netkas.org forum
August 18, 2019, 04:52:33 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Information for registering users http://forum.netkas.org/index.php/topic,2246.0.html
 
   Home   Help Search Login Register  
Pages: [1] 2
  Print  
Author Topic: Modify Xserve3,1 EFI to accept 6-core Westmeres  (Read 31097 times)
jamall007
Not Newbie
*
Offline Offline

Posts: 30


« on: December 09, 2014, 02:19:52 PM »

I have a 2009 Xserve, which shares much of it's architecture with the 2009 Mac Pro. Both support quad-core Nehalem Xeons. That was the last model Xserve ever produced, but the Mac Pro received a firmware update in 2010 which supported hex core Xeons. How hard would it be to modify the 2009 Xserves firmware to support six cores? I've got copies of all three machine's firmware, but not sure if I should be trying to decompile it, and if so using what. If anyone could at least point me in the right direction I'd really appreciate it.
Cheers
jamall
Logged
jamall007
Not Newbie
*
Offline Offline

Posts: 30


« Reply #1 on: December 16, 2014, 04:37:12 PM »


I have the three firmware .fd files (Xserve3,1 MacPro4,1 and MacPro5,1) unpacked and separated into their individual component files, but I'm not sure if I've used xfv.py correctly as the same files appear with different extensions in the three expanded firmwares. Also xfv.py gives a lot of "WARNING: this code path might not work" results. I've played with kexts and machine IDs before, but I'm way out of my depth here. Can anyone point me towards the location of the supported CPU IDs, or a reference that will help me find them? Do I need to disassemble the efi or drv files to find the CPU support section, and even if I can find it are there new capabilities in Westmere that require more than just adding a CPU identifier? I'm trying to learn about Apple's initial startup routines but there's so much irrelevant info to sift through to find each rusty needle that I'm not progressing very quickly. I spent several hours loading every page from support.apple.com/kb/DL256 through to support.apple.com/kb/DL1000 searching for the original firmware that the MP4,1 and XS3,1 shipped with, to no avail. Even if I can patch the Xserve's EFI to support six-core Westmere processors, is there a hardware check that will stop the Xserve from booting? Any help is appreciated, even if it's just some friendly advice telling me to stop wasting my time.
« Last Edit: December 16, 2014, 04:44:44 PM by jamall007 » Logged
Rominator
Hero Member
*****
Offline Offline

Posts: 2346



« Reply #2 on: December 17, 2014, 12:08:48 AM »

Wonderful that you are attempting this. I would absolutely NOT flash a boot rom until you have means to socket or easily switch EEPROM chip.

So many ways to fail and turn x-serve into a brick.

Pm the guy who did past things. Keep in mind replacing a file with a whole file is much less dangerous than what you are attempting. If you succeed could lead to support for the "oddball" Xeons . 5687 and the dual core super fast one.

Good luck
Logged

Before asking a question, check your "Personal Settings" and be sure that you have "Brain Services" set to "On".
jamall007
Not Newbie
*
Offline Offline

Posts: 30


« Reply #3 on: December 21, 2014, 08:00:56 AM »

Thanks Rominator. I have a single CPU Xserve3,1 to play with, and just sourced a dual socket motherboard and spare heatsink for under $100, so I guess there's leeway to make one fatal mistake, but I'd rather not make any. My understanding is that the ability to update firmware is built into the firmware, so if I manage to install one with a fatal flaw there's no going back without resorting to some hardware hacking.

I do have some progress to report. In MacPro1,1 firmware the processor microcode is stored in vol 3 of the expanded .fd file, named 00000000-0000-0000-0000-000000000000. The other EFI volumes can be expanded to access the drivers and .efi binaries within, but I'm not sure how to decrypt the contents of vol 3 to see the supported processors and their individual microcode. UEFITool just gives an error "parseVolume: Unknown file system 00000000-0000-0000-0000-000000000000", and xfv.py, PhoenixTool and MMTool can't make any sense of it either. Importantly though, the Xserve1,1 has a volume of the same name and size, which HexEdit shows is actually identical. The MacPro2,1 has a volume of the same name and size which is identical for about the first third of the file then diverges. Seeing as they support the same CPUs I expected the MacPro3,1 and Xserve2,1 to share a common volume, which they do. The EFI volume 3 in their .fd files is the same name and size as those in the earlier machines but unique to them.

