields (almost certainly Harpertowns), the S5000VXN V8S, that likely paved the way for the R versions supporting Harpertowns

Who's Skull Prevails at Last

setiathome.berkeley.edu

Legit Reviews - Intel Shows Off 8-Core 45nm Penryn Benchmarks - Intel Deals Another Blow - Is It Deadly?

I messaged him on setiathome, let's see if he replies (given that it's been down for 2 years well here are the odds, all other considerations aside)

 

[Larsvonhier]

As in one of these?

Intel S5000PSL - Hardware Museum

Intel S5000PSL is based on the Intel 5000P chipset. Basic parameters: 2x socket 771, E-ATX 305x330 format. Supports up to 32 768MB RAM. Fastest CPU 2x Xeon X5470. Released in 2006

hw-museum.cz

Close but not nearly close enough for a mobo swap, sadly, let alone that it's ATX 😢

I guess François Piednoël (former Intel engineer) would know, I came across his posts on setiathome about modded S5000VXN boards

Who? optimizations Part 2

setiathome.berkeley.edu

Here is where he mentions the prototype board that works with 45nm Penryns/Yorkfields (almost certainly Harpertowns), the S5000VXN V8S, that likely paved the way for the R versions supporting Harpertowns

Who's Skull Prevails at Last

setiathome.berkeley.edu

Legit Reviews - Intel Shows Off 8-Core 45nm Penryn Benchmarks - Intel Deals Another Blow - Is It Deadly?

I messaged him on setiathome, let's see if he replies (given that it's been down for 2 years well here are the odds, all other considerations aside)

That would be a hot lead... if Mr. Piednoël could be reached!

We got this board, its the PSL version and was ready to take the 54xx Xeons.

As for modifying the EFI contents, we have the tools and a modified dual-bank-flash MP2,1 board that allows us to flash anything without risk of bricking the system. The only missing part is detailed knowledge of what to import from 3,1 and what to leave as is in the 2,1 EFI. We started to fiddle around to various different outcomes but never got system control to hand over to PEI phase with correct init of the MCH / RAM. Really helpful would be to hook up a ISP/Debugger or use the intel USB monitoring of the init phase.
Also unknown is whether the SMC interfers or inhibits init when certain CPUs are detected. I managed to dump the contents and even disassemble it (Renesas H8 if I recall right). But debuggers for that are rare and expensive and seem to be tailored to the exact variant of each H8 type. Good thing here is that Apple used the same chip in most Macs, even MacBooks.

 

[pc297]

That would be a hot lead... if Mr. Piednoël could be reached!

We got this board, its the PSL version and was ready to take the 54xx Xeons.

As for modifying the EFI contents, we have the tools and a modified dual-bank-flash MP2,1 board that allows us to flash anything without risk of bricking the system. The only missing part is detailed knowledge of what to import from 3,1 and what to leave as is in the 2,1 EFI. We started to fiddle around to various different outcomes but never got system control to hand over to PEI phase with correct init of the MCH / RAM. Really helpful would be to hook up a ISP/Debugger or use the intel USB monitoring of the init phase.
Also unknown is whether the SMC interfers or inhibits init when certain CPUs are detected. I managed to dump the contents and even disassemble it (Renesas H8 if I recall right). But debuggers for that are rare and expensive and seem to be tailored to the exact variant of each H8 type. Good thing here is that Apple used the same chip in most Macs, even MacBooks.

Yep the PSL should work out of the box with Harpertowns.

According to <a "href=http://forum.netkas.org/index.php?topic=1094.270">this</a> post on netkas, the SMC could indeed be a hurdle for 45nm CPUs.

Great that you managed to dump the contents of the RH8! From the MP3,1, I presume, which would be SMC 1.25? Did you try flashing it on the MP1,1/2,1?!

 

[Larsvonhier]

Yep the PSL should work out of the box with Harpertowns.

According to <a><"href=http://forum.netkas.org/index.php?topic=1094.270">this</href></a> post on netkas, the SMC could indeed be a hurdle for 45nm CPUs.

Great that you managed to dump the contents of the RH8! From the MP3,1, I presume, which would be SMC 1.25? Did you try flashing it on the MP1,1/2,1?!

The other way round; I dumped the 1,1/2,1 SMC and tried to get any clue of the disassembly.
The risk of bricking the system is there by flashing the 3,1 SMC contents to the 2,1. (This is not easy to fix without ISP hardware for the RH8).

