Thunderbolt 4, modified firmware, Full Thunderbolt Bus tree

CaseySJ said:

@ori69,

Some immediate questions/suggestions:

• Have you tried installing GC-Maple Ridge into your Asus Z790-P WiFi with (a) original NVM firmware and (b) modified NVM firmware?
  • If so, for original NVM firmware, does Thunderbolt Local Node appear using just SSDT and cold start?
  • If modified NVM firmware has been flashed, does sleep work when Thunderbolt Local Node is enabled?
• Regarding the Gigabyte Z590iboard, is it assembled and ready to boot? Is it running macOS Sonoma?
  • Have you tried flashing the firmware?
  • If so, does sleep work?
  • Does hot plug work?

Click to expand...

I have never had an Asus Maple Ridge. I ordered today along with the Asus USB4 and am waiting for delivery. I have GC-Maple Ridge - unflashed. I tried to sflash once, but my programmer could not read the ROM.

Tomorrow I will transfer the i3 10300 to the Z590i and try to install Sonoma.

I'm also sharing the 3 BIOSes I got from Gigabyte that support Titan Ridge.
Z690GAMINGXDDR4GC.F22 - Z690 Gaming X DDR4
Z690UDDDR4GC.F22 - Z690 UD DDR4
Z690UDAXGC.F22 - Z690 UD AC (DDR5)

racermaster said:

My understanding is that the signature check is done by the active firmware (the Linux documentation and osy's blog/tutorial seem to support this).

However, the firmware does allow downgrading. NVM firmware update support for Maple Ridge was missing in Linux but it can be enabled with a one-line patch (/sys/bus/thunderbolt/devices/0-0/nvm_non_active0/nvmem is missing without it). I was able to flash NVM 31 on my Z790-CREATOR which was previously running NVM 38. I haven't checked this, but I suspect ASUS added their own downgrade check in the driver that performs the firmware update (CCF23F50-F7C1-4F00-8E70-13643C37E8B0) and simply removed that check in BIOS 9901 for the Z690-CREATOR.

Click to expand...

The problem I was having…. I compiled a new kernel with that patch, and the proper nodes in sysfs now show up. Initially I thought it was blocking the downgrade, but the issue is you can't dump a nvmem, and then write that same dump back. It's not formatted properly, and authentication won't work. Thank you racer for helping me, much appreciated.


Edit: I grabbed Elias's nvm.bin from the first page, and looked at the formatting, compared that to what racer told me, and used that as a guide, copied the HP nvm dump into the relevant spots. It works. So that answers that question; fw format the same for all MR vendors. Really wish there was a way to PM people here tho...sorry mods about earlier, just trying to get a post through was like climbing mount Everest. So happy that TB2 devices work again!

@urgze,

Glad it worked!

Was this an unmodified NVM, meaning that it was just copied-and-pasted into the full image, then flashed via the custom Linux kernel?

CaseySJ said:

@urgze,

Glad it worked!

Was this an unmodified NVM, meaning that it was just copied-and-pasted into the full image, then flashed via the custom Linux kernel?

Click to expand...

Yeah, unmodified v31 maple ridge from HP, and dumped from an identical system that had not been updated yet. @racermaster I owe you a beer. Saved me a boat load of money and time by helping explain the fw format. Would have had to order all new FlexIO TB4 MR modules, and hoped that they still shipped with older v31 fw. HP put no warning or anything in the release notes about TB1&2 compatibility being broken with > v31 fws. I see Asus, etc., are starting to now, due to so many people complaining.

urgze said:

Yeah, unmodified v31 maple ridge from HP, and dumped from an identical system that had not been updated yet. @racermaster I owe you a beer. Saved me a boat load of money and time by helping explain the fw format. Would have had to order all new FlexIO TB4 MR modules, and hoped that they still shipped with older v31 fw. HP put no warning or anything in the release notes about TB1&2 compatibility being broken with > v31 fws. I see Asus etc. are starting to now, due to so many people complaining.

