Contribute
Register

Z490 & Z590 - Will Z590 ever have macOS Support ?

Ah, unfortunately Maple Ridge does not have its own Flash ROM firmware chip! We can use Linux to extract the firmware, but we won't be able to modify it with an SPI Flash ROM reader/writer.
Some questions !
Where thunderbolt firmware is stored ? Motherboard BIOS and loaded with EFI Tbt driver ? GC Maple Ridge doesn’t have any NVM component ?
 
Some questions !
Where thunderbolt firmware is stored ? Motherboard BIOS and loaded with EFI Tbt driver ? GC Maple Ridge doesn’t have any NVM component ?
  • There is a discrete JHL8540 Thunderbolt chip, but we haven't conclusively determined if the firmware is on an accessible flash ROM chip.
  • We tried this:
  • ... but the owner of that board was unable to read the nearby 8-pin flash ROM.
  • Maybe someone adventurous can give it a try?
Windbond Chip Close_1-2.png
 
Hi @CaseySJ @Leesureone @buddyjack2 @dehjomz

I have been seeing all work done on Maple Ridge for Z590 and It seem that NHI driver can't be loaded as this device doesn't have an allowed PID.

We could try patching info.plist of ApplethunderboltNHI.kext to match with VID 0x8086 & PID 0x1137.

View attachment 530678

On this file, we can see that matching is done on IOPCIClass & IOPCI.

As IOPCIClass is same as previous thunderbolt device (Alpine-Ridge & Titan-Ridge), we don't have to change this one.
For IOPCI, Apple driver match with every PID beginning with 0x8A (like Ice Lake Thunderbolt NHI with 0x8A17 PID).

We can try patching this one from 0x8A008086&0xff00ffff to 0x11008086&0xff00ffff (first part is a concatenated PID/VID and second part (after &) is the mask, green zeros on the mask mean that we can have any characters).

On OC config.plist > Kernel > Patch :

Identifier: com.apple.driver.AppleThunderboltNHI
Comment: MapleRidge Patch (Experimentation)
Find: 38413030 38303836
Replace: 31313030 38303836
Enabled: checked

Maple Ridge is discrete USB4 (pid 0x1137, class code 0x0C0340). Apple hasn't made a discrete USB4 driver yet.

M1 Mac is integrated USB4 (name acio) (AppleThunderboltNHIType5). Compiled for Apple Silicon only.

Ice Lake is integrated Thunderbolt (pid 0x8A**, class code 0x088000) (AppleThunderboltNHIType4). Compiled for Intel only.

Light Peak 2010, Light Ridge 2010, Eagle Ridge 2011, Port Ridge 2011, Cactus Ridge 2012, Redwood Ridge 2013, Falcon Ridge 2013, Win Ridge 2014, Alpine Ridge 2015, 2016, Titan Ridge 2018 are discrete Thunderbolt (PID 15xx, class code 0x088000) (AppleThunderboltNHIType1, AppleThunderboltNHIType2, AppleThunderboltNHIType3). Compiled for Intel only.

It is more likely for AppleThunderboltHALType4 to work with Tiger Lake (pid 9A**, class code ?) than it is to work with Maple Ridge (unless Tiger Lake has class code 0xC0340 ?).

I am not too clear on all the differences. I know that the EFI drivers made a distinction between integrated and discrete Thunderbolt. I'm not sure about the Linux drivers.

