Updating a Mac (Pro)s CPU Microcode

[pc297]

Meanwhile I tried @petri Krohn´s (revised) suggestion of writing the 1.7MB file directly to the MP2,1 flash. As suspected, nothing happens on boot, other than the mainboard status LED for GPU init flash in an irregular pattern instead of steadily blinking (with 54xx processor).

Was this 1.7Mb rom meant for -R revisions of the S5000XVN? What about earlier (non-Harpertown) revisions? If the latter does somehow result in some sort of boot with an early breakpoint being achieved, this would clearly indicate the need for a hardware mod. Of course, the MP1,1/2,1 might just be too different for anything meaningful resulting from flashing something meant for the S5000VXN altogether

 

[Larsvonhier]

It's very likely that if true, that these modifications are something else other than LGA 775 to LGA 771, I guess that SMP would not work with two LGA 775 CPUs together as those are not MP-enabled, which would have defeated the purpose of trying them in the MP1,1/2,1?

Or would e.g. only one LGA 775 Core 2 Extreme QX9650 potentially work (65nm, SSE4) with an LGA 771 to LGA 775 strip?

I tried the scenario with one C2E in the MP1,1/2,1 already - does not work in all variations I attempted with the LGA-conversion strip plus frequency settings and (limited) boot-flash modifications...

Btw, the intel server board accepted MP Xeons, so if Apple included that HW patch (that came later after the release of both the intel and the Apple mainboards) it should have worked. That piece of info is still missing... and I can still not find any schematics for either of the Mac Pro 1,1 / 2,1 or 3,1.

 

[pc297]

I tried the scenario with one C2E in the MP1,1/2,1 already - does not work in all variations I attempted with the LGA-conversion strip plus frequency settings and (limited) boot-flash modifications...

Btw, the intel server board accepted MP Xeons, so if Apple included that HW patch (that came later after the release of both the intel and the Apple mainboards) it should have worked. That piece of info is still missing... and I can still not fins any schematics for either of the Mac Pro 1,1 / 2,1 or 3,1.

I guess we could also try to locate the schematics of the original S5000XVN and of the -R version and compare those, if they are available at all, will try to get some leads on that unless you guys already did?

 

[pc297]

The risk of bricking the system is there by flashing the 3,1 SMC contents to the 2,1. (This is not easy to fix without ISP hardware for the RH8).

If you need some ISP equipment I would happily chip in Lars, and could even try to organise some small-scale crowdfunding for it from those interested in this topic

EDIT if this allowed to post on MR?

 

[ypc0cnz]

I was looking for a thread about 54XX+ cpu support in 1,1/2,1 mac pros and I happened to come across this.

I just picked up two mac pro 1,1s the other day, saved them from the scrap yard. I have been using one as my main pc for the past week or two, I flashed it to 2,1 firmware, replaced the 5130s with 5160s (For some reason I had a matching pair laying around that I have been waiting to put in something), and put 32 gigs of ddr2 in it. Well, the sticks (8 4gig sticks) were already in it but were mismatched and only showed as 16. I got this machine running el capitan and I am really hoping to stick a 5492 in it and get ventura running.

So my main mac pro, the one I described above, I am going to leave alone for now. However, the second one I will use to try and further the development and experimentation of this thread. I really want to get not only mine, but all mac pro 1,1/2,1s able to run ventura and keep these machines alive for even longer.

Right now, the only xeons I have are two 5130s, two 5150s, and two 5160s, the last two being in each of my mp1,1s. I am probably going to get some off of ebay or check the nearest escrap yard for some 54XXs, though.

I think with enough work and dedication, we can do this. I feel like there is just one or two things that we are missing, and once we find those, then we can finally keep these old beasts running the newest macos once more.

 

[ypc0cnz]

Okay, I have been busy for a while but I came back to test a 54XX cpu. I didn't believe that I had any, but I actually had an e5430. I put it into my mac pro 1,1 that is going to be used for testing, no updates or upgrades at all, mac os lion, and I was expecting it to fail.

After I put them in, I expected an error code. At first the front light was blinking ram error, but I had forgotten to put the ram tray in. After that, I turned it on, aaaand... No errors. I am going to have to dig up an old graphics card that will show the boot screen, and I also don't have any more power adapters. I think I have a pair of 7300gt's laying around, after I post this I am going to look for them.