Click to expand...

ASUS initially had no warning when they released the updated NVM36. That was BIOS 2204. Was a nightmare !!!! It was so bad that the Thunderbolt controller would literally crash and throw PCIe bus errors when the system entered and resumed from sleep, XMP was on, and a Thunderbolt device was physically connected to the system. I lost an NVMe drive this way. It literally died.

There was also initially no ability to downgrade the NVM firmware back to 31 either.

But the backlash was significant. So, ASUS, after a few months released a special BIOS that allowed us to downgrade the firmware back to 31. BIOS 9901. Only issue is to install 9901, you have to be on a BIOS image that isn’t regression locked. And, if you’re on a regression locked BIOS, you have to unlock some hidden UEFI variables to allow an older BIOS to be installed.

If anyone has MSI Z690 MEG ACE, looking for older Thunderbolt 4 Maple Ridge v31 firmware for a friend. I tried loading a few of their UEFI capsules from their downloads section into UEFITool, but I can't find anything.

Usually you can hex search for something like "736B6970 206C6973" and it'll pop right up...but I'm not seeing it.
I am far from a UEFI expert though. @Elias64Fr any other ways you can think of to find it?

It’s also possible that it’s just not in the caps I looked through. I didn’t go through every single release. Hmm… what a pain.

ori69 said:

I have never had an Asus Maple Ridge.

Click to expand...

I was referring to GC-Maple Ridge.

ori69 said:

I ordered today along with the Asus USB4 and am waiting for delivery. I have GC-Maple Ridge - unflashed. I tried to sflash once, but my programmer could not read the ROM.

Click to expand...

I’ve had good luck reading flash ROM on GC-Maple Ridge. Couple of suggestions:

• Ensure that all 8 pins of SOIC clip are making contact correctly. Sometimes the back 4 pins are misaligned, so we have to carefully seat both the front 4 pins and back 4 pins
• If you are using one of the “cheap” CH341a programmers, ensure it is not resting on a metal surface because that can create electrical shorts; place the programmer on an anti-static plastic bag instead

ori69 said:

Tomorrow I will transfer the i3 10300 to the Z590i and try to install Sonoma.

I'm also sharing the 3 BIOSes I got from Gigabyte that support Titan Ridge.
Z690GAMINGXDDR4GC.F22 - Z690 Gaming X DDR4
Z690UDDDR4GC.F22 - Z690 UD DDR4
Z690UDAXGC.F22 - Z690 UD AC (DDR5)

Click to expand...

There is no Thunderbolt firmware in any of these BIOS files.

I still haven't had any luck trying to find and extract the v31 TB F/W from this MSI Z690 ACE UEFI cap.
It's the original 1.0 release of the BIOS. So I would assume it has to have the Thunderbolt firmware in there, but maybe not? Anyway, if someone has time and can take a look and help out, I would appreciate it!

Good evening,
Surely a naive question: is there a way to extract the Thunderbolt firmware without having to use a SOIC8 clip / Raspberry Pi on the SPI ROM chip (either on macOS or Windows) ?
Apologies if this was already posted somewhere else!

Thank you!

mmaira said:

Good evening,
Surely a naive question: is there a way to extract the Thunderbolt firmware without having to use a SOIC8 clip / Raspberry Pi on the SPI ROM chip (either on macOS or Windows) ?
Apologies if this was already posted somewhere else!

Thank you!

Click to expand...

Idk about Mac or Win, but on Linux it’s trivial


Only caveat is like I said you can’t dump current firmware and then write that binary back, you have to format it (put header & padding, and then remove zeroes at the end), and if you want to write Maple Ridge (tb4) you’ll need to add that line to icm.c in the thunderbolt kernel driver source code.

Intel has a windows flash utility but it doesn’t work on TB4. Probably could be modded / hex edited to allow TB4 — Intel confirmed that TB4 uses the same read and write firmware access flows as TB3. They just decided as a management decision to do fw upgrades via UEFI capsules through oems for TB4.