Code:
| ++02:08.0-[03-08]  # g3x8 > g3x4   [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
| |`+03:00.0-[04-08] # g3x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | ++04:00.0-[05]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | |`-05:00.0       # g1x4          [8086:15EB] [088000] System peripheral                   : Intel Corporation JHL7540 Thunderbolt 3 NHI [Titan Ridge 4C 2018]
| | ++04:01.0-[06]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | ++04:02.0-[07]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | |`-07:00.0       # g1x4          [8086:15EC] [0C0330] USB controller (XHCI)               : Intel Corporation JHL7540 Thunderbolt 3 USB Controller [Titan Ridge 4C 2018]
| | `+04:04.0-[08]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| ++02:09.0-[09-0E]  # g3x8 > g3x4   [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
| |`+09:00.0-[0A-0E] # g3x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | ++0A:00.0-[0B]   # g1x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | |`-0B:00.0       # g1x4          [8086:1137] [0C0340] USB controller (USB4 Host Interface) : Intel Corporation Thunderbolt 4 NHI [Maple Ridge 4C 2020]
| | ++0A:01.0-[0C]   # g1x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | ++0A:02.0-[0D]   # g1x4 > g0x4   [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | |`-0D:00.0       # g1x4          [8086:1138] [0C0330] USB controller (XHCI)               : Intel Corporation Thunderbolt 4 USB Controller [Maple Ridge 4C 2020]
| | `+0A:03.0-[0E]   # g1x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| ++02:10.0-[0F]     # g3x8          [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
| |+-0F:00.0         # g3x16 > g3x8  [10DE:17C2] [030000] VGA compatible controller (VGA controller) : NVIDIA Corporation GM200 [GeForce GTX TITAN X]
| |`-0F:00.1         # g3x16 > g3x8  [10DE:0FB0] [040300] Audio device                        : NVIDIA Corporation GM200 High Definition Audio
| `+02:11.0-[10]     # g3x8 > g3x4   [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
|  `+10:00.0-[00]    # g3x4          [FFFF:FFFF] [060400] PCI bridge (Normal decode)          : Illegal Vendor ID Device
|   ++24:00.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
|   |`-25:00.0       # g1x4          [8086:1577] [088000] System peripheral                   : Intel Corporation DSL6540 Thunderbolt 3 NHI [Alpine Ridge 4C 2015]
|   ++24:01.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
|   ++24:02.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
|   |`-25:00.0       # g1x4          [8086:15B6] [0C0330] USB controller (XHCI)               : Intel Corporation DSL6540 USB 3.1 Controller [Alpine Ridge]
|   `+24:04.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
 

  • There is a discrete JHL8540 Thunderbolt chip, but we haven't conclusively determined if the firmware is on an accessible flash ROM chip.
  • We tried this:
  • ... but the owner of that board was unable to read the nearby 8-pin flash ROM.
  • Maybe someone adventurous can give it a try?
View attachment 530830
 

Attachments

  • TB4org.zip
    1.7 MB · Views: 68
I read this layout, but since thunderbolt didn't even have a hot-plug under Windows, I dropped the topic. Maybe it's time to come back to him.
I didn't upload your modified ROM, but I'll try to do it this week.
 
Maple Ridge is discrete USB4 (pid 0x1137, class code 0x0C0340). Apple hasn't made a discrete USB4 driver yet.

M1 Mac is integrated USB4 (name acio) (AppleThunderboltNHIType5). Compiled for Apple Silicon only.

Ice Lake is integrated Thunderbolt (pid 0x8A**, class code 0x088000) (AppleThunderboltNHIType4). Compiled for Intel only.

Light Peak 2010, Light Ridge 2010, Eagle Ridge 2011, Port Ridge 2011, Cactus Ridge 2012, Redwood Ridge 2013, Falcon Ridge 2013, Win Ridge 2014, Alpine Ridge 2015, 2016, Titan Ridge 2018 are discrete Thunderbolt (PID 15xx, class code 0x088000) (AppleThunderboltNHIType1, AppleThunderboltNHIType2, AppleThunderboltNHIType3). Compiled for Intel only.

It is more likely for AppleThunderboltHALType4 to work with Tiger Lake (pid 9A**, class code ?) than it is to work with Maple Ridge (unless Tiger Lake has class code 0xC0340 ?).

I am not too clear on all the differences. I know that the EFI drivers made a distinction between integrated and discrete Thunderbolt. I'm not sure about the Linux drivers.