 

[pc297]

Apparently on Macbooks there is a way to recover from a failed SMC update, it apparently does not completely brick them (even though OSX becomes unbootable) and supposedly the SMC can be force-reflashed under rEFIt/rEFInd

How to recover corrupted MacBook Pro SMC Firmware

I have a MacBook Pro Retina 15" that is no longer bootable due to (as far as I can tell) corrupted SMC firmware. The reason I think this is that SMC resets no longer work, the MagSafe charging...

superuser.com

SMC FIRMWARE UPDATE - Apple Community

discussions.apple.com

ReadSMC for EFI, a tool to enter read SMC keys from EFI shell on real Macs

I wrote a little EFI tool to read SMC keys from real Macs from an EFI shell running on the real Macs. I made 32bit and 64bit versions. It also reads the SMC Signature out and shows it. Usage example: ReadSMC.efi OSK 31 It show: OSK0: [ 6f 75 72 68 61 72 64 77 6f 72 6b 62 79 74 68 65 73 65 77 6f 7...

www.insanelymac.com

However whether this holds true for MPs is another question

 

[Larsvonhier]

Apparently on Macbooks there is a way to recover from a failed SMC update, it apparently does not completely brick them (even though OSX becomes unbootable) and supposedly the SMC can be force-reflashed under rEFIt/rEFInd

How to recover corrupted MacBook Pro SMC Firmware

I have a MacBook Pro Retina 15" that is no longer bootable due to (as far as I can tell) corrupted SMC firmware. The reason I think this is that SMC resets no longer work, the MagSafe charging...

superuser.com

SMC FIRMWARE UPDATE - Apple Community

discussions.apple.com

ReadSMC for EFI, a tool to enter read SMC keys from EFI shell on real Macs

I wrote a little EFI tool to read SMC keys from real Macs from an EFI shell running on the real Macs. I made 32bit and 64bit versions. It also reads the SMC Signature out and shows it. Usage example: ReadSMC.efi OSK 31 It show: OSK0: [ 6f 75 72 68 61 72 64 77 6f 72 6b 62 79 74 68 65 73 65 77 6f 7...

www.insanelymac.com

However whether this holds true for MPs is another question

The old SMC reset/reflash thread(s) brought me to an idea: Is that SMC bypass mode also available on Mac Pro? If so, how could it be evoked?
(That would mean we could try to flash the 3,1 SMC contents to the 2,1 board and see what happens with a return possibilty by flashing back the original 2,1 contents. That oc requires to have some "bypass" boot method).

 

[pc297]

The old SMC reset/reflash thread(s) brought me to an idea: Is that SMC bypass mode also available on Mac Pro? If so, how could it be evoked?
(That would mean we could try to flash the 3,1 SMC contents to the 2,1 board and see what happens with a return possibilty by flashing back the original 2,1 contents. That oc requires to have some "bypass" boot method).

Anyone here ever installed rEFit/rEFInd and ever ran

SmcFlasher.efi -reset 1

or

SmcFlasher.efi -force -update <filename.smc>

on the MP1,1/2,1, e.g with the 2,1 SMC?

 

[Larsvonhier]

Anyone here ever installed rEFit/rEFInd and ever ran

SmcFlasher.efi -reset 1

or

SmcFlasher.efi -force -update <filename.smc>

on the MP1,1/2,1, e.g with the 2,1 SMC?

Did not run the flasher with -reset 1 parameter, but upgraded several 1,1 to 2,1 incl. the SMC by flashing the newer firmware to it. Worked like a charm.

Just tested starting up the 2,1 in SMC bypass mode -> that works like suggested by Apple support and others:
Unplug the AC connection, hold the motherboard PWR (normally unpopulated) or case power button for 10s, keep holding and plug in AC mains supply then release the button. Mac then starts with blowing fans, status LEDs on the RAM riser show all error (uninitialized state) and machine boots.
BUT: It seems that bypass mode still requires at least some working parts of SMC firmware, because I made another test. If SMC reset (input) on the LPC conn. is pulled low or the SMC´s crystal is inhibited (so in both cases SMC cannot start itself), there is no way to start the whole system. Button presses are ignored (routed through SMC and not processed there?).

My bet is that a totally wrong SMC firmware would completely brick the Mac Pro with no way of running SmcFlasher...

 

[pc297]

My bet is that a totally wrong SMC firmware would completely brick the Mac Pro with no way of running SmcFlasher...

Then I guess we really do need an ISP/debugger kit in case it goes wrong. How much are these?

Unless someone has a spare MP1,1/2,1 mobo and is willing to take the risk...

Did not run the flasher with -reset 1 parameter, but upgraded several 1,1 to 2,1 incl. the SMC by flashing the newer firmware to it. Worked like a charm.

I had followed the following guides and indeed worked like a charm:

Mac Pro 2006-2007 Firmware Tool Released

Mac Pro 2006-2007 Firmware Tool Released

forum.netkas.org

So Long, and Thanks for All the Fish - Alexandre Boeglin's Web Page - Flashing a 2006 Mac Pro with a 2007 Mac Pro SMC Firmware

Indeed it did use an EFI shell, didn't remember that

If SMC reset (input) on the LPC conn. is pulled low or the SMC´s crystal is inhibited (so in both cases SMC cannot start itself), there is no way to start the whole system. Button presses are ignored (routed through SMC and not processed there?).

