T2 and DFU firmware reflashing

[mon2]

Hi. Have a logic board (820-01958 from A2179 chassis) that is not booting.

Adapter voltage is 20v @ ~70-80mA consumption.

PPBUS_G3H @ 12v29 (should be 12v6). The SMBUS lines on U7000 (ISL9240) are stuck low but there is no short circuit and the level shifters are fine.

Based on the assorted voltage rail review, this board is similar to a case on the Rosmann forum where a DFU is recommended.

At this time, we do not have such a current macbook to perform this DFU process.

Q: What exactly does the DFU process do with respect to the firmware upgrade? That is, which device holds this corrected firmware?

U3060 = TBT ROM storage but we are negotiating fine @ 20V. So we can ignore this device.

U4770 = Is this the T2 rom? (SOC)

Respectively - can the T2 rom (U4470) be applied from a donor board to mimic the DFU process? If only to test if this logic board is capable of working or not, wish to transplant from the donor board.

Do not want to lose any potential data on the non-working target board in this process.

Welcome all suggestions.

[spidertnt]

Re: T2 and DFU firmware reflashing

You can use any Macbook to restore using DFU mode ....I use a Mac Pro 5.1 from 2010.

I use this cable
https://www.amazon.ca/gp/product/B01...?ie=UTF8&psc=1

You will need a working chassis to place the logic board in...so you can use keyboard commands to get into DFU mode

----------------------------------------------------------------------------------------------------------------------------------

Programming the T2 chip manually with another rom backup can work to just show if power on AKA screen comes on etc. ...but it won't actually load or allow restore etc.
I have tried this using T2 USB programmer

[mon2]

Re: T2 and DFU firmware reflashing

Thanks so much for the guidance. Did know that an older MacBook could be used as the host.

To confirm, the T2 firmware is stored on an external flash rom device and is not internal to the T2 controller?

Will consider to apply a ROM from a donor board to see if the board can consume > 80 mA.

[Stephen]

Re: T2 and DFU firmware reflashing

Yes you can use an older macbook to do a DFU restore. Just make sure the usb 3.0 is usb 3.0 to usb c to communicate with the device.

The internal rom is stored on the rom. The ROM chip has a lot of important information. For it to boot. Such as serial info etc. EFI etc. when doing the DFU make sure you are using the second port closest to the bottom on the left side. Hold down right shift alt option and control. Then press power button let go power button and continue holding until you see DFU in AC2.

Also yes U4470 is the rom chip that is correct. I suggest having a T2 programmer ROM tool. You can extract info. Worst case you can copy bin files from myself if you need a clean EFI bin file but the serial will not match but I can manually change it to match your board. Let me know

Alsooooo keep in mind when copying a new bin file the computer won't boot so a DFU will be required.

[piernov]

Re: T2 and DFU firmware reflashing

T2 has an internal boot ROM that cannot be updated (same as on iPhone and hence why checkm8 cannot be patched), it handles the DFU feature and hands off the boot process to the bootloader. A small part of the bootloader is stored on the external SPI ROM, this does contain the serial number, but it does no contain EFI and many other firmware modules required to boot. Everything else is stored inside a hidden partition on the SSD. EFI is read from the SSD and sent to the PCH by T2 through eSPI.
DFU restore can repair many firmware modules but it's not able to rebuild everything from scratch (e.g. blank SPI ROM and blank SSD ICs).

[spidertnt]

Re: T2 and DFU firmware reflashing

Alsooooo keep in mind when copying a new bin file the computer won't boot so a DFU will be required.

yes ..i forgot you will need to do DFU restore after swap . it should also fail but possible the the screen will post before failure .

also possible voltage stays at 5v needing DFU to restore back to 20v

[nelusab]

Hi Stephen!
I have an issue with an MBP 15' - A1990, it boots when battery flex cable is unpluged but when I plug in the cable it runs in kernel panic, the fans are running at max for a second and the machine reboots over and over again, in loop, until I disconect the flex cable.
First I thought is something about current sensing, and I replaced the current sense rezistor, after that the ISL chip (U7000). Result - same behavior. I've dumped the ACPI tables and I found that one of them SSDT SmcDppt.aml is empty, has nothing written on him. If this table is responsible of SMC behavior, could be an explanation. I have a reflashing tool, but no genuine A1990 I7 2,6Ghz bin file to reflash SPI ROM. Could you help me?

[Stephen]

Usually when you plug in battery and fans run at max speed is a clear indicator of a faulty battery in most cases. I would suggest trying another batter and seeing if that is the issue then proceed further.

[nelusab]

Hi Stephen,
I already tried with 2 other batteries. this one has 168 cycles. I could boot with the battery pluged in but with trackpad cable disconected. It booted slow, and the fans where running noisy, and that's how I found information about the battery.
I've performed a new DFU Restore, this time with last version of macos Sonoma on both macs, and with the last iBridge. The same result. Please tell me this, DFU Restore operation is reflashing the entire T2 ROM file?
I have some KP messages looking like this

[nelusab]

I forgot to mention the fan where running fast but nothing was heating on the board, I've checked the CPU, GPU, Nands, memory, T2 chip, they where at max 40 degrees(Celsius)

[nelusab]

When I read the KP message - about a namespace error, I thought there's something about ACPI namespace and the ACPI tables are part of T2 ROM bin file. That's why I've asked you to help me with a clean T2ROM bin file.
The old battery had over 750 cycles, and I experienced something with an A1989 model, wich was working normal until the battery percentage was drawing down to 60% - 70%, when suddenly the system was crashing, rebooting by itself with KP message. So my explanation is that could be the same with this A1990, perhaps it was performed a major update, without the addapter pluged in and during the process, the system crashed and the bios was corrupted.
I have another macbook in the same stage, an A2251 one. At this one I have no info about the battery, but I let it to charge at full, and after few hours I measured the voltage - first 8V, after 7V -decreasing, with the battery flex cable un plugged. I think this one also had a broblem with the T2ROM bin file corrupted, probably the same cause. I could be wrong but I have no other explanation. So could you help me?

[Stephen]

You will have high fan spin when trackpad is disconnected and it will act slow with these machines. This also happens with m1 machines. You should always have the trackpad connected. If the fans are off when it is connected and it boots normally and the battery holds a charge you have an issue with the board and need to diagnose the board for repair.

[nelusab]

Ohh yeah, it helped me very much!
Thanks, anyway!