netkas.org forum

General Category => Rom things => Topic started by: jamall007 on December 09, 2014, 02:19:52 PM



Title: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on December 09, 2014, 02:19:52 PM
I have a 2009 Xserve, which shares much of it's architecture with the 2009 Mac Pro. Both support quad-core Nehalem Xeons. That was the last model Xserve ever produced, but the Mac Pro received a firmware update in 2010 which supported hex core Xeons. How hard would it be to modify the 2009 Xserves firmware to support six cores? I've got copies of all three machine's firmware, but not sure if I should be trying to decompile it, and if so using what. If anyone could at least point me in the right direction I'd really appreciate it.
Cheers
jamall


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on December 16, 2014, 04:37:12 PM
(http://i.imgur.com/Y4k3bIX.jpg)
I have the three firmware .fd files (Xserve3,1 MacPro4,1 and MacPro5,1) unpacked and separated into their individual component files, but I'm not sure if I've used xfv.py correctly as the same files appear with different extensions in the three expanded firmwares. Also xfv.py gives a lot of "WARNING: this code path might not work" results. I've played with kexts and machine IDs before, but I'm way out of my depth here. Can anyone point me towards the location of the supported CPU IDs, or a reference that will help me find them? Do I need to disassemble the efi or drv files to find the CPU support section, and even if I can find it are there new capabilities in Westmere that require more than just adding a CPU identifier? I'm trying to learn about Apple's initial startup routines but there's so much irrelevant info to sift through to find each rusty needle that I'm not progressing very quickly. I spent several hours loading every page from support.apple.com/kb/DL256 through to support.apple.com/kb/DL1000 searching for the original firmware that the MP4,1 and XS3,1 shipped with, to no avail. Even if I can patch the Xserve's EFI to support six-core Westmere processors, is there a hardware check that will stop the Xserve from booting? Any help is appreciated, even if it's just some friendly advice telling me to stop wasting my time.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Rominator on December 17, 2014, 12:08:48 AM
Wonderful that you are attempting this. I would absolutely NOT flash a boot rom until you have means to socket or easily switch EEPROM chip.

So many ways to fail and turn x-serve into a brick.

Pm the guy who did past things. Keep in mind replacing a file with a whole file is much less dangerous than what you are attempting. If you succeed could lead to support for the "oddball" Xeons . 5687 and the dual core super fast one.

Good luck


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on December 21, 2014, 08:00:56 AM
Thanks Rominator. I have a single CPU Xserve3,1 to play with, and just sourced a dual socket motherboard and spare heatsink for under $100, so I guess there's leeway to make one fatal mistake, but I'd rather not make any. My understanding is that the ability to update firmware is built into the firmware, so if I manage to install one with a fatal flaw there's no going back without resorting to some hardware hacking.

I do have some progress to report. In MacPro1,1 firmware the processor microcode is stored in vol 3 of the expanded .fd file, named 00000000-0000-0000-0000-000000000000. The other EFI volumes can be expanded to access the drivers and .efi binaries within, but I'm not sure how to decrypt the contents of vol 3 to see the supported processors and their individual microcode. UEFITool just gives an error "parseVolume: Unknown file system 00000000-0000-0000-0000-000000000000", and xfv.py, PhoenixTool and MMTool can't make any sense of it either. Importantly though, the Xserve1,1 has a volume of the same name and size, which HexEdit shows is actually identical. The MacPro2,1 has a volume of the same name and size which is identical for about the first third of the file then diverges. Seeing as they support the same CPUs I expected the MacPro3,1 and Xserve2,1 to share a common volume, which they do. The EFI volume 3 in their .fd files is the same name and size as those in the earlier machines but unique to them.

There seems to have been a change in 2009 in the structure of the firmware - the MacPro4,1's firmware has 9 EFI volumes instead of 5, and it doesn't have a volume called 00000000-0000-0000-0000-000000000000. It's first and second volumes are duplicates, its third and fifth volumes are duplicates, and its fourth and sixth volumes are duplicates. Its 4th and 6th volumes, which are both called 153D2197-29BD-44DC-AC59-887F70E41A6B, cannot be parsed by UEFITool and are the same size as the 00000000-0000-0000-0000-000000000000 volumes in the previous generations of Intel machines, so it looks like the microcode has moved and has been duplicated for some reason. Significantly, the Xserve3,1 has a pair of volumes by the same name which are identical to the MacPro4,1's.