Code:
| ++02:08.0-[03-08]  # g3x8 > g3x4   [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
| |`+03:00.0-[04-08] # g3x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | ++04:00.0-[05]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | |`-05:00.0       # g1x4          [8086:15EB] [088000] System peripheral                   : Intel Corporation JHL7540 Thunderbolt 3 NHI [Titan Ridge 4C 2018]
| | ++04:01.0-[06]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | ++04:02.0-[07]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| | |`-07:00.0       # g1x4          [8086:15EC] [0C0330] USB controller (XHCI)               : Intel Corporation JHL7540 Thunderbolt 3 USB Controller [Titan Ridge 4C 2018]
| | `+04:04.0-[08]   # g1x4          [8086:15EA] [060400] PCI bridge (Normal decode)          : Intel Corporation JHL7540 Thunderbolt 3 Bridge [Titan Ridge 4C 2018]
| ++02:09.0-[09-0E]  # g3x8 > g3x4   [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
| |`+09:00.0-[0A-0E] # g3x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | ++0A:00.0-[0B]   # g1x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | |`-0B:00.0       # g1x4          [8086:1137] [0C0340] USB controller (USB4 Host Interface) : Intel Corporation Thunderbolt 4 NHI [Maple Ridge 4C 2020]
| | ++0A:01.0-[0C]   # g1x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | ++0A:02.0-[0D]   # g1x4 > g0x4   [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| | |`-0D:00.0       # g1x4          [8086:1138] [0C0330] USB controller (XHCI)               : Intel Corporation Thunderbolt 4 USB Controller [Maple Ridge 4C 2020]
| | `+0A:03.0-[0E]   # g1x4          [8086:1136] [060400] PCI bridge (Normal decode)          : Intel Corporation Thunderbolt 4 Bridge [Maple Ridge 4C 2020]
| ++02:10.0-[0F]     # g3x8          [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
| |+-0F:00.0         # g3x16 > g3x8  [10DE:17C2] [030000] VGA compatible controller (VGA controller) : NVIDIA Corporation GM200 [GeForce GTX TITAN X]
| |`-0F:00.1         # g3x16 > g3x8  [10DE:0FB0] [040300] Audio device                        : NVIDIA Corporation GM200 High Definition Audio
| `+02:11.0-[10]     # g3x8 > g3x4   [10B5:8747] [060400] PCI bridge (Normal decode)          : PLX Technology, Inc. PEX 8747 48-Lane, 5-Port PCI Express Gen 3 (8.0 GT/s) Switch
|  `+10:00.0-[00]    # g3x4          [FFFF:FFFF] [060400] PCI bridge (Normal decode)          : Illegal Vendor ID Device
|   ++24:00.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
|   |`-25:00.0       # g1x4          [8086:1577] [088000] System peripheral                   : Intel Corporation DSL6540 Thunderbolt 3 NHI [Alpine Ridge 4C 2015]
|   ++24:01.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
|   ++24:02.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
|   |`-25:00.0       # g1x4          [8086:15B6] [0C0330] USB controller (XHCI)               : Intel Corporation DSL6540 USB 3.1 Controller [Alpine Ridge]
|   `+24:04.0-[00]   # g1x4          [8086:1578] [060400] PCI bridge (Normal decode)          : Intel Corporation DSL6540 Thunderbolt 3 Bridge [Alpine Ridge 4C 2015]
Partially agree with you,
when you say "M1 Mac is integrated USB4 (name acio) (AppleThunderboltNHIType5). Compiled for Apple Silicon only."

Inside AppleThunderboltNHI.kext, we can find only one binary file that include AppleThunderboltHALType5, AppleThunderboltHALType4 and all previous release named as AppleThunderboltHAL. That probably mean we have one "Universal" driver. This can eventually be confirmed by driver details on System Information / Extensions

Capture d’écran 2021-10-14 à 09.41.31.png

Capture d’écran 2021-10-14 à 09.49.44.png


One other information to add: When we compare, inside BIOS files from MacBookPro16,2 (including Ice Lake variant of thunderbolt 4 3 device with TDM0, TRPx subdevices) and iMac19,1 (including a Titan Ridge thunderbolt 3 device with NHI, UPSB, DSBx) we have the same EFI thunderbolt drivers (same size, same checksum). this include ThunderboltNhi, ThunderboltXDomain and PciThunderbolt.

Capture d’écran 2021-10-14 à 09.37.38.png
 
Last edited:
On this comparison table of the different Thunderbolt versions, found here, we have Intel VT-d only used on Thunderbolt 4 features for security. So we should consider enabling AppleVTD on Maple Ridge experimentations.
 
