** Quick Comparative Analysis of Thunderbolt DROM and Thunderbolt Config **
When a real Mac contains more than one Thunderbolt controller, it provides an opportunity to compare ThunderboltDROM and ThunderboltConfig in a manner that facilities some amount of deciphering. In other words, comparative analysis can reveal the meaning of some of the bytes. The more Thunderbolt controllers a Mac has, the better our ability to draw conclusions.
How fortunate then that the 2019 Mac Pro 7,1 contains
six Thunderbolt controllers. Yes
six of the darn things! Thanks to
@S1lla we are given an opportunity to study the differences.
This is a quick summary of some immediate observations:
- The six controllers in MacPro 7,1 are located at PC04.MCP0.US00. They are sub-nodes under this path, as follows:
- DS09.UPSB
- DS0A.UPSB
- DS0D.UPSB
- DS0E.UPSB
- DS15.UPSB
- DS16.UPSB
- Each controller supports two USB-2 ports (HS01, HS02) and two USB-3 ports (SSP1, SSP2).
- Each controller drives all 4 ports by itself. In other words, these controllers are not using so-called companion ports that are controlled by a different XHC (USB) controller.
Our Current Best Understanding of Thunderbolt DROM
In an earlier post,
@Elias64Fr decoded the native Designare Z390 DROM as follows:
- 71 -- CRC (cyclic redundancy check)
- 00 00 00 00 00 00 ED 00 -- UID SwitchType3: ED000000000000
- E0 -- CRC
- 40 34 98 01 69 00 ED 00 -- To be defined
- 08 C0 01 01 -- To be defined
- 08 81 80 02 80 00 0000 -- TBPort1 DualLinkport2 HPMAddr0
- 08 82 90 01 80 00 0000 -- TBPort2 DualLinkport1 HPMAddr0
- 08 83 80 04 80 01 0000 -- TBPort3 DualLinkport4 HPMAddr1
- 08 84 90 03 80 01 0000 -- TBPort4 DualLinkport3 HPMAddr1
- 05 85 50 00 00 -- TBPort5 DisplayPort Adapter
- 05 86 50 00 00 -- TBPort6 DisplayPort Adapter
- 02 C7 -- TBSwitch7
- 0B 88 20 01 00 64 00 00 00 00 00 -- TBPort8 PCI Down Adapter DSB1
- 03 89 80 -- TBPort9 PCI Down Adapter DSB4
- 05 8A 50 40 00 -- TBPortA DisplayPort Adapter
- 05 8B 50 40 00 -- TBPortB DisplayPort Adapter
- 0B 01 47 49 47 41 42 59 54 45 00 -- The string "GIGABYTE"
- 11 02 5A 33 39 30 20 44 45 53 49 47 4E 41 52 45 00 -- The string "Z390 DESIGNARE"
As we can see, we have only a partial understanding. Let's first compare the first 10 bytes (UID SwitchType3) of each of the six Mac Pro controllers:
- 03 02 11 22 33 44 55 00 00 2d
- 10 03 11 22 33 44 55 00 00 1f
- 25 00 11 22 33 44 55 00 00 15
- 36 01 11 22 33 44 55 00 00 7b
- 69 04 11 22 33 44 55 00 00 3d
- 7a 05 11 22 33 44 55 00 00 53
If the first and last bytes are
CRC (cyclic redundancy check -- or simply the checksum) then we can focus on the inner 8 bytes. The CRC is very important because we will be unable to modify DROM ourselves unless we know how to calculate CRC.
- 02 11 22 33 44 55 00 00
- 03 11 22 33 44 55 00 00
- 00 11 22 33 44 55 00 00
- 01 11 22 33 44 55 00 00
- 04 11 22 33 44 55 00 00
- 05 11 22 33 44 55 00 00
Here we see something interesting in the first column of bytes. They are IDs from 00 to 05, which we might interpret as the
Thunderbolt Bus ID. The next 5 bytes are a 5-byte UID that we believe is unique to each computer (not each controller).
In the interest of privacy, the UID numbers above
have been modified. They are not the actual values from
@S1lla's system.
