Succesfully flashing EFI chip on MacBook Air A1465


Rendering Error in layout Widget/Social: Call to a member function exists() on null. Please enable debug mode for more information.
More
2 years 5 months ago #10364 by brocking
Hi all,

I recently managed to successfully flash the Macronix MX25L6406E EEPROM chip in my MacBookAir which I had managed to corrupt with a misadventure with the Clover bootloader. I had quite some difficulty to manage to get the flash to work and so I wanted to make a note of the solution that was eventually successful for me in case it's of use to anyone else as well. The many posts on ghostlyhaks and elsewhere plus the EFI repo and the EasyFlash clip from ThaGhost were all extremely useful and there is no way I would have been able to reflash my EEPROM chip without that assistance.

In short:

The parts I was working with were:
  • MacBook Air A1465 MD711LL/A* (link)
  • Raspberry Pi Model B rev 1.2 (link) running the current release of the raspbian linux distro
  • EasyFlash v4.0.2 clip
  • Percona SOIC 8 clip (link)
  • Flasrom v1.0 compiled from source (link)

And the steps that eventually allowed me to succesfully reflash the EEPROM chip were:
  • With the battery connected to the motherboard, the mag safe power cable not connected, and the power button held down during reads and writes
  • and the EasyFlash adapter attached to the header port on the motherboard
  • flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -c "MX25L6406E/MX25L6408E" -r efi/read3.bin
  • I also needed to reinstall the OS as it seems I had aditionally managed to corrupt the EFI partition on the hard drive during my Clover misadventure. However once the firmware was loading correctly I was able to simply make a bootable USB install for macOS and then boot the MacBook with the option key held down and select the USB installer from the boot selection screen. However for some reason it did also seem to be necessary to reset the NVRAM in order to be able to get to the boot selection screen.
It seems that the crucial steps were holding down the power button during any i/o with the chip and specifying the spispeed parameter.

And in detail:

I was messing around (out of my depth) with the Clover bootloader and somehow managed to accidentally corrupt the EFI chip in my MacBook. As a result the machine would not boot and would instead just loop on the Mac boot chimes until switched off again. After determining that a corrupted firmware on the EEPROM chip was the likely cause I came across the ghostlyhaks sites. Eventually I got round to attempting the EFI flashing as described in the guide by the ThaGhost. I already had a raspberry pi available and so I just ordered a SOIC 8 clip and jumper cables in order to connect it to the EEPROM chip. Unfortunately this did not give much joy at all as I was unable to get any read from the chip, instead I would just continuously get the flashrom error message:
pi@raspberrypi:~$ flashrom -p linux_spi:dev=/dev/spidev0.0 -r efi/read1.bin
flashrom  on Linux 4.14.34+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.

I was getting pretty frustrated by now as I had tried every combination of connections mentioned in ThaGhost's guide and I really couldn't see why I could not connect to the damn chip. Eventually I decided to see if I could order an EasyFlash clip from ThaGhost just so that I could be sure that the problem was not to do with the physical connection between the chip and the raspberry pi. The terminals on the Macronix MX25L6406E chip in the A1465 seem to be fairly sunk into the motherboard (image attached) and so there is not a huge surface area for the terminals on the SOIC 8 clip to attach to.

The EasyFlash chip arrived very quickly and so I again attempted the connection to the EEPROM chip, and that didn't work either! So now I knew that the problem was very unlikely to be with the physical connection to the chip. I did wonder if I had somehow managed to physically damage the chip whilst trying to get the SOIC 8 clip to connect to the EEPROM chip, but actually replacing the EEPROM chip was somewhere I really didn't want to go and so I continued to try to find other possible solutions. Eventually I came across another post on the ghostlyhaks forums which mentioned holding down the power button whilst doing any read/writes to the chip, and this was definitely a step in the right direction. The output from flashrom was now:
pi@rasberrypi:~$ flashrom -p linux_spi:dev=/dev/spidev0.0 -r efi/read1.bin
flashrom  on Linux 4.14.34+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on linux_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to  if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

Finally some progress! But the chip was still not being identified (even when supplying the -c option to flashrom), neither could flasshrom read from it. After some more searching I came across this issue on the flashrom Github repo, which said that it was necessary to specify the spispeed flashrom parameter when used on a raspberry pi, so I used spispeed=30000, and suddenly it all worked like a dream!
pi@raspberrypi:~$ flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=30000 -c "MX25L6406E/MX25L6408E" -r efi/read3.bin
flashrom  on Linux 4.14.34+ (armv6l)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L6406E/MX25L6408E" (8192 kB, SPI) on linux_spi.
Reading flash... done.

Once that was all working it was straightforward to edit a clean EFI from ThaGhost's EFI repo and write it onto the EEPROM chip.

I did have one further problem which was that the EFI partition on the MacBook also seemed to have become corrupted and so I still was not able to actually boot the whole OS. I also had an old windows EFI partition on the hard drive which I had forgotten about and it seems that the bootloader was trying to boot that after it failed to find a working macOS EFI partition. Eventually I was able to simply reinstall the whole OS by creating a bootable USB stick with a copy of macOS on it and then booting the MacBook with the option key hold down and selecting the USB installer from the boot selection screen. For some reason it did also seem to be necessary to reset the NVRAM in order to be able to get to the boot selection screen, perhaps somehow as a result of the Windows EFI partition (I had long since deleted the actual Windows OS partition).
Attachments:

Please Log in or Create an account to join the conversation.

Who's Online

We have 171 guests and no members online

N00BZ

  • cagi
  • remi2020
  • IO
  • drexel0318

Cookies