Great idea So do you think it means that

SmcFlasher.efi -reset 1

will brick the MP1,1/2,1?

 

[Petri Krohn]

Intel Management Engine firmware?

Does the Mac Pro 1,1 have an Intel Management Engine running somewhere? If so, would it interfere with the boot process and prevent the Mac from booting with Harpertown CPUs?

As far as I know, both the Mac Pro 1,1 and the 3,1 use the ESB2 Enterprise Southbridge. Wikipedia list the chip as belonging to the ICH6 family, but the chip sometimes reports itself with PCI device IDs belonging to the ICH7 family. Intel® Active Management Technology is supported by ICH7 but not by ICH6. I have not been able to find any documentation online for the ESB2 chips, but Intel says they have a "Intel® ME Firmware Version".

The Intel® S5000 Server Board Family Datasheet says this about the Management Engine:

2.1.2.6 Baseboard Management Controller (BMC)

The BMC component of the Intel® 631xESB / 632xESB I/O Controller Hub is provided by an embedded ARC* controller and associated peripheral functionality that is used to provide the baseboard management controller functionality that is required for IPMI-based server management. The following is a summary of the Intel® 631xESB / 632xESB I/O Controller Hub management hardware features utilized by the BMC:

• ARC4 processor with 16 Kb I-cache and D-cache
• 256 Kb of internal SRAM with dual port (one for code accesses and one for all other accesses).
• Expansion bus, allowing connection to external Flash PROM (asynchronous or synchronous), an external SRAM or an external SDRAM.
• Serial flash interface
• Five SMB ports, two that support FML (either master or slave)
• RS-232 serial port (UART)
• Cryptographic module, supporting AES and RC4 encryption algorithms and SHA1 and MD5 authentication algorithms with internal DMA and raw checksum support.
• Two keyboard controller style (KCS) interfaces residing on the LPC bus
• General-purpose input/output (GPIO) interface
• MAC CSR interface
• Timer interface
• Host DMA interface

I suppose the Management Engine firmware is part of the firmware image. Maybe we need to replace this part with a newer firmware version that supports Harpertowns. I likely source for the firmware module is the Intel® Workstation Board S5000XVN.

The Management Engine firmware was also discussed in the context of the 2011 iMac processor upgrade, but it did not seem to solve the issue.

 

[pc297]

Intel Management Engine firmware?

Does the Mac Pro 1,1 have an Intel Management Engine running somewhere? If so, would it interfere with the boot process and prevent the Mac from booting with Harpertown CPUs?

As far as I know, both the Mac Pro 1,1 and the 3,1 use the ESB2 Enterprise Southbridge. Wikipedia list the chip as belonging to the ICH6 family, but the chip sometimes reports itself with PCI device IDs belonging to the ICH7 family. Intel® Active Management Technology is supported by ICH7 but not by ICH6. I have not been able to find any documentation online for the ESB2 chips, but Intel says they have a "Intel® ME Firmware Version".

The Intel® S5000 Server Board Family Datasheet says this about the Management Engine:



I suppose the Management Engine firmware is part of the firmware image. Maybe we need to replace this part with a newer firmware version that supports Harpertowns. I likely source for the firmware module is the Intel® Workstation Board S5000XVN.

The Management Engine firmware was also discussed in the context of the 2011 iMac processor upgrade, but it did not seem to solve the issue.

So this would involve identifying and splicing out the Management Engine firmware out of the S5000XVN (newer versions i.e. R revision) or MP 3,1 firmwares and paste it in place of the EFI32 1,1 firmware bit, would this be an issue from an EFI64 firmware in the case of the MP 3,1?

 

[pc297]

That would be a hot lead... if Mr. Piednoël could be reached!

So far no news on this front, but as I PMed him on seti@home it could very well be that no one reads this anymore as it's been down for almost three years now :\ Maybe I'll give it a try on linkedin?

 

[pc297]

(There were plausible hints that the Intel server board -that Apple based the initial 1,1 design on- was first released in a version that required solder/trace modifications to operate with newer 45nm (thus SSE4.x capable) Xeons.

It's very likely that if true, that these modifications are something else other than LGA 775 to LGA 771, I guess that SMP would not work with two LGA 775 CPUs together as those are not MP-enabled, which would have defeated the purpose of trying them in the MP1,1/2,1?

Or would e.g. only one LGA 775 Core 2 Extreme QX9650 potentially work (65nm, SSE4) with an LGA 771 to LGA 775 strip?