When we patch our
GC-Titan Ridge using DSM2's firmware and use the Thunderbolt DROM he provides, we find that
System Information --> Thunderbolt assigns the card to
Bus ID 0x02. Now if we look at the DSM2 DROM and skip the first CRC byte (the very first byte), then we see this:
This seems to confirm that this represents the Thunderbolt Bus ID.
Our Current Best Understanding of Thunderbolt Config
We know almost nothing about Thunderbolt Config, except for the last 4 bytes, which we believe are the USB-C Port Numbers. After looking at the six sample Thunderbolt Config files from Mac Pro 7,1 we find some interesting observations:
- 02 03 02 00 0a 00 05 01 01 00 01 00 05 01 02 00 06 00 05 01 01 00 01 00 03 01 02 00 06 00 05 00
- 03 03 03 00 09 00 05 01 01 00 00 00 05 01 02 00 04 00 05 01 01 00 00 00 03 01 02 00 08 00 07 00
- 00 03 00 00 0b 00 05 01 01 00 02 00 05 01 02 00 07 00 05 01 01 00 02 00 03 01 02 00 02 00 01 00
- 01 03 01 00 0b 00 05 01 01 00 02 00 05 01 02 00 07 00 05 01 01 00 03 00 03 01 02 00 04 00 03 00
- 04 03 04 00 0c 00 05 01 01 00 03 00 05 01 02 00 08 00 05 01 01 00 04 00 03 01 02 00 0a 00 09 00
- 05 03 05 00 0c 00 05 01 01 00 03 00 05 01 02 00 08 00 05 01 01 00 05 00 03 01 02 00 0c 00 0b 00
Does that first column look familiar?
It represents the
Thunderbolt Bus ID. Even though column 3 in this case is the same as column 1, this is not always the case. Other Thunderbolt Config strings have different values in columns 1 and 3.
Now look at those last 4 bytes, where two bytes are in green. They seem to be
USB-C Port Numbers because IORegistryExplorer shows the following:
- Controller 02 has USB-C Port Numbers 03 and 04
- Controller 03 has USB-C Port Numbers 02 and 01
- Controller 00 has USB-C Port Numbers 09 and 0A
- Controller 01 has USB-C Port Numbers 0B and 0C
- Controller 04 has USB-C Port Numbers 05 and 06
- Controller 05 has USB-C Port Numbers 07 and 08
Although these values are the same as those in Thunderbolt Config, they belong to
different Thunderbolt controllers/buses. Maybe this doesn't really matter as long as each USB-C port number is assigned to a controller.
If we look at a real
iMac 19,1 the first few bytes of Thunderbolt DROM are as follows (UID values have been replaced for privacy):
- 19 00 11 22 33 44 55 01 00 26
If we strip away the CRC bytes (19 and 26) we get:
So the Thunderbolt Bus ID or Controller ID is 00 (column 1). Now let's look at Thunderbolt Config:
- 00 02 1c 00 02 00 05 03 01 00 04 00 05 03 02 00 03 00 05 03 01 00 00 00 03 03 02 00 01 00 02 00
Here we see that Thunderbolt Config is for Controller or Bus ID 0 and the last 4 bytes show USB-C port numbers 01 and 02. If we examine IORegistryExplorer, we see that:
- SSP1 = USB-C Port 02
- SSP2 = USB-C Port 01
So we can be reasonably confident that the last 4 bytes of Thunderbolt Config represent the USB-C port numbers. Can you find or guess the meaning of the other Thunderbolt Config values?
Next 12 Bytes of Thunderbolt DROM
We examined the first 10 bytes of Thunderbolt DROM above. Now we turn to the next 12 bytes because they're marked "To be defined".
- ea 01 bd 01 58 00 01 00 10 00 01 00
- 88 4d e2 01 58 00 01 00 12 00 01 00
- 6e 56 27 01 58 00 01 00 15 00 01 00
- 4c d5 5c 01 58 00 01 00 16 00 01 00
- e4 1d 7c 01 58 00 01 00 15 00 01 00
- c6 9e 07 01 58 00 01 00 16 00 01 00
The values in red and blue are of course identical, but the values in black vary. The meanings of these bytes remain elusive. Any guesses?