With device-id 8A17, no dice: I wonder if there's code in the kext itself that probes the thunderbolt chip itself to decide whether or not to load and attach.
Probably. There are three drivers listed in the info.plist:
  • AppleThunderboltHAL (for NHI types 1,2,3 Thunderbolt 1,2,3 discrete controllers)
  • AppleThunderboltHALType4 (for NHI type 4 Ice Lake Thunderbolt 3 integrated controller)
  • AppleThunderboltHALType5 (for NHI type 5 Apple Silicon USB4/Thunderbolt integrated controller)

Those are sub classes of a common parent class (use ioreg -iw0 ):
  • AppleThunderboltGenericHAL:AppleThunderboltIntelPCIHAL:AppleThunderboltHAL
  • AppleThunderboltGenericHAL:AppleThunderboltHALType4
  • AppleThunderboltGenericHAL:AppleThunderboltHALType5

Those classes create a child device for the NHI driver:
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType1
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType2
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType3
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType4
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIType5

And there's a child of those:
  • IOThunderboltController (Thunderbolt 1,2,3 discrete controllers)
  • IOThunderboltController:IOThunderboltControllerType5 (Apple Silicon USB4/Thunderbolt integrated controller)

Instead of trying to squeeze one of those HAL's onto Maple Ridge, I think it would be better to make a sub class of those three drivers for Maple Ridge and then customize:
  • AppleThunderboltGenericHAL:???:AppleThunderboltHALTypeHackUSB4
  • IOThunderboltNHI:AppleThunderboltNHI:???:AppleThunderboltNHITypeHackUSB4
  • IOThunderboltController:???:IOThunderboltControllerHackUSB4
You have to decide what the parent ??? class should be. In your current tests, it would be the Type4 classes. It should be a simple task to get the vtables (I have a Hopper script to generate those). And the constructors will tell you how big the class is so your sub class can reserve enough space for that.

Other things to include (NHIType5 has its own subclass of these so NHITypeHackUSB4 will probably also need a subclass - these are for probably for Thunderbolt IP and Thunderbolt Target Disk Mode and Thunderbolt Target Display Mode):
  • AppleThunderboltNHITransmitRingManager
  • AppleThunderboltNHITransmitRing
  • AppleThunderboltNHIReceiveRingManager
  • AppleThunderboltNHIReceiveRing

Other kexts may have classes that need a sub class.
  • AppleThunderbolttDPInAdapter (has a type 5 variant)
  • AppleThunderbolttDPOutAdapter (has a type 5 variant)
  • AppleThunderboltPCIDownAdapter (has a type 5 variant)
  • IOThunderboltConnectionManager (has a type 5 variant)
  • IOThunderboltSwitch (has variants for type 1,2,3,4,5)

In any case, TypeHackUSB4 can't use any of the Type5 classes as a parent since those are compiled only for Apple Silicon.


My laptop has an onboard Alpine Ridge, and it seem that NHI driver drive both Alpine/Titan and other ARM M1 variant. With Maple Ridge, we hope that configuration registers are same as previous thunderbolt device like Titan ridge.
Probably Maple Ridge has registers based on USB4 spec since the class code 0x0c0340 is from USB4 spec. You can read the USB4 spec. There's a document Alpine-Ridge_DP_1.03.pdf with all the discrete Thunderbolt registers (at least up to Alpine Ridge). Linux and UEFI drivers will list some of the registers.
https://github.com/tianocore/edk2-platforms
https://github.com/torvalds/linux/tree/master/drivers/thunderbolt

Partially agree with you,
when you say "M1 Mac is integrated USB4 (name acio) (AppleThunderboltNHIType5). Compiled for Apple Silicon only."

Inside AppleThunderboltNHI.kext, we can find only one binary file that include AppleThunderboltHALType5, AppleThunderboltHALType4 and all previous release named as AppleThunderboltHAL. That probably mean we have one "Universal" driver. This can eventually be confirmed by driver details on System Information / Extensions

View attachment 530846
View attachment 530847
The AppleThunderboltNHI binary is a fat binary containing an x86 and an ARM image. Use the file command to get a list of architectures that the binary contains.

The Hopper Disassembler lets you choose what architecture to disassemble. The ARM image only includes code for Type5 (plus the base classes of course). The x86 image does not include Type5.

You can also see the same thing with the strings -arch arm64e and strings -arch x86_64 commands.

One other information to add: When we compare, inside BIOS files from MacBookPro16,2 (including Ice Lake variant of thunderbolt 4 3 device with TDM0, TRPx subdevices) and iMac19,1 (including a Titan Ridge thunderbolt 3 device with NHI, UPSB, DSBx) we have the same EFI thunderbolt drivers (same size, same checksum). this include ThunderboltNhi, ThunderboltXDomain and PciThunderbolt.

