** Mission Update **
Recap of today's mission statement:
Step 1:
Attempt the 10K pull-up resistor method to read Flash ROM. Fortunately I have an Arduino kit that includes many resistors of various Ohms, including 10K. If this method can reliably read W25Q80DV in-circuit, then it's on to next step.
Step 2:
Flash original firmware back and verify.
Step 3:
Use the
TbtOnPch method to modify 10 bytes. Use a script registered with Launch Daemon to run automatically on startup with root privileges.
Step 4:
If I brick the system again with Step 3, I'll modify those 10 bytes directly in original firmware and flash entire thing with external programmer.
MISSION REPORT
Mission 1: Use of Pull-Up Resistors to Facilitate In-Circuit Chip Reading
- Despite the use of 10K Ohm, 2K Ohm, and 1K Ohm pull-up resistors, the on-board flash chip remained difficult to read. So this does not seem to be viable solution.
- However, others with more experience in this area might be able to find a way.
Mission 2: Flash Original Firmware Back
- Using the Raspberry Pi and carefully adjusting the SOIC8 clip over the Winbond chip until the LEDs on motherboard were a faint shade of red, it was possible to flash the original firmware back.
Mission 3: Use Osy86's
tbpatch to Modify 7 Bytes in Thunderbolt Firmware
- This was the most potentially exciting possibility.
- However, after several hours of attempts, it was not successful.
- Automatic boot script was created to read 4K bytes of Thunderbolt firmware four times in a row.
- But subsequent attempt to modify 7 bytes in firmware failed.
- Attempt 1 failed during the first read operation, so firmware was unchanged.
- Attempt 2 failed during the write operation, so Thunderbolt controller got bricked again.
Mission 4: Manually Change 7 Bytes in Original Firmware and Flash the Whole Thing Back
- The Thunderbolt controller was bricked anyway, so why not just modify the firmware manually and flash it in?
- Using the Raspberry Pi, this succeeded. The result of this is very promising just as @Elias64Fr pointed out yesterday.
Result of Flashing Modified Original Firmware (7 Bytes Changed)
Testing is under way, but preliminary result shows:
Both DSB1 and DSB4 ports are functional.
Hot plug is functional.
Thunderbolt devices not only connect, they work as well.
Link Speed and Link Status are correct -- including 40 Gbps.
USB controller is still alive and kicking!
Preliminary Conclusion:
- With only 7 bytes modified and a simple SSDT added for enabling hot-plug, the results so far are better than anything we've yet seen on this motherboard.