MP 1,1-5,1 Accessing the hidden MP3,1 BIOS setup utility?

[lnx64]

Having not touched a retail model Mac Pro 3,1 in a while, I almost forgot about the hidden BIOS setup utility that is actually in the ROM still. On the last BIOS revision released, it's at 056E7324-A718-465B-9A84-228F06642B4F, in the PE32 image. If you use a utility to convert this binary image to a readable IFR, this is what you will see:

https://imgur.com/CfNTRhZ

As you can imagine, this is a gold mine, there IS IFR contents for the BIOS setup utility. However, I'm not 100% if the ROM was shipped with the actual utility to utilize it. (Though defaults in the IFR appear to be the settings that are actually being read on CSM startup, including PATA emulation, booting to CD first before HD, etc).

 

[Ludacrisvp]

How is this the first I’ve heard of anything like this?

 

[lnx64]

How is this the first I’ve heard of anything like this?

No one knew where to look. Pop up any MacPro 3,1, in Windows use the Universal BIOS Backup Toolkit, now use UEFITool, look for GUID mentioned, extract the PE32 "as is" (or whatever really), run it through the Universal IFR Extractor, and voila, you can see the menu entries in the IFR for the "hidden" UEFI BIOS settings that supposedly don't actually exist. In theory you can change settings through the IFR but I REALLY don't recommend this. What we need is to inject the setup utility back in the ROM and to be able to utilize it.

 

[lnx64]

Here's a video demonstrating in Windows how to get this. I don't know how to do it on OS X as I'm not familiar with those utilities. So this is all done within the CSM environment: https://streamable.com/lfhpv

If we can inject the setup utility back into the ROM in theory it should be able to load this setup UI. My only concern is that it stores the settings in the right location in NVRAM, not somewhere it shouldn't be writing to.

 

[tsialex]

MP5,1 config is done with separate modules but this seems equivalent of the MP3,1 one, GUID is FC1BCDB0-7D31-49AA-936A-A4600D9DD083:

 

[lnx64]

MP5,1 config is done with separate modules but this seems equivalent of the MP3,1 one, GUID is FC1BCDB0-7D31-49AA-936A-A4600D9DD083:

Interesting, I did a file compare and it's identical. I wonder how hard it would be to inject the Insyde BIOS Setup Utility to load the IFR and actually give us some options when CSM booting. (Though a challenge might be making sure it writes to NVRAM in the correct spot, and doesn't wreck havoc on the defaults it's loading from this IFR).
EDIT: Wait, your 5,1 IFR is identical to my 3,1 IFR, though most settings aren't actually set, only some of the interesting bits like IDE emulation SATA vs AHCI, the setting to actually enable VT-x is left unset, but some of the variables I don't see being useful on a 5,1 at all. (Or a 3,1 AC97? lol)

 

[tsialex]

Interesting, I did a file compare and it's identical. I wonder how hard it would be to inject the Insyde BIOS Setup Utility to load the IFR and actually give us some options when CSM booting. (Though a challenge might be making sure it writes to NVRAM in the correct spot, and doesn't wreck havoc on the defaults it's loading from this IFR).
EDIT: Wait, your 5,1 IFR is identical to my 3,1 IFR, though most settings aren't actually set, only some of the interesting bits like IDE emulation SATA vs AHCI, the setting to actually enable VT-x is left unset, but some of the variables I don't see being useful on a 5,1 at all. (Or a 3,1 AC97? lol)

Maybe this is just an example and not the real one used.

 

[lnx64]

Maybe this is just an example and not the real one used.

Possible. I wonder if I should try changing the default on the SATA mode to AHCI, re-injecting it back in place (to not damage how the EFI image is put together), reflashing it, and see if now Windows boots in AHCI by default.

Though, if it's a sample, that's a good 64KB wasted for a setup UI that doesn't exist. I would think they'd keep clutter down to a minimum. Though if this is being used for the defaults on SATA and VT-x, this could hugely help performance in Windows (and hyperv and the likes).

 

[tsialex]

Possible. I wonder if I should try changing the default on the SATA mode to AHCI, re-injecting it back in place (to not damage how the EFI image is put together), reflashing it, and see if now Windows boots in AHCI by default.

Though, if it's a sample, that's a good 64KB wasted for a setup UI that doesn't exist. I would think they'd keep clutter down to a minimum. Though if this is being used for the defaults on SATA and VT-x, this could hugely help performance in Windows (and hyperv and the likes).

Ok, but don't test with a MP3,1. The TSOP FWB is hell to reprogram. We can test it easily with MP5,1 SPI.

 

[lnx64]

Ok, but don't test with a MP3,1. The TSOP FWB is hell to reprogram. We can test it easily with MP5,1.