View attachment 530849
So the EFI driver shares a lot of code like the kext drivers. But it doesn't mean the EFI driver or the kext driver covers the Maple Ridge case.

In the EFI driver, you can do stuff like this:
Code:
integrated = (productID == IceLake).
if (integrated) {
    do integrated stuff with integrated registers.
} else {
    do discrete stuff with discrete registers.
}

In the kext driver, to handle the differences in the controllers, sub classes are used to override a base class.

In the case of Maple Ridge, other changes probably need to be added:
Code:
if (integrated thunderbolt) {
    do integrated stuff with integrated registers.
} else if (discrete thunderbolt) {
    do discrete stuff with discrete registers.
} else if (usb4) {
    do usb4 stuff with usb4 registers.
}

You can see some integrated and discrete Thunderbolt UEFI code at https://github.com/tianocore/edk2-platforms . I haven't seen USB4 UEFI code yet.

For checking UEFI, I would run the attached do_all.nsh script in the UEFI Shell to get all the drivers and devices and handles. It should show how the Maple Ridge is handled.
Code:
fs0:
mkdir do_all_test1
cd do_all_test1
..\do_all.nsh


  • There is a discrete JHL8540 Thunderbolt chip, but we haven't conclusively determined if the firmware is on an accessible flash ROM chip.
  • We tried this:
  • ... but the owner of that board was unable to read the nearby 8-pin flash ROM.
  • Maybe someone adventurous can give it a try?
View attachment 530830
This rom was discussed back in #146
I believe it's a full rom but it's larger than it should be. Is that the size of the rom chip or does the rom reader just assume the size?

@vipermachine got his ROM from linux but it did not get the entire thing. I believe a newer linux kernel will read the Maple Ridge ROM properly now. I attached mine (note Linux doesn't include the 16K header of the ROM which determines if the active or inactive part is used - Linux only includes the part that you ask for - active in my case).

Code:
0x01) UID: 0x80871F7645FDBC00
0x0d) Version: 1 // TBT3
0x10) TBT3-Vendor ID: 0x31
0x12) TBT3-Device ID: 0x5013
0x14) TBT3-Model Revision: 0x1
0x15) TBT3-NVM Revision: 24
0x16)   1: 800280000000
0x1e)   2: 900180000000
0x26)   3: 800480010000
0x2e)   4: 900380010000
0x36)   5: 000000 // DP  { Preferred Lane Adapter:0, Preference Valid:0 }
0x3b)   6: 500000
0x40) - 7:
0x42)   8: 200100640000000000
0x4d)   9: 80 // TBT3-PCIe Downstream Adapter  xx:04.0
0x50)   A: 500000
0x55)   B: 500000
0x5a)   1: "ASUS" // ASCII Vendor Name
0x61)   2: "THUNDERBOLTEX 4" // ASCII Model Name
0x73)   9: 10044310f68724240000000001 // Product Descriptor  { USB Spec:4.1.0, Vendor ID:0x1043, Product ID:0x87f6, Product FW Revision:24.2.4, TID:0x00000000, Product HW Revision:1 }
0x82) End
 

Attachments

  • ASUSThunderboltEX4.bin.zip
    218.6 KB · Views: 51
  • joevt_EFI_do_all_script.zip
    411.5 KB · Views: 49
Probably. There are three drivers listed in the info.plist:
  • AppleThunderboltHAL (for NHI types 1,2,3 Thunderbolt 1,2,3 discrete controllers)
  • AppleThunderboltHALType4 (for NHI type 4 Ice Lake Thunderbolt 3 integrated controller)
  • AppleThunderboltHALType5 (for NHI type 5 Apple Silicon USB4/Thunderbolt integrated controller)

Those are sub classes of a common parent class (use ioreg -iw0 ):
  • AppleThunderboltGenericHAL:AppleThunderboltIntelPCIHAL:AppleThunderboltHAL
  • AppleThunderboltGenericHAL:AppleThunderboltHALType4
  • AppleThunderboltGenericHAL:AppleThunderboltHALType5

Those classes create a child device for the NHI driver:
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType1
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType2
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType3
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIIntelPCI:AppleThunderboltNHIType4
  • IOThunderboltNHI:AppleThunderboltNHI:AppleThunderboltNHIType5

And there's a child of those:
  • IOThunderboltController (Thunderbolt 1,2,3 discrete controllers)
  • IOThunderboltController:IOThunderboltControllerType5 (Apple Silicon USB4/Thunderbolt integrated controller)

