Flashing coreboot on MacBook Pro 10,1 using external SPI programmer

MacBook Pro 10,1 (15'' Mid 2012 Retina) is very easy to flash with SPI programmer and SOIC-8 clip, such as Pomona 5250.

Open the laptop, detach the battery connector, then find the SPI chip:

Attach the clip.

Try to probe the chip with flashrom. It should see it and print something like the below:

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0
flashrom v1.1-rc1-2-g93db6e1-dirty on Linux 4.14.24-v7+ (armv7l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Using default 2000kHz clock. Use 'spispeed' parameter to override.
Found Macronix flash chip "MX25L6405" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6405D" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Found Macronix flash chip "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" (8192 kB, SPI) on linux_spi.
Multiple flash chip definitions match the detected chip(s): "MX25L6405", "MX25L6405D", "MX25L6406E/MX25L6408E", "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F"
Please specify which chip definition to use with the -c <chipname> option.

Dump chip contents twice and compare the checksums. If they don't match, something's wrong with your programmer, wiring, clip, or something else. If multiple chips were found, as in my case, specify the correct name in -c argument:

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E" -r backup01.bin
$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E" -r backup02.bin
$ md5 backup*

Building and flashing coreboot

Clone the coreboot repository:

$ git clone --recurse-submodules https://review.coreboot.org/coreboot.git && cd coreboot

Build the toolchain (you must have gnat compiler installed, it's required for building libgfxinit which is written in Ada):

$ make crossgcc-i386 CPUS=$(nproc)
$ make iasl

Now run make menuconfig and configure coreboot:

General setup --->
    [*] Use CMOS for configuration values

Mainboard --->
    Mainboard vendor (Apple)
    Mainboard model (MacBookPro10,1)

Devices --->
    Graphics initialization (Use libgfxinit)

Under the Payload menu, select payload of your taste.

If you want microcode updates:

General setup --->
    [*] Allow use of binary-only repository

If you want to "neutralize" Intel ME, first extract modules from the backup:

$ ifdtool -x backup01.bin

Then add descriptor and ME to the config:

Chipset --->
    [*] Add Intel descriptor.bin file
    (/path/to/flashregion_0_flashdescriptor.bin) Path and filename of the descriptor.bin file
    [*]   Add Intel ME/TXE firmware 
    (/path/to/flashregion_2_intel_me.bin) Path to management engine firmware
    [ ]     Verify the integrity of the supplied ME/TXE firmware
    [*]     Strip down the Intel ME/TXE firmware

Run make to build coreboot. At the end you should have build/coreboot.rom file. Don't flash the whole ROM to the chip, in most cases you only need to flash the bios region:

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E" --ifd -i bios -N -w build/coreboot.rom

If you neutralized ME, flash the me region as well:

$ sudo flashrom -p linux_spi:dev=/dev/spidev0.0 -c "MX25L6406E/MX25L6408E" --ifd -i me -N -w build/coreboot.rom

When it's done, detach the clip, plug the battery connector, power up the laptop and enjoy open source firmware on your MacBook Pro.

Note that with coreboot Intel GPU Just Works™ and you don't need any special hacks.