Contribute
Register

Thunderbolt 4, modified firmware, Full Thunderbolt Bus tree

Elias64Fr said:
I have bought an Asrock Thunderbolt 4 AIC (Rev 1) with the following specification here :
View attachment 580592
Click to expand...
@Elias64Fr , do you by any chance have the stock unmodified firmwares for this card, hopefully the later ones that fix ASM USB4 compatibility issues?

Edit; It looks like AsRock just stopped updating the firmware for V1 of that card and came out with the rev 2 version. Lol. That’s some BS. I would imagine the newer firmware for rev2 would still work on rev1 cards, but that’s just a guess. From what I can tell they only released one firmware for the V1, and that’s firmware 28. i wonder what is even different with the newer card? The board layout looks damn near identical.
 
Last edited:
@Elias64Fr,

ASRock Thunderbolt 4 AIC just arrived from the Netherlands! The good news ends there... :(

The Macronix flash ROM on this board is turning out to be very difficult to read. Although flashrom detected the chip a few times and read the contents, the contents are corrupt.

In your experience, was it easy to read the flash ROM on this card? If so, which CH341a device are you using?

IMG_3087_resize.jpg
IMG_3088_resize.jpg
IMG_3092_resize.jpg
IMG_3091_resize.jpg
 
Last edited:
CaseySJ said:
@Elias64Fr,

ASRock Thunderbolt 4 AIC just arrived from the Netherlands! The good news ends there... :(

The Macronix flash ROM on this board is turning out to be very difficult to read. Although flashrom detected the chip a few times and read the contents, the contents are corrupt.

In your experience, was it easy to read the flash ROM on this card? If so, which CH341a device are you using?

View attachment 581806 View attachment 581803View attachment 581804 View attachment 581805
Click to expand...
Hi @CaseySJ
Had similar difficult on beginning, you should try playing with middle position jumper named as PD Reset or something like this … play with it from one position to another (right left position). Power Delivery component may share same SPI bus (serial bus) with Flash component and may disturb communication

If I remember, when you connect CH341A programmer to USB port, you have red LED ON and you should have orange DATA LED NOT BLINKING before flashing process (before flashrom command)… but not sure… try this. If you can’t read flash component, I will redone it and will explain process if needed.
 
Last edited:
Hello Elias64Fr
Did you read my posts about Asus USB4 Controller?
www.tonymacx86.com

Thunderbolt 4, modified firmware, Full Thunderbolt Bus tree

Good evening, Surely a naive question: is there a way to extract the Thunderbolt firmware without having to use a SOIC8 clip / Raspberry Pi on the SPI ROM chip (either on macOS or Windows) ? Apologies if this was already posted somewhere else! Thank you! Yes we can read the firmware from...
www.tonymacx86.com www.tonymacx86.com
 
ori69 said:
Hello Elias64Fr
Did you read my posts about Asus USB4 Controller?
www.tonymacx86.com

Thunderbolt 4, modified firmware, Full Thunderbolt Bus tree

Good evening, Surely a naive question: is there a way to extract the Thunderbolt firmware without having to use a SOIC8 clip / Raspberry Pi on the SPI ROM chip (either on macOS or Windows) ? Apologies if this was already posted somewhere else! Thank you! Yes we can read the firmware from...
www.tonymacx86.com www.tonymacx86.com
Click to expand...
Hi @ori69

Yes, I have seen it. But I don’t think we could have it working on macOS without a dedicated Asmedia driver. This component should a different technical specification from Intel component… except if you have different information about this.
 
@Elias64Fr,

With PD_RESET_1 jumper in "floating" state (pins 2-3 connected) or removed, the flash ROM cannot be detected:

Code: 
% sudo flashrom -p ch341a_spi -r asrock5.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
No EEPROM/flash device found.
Note: flashrom can never write if the flash chip isn't found automatically.

With RTD3 jumper connected to pins 1-2 instead of default 3-4, the flash ROM also cannot be detected.