There seems to have been a change in 2009 in the structure of the firmware - the MacPro4,1's firmware has 9 EFI volumes instead of 5, and it doesn't have a volume called 00000000-0000-0000-0000-000000000000. It's first and second volumes are duplicates, its third and fifth volumes are duplicates, and its fourth and sixth volumes are duplicates. Its 4th and 6th volumes, which are both called 153D2197-29BD-44DC-AC59-887F70E41A6B, cannot be parsed by UEFITool and are the same size as the 00000000-0000-0000-0000-000000000000 volumes in the previous generations of Intel machines, so it looks like the microcode has moved and has been duplicated for some reason. Significantly, the Xserve3,1 has a pair of volumes by the same name which are identical to the MacPro4,1's.

The MacPro5,1 has a pair of duplicate 153D2197-29BD-44DC-AC59-887F70E41A6B volumes of the right size, so I'm hoping that transferring those two EFI volumes from the MacPro5,1 to the Xserve3,1 will enable Westmere CPUs in the Xserve. There's a 10th volume introduced in the MacPro5,1 .fd that appears to be just padding, but it may complicate things. My next step is to rebuild the Xserve3,1 firmware with the MacPro5,1's microcode and to see if that breaks the installer. I run a boutique wine store and it's particularly busy at the moment, so I may have to leave it for a week or two. If anyone has any suggestions or pointers I'd be glad to hear them, especially regarding getting into Apple's mysterious microcode EFI volumes.
« Last Edit: December 21, 2014, 08:23:23 AM by jamall007 » Logged
TheRacerMaster
Not Newbie
*
Offline Offline

Posts: 13


« Reply #4 on: January 17, 2015, 10:11:39 PM »

Have you made any progress with this? I recently acquired a 2009 Xserve with dual X5550s. It'd be nice if I could upgrade to an L5640 or something similar.
Logged
jamall007
Not Newbie
*
Offline Offline

Posts: 30


« Reply #5 on: January 23, 2015, 07:30:34 PM »

Hi RaceMaster,
I've extracted the microcode from the MacPro5,1 firmware and can expand the Xserve3,1 firmware and remove the old microcode easily enough, but I can't repackage the remaining EFI volumes and new microcode into a .fd file correctly - the resulting .fd can't be expanded again. I've been playing with MMTool and PhoenixTool in windows, but they're not very intuitive. Any help would be welcome - especially if anyone knows how to build an .fd in a Mac app.
Logged
BastyJuice
Not Newbie
*
Offline Offline

Posts: 37


WWW
« Reply #6 on: February 16, 2015, 11:10:32 PM »

Any news about the Project ?
Logged
TheRacerMaster
Not Newbie
*
Offline Offline

Posts: 13


« Reply #7 on: February 25, 2015, 02:44:43 AM »

Hi RaceMaster,
I've extracted the microcode from the MacPro5,1 firmware and can expand the Xserve3,1 firmware and remove the old microcode easily enough, but I can't repackage the remaining EFI volumes and new microcode into a .fd file correctly - the resulting .fd can't be expanded again. I've been playing with MMTool and PhoenixTool in windows, but they're not very intuitive. Any help would be welcome - especially if anyone knows how to build an .fd in a Mac app.

Just curious - what are you using to repack the EFI volumes? I can see you are using bios_extract to extract the EFI volumes.
Logged
jamall007
Not Newbie
*
Offline Offline

Posts: 30


« Reply #8 on: February 26, 2015, 06:55:45 PM »

Hi BastyJuice, I haven't made much headway in the last couple of weeks - I'd pretty much stalled at repacking the firmware into a usable file when I was struck down with a series of unlikely health issues. While I was convalescing in hospital I stumbled across https://trmm.net/Thunderstrike_31c3 where Trammell Hudson details his (very cool) firmware hack for Thunderbolt-equiped Macs. I haven't had a chance to play with it yet, but it seems to cover everything I'll need to know to have any chance of success at this. In answer to your question RaceMaster, I've been tinkering with MMTool and phoenixtool in Windows.
Logged
TheRacerMaster
Not Newbie
*
Offline Offline

Posts: 13


« Reply #9 on: March 08, 2015, 06:26:07 PM »

Using PhoenixTool in Windows, I was able to extract what I believe to be the microcode volumes (both of the 153D2197-29BD-44DC-AC59-887F70E41A6B volumes). I was also able to repack them and extract them fine. I haven't tried flashing it yet or anything, so I don't really know if it works or not. If someone tries it and they manage to screw up their EFI, you might be able to use the Apple Firmware Restore CD to fix it, but no guarantees. I have no idea if this works or not - don't try flashing it!