Here is a picture of the diagnostic leds whenever the mac is turned on.

 

[ypc0cnz]

Okay, so I found both of my 7300gts and hooked everything up. The machine will post with the e5430s in it, but after it does the cpu fail lights will come on. It is still doing something, though, because the mac stays powered on, front light normal and all, the hard drive arm is moving, and if I take the heat sink off the cpu is hot, very hot, the same as touching a normal cpu that is running. And now while that may sound like a stupid idea, it is, and I probably shouldn't do it.

 

[ypc0cnz]

Then I guess we really do need an ISP/debugger kit in case it goes wrong. How much are these?

Unless someone has a spare MP1,1/2,1 mobo and is willing to take the risk...




I had followed the following guides and indeed worked like a charm:

Mac Pro 2006-2007 Firmware Tool Released

Mac Pro 2006-2007 Firmware Tool Released

forum.netkas.org

So Long, and Thanks for All the Fish - Alexandre Boeglin's Web Page - Flashing a 2006 Mac Pro with a 2007 Mac Pro SMC Firmware

Indeed it did use an EFI shell, didn't remember that




Great idea So do you think it means that

SmcFlasher.efi -reset 1

will brick the MP1,1/2,1?

Hmm, well, Im willing to take the risk.

 

[ypc0cnz]

Hey @Larsvonhier , would you happen to still have the smc from the 3,1 board that might very well permanently brick the 1,1/2,1 boards? Because hell, if it works then it works, if it doesn't then I don't know. There has to be a way to reflash a perma-bricked board though, maybe there is a chip similar to that of a normal bios chip that can be desoldered and swapped/flashed. I am not very familiar with the ins and outs of these boards, so I don't know if that is possible or not.

 

[Larsvonhier]

Hey @Larsvonhier , would you happen to still have the smc from the 3,1 board that might very well permanently brick the 1,1/2,1 boards? Because hell, if it works then it works, if it doesn't then I don't know. There has to be a way to reflash a perma-bricked board though, maybe there is a chip similar to that of a normal bios chip that can be desoldered and swapped/flashed. I am not very familiar with the ins and outs of these boards, so I don't know if that is possible or not.

I´ll have a look into the old project "vaults" and search for the hex file of the 3,1 SMC.
In any case, if that bricks the 2,1 SMC, the only way to restore the old contents is via Renesas emulator/debugger tool incl. their proprieatary interface box/board (there is a PCI solution for PC installation and an external USB driven box).
The SMC itself has no external SPI flash that could be swapped, but only internal flash that has to be programmed. This Renesas H8 based chip is not easy to solder/desolder!
Doing another search-the-net round, I found this SMC flasher tool, which looks promising although our Mac Pros are not yet supported.

edit: It´s been a while since I´ve been actively been involved so I forgot that dumping the 3,1 to 5,1 SMCs is not possible, only re-flashing. This is due to protected access feature of the Renesas controller (SMC). So once you wrote the 2,1 binary to the 3,1 SMC, there is no way back. What´s more: There were no freely available SMC versions as updates or parts of updates from Apple for the 3,1 (in contrast to 1,1 / 2,1). So re-flashing with the original contents is also blocked. Darn!

edit-2: Thanks for clarifying @tsialex - edit corrected above!

 

[ypc0cnz]

I´ll have a look into the old project "vaults" and search for the hex file of the 3,1 SMC.
In any case, if that bricks the 2,1 SMC, the only way to restore the old contents is via Renesas emulator/debugger tool incl. their proprieatary interface box/board (there is a PCI solution for PC installation and an external USB driven box).
The SMC itself has no external SPI flash that could be swapped, but only internal flash that has to be programmed. This Renesas H8 based chip is not easy to solder/desolder!
Doing another search-the-net round, I found this SMC flasher tool, which looks promising although our Mac Pros are not yet supported.

edit: It´s been a while since I´ve been actively been involved so I forgot that dumping the 3,1 to 5,1 SMCs is not possible, only re-flashing. This is due to protected access feature of the Renesas controller (SMC). So once you wrote the 2,1 binary to the 3,1 SMC, there is no way back. What´s more: There were no freely available SMC versions as updates or parts of updates from Apple for the 3,1 (in contrast to 1,1 / 2,1 and 4,1 / 5,1). So re-flashing with the original contents is also blocked. Darn!

