T480 trouble reading thunderbolt eeprom - tips?

[surprisedHacker]

Hi,

I have a T480 which suffered a failed bios update. I can reliably read and flash the WInbond 25Q128 (U49) but it's still dead (no post, just musical beeps). Turned to the Thunderbolt eeprom (25Q80 in U15) but I can't read the same data from it twice in a row - it's different every time. I'm using a CH341G (same as on https://www.onetransistor.eu/2017/08...schematic.html) in exactly the same way, just moving the SOIC clip from one to the other (noting location of pin 1). Both are 3.3V devices.

The coin cell backup battery is out, the main battery is out. I don't understand why I can't reliably read this IC. Do I have to desolder it first or does this sound like a faulty / damaged eeprom?

Thoughts / ideas appreciated.

[mon2]

Can you consistently read out the manufacturing ID / device ID codes?

[surprisedHacker]

Yes, however IMSProg (v1.4.1) detects a W25Q80BL which isn't the same as 25Q80DVSIG which is on the package.

25Q80DV is 2.7-3.3V and the 25Q80BL is 2.3 to 3.3V. This shouldn't matter should it?

[mon2]

No the Vcc does not matter since your hardware is fixed to support 3v3 only (which is ok for both flash types). However, do not like the mismatch of the detection which could be the root cause.

Hunt around for a better program that is compatible with your hardware. Never heard of the software you are currently using. You need the program s/w to detect as marked on the IC for the best results.

[mon2]

Ok - found your s/w on github via Adafruit chats.

Try this tool and post your results.

Releases · nofeletru/UsbAsp-flash (github.com)

[surprisedHacker]

AsProgrammer is for Windows, I'm on Lunix so tried flashrom. It identifies the IC so I did 4 reads and compared them. Different each time :-(

$ rm *.bin; flashrom -p ch341a_spi -r tb1.bin; flashrom -p ch341a_spi -r tb2.bin; flashrom -p ch341a_spi -r tb3.bin; flashrom -p ch341a_spi -r tb4.bin
flashrom v1.2 on Linux 5.15.0-113-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip "W25Q80.V" (1024 kB, SPI) on ch341a_spi.
Reading flash... done
... snip ...

$ md5sum *.bin
51f0fd57d0ea968c9aec06414506473c tb1.bin
460420c75596b0371e97294a8703f085 tb2.bin
285f1c3d689dbc0e113e3e4b222e8fa4 tb3.bin
a3fd730f0f90d54500e8f03a9d2e1674 tb4.bin

The line "Found Winbond flash chip "W25Q80.V" (1024 kB, SPI) on ch341a_spi." makes me think it's ID'ing the eeprom correctly - assuming the '.' in W25Q8-.V is a wildcard.'

I'm going to try and get hold of another programmer. Thanks for your help so far.

[mon2]

Can you test with more delays for the SPI clock?

[surprisedHacker]

I don't think it is possible to control the spi clock on the CH341A programmer

$ flashrom -p ch341a_spi:spispeed=100 -r outfile
flashrom v1.2 on Linux 5.15.0-113-generic (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Unhandled programmer parameters: spispeed=100
Aborting.
Error: Programmer initialization failed.

Might have to see if I can persuade a raspi to do it.

[surprisedHacker]

Just to update - I used a raspberry pi + flashrom with the CH341 clip. It detects the eeprom but I still can't get 2 reads the same even if I drop the clock speed.

I checked the supply voltage on the 25Q80 and it's 5V. This is a 3.3V part which according to the schematic at https://www.badcaps.net/filedata/fetch?id=2056435 is supplied by a SN1701012RJTR in U207. This goes via a mosfet U234 in FDG316P_SC70-6 which protects from PD burnout (schematic note).

I don't see that U234 would make 3V3 into 5V but I also suspect something is amiss between U207 and U15 (eeprom). Can somebody double-check my logic here and speculate what's going on?

Many thanks