With PD_RESET_1 and RTD3 in their default state, flash ROM is detectable with Force_PWR1 on or off. But the chip is sometimes detected as a generic device:

Code: 
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.

And very occasionally as Macronix:

Code: 
% sudo flashrom -p ch341a_spi -r asrock5.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on ch341a_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.

No errors were reported this time, but the resulting file is gibberish.

Spoiler below contains additional attempts...
** Attempt #1 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #2 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #3 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #4 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on ch341a_spi.
===
This flash part has status NOT WORKING for operations: PROBE READ ERASE WRITE
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Read is not working on this chip. Aborting.

** Attempt #5 **

% sudo flashrom -p ch341a_spi -r asrock2.bin

flashrom v1.3.0 on Darwin 23.5.0 (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on ch341a_spi.
spi_get_erasefn_from_opcode: unknown erase opcode (0xc6). Please report this at [email protected]
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Block protection could not be disabled!
Reading flash... done.

... but the data in file is corrupt.

I'll try using Raspberry Pi over the weekend because we can use spispeed parameter to change the read/write frequency in MHz. I'll try using a reduced frequency.
 
400 Series
Prime Z490-A |  i5 10600K |  HD 630
300 Series
Z370N WIFI |  i7 8700K |  HD 630
200 Series
GA-Z270X-UD5 |  i3 7100 |  Radeon RX Vega 56 Air Boost
100 Series
GA-Z170X-UD5 TH |  i5 6600K |  GeForce GTX 770
9 Series
GA-Z97-D3H |  i7 4790K |  HD 4600
@Elias64Fr,

Using Raspberry Pi 4B, I can read the MXIC chip every time without any errors or warnings, but all of the binary files are gibberish. I tried different frequencies using spispeed=1024 and 2048 and 8192 and also omitted spispeed.

Here's what the Rapberry Pi cmmand line looks like:

Code: 
$ shasum *
b2047f75c73528368491d46be3f4730871c00d08  asrock1.bin
4a9f792777bd6401d3578f634efa1aa113632b53  asrock2.bin
1ca638712bf769c907551a1c1c7740d58940944b  asrock3.bin
9aa393fc4991fe2c6ef6a2b16cdb249c6d359487  asrock4.bin
bc3876948e4fbd6923db15fa2d0be5a2611bad78  asrock5.bin
bf0b121670df23f2cc64302d9f215e7c81187bbb  asrock6.bin

casey@rasp4b:~/Documents $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -r asrock2.bin
flashrom unknown on Linux 6.6.20+rpt-rpi-v8 (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on linux_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.


casey@rasp4b:~/Documents $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=1024 -r asrock3.bin
flashrom unknown on Linux 6.6.20+rpt-rpi-v8 (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on linux_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.


casey@rasp4b:~/Documents $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2048 -r asrock4.bin
flashrom unknown on Linux 6.6.20+rpt-rpi-v8 (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on linux_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.


casey@rasp4b:~/Documents $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2048 -r asrock5.bin
flashrom unknown on Linux 6.6.20+rpt-rpi-v8 (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on linux_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.


casey@rasp4b:~/Documents $ sudo flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2048 -r asrock6.bin
flashrom unknown on Linux 6.6.20+rpt-rpi-v8 (aarch64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Macronix flash chip "MX25L8005/MX25L8006E/MX25L8008E/MX25V8005" (1024 kB, SPI) on linux_spi.
===
This flash part has status UNTESTED for operations: WP
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to [email protected] if any of the above operations
work correctly for you with this flash chip. Please include the flashrom log
file for all operations you tested (see the man page for details), and mention
which mainboard or programmer you tested in the subject line.
Thanks for your help!
Reading flash... done.

IMG_3095_resize.jpg
 
Last edited:
Why don't you dump the FW of Asrock Tbt AIC with Linux reading nvmem file ?
 
You must log in or register to reply here.
Copyright © 2010 - 2024 tonymacx86 LLC
Back
Top