Hmm, well I wonder if there is a way to do an smc bypass like on certain other macs. I remember someone else, I think it may have been you, was experimenting with it but I think the conclusion was that the smc was always needed. Maybe there is another way?

I am going to keep the Renesas tool in mind, but I am going to look more into that flasher tool you found. It says it is not compatible with mac pros or Renesas chips, but it is on github so I am going to download the source code and see if I can get just the basic part that allows booting with a corrupted smc and try and use it to just fully boot mac os.

 

[tsialex]

What´s more: There were no freely available SMC versions as updates or parts of updates from Apple for the 3,1 (in contrast to 1,1 / 2,1 and 4,1 / 5,1). So re-flashing with the original contents is also blocked. Darn!

You are correct about MacPro3,1 SMC but you are mistaking about MacPro4,1 and MacPro5,1 SMC versus EFI firmware updates.

Apple never issued a SMC firmware update with any of the MacPro3,1, MacPro4,1 or MacPro5,1, so, the SMC firmware is not available to extract from SMC firmware update package like with MacPro2,1 and the firmware was never leaked from Apple or the OEMs.

It's not possible to update the Renesas microcontroller without the SMC firmware code and that's why every early-2009 Mac Pro still have the SMC 1.39f5 instead of the 1.39f11 of mid-2010/mid-2012s.

 

[ypc0cnz]

Hmm, what would happen if we soldered a 3,1 chip on top of a 1,1/2,1 chip, like both of them on the board at the same time? I know it would probably do nothing, but what if the contents are close enough and it for some reason reads from both at the same time and lets us boot a unsupported cpu?

 

[tsialex]

Hmm, what would happen if we soldered a 3,1 chip on top of a 1,1/2,1 chip, like both of them on the board at the same time? I know it would probably do nothing, but what if the contents are close enough and it for some reason reads from both at the same time and lets us boot a unsupported cpu?

This is not a DIP EPROM where you have 20 and some pins and can easily piggyback one to the other and control the enable pin - it's a 144-pins TQFP encapsulated microcontroller, how you gonna even solder one over the other?!?!

Btw, it's just a hypothesis that is the SMC that is blocking the upgrade/booting process, AFAIK, it was never proved.

 

[ypc0cnz]

This is not a DIP EPROM where you have 20 and some pins and can easily piggyback one to the other and control the enable pin - it's a 144-pins TQFP encapsulated microcontroller, how you gonna even solder one over the other?!?!

Btw, it's just a hypothesis that is the SMC that is blocking the upgrade/booting process, AFAIK, it was never proved.

With enough dedication and objects to take your anger out on 👍

But in all seriousness I would do it just for fun if I had a 3,1 smc chip, because I mean, what is the worst that can happen? Boards are like $50 now so if I do mess it up then it will suck to have to get another one, but I will do it just for the experiment.

What I have heard is that the microcode does not have anything to enable/boot/whatever-you-call-it the harpertown or other cpus, but like you said, that is just speculation, and it could be that and a combination of other things for all that we know.

Speaking of harpertown, I am going to try and put in a pair of harpertown core 2 quads and see if that will work. Let me check and see if I have any. If there is one thing I have an over abundance of it is core 2 duos and quads.

 

[ypc0cnz]

So it looks like that other than xeons, the other lga771 cpus are the celeron 445, core 2 duo e6305 and e6405, and the core 2 extreme qx9775. Not much room to work with... I will see what I have and test it. I know I have a few celerons but I don't know about extremes. I imagine that I have both of the supported duos and will test them if I do.

edit: it looks like out of those four, only the extreme qx9775 has sse4.1

edit 2: the xeon x3323, x3353, and x3363 all are lga771 and support sse4.1, so I will see if I have them

 

[ypc0cnz]

No bueno, I have not any extreme editions or xeon x33X3's and it looks like they are several hundred dollars for one online. Well, I guess I'm going to just start decompiling the microcode. Visual studio code should work fine, right?