The MacPro5,1 has a pair of duplicate 153D2197-29BD-44DC-AC59-887F70E41A6B volumes of the right size, so I'm hoping that transferring those two EFI volumes from the MacPro5,1 to the Xserve3,1 will enable Westmere CPUs in the Xserve. There's a 10th volume introduced in the MacPro5,1 .fd that appears to be just padding, but it may complicate things. My next step is to rebuild the Xserve3,1 firmware with the MacPro5,1's microcode and to see if that breaks the installer. I run a boutique wine store and it's particularly busy at the moment, so I may have to leave it for a week or two. If anyone has any suggestions or pointers I'd be glad to hear them, especially regarding getting into Apple's mysterious microcode EFI volumes.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on January 17, 2015, 10:11:39 PM
Have you made any progress with this? I recently acquired a 2009 Xserve with dual X5550s. It'd be nice if I could upgrade to an L5640 or something similar.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on January 23, 2015, 07:30:34 PM
Hi RaceMaster,
I've extracted the microcode from the MacPro5,1 firmware and can expand the Xserve3,1 firmware and remove the old microcode easily enough, but I can't repackage the remaining EFI volumes and new microcode into a .fd file correctly - the resulting .fd can't be expanded again. I've been playing with MMTool and PhoenixTool in windows, but they're not very intuitive. Any help would be welcome - especially if anyone knows how to build an .fd in a Mac app.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: BastyJuice on February 16, 2015, 11:10:32 PM
Any news about the Project ?


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on February 25, 2015, 02:44:43 AM
Hi RaceMaster,
I've extracted the microcode from the MacPro5,1 firmware and can expand the Xserve3,1 firmware and remove the old microcode easily enough, but I can't repackage the remaining EFI volumes and new microcode into a .fd file correctly - the resulting .fd can't be expanded again. I've been playing with MMTool and PhoenixTool in windows, but they're not very intuitive. Any help would be welcome - especially if anyone knows how to build an .fd in a Mac app.

Just curious - what are you using to repack the EFI volumes? I can see you are using bios_extract to extract the EFI volumes.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on February 26, 2015, 06:55:45 PM
Hi BastyJuice, I haven't made much headway in the last couple of weeks - I'd pretty much stalled at repacking the firmware into a usable file when I was struck down with a series of unlikely health issues. While I was convalescing in hospital I stumbled across https://trmm.net/Thunderstrike_31c3 (https://trmm.net/Thunderstrike_31c3) where Trammell Hudson details his (very cool) firmware hack for Thunderbolt-equiped Macs. I haven't had a chance to play with it yet, but it seems to cover everything I'll need to know to have any chance of success at this. In answer to your question RaceMaster, I've been tinkering with MMTool and phoenixtool in Windows.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on March 08, 2015, 06:26:07 PM
Using PhoenixTool in Windows, I was able to extract what I believe to be the microcode volumes (both of the 153D2197-29BD-44DC-AC59-887F70E41A6B volumes). I was also able to repack them and extract them fine. I haven't tried flashing it yet or anything, so I don't really know if it works or not. If someone tries it and they manage to screw up their EFI, you might be able to use the Apple Firmware Restore CD to fix it, but no guarantees. I have no idea if this works or not - don't try flashing it!

Link to the modded FD: https://www.dropbox.com/s/1dq7fkvptdo6b7h/XS31_0081_06B.zip?dl=0
Link to Apple Firmware Restoration CD: https://support.apple.com/kb/dl976?locale=en_US

Again, I HAVE NOT TESTED THIS. USE AT YOUR OWN RISK.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Sebinouse on March 09, 2015, 12:09:27 AM
I've been digging into MacMini's firmware and I gave a try to xfv.py to dismantle .fd.

The only differences I know between MacMini1,1 (http://www.everymac.com/ultimate-mac-lookup/?search_keywords=Macmini1,1) et MacMini2,1 (http://www.everymac.com/ultimate-mac-lookup/?search_keywords=Macmini2,1) are :
MacMini1,1 handles CoreSolo, CoreDuo and Core2Duo ; and is limited to 2 GB of RAM
MacMini2,1 handles Core2Duo (CoreDuo and CoreDuo not tested, but you have to change the processor before upgrade 1,1>2,1) ; and is limited to 4 GB of RAM

The differences in the output of the script are in yellow : there are more files for 1,1 than 2,1 ... Maybe it's just a coincidence ... ???

Hope this will help you tough !


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on March 09, 2015, 02:24:38 AM
Do you know if there is any CRC or anything that has to be patched? Or can you just edit the EFI volumes?

