Hi everyone,
long story this evening...
I did some test with patching the BootRom on my trusty late 2013 rMBP.
It's too soon to tell that the patch I did was successful, but at present it seems to work.
Here is what I wanted to do : I had previously watched into and compared BootRom files between rMBP late 2013 and early - mid 2015.
I had extracted EFI payloads files from the High Sierra installer, and compared them with UEFI tool.
I had seen some differences between the NVMe DXE drivers include in the BootRoms : all DXE drivers are located at an address starting with 51116915, but those from 2013-2014 macs bootroms all have a size of 10382 bytes, while all DXE drivers from 2015 and later macs are 25820 bytes wide.
Also, 2015 macs have an NVMe entry in the compiled DSDT table included in the EFI.
I must also say I had previously success with patching an UEFI of an old Fujitsu TX140 serveur (I did successfully added to its UEFI/bios a generic NVMe DXE driver in order to make it recognise NVMe drives at boot :
https://twitter.com/gillesaurejac/status/995418694875537409).
So I wanted to do the same with my late 2013 rMBP, and edit its BootRom so that it would include the proper NVME driver and DSDT table reference.
Here is what I did :
- I bought an EFI cable at MacUnlocks :
https://macunlocks.com/product/efi-flex-cable-for-macbook-air-pro-2010-2016/
- I already had an SPI programmer, a little EZP-2013 which does works great (even under windows 8.1 64 bits)
Ok, so the first tries were epic fails...
The dump of BootRom I did were never the same, and the rom file was not editable in UEFI tool. I was too scared of briking my rMBP.
What was in cause ? I thought I had a bad cable, or any other problem, and managed to unsoldered the SPI rom and connect it directly on the EZP programmer... With no luck : I had the same unreliable results. Worse, in desoldering the SPI rom I did loose some resistor, and had to read the schematics and find some new 33k resistors and solder them in the proper place... eeehhh...
Once the SPI rom again in place, I did some googling and find that other had same problems : I have read somewhere (here :
https://www.ghostlyhaks.com/forum/macbook/234-flashing-micron-25q064a-on-mba-2013-2014) that the power supplied by the SPI programmer wasn't strong enough...
So I did a little mod to my programmer and added an iPhone battery to provide it a 3.7-3.9V supply (not so clean but sorry... I was lazy this time).
And that time the dump of the SPI eeprom worked, I could even do it with the logic board in place, without having to desolder anything !
What next : with the full dump of my SPI bootrom, I could to some patch to it without any fear to brick my mac.
So I did extract the full BootRom, and did the following :
- open the BootRom of a rMBP 2015 with UEFI Tool for Mac, find the NVMe DXE driver and extract it
- open the BootRom of my rMBP 2013 with UEFI Tool for Mac, and replace the NVMe DXE driver with the new one from the 2015.
Next the DSDT Table :
- find and extract the compiled (assembly langage) DSDT table of a 2015 Mac, and decompile it with MacIASL
- find and extract the compiled (assembly langage) DSDT table from my 2013 Mac, and decompile it with MacIASL
- compare the difference to add the NVMe reference (I know nothing in ACPI tables, I just add at line 288 the line "NVME, 8" just before "Offset 0x12C)
- recompile the DSDT table as an aml file, and insert it back in the BootRom of my 2013 mac.
Then I just flashed inplace my BootRom with the obtained file.
And the result : the NVMe SSD is still orange at startup menu, but who cares...
Startup is now without any delay...
Hibernation now works fully... (I tested 4 times, with setting standby to 1 and standbydelay to 10s)
I think some tests need to be done, but a step has been made !