Flashing coreboot on MacBook Air 5,2 using external SPI programmer

Recently I ported coreboot on MacBook Air 5,2 (13'' Mid 2012). This model has WSON-8 packaged SPI flash chip, which means you can't just use SOIC-8 clip such as Pomona 5250. I'll show you how to flash it using the J5100 debug connector on the mainboard and SPI adapter.

Open the laptop and find the debug connector:

You'll need an SPI adapter that plugs into it. I used the A4052 EasyFlash adapter; to use it, you also need 8-pin JST-SH 1.0mm male cable that plugs into this adapter's 8-pin header on the other side:

Here's the pinout of the adapter, left to right:

1  CS
2  3v3
3  MISO
4  Hold (NC)
5  WP (NC)
6  CLK
7  GND
8  MOSI

Connect the JST-SH cable's wires to your SPI programmer (e.g. ft2232h, ch341a, Raspberry Pi 3 or whatever you use), all except VCC (3v3), then detach battery connector from the mainboard:

Plug the adapter into the J5100:

The 3v3 pin of J5100 is not connected directly to the flash chip (U6100) so I do not recommend to use it, it's very unreliable and almost never works. Instead, connect the 3v3 pin of your programmer to U7930's 3v3. It's connected directly to the SPI chip:

Try to probe the chip with flashrom (replace YOUR_PROGRAMMER with your programmer, e.g. linux_spi:dev=/dev/spidev0.0 for Raspberry Pi or ch341a_spi for CH341A):

$ sudo flashrom -p YOUR_PROGRAMMER

If the chip was successfully detected, you will see something like this:

flashrom v1.1-rc1-2-g93db6e1-dirty on Linux 4.14.24-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Micron/Numonyx/ST flash chip "N25Q064..3E" (8192 kB, SPI) on linux_spi.

Dump chip contents twice and compare the checksums. If they don't match, something's wrong with your setup:

$ sudo flashrom -p YOUR_PROGRAMMER -r backup01.bin
$ sudo flashrom -p YOUR_PROGRAMMER -r backup02.bin
$ md5 backup*

Building and flashing coreboot

Clone the coreboot repository:

$ git clone --recurse-submodules https://review.coreboot.org/coreboot.git && cd coreboot

Build the toolchain (you must have gnat compiler installed, it's required for building libgfxinit which is written in Ada):

$ make crossgcc-i386 CPUS=$(nproc)
$ make iasl

Now run make menuconfig and configure coreboot:

General setup --->
    [*] Use CMOS for configuration values

Mainboard --->
    Mainboard vendor (Apple)
    Mainboard model (MacBookAir5,2)

Devices --->
    Graphics initialization (Use libgfxinit)

Under the Payload menu, select payload of your taste.

If you want microcode updates:

General setup --->
    [*] Allow use of binary-only repository

If you want to "neutralize" Intel ME, first extract modules from the backup:

$ ifdtool -x backup01.bin

Then add descriptor and ME to the config:

Chipset --->
    [*] Add Intel descriptor.bin file
    (/path/to/flashregion_0_flashdescriptor.bin) Path and filename of the descriptor.bin file
    [*]   Add Intel ME/TXE firmware 
    (/path/to/flashregion_2_intel_me.bin) Path to management engine firmware
    [ ]     Verify the integrity of the supplied ME/TXE firmware
    [*]     Strip down the Intel ME/TXE firmware

Run make to build coreboot. At the end you should have build/coreboot.rom file. Don't flash the whole ROM to the chip, in most cases you only need to flash the bios region:

$ sudo flashrom -p YOUR_PROGRAMMER --ifd -i bios -N -w build/coreboot.rom

If you neutralized ME, flash the me region as well:

$ sudo flashrom -p YOUR_PROGRAMMER --ifd -i me -N -w build/coreboot.rom

When it's done, unplug the SPI adapter from the board, plug the battery connector, power up the laptop and enjoy open source firmware on your MacBook.