Edit: Looked at one of your posts about modding the iMac firmware and flashing it to a Mac mini. You changed the CRC. Does that still apply here? The firmware is still a Xserve3,1 firmware, just with updated CPU microcode, to (hopefully) enable support for 5600 series Xeons (6-cores, like the ones in the MacPro5,1).


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Sebinouse on March 09, 2015, 10:44:41 AM
Yes we had to find the right EFIUpdaterApp.efi to perform the update (one that actually knows the mac we are using, that why we needed v2 for MacMini2,1).
For you it is easier, you just have to rename your custom .fd with the original name and then with an hex editor (hexfiend) you find and replace the CRC32 check (https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/mann/crc32.n.html) of the original firmware you want to mimic/update (be careful it is in LSB-MSB).
This is mandatory, of the flash won't work (it will begin and fail at this check)

And finally to can run a script looking like this :

 
Code:
#!/bin/bash

updatesdir1="/System/Library/CoreServices/Firmware Updates"
updatesdir2="/System/Library/CoreServices/Firmware Updates/MacMiniEFIUpdate"
firmwaredir="path to your files"
firmware="EfiUpdaterApp.efi"
firmware2="LOCKED_MM11_0055_08B.fd"

rm -r "${updatesdir1}"
mkdir "${updatesdir1}"
mkdir "${updatesdir2}"

cp "${firmwaredir}/${firmware}" "${updatesdir2}"
cp "${firmwaredir}/${firmware2}" "${updatesdir2}"

/usr/sbin/bless -mount / -firmware "${updatesdir2}/${firmware}" -payload "${updatesdir2}/${firmware2}" -options "-x efi-apple-payload0-data" --verbose

exit 0


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on March 09, 2015, 09:59:19 PM
So in the EfiUpdaterApp2.efi, if the original CRC32 for the Xserve3,1 firmware is 2acb387f, and the custom firmware's CRC32 is d60cd2b6, I look for 2f in the EfiUpdaterApp2.efi file, and replace it with d6?


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Sebinouse on March 10, 2015, 12:42:48 AM
you look for " 7F 38 CB 2A  " and you replace with " B6 D2 0C D6 "


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on March 10, 2015, 01:02:12 AM
Ah, OK. Thanks.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on March 11, 2015, 03:41:46 PM
Nice work RM! Have a look at https://trmm.net/Thunderstrike_31c3 (https://trmm.net/Thunderstrike_31c3), "...we can conclusively say that Apple has added their own CRC32 boot-time check on the contents of the firmware volume and that is why changing a single byte in the ROM makes the system shutdown." He goes into detail about how to get around the boot check, it's pretty involved but definitely doable.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on March 11, 2015, 10:15:18 PM
Looking at that link, it should be possible. The problem is acquiring a copy of the SMC firmware for the Xserve. AFAIK there weren't any SMC firmware updates released for it, which makes things more difficult.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: TheRacerMaster on March 22, 2015, 05:52:32 PM
Does anyone have any idea how we can get the SMC firmware for the Xserve?


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Sebinouse on March 25, 2015, 11:51:37 AM
Once again from EFI shell you may be able to read / dump / write SMC : more info HERE (http://www.insanelymac.com/forum/topic/299811-readsmc-for-efi-a-tool-to-enter-read-smc-keys-from-efi-shell-on-real-macs/)


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Spanky Deluxe on November 08, 2015, 09:29:33 PM
Did anyone ever make any progress with this?


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: jamall007 on December 01, 2015, 04:53:19 PM
Yes, one of my motherboards is off having its EEPROM chip replaced with a socket so I can start testing the various EFI builds I've come up with at a reasonable clip. Using my Raspberry Pi as a Bus Pirate was far too slow for trial and error. I'll report back with any progress...


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Rominator on December 02, 2015, 11:37:45 PM
You should say "Hi" to the guy at MR trying to add EFI support for NVME, he is working with similar issues, could help each other greatly.


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: hyram on April 29, 2016, 07:27:57 PM
A while back I was looking into the MP1,1 and MP2,1 EFI's, but sidelined it due to life. Anyway, here's what I can tell you about the xs31_81_06b firmware and processor support:

With absolute certainty, the only processors supported will have a CPUID of 0x106A2, 0x106A4, and 0x106a5 as the FW (vol 4 & 6) includes microcode for these CPUIDs. I'm sure that there are others supported without microcode, but I'd have to disassemble the PEIcore code to be sure which ones, and I don't really have the time to do that.

