VMware Community and Team,
It appears the Apple has bricked the Mac Pro 6,1 recently where VMware vSphere 6.5u1 will no longer install properly (yes I know of @lamw - no reply from him on if anyone recently was successful). Upon installation, it seems that the usual message on the nfs41client fails but as it completes, one is presented with a message that there are no network adapters present.
Oddly enough, I then went into shell and ran dmesg and lspci - it appears that the BCM577xx series is indeed being presented to the hypervisor (including the same vendor and hardware ID for the thunderbolt to gigabit ethernet adapter) but the driver for them is not. I did check the HCL and what I found was a specific EFI or Boot ROM version that is much older than what is currently available today. After reading into Duo Security's white paper regarding "Apple of my EFI" it seems they have been unwilling or more likely, less concerned with providing VMware as a partner any updates to your HCL regarding changes made at ring 2 that affect you at ring 1. I can only speculate that the amount of PR from that incident in SEP-2017 is the result of this. This update seems to be applied only if one has or did apply macOS 10.13 High Sierra - which permits this EFI to be presented as a security update. If applied (for which the majority of supply today that exists) by any previous owner or by the OEM (Apple of course) then you will most certainly encounter a failure of installation.
I also tested this in the Apple Store on a display model which had 10.13 no less. It failed of course in the same manner. Please see here for my details to William Lam (Apple Communities have them too but they are either too ignorant or more likely unconcerned with this issue). https://www.virtuallyghetto.com/2017/01/esxi-6-5-support-for-apple-mac-pro-61.html (I am the last of those comments with Boot ROM version).
Does anyone here have a Mac Pro 6,1 that they can confirm this issue and provide the Boot ROM listed (boot off MacOS installed to an external disk to test unless you just have one with High Sierra for giggles)?
*** IMPORTANT PRODUCT SECURITY NOTE ***
It is in Apple's best interest to perform this EFI firmware update because if it is not present, I can pwn you permanently with a Thunderkit rootkit and you will be unable to get me out of your host. Apple no longer provides a known means to downgrade your EFI however I am aware that only productsecurity@apple.com can reapply the EFI if you become compromised. This is and should be a major concern for anyone running current versions or planning on running any type 1 and especially a type 2 hypervisor - because if I have ring 2 access, I have access to ESXi at ring 1 and all guests at ring 0. VMware team, please get in contact with Apple product security and SE team to obtain updated HCL information.
For all existing vSphere or ESXi customers running any version of VMware vSphere - it is likely you are vulnerable and therefore have risk. Therefore you either update your EFI and brick your system or accept the risk and do no nothing - without proper auditing (logging) and accounting (reviewing them regularly) you would not notice the exploit is present nor would you even be able to remove it, except by running macOS 10.13, permitting the update and thereby bricking your system with vSphere/ESXi - obviously you will still be able to run macOS and a type 2 hypervisor.