Would be interesting to see if it does actually change the settings on the 5,1.

If I remember, the TSOP on a 2008 is under the Airport card (been a while since I was at the hardware level of these machines, 6 years to be precise). Thanks for testing on a 5,1. I do have an EEPROM programmer if I really needed to desolder it to reflash it, but that's quite the location, fan shroud would need to come out, and I'd have to lug it on the bench to do the whole procedure. Luckily around the pins there's free space if I remember, but let's see what the 5,1 does with this first. NVRAM reset "might" be required for it to take effect if it does commit the defaults to NVRAM.

 

[tsialex]

Would be interesting to see if it does actually change the settings on the 5,1.

If I remember, the TSOP on a 2008 is under the Airport card (been a while since I was at the hardware level of these machines, 6 years to be precise). Thanks for testing on a 5,1. I do have an EEPROM programmer if I really needed to desolder it to reflash it, but that's quite the location, fan shroud would need to come out, and I'd have to lug it on the bench to do the whole procedure. Luckily around the pins there's free space if I remember, but let's see what the 5,1 does with this first. NVRAM reset "might" be required for it to take effect if it does commit the defaults to NVRAM.

I can take a look at this after the PXS* renames.

Maybe we should disable something that affect Windows to see if it's the real config.

The MP3,1 FWB needs to be removed, it's hell to do it.

 

[Ludacrisvp]

Well at least on the 3,1 it would be a really easy test (obviously not so easy to recover from) ... attempting to boot from the SATA ODD ports just flat out doesn't work when you go CSM mode due to it being flagged to boot in IDE mode (hence my how to on insanelymac about 11 years ago using grub and then later an MBR modification to change the PCI config space during boot to get AHCI).
I can only suspect how this behaves with the 4,1/5,1.

Can you boot windows installer from DVD in CSM mode on a 4,1/5,1?

 

[tsialex]

Can you boot windows installer from DVD in CSM mode on a 4,1/5,1?

Yes, thats the way we install Windows 10 to not have SecureBoot certificates all over the NVRAM.

 

[Ludacrisvp]

Slightly off topic ... how are you doing the overclock on your X5482s?

PXS* renames on the 3,1 would be nice too

If it is a 'sample' why would it mention the ESB2 chipset?
[automerge]1573528858[/automerge]

Yes, thats the way we install Windows 10 to not have SecureBoot certificates all over the NVRAM.

So they didn't revert to IDE mode on 4,1/5,1 then to keep all 6 SATA ports active?

 

[lnx64]

Um, only option I can think of disabling would be PATA, but there are no PATA ports on a 5,1. This should enable AHCI if I understand the layout correctly, I flipped the default for SATA to 0x2 (0x1 would be RAID). (Just check in IFR Extractor that the 0x2EB7 variable equals 0x2).

And yes, it is hell. This is my personal 3,1 and I don't dare mess with it:

https://imgur.com/iK1TVjW

(The one I'm checking out isn't mine, his is a retail version, mine's not, but he doesn't care if it gets bricked, I do however, I'd rather a successful firmware hack.)

 

[tsialex]

Slightly off topic ... how are you doing the overclock on your X5482s?

PXS* renames on the 3,1 would be nice too

If it is a 'sample' why would it mention the ESB2 chipset?
[automerge]1573528858[/automerge]

So they didn't revert to IDE mode on 4,1/5,1 then to keep all 6 SATA ports active?

I didn't found yet where are the checksums for the DSDT tables, almost an hour searching and nothing yet. Once done with MP5,1, PXS* renames will be trivial to implement with MP3,1. Did you get HEVC decoding working?

MP5,1 don't have PATA ports, just the six SATA ports - all connected to the southbridge.

 

[lnx64]

Slightly off topic ... how are you doing the overclock on your X5482s?

I set the PLL to a bus speed of 454MHz, so the whole entire system is bus overclocked basically. 454MHz is the fastest you can reliably overclock while being able to still reboot the system. Firmware will fail to execute if you go past this.

 

[tsialex]

Um, only option I can think of disabling would be PATA, but there are no PATA ports on a 5,1. This should enable AHCI if I understand the layout correctly, I flipped the default for SATA to 0x2 (0x1 would be RAID). (Just check in IFR Extractor that the 0x2EB7 variable equals 0x2).

And yes, it is hell. This is my personal 3,1 and I don't dare mess with it:

https://imgur.com/iK1TVjW

(The one I'm checking out isn't mine, his is a retail version, mine's not, but he doesn't care if it gets bricked, I do however, I'd rather a successful firmware hack.)

AHCI with CSM working would be perfect for MP5,1 people that loathe IDE mode and risk bricking using UEFI just for this.