 

[lilmul123]

Now watching this thread. I just inherited a 1,1 and am very interested in seeing if I can get a Harpertown going in this bad boy.

 

[ypc0cnz]

Well, on an unrelated note, I just got my ram that I ordered for my mp 1,1. I got 25 8 gig sticks, and so I have enough to get both of my 1,1s to 64 gigs of ram and then have 9 left over. I'm pretty excited. But anyways, now my other mp 1,1 that I am using daily is fully upgraded. 2x x5365's, a gtx 980 ti, and 64 gigs of ram. And yeah, I know the titan x is faster, but it will overdraw power and I don't feel like figuring out how to wire in a bigger psu since apple didn't use standard power supply connectors.

But anyways, I can do a lot with this machine. It runs every program I throw at it much better and faster than the m2 mac that someone I know has. I am going to try and see if it can handle editing, decompiling, recompiling, and saving the microcode. So @Larsvonhier , do you think that I would be able to use the 3,1 microcode and try to insert the segments that allow the 1,1/2,1 to boot into it? I'm thinking that if I replace most of the 1,1/2,1 firmware, the conflicting parts, with the 3,1 firmware, it might have a chance at working. Sorry if that was a little confusing.

Also, I have 12 C0 stepping e5430's on the way. I will send any 5 people who want to help with this project a pair for free. I really want to figure out what we are missing and finally allow harpertown cpus to work in a mac pro 1,1/2,1.

 

[ypc0cnz]

Now watching this thread. I just inherited a 1,1 and am very interested in seeing if I can get a Harpertown going in this bad boy.

Yeah, the 1,1 mac pros are still a powerhouse compared to most modern computers in my opinion, and I am really interested in getting a harpertown in it. I can guarantee that it is going to take a lot of work, and very likely some time, but I truly believe that it can be done. I got my two mac pro 1,1's from my work that were destined for the scrapyard, traded a mac mini that I fixed for them. I got that mac mini from them as well lol. So now I am using one as my daily machine, and the other for testing.

 

[Larsvonhier]

Well, on an unrelated note, I just got my ram that I ordered for my mp 1,1. I got 25 8 gig sticks, and so I have enough to get both of my 1,1s to 64 gigs of ram and then have 9 left over. I'm pretty excited. But anyways, now my other mp 1,1 that I am using daily is fully upgraded. 2x x5365's, a gtx 980 ti, and 64 gigs of ram. And yeah, I know the titan x is faster, but it will overdraw power and I don't feel like figuring out how to wire in a bigger psu since apple didn't use standard power supply connectors.

But anyways, I can do a lot with this machine. It runs every program I throw at it much better and faster than the m2 mac that someone I know has. I am going to try and see if it can handle editing, decompiling, recompiling, and saving the microcode. So @Larsvonhier , do you think that I would be able to use the 3,1 microcode and try to insert the segments that allow the 1,1/2,1 to boot into it? I'm thinking that if I replace most of the 1,1/2,1 firmware, the conflicting parts, with the 3,1 firmware, it might have a chance at working. Sorry if that was a little confusing.

Also, I have 12 C0 stepping e5430's on the way. I will send any 5 people who want to help with this project a pair for free. I really want to figure out what we are missing and finally allow harpertown cpus to work in a mac pro 1,1/2,1.

Identifying and replacing the conflicting segments that prevent system init (comes even before actual boot process) is the hard part. A co-worker and I tried this a few months ago to no avail because there is really a lot going on in there and inter-dependencies are all over the place. Without more time / knowledge we stopped at some point.
Would be happy to test-ride firmware mods if someone drops them here...
Interesting side note: Syncretic (author of the MouSSE tool) is on a project where he modifies 4,1 / 5,1 firmware to init generic PC stuff correctly before boot time, so that native unmodified PC cards like GPUs, I/O and external USB peripherals etc. work out of the box. With his knowledge, bringing the 2,1 to newer XEONS seems in reach, but is clearly not his focus atm.

