Thunderbolt 4, modified firmware, Full Thunderbolt Bus tree

[Elias64Fr]

@Elias64Fr,

With PD_RESET_1 jumper in "floating" state (pins 2-3 connected) or removed, the flash ROM cannot be detected:

% sudo flashrom -p ch341a_spi -r asrock5.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.

With RTD3 jumper connected to pins 1-2 instead of default 3-4, the flash ROM also cannot be detected.

With PD_RESET_1 and RTD3 in their default state, flash ROM is detectable with Force_PWR1 on or off. But the chip is sometimes detected as a generic device:

Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.

And very occasionally as Macronix:

% sudo flashrom -p ch341a_spi -r asrock5.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on ch341a_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.

No errors were reported this time, but the resulting file is gibberish.

Spoiler below contains additional attempts...

Spoiler: flashrom usage

** Attempt #1 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #2 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #3 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #4 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #5 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on ch341a_spi.
spi_get_erasefn_from_opcode: unknown erase opcode (0xc6). Please report this at [email protected]
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Block protection could not be disabled!
Reading flash... done.

... but the data in file is corrupt.

I'll try using Raspberry Pi over the weekend because we can use spispeed parameter to change the read/write frequency in MHz. I'll try using a reduced frequency.

Hi @CaseySJ

I use same common CH341A programmer as ori69 on last screenshot of his post .

Daily use jumpers position is Force_PWR1 on 1-2 (ON, left position), PD_RESET_1 on 1-2 (ON, left position) and RTD3 on 3-4 (right position).

From this jumpers configuration, I connect SOIC8 connector on Flash component of board then plug USB connector of programmer. Red LED switch ON and orange RUN LED blink one time.

I use the following command :

sudo flashrom -p ch341a_spi -c MX25L8005/MX25L8006E/MX25L8008E/MX25V8005 -r ASROCK_Thunderbolt4_AIC_Last1.bin

For the first attempt, I have an error related to Programmer initialization

Failed to claim interface 0: 'LIBUSB_ERROR_NOT_FOUND'
Error: Programmer initialization failed.

then after a second attempt I have an Error detection of Flash component

No EEPROM/flash device found.

From this state, I only have to remove PD_RESET_1 jumper with programmer still powered and plugged. After this, all read/write attempts are working.

sudo flashrom -p ch341a_spi -c MX25L8005/MX25L8006E/MX25L8008E/MX25V8005 -w ASROCK_Thunderbolt4_AIC_Last1mod.bin

After success flashing, plug back PD_RESET_1 jumper on daily use position (1-2).

 

[CaseySJ]

Why don't you dump the FW of Asrock Tbt AIC with Linux reading nvmem file ?

Because our goal is to modify and flash it back, which we cannot do via Linux.

 

[CaseySJ]

@Elias64Fr,

I’ll follow your exact sequence of actions once power is restored to this neighborhood. Power is comically unreliable here so I’m in the process of getting whole home battery backup.

Update:

• Using my 3.3V CH341A, I was unable to obtain valid firmware even by following the exact sequence of steps (all bytes in the file are 0xFF
• Using the argument -c MX25L8005/MX25L8006E/MX25L8008E/MX25V8005 made a big difference, however, in being able to read the firmware every time
• I'll try again with Raspberry Pi

 

[gandem]

@CaseySJ @Elias64Fr

I have an Asus Thunderbolt EX4 add in card. I was hoping to experiment with patched firmware.
Can either of you validate this firmware I pulled off the card? What version it is and possibly patch it to experiment with?
Thanks!

 

[CaseySJ]

@CaseySJ @Elias64Fr

I have an Asus Thunderbolt EX4 add in card. I was hoping to experiment with patched firmware.
Can either of you validate this firmware I pulled off the card? What version it is and possibly patch it to experiment with?
Thanks!

Perfectly good extraction. This is NVM 36. Patched version attached.

 

[gandem]

Perfectly good extraction. This is NVM 36. Patched version attached.

Will the current SSDT with corrected RP be the correct route?

 

[CaseySJ]

Will the current SSDT with corrected RP be the correct route?

If you're using the SSDT from earlier in this thread, then yes we only need to fix the root ports.

On which motherboard will you be installing the Thunderbolt add-in-card? If you're installing this on an Asus board that has a Thunderbolt header, we should see if SSDT alone can enable Local Node...

 

[gandem]

If you're using the SSDT from earlier in this thread, then yes we only need to fix the root ports.

On which motherboard will you be installing the Thunderbolt add-in-card? If you're installing this on an Asus board that has a Thunderbolt header, we should see if SSDT alone can enable Local Node...

I'm planning on using it in my Z690 Pro Art.

I seem to be having issues when attempting to flash the patched firmware back.
I went to re-connect the clip, and to verify I have a good connection, I follow your procedure of reading backups 1,2,3 and then comparing the shasum. Unfortunately, I'm not getting consistent checksum on the three files. I have not attempted to write, so theoretically, I'm just re-reading the original firmware that shipped.

Can you compare these with what I sent originally? I'm trying to figure out what's going on with my Raspberry Pi.

 

[CaseySJ]

I'm planning on using it in my Z690 Pro Art.

I seem to be having issues when attempting to flash the patched firmware back.
I went to re-connect the clip, and to verify I have a good connection, I follow your procedure of reading backups 1,2,3 and then comparing the shasum. Unfortunately, I'm not getting consistent checksum on the three files. I have not attempted to write, so theoretically, I'm just re-reading the original firmware that shipped.

Can you compare these with what I sent originally? I'm trying to figure out what's going on with my Raspberry Pi.

It seems you're experiencing the same problem I am! These latest extractions are gibberish.

Is this a Macronix (MXIC) flash ROM? Or Winbond?

 

[gandem]

It is a Winbond. Strange, my initial extraction went flawlessly. Could the chip be F-d?