I've attached a listing of everything I was able to ascertain about the xs31_81_06b firmware. I hope it helps.

hyram


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: edgerider on December 04, 2018, 09:27:24 AM
just to let you guys know that we have opened a post on MR to try to make the Xserve go to 2019 and build a new firmware with all the bells and wistle of the mac pro 5.1 while still remain true Xserve function...
all help is needed , like the Macpro, i think if we do the base work, apple will release an official firmware update.
here is the link!

no intention to hijack this post! @netkas, rominator, we absolutely need your help on this one!
Dosdude1 and Tsialex are already over there, so please I beg you guys to come and join the force!

https://forums.macrumors.com/conversations/xserve.989909/page-2#message-1143016


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: Rominator on December 16, 2018, 10:46:36 AM
yeah, i'd love to but they tossed me out for correctly arguing that the nMP 6,1 was a turd with no upgrade path

i was right, the moron who drives around with Five Flats was 100% wrong, but i won't ever post there again

anyhow, did someone try my quick and dirty "flash it as 5,1" method?

i got the cable to connect boards together but not found time


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: edgerider on December 18, 2018, 12:39:08 PM
sorry for late reply i dont come here very often.

so basically someone over there did boot a xs3.1 just fine with macpro 5.1 140.0 firmware but he lost hardware xserve fonctionality such as led planel on front here is what he say :

Here it is ... Hope that can help, I already flashed it with a MacPro 5.1 even with boot room 140.0 booted fine showed as a MacPro 5.1 and I could put 6 core and 12 core same thing as the Mac Pro. Now you lose the Hard Drive led's activity, and the front panel led too, so I did revert back to Xserve original rom 2009, Installed Sierra, and High Sierra on the other, Got back the LED HD's activity nice I love it, and I managed also to bring back the LED front Panel ... Where It used to be a time where the front panel was working OOB under the Snow and Lion 10.7.5 era with Server install, but I found a way to run the LED's even under ML, Mavericks and UP to High Sierra...

so i don’t understand if he had remove the 6 core and put back the 4 core to boot into xs3.1 firmaware, or if reverting to x3.1 actually kept the processor compatibility....
pending on his reply...


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: edgerider on December 23, 2018, 02:14:35 PM
@rominator,

so yes i can confirm someone at MR got a xserve 3.1 booting just fine with 5.1 firmware 140.0 and two x5690, and successfully revert back to xs3.1 firmware and x55xx processor.

the only thing that was not working was the LOM and hhd led .

We were about to get tve very precious help of someone there, but one other member used one of his idea as « his » so he got pissed and decline helping, which i gess is understandable...

sorry for my noob question but what do you think is the best strategie :
inject X3.1 lom function in cMp5.1 v140.0 firmware?
inject cMp5.1 cpu microcode/nvme boot and so on in xs3.1 firmware...

or

compare the two firmware side by side and look for differences ?

the guy on MR that was able to modify firmware also told me that « only apple had a special way to access the firmware update via ethernet boot... »

he also said that the only way to modify the firmware without bricking the xserve was to build a breakout board to connect the LCP+sip connector to capture what was going on during the boot to debug...

other than that they have found the soic8 chip in the mobo but no one can explain me why you need to have access to the LCP+Sip to unbrick a mobo with a bugged firmware...

dont a soic clip dont do exactly the same?

merry xmas and hollydays to all of you!


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: edgerider on December 23, 2018, 04:24:30 PM
I think I found an interesting link to the x-serve technician manual :

http://tim.id.au/laptops/apple/xserve/xserve_early2009.pdf

in this manuals a block diagram clearly show that the serial port on the back is indeed connected to the smc and the eeprom containing the firmware...
look page 16....


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: donluca on July 14, 2019, 06:11:48 PM
Has there been any development? I know there’s a guy who managed doing this and posted on a xserve facebook group but he didn’t tell how he did it.

I’m still trying to understand the procedure, do we have to desolder the chip and program it?


Title: Re: Modify Xserve3,1 EFI to accept 6-core Westmeres
Post by: reukiodo on August 27, 2019, 09:14:06 AM
Do you mean to flash the Mac Pro firmware as-is? This has been discussed on macrumors forums how to repeat the process using the same tools as flashing the MacPro4,1 to MacPro5,1.

Or are you asking about updates to a hybrid xserve-macpro firmware? I beleieve there isn't anyone publicly working on a hybrid firmware yet.