 

[lnx64]

AHCI with CSM working would be perfect for MP5,1 people that loathe IDE mode and risk bricking using UEFI just for this.

I agree. I tried using an SSD in my personal 3,1, and I was kinda shocked at the performance, it was terrible, Windows 10 still took ages to boot, despite 4k random reads and writes being fairly faster (somehow the writes were faster than read, I don't know how that was possible, it was a significant margin).

I tried the popular AHCI MBR mod on my 3,1, but it had quirks. On boot, the display would freeze until the display driver in Windows loaded. So if I ever needed to get into Safemode, I can't "see" it because it shows a Windows logo (but you can hear the HD successfully get into Safemode). It was weird, I don't know why AHCI had an effect on my video card but it does, so I can't use the MBR hack. Besides, FastBoot has to be disabled on Windows 10 or your first cold power on results in a BSOD or sudden restart.

Honestly, I'd be willing to give a modified 3,1 firmware a shot on my machine for AHCI and VT-x (I want to get back into Android development and I simply can't on Windows 10). I don't know how close to a retail board my 3,1 is though and weather it could take a standard firmware or not. I'm scared to even try to be perfectly honest. The firmware is different (it boots to a black screen with blinking text mode cursor, and if no hard drive is installed, you get a funny looking 80x25 text mode flashing folder icon rendered in custom VGA character glyphs (it looks fairly close but it's a white background not grey).

 

[Ludacrisvp]

I didn't found yet where are the checksums for the DSDT tables, almost an hour searching and nothing yet. Once done with MP5,1, PXS* renames will be trivial to implement with MP3,1. Did you get HEVC decoding working?

MP5,1 don't have PATA ports, just the six SATA ports - all connected to the southbridge.

I do have HEVC decode in mojave and h264 encode/decode.

Right 3,1 has 2x PATA for ODD (not sure of the controller name) and 6x SATA on the ESB2 chipset which boots in IDE mode (4x SATA + 2x PATA with the 2x ODD SATA disabled) for windows unless modded.
So the 3,1 could run more drives without extra hardware than the 4,1/5,1 could due to the extra controller.

Is there reason to believe that there will be a checksum in place for the ACPI tables?
For what it is worth, in the 3,1 darwindumper provided above from someone's mac years ago ... the PXS* was part of the SSDT-18.aml table rather than being in the DSDT.

Interestingly for the actual devices Apple really didn't put anything in them in the config.
There doesn't appear to be any other references to PXS* in any other SSDT/DSDT.

\_SB.PCI0.NRP5.PXS1 <<< for reference

            Device (PXS1)
            {
                Name (_ADR, 0xFFFF)  // _ADR: Address
                Name (_SUN, 0x01)  // _SUN: Slot User Number
            }

\_SB.PCI0.NRP1.PXS2 <<< for reference

            Device (PXS2)
            {
                Name (_ADR, 0xFFFF)  // _ADR: Address
                Name (_SUN, 0x02)  // _SUN: Slot User Number
            }

These are under P2P3 and P2P4, interestingly P4 is slot 3 and P3 is slot 4

\_SB.PCI0.P0P9.P9P2.P2P3 <<< for reference

                Device (PXS4)
                {
                    Name (_ADR, 0xFFFF)  // _ADR: Address
                    Name (_SUN, 0x04)  // _SUN: Slot User Number
                }

\_SB.PCI0.P0P9.P9P2.P2P4 <<< for reference

                Device (PXS3)
                {
                    Name (_ADR, 0xFFFF)  // _ADR: Address
                    Name (_SUN, 0x03)  // _SUN: Slot User Number
                }

Also verified disassembly via this using ACPI 6.2a revision

$ /Applications/MaciASL.app/Contents/MacOS/iasl62 -da -dl DSDT.aml SSDT*.aml

And compiled against the same revision and no errors with a swap from PSX1 to GFX0
[automerge]1573530877[/automerge]

I agree. I tried using an SSD in my personal 3,1, and I was kinda shocked at the performance, it was terrible, Windows 10 still took ages to boot, despite 4k random reads and writes being fairly faster (somehow the writes were faster than read, I don't know how that was possible, it was a significant margin).

Samsung can do some RAM backed virtual disk thing to supposedly give better performance.
I've not done it but some on Facebook have, I don't trust it.

Honestly, I'd be willing to give a modified 3,1 firmware a shot on my machine for AHCI and VT-x (I want to get back into Android development and I simply can't on Windows 10). I don't know how close to a retail board my 3,1 is though and weather it could take a standard firmware or not. I'm scared to even try to be perfectly honest. The firmware is different (it boots to a black screen with blinking text mode cursor, and if no hard drive is installed, you get a funny looking 80x25 text mode flashing folder icon rendered in custom VGA character glyphs (it looks fairly close but it's a white background not grey).