From our earlier experiments with firmware and microcode tables (note the difference) I have a broad range of potential XEON candidates for the 2,1 available for tests here. As said, would be happy to test some "brews" ;-)

 

[ypc0cnz]

Identifying and replacing the conflicting segments that prevent system init (comes even before actual boot process) is the hard part. A co-worker and I tried this a few months ago to no avail because there is really a lot going on in there and inter-dependencies are all over the place. Without more time / knowledge we stopped at some point.
Would be happy to test-ride firmware mods if someone drops them here...
Interesting side note: Syncretic (author of the MouSSE tool) is on a project where he modifies 4,1 / 5,1 firmware to init generic PC stuff correctly before boot time, so that native unmodified PC cards like GPUs, I/O and external USB peripherals etc. work out of the box. With his knowledge, bringing the 2,1 to newer XEONS seems in reach, but is clearly not his focus atm.

From our earlier experiments with firmware and microcode tables (note the difference) I have a broad range of potential XEON candidates for the 2,1 available for tests here. As said, would be happy to test some "brews" ;-)

Hmm, well, could we just manually initiate certain components, just completely scrap the original conflicting segments? It would probably be a ton of work, but I am thinking that we could at least remove the default cpu initiation and replace it with that of the mac 3,1. I am not familiar enough with the mac pros smc/microcode to say that it would work with confidence, but I mean, that has a possibility of working, right?

 

[pc297]

Okay, I have been busy for a while but I came back to test a 54XX cpu. I didn't believe that I had any, but I actually had an e5430. I put it into my mac pro 1,1 that is going to be used for testing, no updates or upgrades at all, mac os lion, and I was expecting it to fail.

After I put them in, I expected an error code. At first the front light was blinking ram error, but I had forgotten to put the ram tray in. After that, I turned it on, aaaand... No errors. I am going to have to dig up an old graphics card that will show the boot screen, and I also don't have any more power adapters. I think I have a pair of 7300gt's laying around, after I post this I am going to look for them.

Here is a picture of the diagnostic leds whenever the mac is turned on.

Has anyone got this far with X54XX CPUs? How about trying the E5430 with the microcode-updated firmware from @Petri Krohn before anyone attempts the SMC 3.1 flash?

 

[ypc0cnz]

Has anyone got this far with X54XX CPUs? How about trying the E5430 with the microcode-updated firmware from @Petri Krohn before anyone attempts the SMC 3.1 flash?

I don't have any X harpertowns but I do have 12 C0 stepping E5430s on the way that will be here on thursday (As long as they aren't delayed), so I will try the firmware you mentioned.

Also, like I said earlier, I will send 5 people who want to work with this a pair of C0 stepping E5430s free of charge. I really want to get harpertown working and so if anyone wants to test with us, but doesn't have any 54XX cpus or no E5430s, then I will be more than happy to send a pair for free.

 

[ypc0cnz]

I´m looking at the HW side of how to get SSE4.x capable Xeons to work in MP2,1 (or up-modded 1,1).
Set up an easy-access "eval board" also, with a dual Boot-Flash selector switch that makes it easy to dare to flash non-sense configurations like a 3,1 flash content to a 2,1 machine - I do not have to de-solder the flash to revive the machine to a working "bank" of the boot flash... ;-)
View attachment 936706View attachment 936708View attachment 936712
Still: No luck. Even with modifications to the processors (taped select pins as insulation) and suitable µcodes I can only get as far as a non-boot (with various indications on the status LEDs and even on the RAM bank LEDs).

I just wish the SMC (H8) was as easy to double as the flash... but hey, me might have a debugger left over from some recent project - it might be usable as it was for a H8/300 system... close enough to the H8/2116?! We´ll see...

More to come, as we do not give up so easily! ;-)

edit:
I´ve attached another PDF where I extracted and noted all pinout differences between 53xx and 54xx Xeons.
Interestingly, signal TESTHI12 which is not available on 53xx but needed on 54xx is already routed correctly by Apple on the MB1,1(2,1) mainboard. Other -reserved- pins on the 54xx can be tape-insulated on the processor locally.
Still, we seem to have missed a detail...

View attachment 936967

Oh, I missed this and just now saw it. So this is the chip on my 1,1 board, and from what I can tell, all of the numbers and everything match up, so could I do this to mine so that I can be an idiot but be able to undo my idiocracy? Would this work instead of having to get the fancy emulator/debugger to reflash the smc if you brick your board?

I'm going to see about doing this to my board