EFI Bootup CS Graph
SPI CS during a successful bootup on an 820-4924. The first 200ms burst seems to signify there is good communications with the EFI. With bad traces, that initial burst lasts around 2ms. Near the start of the 1.2 second burst the chime sounds and backlight turns on.
EFI Quad SPI
because they switched to Quad SPI, they can't use HOLD# directly to bypass SPI ROM as it's now an I/O pin.
It uses a different SPI ROM chip (the smaller WSON8 footprint IIRC) which supports Quad SPI. Typically it has to be enabled by setting the "QE" (Quad Enable bit) with a programmer, then those 4 pins will act as I/O all the time. With Dual SPI that was used before, the communication starts in standard (single) SPI and then a command is used to switch to Dual SPI.
[5:01 PM] piernov: SPI is originally a protocol that works with 2 simplex data lines(only one direction, one transmit MISO, one receive MOSI, viewed from the SPI ROM). In dual mode, those 2 lines are now half-duplex data lines (bidirectional, but not at the same time, it alternates directions) and data is shared across them (so that the device can send or receive twice as fast). In quad SPI mode, it's similar to dual SPI but you now have 4 data lines because you use the Hold and Write Protect signal lines as data lines, so you can transmit 4 times as fast as on a standard SPI bus.
EFI ME Cleaning
How to clean the Intel ME (Management Engine) region of the EFI
EFI Change Serial Number
How to edit the serial number of a Mac
EFI Bootup Diagram