Sounds like yours boots to EFI shell. maybe not after re-reading (was distracted)

What is your bootROM version?

 

[tsialex]

I do have HEVC decode in mojave and h264 encode/decode.

Right 3,1 has 2x PATA for ODD (not sure of the controller name) and 6x SATA on the ESB2 chipset which boots in IDE mode (4x SATA + 2x PATA with the 2x ODD SATA disabled) for windows unless modded.
So the 3,1 could run more drives without extra hardware than the 4,1/5,1 could due to the extra controller.

Is there reason to believe that there will be a checksum in place for the ACPI tables?
For what it is worth, in the 3,1 darwindumper provided above from someone's mac years ago ... the PXS* was part of the SSDT-18.aml table rather than being in the DSDT.

Interestingly for the actual devices Apple really didn't put anything in them in the config.
There doesn't appear to be any other references to PXS* in any other SSDT/DSDT.

\_SB.PCI0.NRP5.PXS1 <<< for reference

            Device (PXS1)
            {
                Name (_ADR, 0xFFFF)  // _ADR: Address
                Name (_SUN, 0x01)  // _SUN: Slot User Number
            }

\_SB.PCI0.NRP1.PXS2 <<< for reference

            Device (PXS2)
            {
                Name (_ADR, 0xFFFF)  // _ADR: Address
                Name (_SUN, 0x02)  // _SUN: Slot User Number
            }

These are under P2P3 and P2P4, interestingly P4 is slot 3 and P3 is slot 4

\_SB.PCI0.P0P9.P9P2.P2P3 <<< for reference

                Device (PXS4)
                {
                    Name (_ADR, 0xFFFF)  // _ADR: Address
                    Name (_SUN, 0x04)  // _SUN: Slot User Number
                }

\_SB.PCI0.P0P9.P9P2.P2P4 <<< for reference

                Device (PXS3)
                {
                    Name (_ADR, 0xFFFF)  // _ADR: Address
                    Name (_SUN, 0x03)  // _SUN: Slot User Number
                }

Also verified disassembly via this using ACPI 6.2a revision

$ /Applications/MaciASL.app/Contents/MacOS/iasl62 -da -dl DSDT.aml SSDT*.aml

And compiled against the same revision and no errors with a swap from PSX1 to GFX0

I bricked editing the 3rd and 4th streams of the NVRAM without correcting checksums before, since then I try to find before and not after

 

[lnx64]

Sounds like yours boots to EFI shell.

What is your bootROM version?

Supposedly the ROM appears to be the same version as a retail unit. (I was under the impression it was a custom ROM, but now that I dumped it, it's actually identical to the released 3,1 firmware, yet behaves differently. I'll get a video of it's behavior. I know this board is slightly earlier than the released versions, and the diagnostic LED's are always powered up, you can't turn them off.

I'll get a video of its behaviors. Other quirks of mine: It won't boot retail OS X discs, and despite using a PC video card, I can see boot, all with a standard firmware. So I believe it's either doing as you say, booting to an EFI shell, or its actually just jumping straight to CSM.

 

[tsialex]

Supposedly the ROM appears to be the same version as a retail unit. (I was under the impression it was a custom ROM, but now that I dumped it, it's actually identical to the released 3,1 firmware, yet behaves differently. I'll get a video of it's behavior. I know this board is slightly earlier than the released versions, and the diagnostic LED's are always powered up, you can't turn them off.

I'll get a video of its behaviors. Other quirks of mine: It won't boot retail OS X discs, and despite using a PC video card, I can see boot, all with a standard firmware. So I believe it's either doing as you say, booting to an EFI shell, or its actually just jumping straight to CSM.

Did you ever dumped the SPI to check if something is different in the NVRAM part of the BootROM? Maybe some debug mode enabled?

If I remember correctly, the FWB has just the BootROM and SPI has the NVRAM.

 

[lnx64]

How can I dump the SPI from within Windows? (Can it even access it?)
Here's a video of how it behaves. https://streamable.com/ew0tc
(Brb, my since making this video my USB 3.0 card isn't starting, Windows reporting it has a problem. I sometimes need to re-seat it in the PCI-E slot).
EDIT: Back. Got it back up again.

 

[Ludacrisvp]

I think that is just CSM mode (booting windows)
not sure i've tried booting with no HDD installed in mine with a normal PC card.
I've got several drives installed that aren't in the 4 slots so its more work than I want to mess with right now.

But i'm spinning up my windows 7 install now to see how well I can OC (if it will at all)