Link to the modded FD: https://www.dropbox.com/s/1dq7fkvptdo6b7h/XS31_0081_06B.zip?dl=0
Link to Apple Firmware Restoration CD: https://support.apple.com/kb/dl976?locale=en_US

Again, I HAVE NOT TESTED THIS. USE AT YOUR OWN RISK.
Logged
Sebinouse
Jr. Member
**
Offline Offline

Posts: 64



« Reply #10 on: March 09, 2015, 12:09:27 AM »

I've been digging into MacMini's firmware and I gave a try to xfv.py to dismantle .fd.

The only differences I know between MacMini1,1 et MacMini2,1 are :
MacMini1,1 handles CoreSolo, CoreDuo and Core2Duo ; and is limited to 2 GB of RAM
MacMini2,1 handles Core2Duo (CoreDuo and CoreDuo not tested, but you have to change the processor before upgrade 1,1>2,1) ; and is limited to 4 GB of RAM

The differences in the output of the script are in yellow : there are more files for 1,1 than 2,1 ... Maybe it's just a coincidence ... Huh

Hope this will help you tough !


* MM11.png (185.03 KB, 567x852 - viewed 1299 times.)

* MM21.png (197.94 KB, 588x852 - viewed 1250 times.)
« Last Edit: March 09, 2015, 12:11:09 AM by Sebinouse » Logged
TheRacerMaster
Not Newbie
*
Offline Offline

Posts: 13


« Reply #11 on: March 09, 2015, 02:24:38 AM »

Do you know if there is any CRC or anything that has to be patched? Or can you just edit the EFI volumes?

Edit: Looked at one of your posts about modding the iMac firmware and flashing it to a Mac mini. You changed the CRC. Does that still apply here? The firmware is still a Xserve3,1 firmware, just with updated CPU microcode, to (hopefully) enable support for 5600 series Xeons (6-cores, like the ones in the MacPro5,1).
« Last Edit: March 09, 2015, 02:34:14 AM by TheRacerMaster » Logged
Sebinouse
Jr. Member
**
Offline Offline

Posts: 64



« Reply #12 on: March 09, 2015, 10:44:41 AM »

Yes we had to find the right EFIUpdaterApp.efi to perform the update (one that actually knows the mac we are using, that why we needed v2 for MacMini2,1).
For you it is easier, you just have to rename your custom .fd with the original name and then with an hex editor (hexfiend) you find and replace the CRC32 check of the original firmware you want to mimic/update (be careful it is in LSB-MSB).
This is mandatory, of the flash won't work (it will begin and fail at this check)

And finally to can run a script looking like this :

 
Code:
#!/bin/bash

updatesdir1="/System/Library/CoreServices/Firmware Updates"
updatesdir2="/System/Library/CoreServices/Firmware Updates/MacMiniEFIUpdate"
firmwaredir="path to your files"
firmware="EfiUpdaterApp.efi"
firmware2="LOCKED_MM11_0055_08B.fd"

rm -r "${updatesdir1}"
mkdir "${updatesdir1}"
mkdir "${updatesdir2}"

cp "${firmwaredir}/${firmware}" "${updatesdir2}"
cp "${firmwaredir}/${firmware2}" "${updatesdir2}"

/usr/sbin/bless -mount / -firmware "${updatesdir2}/${firmware}" -payload "${updatesdir2}/${firmware2}" -options "-x efi-apple-payload0-data" --verbose

exit 0
« Last Edit: March 09, 2015, 11:37:28 AM by Sebinouse » Logged
TheRacerMaster
Not Newbie
*
Offline Offline

Posts: 13


« Reply #13 on: March 09, 2015, 09:59:19 PM »

So in the EfiUpdaterApp2.efi, if the original CRC32 for the Xserve3,1 firmware is 2acb387f, and the custom firmware's CRC32 is d60cd2b6, I look for 2f in the EfiUpdaterApp2.efi file, and replace it with d6?
Logged
Sebinouse
Jr. Member
**
Offline Offline

Posts: 64



« Reply #14 on: March 10, 2015, 12:42:48 AM »

you look for " 7F 38 CB 2A  " and you replace with " B6 D2 0C D6 "
« Last Edit: March 10, 2015, 12:45:54 AM by Sebinouse » Logged
Pages: [1] 2
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Valid XHTML 1.0! Valid CSS!