Flashing coreboot on MacBook Air 5,2 using external SPI programmer
Recently I ported coreboot on MacBook Air 5,2 (13'' Mid 2012). This model has WSON-8 packaged SPI flash chip, which means you can't just use SOIC-8 clip such as Pomona 5250. I'll show how to flash it using the J5100 debug connector on the mainboard and SPI adapter.
Open the laptop and find the debug connector:
You'll need an SPI adapter that plugs into it. I used A4052 EasyFlash adapter; to use it, you also need 8-pin JST-SH 1.0mm male cable that plugs into this adapter's 8-pin header on the other side:
Here's the pinout of the adapter, left to right:
1 CS 2 3v3 3 MISO 4 Hold (NC) 5 WP (NC) 6 CLK 7 GND 8 MOSI
Connect the JST-SH cable's wires to your SPI programmer (e.g. ft2232h, ch341a, Raspberry Pi 3 or whatever you use), all except VCC (3v3), then detach battery connector from the mainboard:
Plug the adapter into the J5100:
The 3v3 pin of J5100 is not connected directly to the flash chip (U6100) so I do not recommend to use it, it's very unreliable and almost never works. Instead, connect the 3v3 pin of your programmer to U7930's 3v3. It's connected directly to the SPI chip:
Try to probe the chip with flashrom (replace
YOUR_PROGRAMMER with your programmer, e.g.
linux_spi:dev=/dev/spidev0.0 for Raspberry Pi or
ch341a_spi for CH341A):
$ sudo flashrom -p YOUR_PROGRAMMER
If the chip was successfully detected, you will see something like this:
flashrom v1.1-rc1-2-g93db6e1-dirty on Linux 4.14.24-v7+ (armv7l) flashrom is free software, get the source code at https://flashrom.org Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns). Found Micron/Numonyx/ST flash chip "N25Q064..3E" (8192 kB, SPI) on linux_spi.
Dump chip contents twice and compare the checksums. If they don't match, something's wrong with your setup:
$ sudo flashrom -p YOUR_PROGRAMMER -r backup01.bin $ sudo flashrom -p YOUR_PROGRAMMER -r backup02.bin $ md5 backup*
Building and flashing coreboot
Clone the coreboot repository:
$ git clone --recurse-submodules https://review.coreboot.org/coreboot.git && cd coreboot
Build the toolchain (you must have gnat compiler installed, it's required for building libgfxinit which is written in Ada):
$ make crossgcc-i386 CPUS=$(nproc) $ make iasl
make menuconfig and configure coreboot:
General setup ---> [*] Use CMOS for configuration values Mainboard ---> Mainboard vendor (Apple) Mainboard model (MacBookAir5,2) Devices ---> Graphics initialization (Use libgfxinit)
Under the Payload menu, select payload of your taste.
If you want microcode updates:
General setup ---> [*] Allow use of binary-only repository
If you want to "neutralize" Intel ME, first extract modules from the backup:
$ ifdtool -x backup01.bin
Then add descriptor and ME to the config:
Chipset ---> [*] Add Intel descriptor.bin file (/path/to/flashregion_0_flashdescriptor.bin) Path and filename of the descriptor.bin file [*] Add Intel ME/TXE firmware (/path/to/flashregion_2_intel_me.bin) Path to management engine firmware [ ] Verify the integrity of the supplied ME/TXE firmware [*] Strip down the Intel ME/TXE firmware
make to build coreboot. At the end you should have
build/coreboot.rom file. Don't flash the whole ROM to the chip, in most cases you only need to flash the
$ sudo flashrom -p YOUR_PROGRAMMER --ifd -i bios -N -w build/coreboot.rom
If you neutralized ME, flash the
me region as well:
$ sudo flashrom -p YOUR_PROGRAMMER --ifd -i me -N -w build/coreboot.rom
When it's done, unplug the SPI adapter from the board, plug the battery connector, power up the laptop and enjoy open source firmware on your MacBook.