From LogiWiki
Jump to navigation Jump to search

EFI Bootup CS Graph


SPI CS during a successful bootup on an 820-4924. The first 200ms burst seems to signify there is good communications with the EFI. With bad traces, that initial burst lasts around 2ms. Near the start of the 1.2 second burst the chime sounds and backlight turns on.

Successful Boot EFI 1.jpgSuccessful Boot EFI 2.jpg


Communication issue

CPU VCore, SLP_S5# and SPI_CS0_L when R6120 is removed on an 820-3437, simulating communication issue with SPI ROM causing power cycling.

  • CPU VCore
  • PM_SLP_S5_L
  • SPI_CS0_L

Commmunication ok

Expected SPI_CS0_L behaviour before RAM initialization. This board has RAM issue, on a working board there will be more activity afterwards when EFI is copied into RAM.




SPI_MLB_CS_L 2.4 second graph

SPI_MLB_CS_L 12 second graph

SPI_MLB_CS_L 24 second graph. Charger chime happens at the end of the communications

SPI_MLB_CS_L in blue, SPIROM_USEMLB in yellow. 24 second chart.


LPC_FRAME_L in blue, SPI_MLB_CS_L in yellow. 2.4 second graph.

LPC_FRAME_L in blue, SPI_MLB_CS_L in yellow. 24 second graph.


because they switched to Quad SPI, they can't use HOLD# directly to bypass SPI ROM as it's now an I/O pin.

It uses a different SPI ROM chip (the smaller WSON8 footprint IIRC) which supports Quad SPI. Typically it has to be enabled by setting the "QE" (Quad Enable bit) with a programmer, then those 4 pins will act as I/O all the time. With Dual SPI that was used before, the communication starts in standard (single) SPI and then a command is used to switch to Dual SPI.

[5:01 PM] piernov: SPI is originally a protocol that works with 2 simplex data lines(only one direction, one transmit MISO, one receive MOSI, viewed from the SPI ROM). In dual mode, those 2 lines are now half-duplex data lines (bidirectional, but not at the same time, it alternates directions) and data is shared across them (so that the device can send or receive twice as fast). In quad SPI mode, it's similar to dual SPI but you now have 4 data lines because you use the Hold and Write Protect signal lines as data lines, so you can transmit 4 times as fast as on a standard SPI bus.

EFI Tools

Script EFI Tool

EFI ME Cleaning

How to clean the Intel ME (Management Engine) region of the EFI:

The user Crumblenaut has created a guide based on Piernov's video above that should spell out this process in a series of hopefully easy-to-follow step-by-step instructions. You can find it on the Clean ME Region wiki page.

EFI Change Serial Number

How to edit the serial number of a Mac

EFI Bootup Diagram

EFI Boot up Diagram.jpg


SPI ROM compatibility

It is not recommended to replace the SPI ROM chip with a different model. Different SPI ROM chips may have different working voltage (1.8V or 3.3V), different operating frequency and latency, different command set and especially support for Quad SPI mode which may not be enabled by default. In particular, the 2015 MacBooks use Quad SPI mode, so the chip must support it and have its QE bit set to one. Additionally, Intel platforms all have Intel Management Engine nowadays, and it can be picky about the SPI ROM. The firmware contains a list of supported chip in the VSCC table, you can check it with UEFITool NE or Intel FITC if ever you have to swap with a different chip.

Swapping SPI ROM between boards and using pre-programmed ICs

Buying pre-programmed chip off of eBay is not a good idea. Sometimes it works, sometimes it doesn't, because the people that sell them don't necessarily know what they are doing and just flash random dumps found on badcaps.net or Vinafix.
Using a pre-programmed chip or a chip from another machine means you will have the wrong serial number. In the best case the serial number is blank and the board has to be serialized using Apple's Blank Board Serializer. Otherwise it has to be edited to match the original one, and the checksum for the Fsys store (which contains the ssn variable) has to be recalculated.
Using a chip from another machine means you get the ME region that has already been tied to the new machine's PCH. This will cause all sorts of random problems depending on the machine, incl. shutdown after 30 minutes, long POST delay, fan running at full speed, ME not working, freeze/kernel panic while booting macOS, apparently even webcam not working on some Mac boards. The ME region has to be cleaned, and there's a specific procedure for that, 90% of the videos or tutorials you'll find are wrong about it. Don't copy/paste with an hex editor, don't use MEInject. This will put a raw ME region without manufacturer settings, and Macs for example have specific settings for the ME region that will be lost (and it can also cause similar issues to "dirty" ME region). The correct way is to use Intel FITC, see tutorial on win-raid forums. Some pre-programmed chip also may not have the ME region cleaned properly.


Apple switched to APFS by default with High Sierra on machines with SSD (and HDD since Mojave), which required a BootROM update (part of the EFI) to support booting from this filesystem. Meaning that if you use an EFI with an old BootROM (either flashing a random dump or using a pre-programmed chip without the update), suddenly you won't be able to boot from a drive with High Sierra or newer on it, and you won't even see it in the boot menu. One solution is to reinstall macOS on the internal SSD to trigger the BootROM update.

WSON8 adapter

You can buy a WSON8 adapter board for your programmer, it should come with both the 8x6 and the 6x5 footprints for 2013 and 2015 machines respectively. You don't need to use hot air to solder it on the adapter, you can just run the solder iron with some solder on the edges.