Instead of trying to squeeze one of those HAL's onto Maple Ridge, I think it would be better to make a sub class of those three drivers for Maple Ridge and then customize:
  • AppleThunderboltGenericHAL:???:AppleThunderboltHALTypeHackUSB4
  • IOThunderboltNHI:AppleThunderboltNHI:???:AppleThunderboltNHITypeHackUSB4
  • IOThunderboltController:???:IOThunderboltControllerHackUSB4
You have to decide what the parent ??? class should be. In your current tests, it would be the Type4 classes. It should be a simple task to get the vtables (I have a Hopper script to generate those). And the constructors will tell you how big the class is so your sub class can reserve enough space for that.

Other things to include (NHIType5 has its own subclass of these so NHITypeHackUSB4 will probably also need a subclass - these are for probably for Thunderbolt IP and Thunderbolt Target Disk Mode and Thunderbolt Target Display Mode):
  • AppleThunderboltNHITransmitRingManager
  • AppleThunderboltNHITransmitRing
  • AppleThunderboltNHIReceiveRingManager
  • AppleThunderboltNHIReceiveRing

Other kexts may have classes that need a sub class.
  • AppleThunderbolttDPInAdapter (has a type 5 variant)
  • AppleThunderbolttDPOutAdapter (has a type 5 variant)
  • AppleThunderboltPCIDownAdapter (has a type 5 variant)
  • IOThunderboltConnectionManager (has a type 5 variant)
  • IOThunderboltSwitch (has variants for type 1,2,3,4,5)

In any case, TypeHackUSB4 can't use any of the Type5 classes as a parent since those are compiled only for Apple Silicon.



Probably Maple Ridge has registers based on USB4 spec since the class code 0x0c0340 is from USB4 spec. You can read the USB4 spec. There's a document Alpine-Ridge_DP_1.03.pdf with all the discrete Thunderbolt registers (at least up to Alpine Ridge). Linux and UEFI drivers will list some of the registers.
https://github.com/tianocore/edk2-platforms
https://github.com/torvalds/linux/tree/master/drivers/thunderbolt


The AppleThunderboltNHI binary is a fat binary containing an x86 and an ARM image. Use the file command to get a list of architectures that the binary contains.

The Hopper Disassembler lets you choose what architecture to disassemble. The ARM image only includes code for Type5 (plus the base classes of course). The x86 image does not include Type5.

You can also see the same thing with the strings -arch arm64e and strings -arch x86_64 commands.


So the EFI driver shares a lot of code like the kext drivers. But it doesn't mean the EFI driver or the kext driver covers the Maple Ridge case.

In the EFI driver, you can do stuff like this:
Code:
integrated = (productID == IceLake).
if (integrated) {
    do integrated stuff with integrated registers.
} else {
    do discrete stuff with discrete registers.
}

In the kext driver, to handle the differences in the controllers, sub classes are used to override a base class.

In the case of Maple Ridge, other changes probably need to be added:
Code:
if (integrated thunderbolt) {
    do integrated stuff with integrated registers.
} else if (discrete thunderbolt) {
    do discrete stuff with discrete registers.
} else if (usb4) {
    do usb4 stuff with usb4 registers.
}

You can see some integrated and discrete Thunderbolt UEFI code at https://github.com/tianocore/edk2-platforms . I haven't seen USB4 UEFI code yet.

For checking UEFI, I would run the attached do_all.nsh script in the UEFI Shell to get all the drivers and devices and handles. It should show how the Maple Ridge is handled.
Code:
fs0:
mkdir do_all_test1
cd do_all_test1
..\do_all.nsh


This rom was discussed back in #146
I believe it's a full rom but it's larger than it should be. Is that the size of the rom chip or does the rom reader just assume the size?

@vipermachine got his ROM from linux but it did not get the entire thing. I believe a newer linux kernel will read the Maple Ridge ROM properly now. I attached mine (note Linux doesn't include the 16K header of the ROM which determines if the active or inactive part is used - Linux only includes the part that you ask for - active in my case).

Code:
0x01) UID: 0x80871F7645FDBC00
0x0d) Version: 1 // TBT3
0x10) TBT3-Vendor ID: 0x31
0x12) TBT3-Device ID: 0x5013
0x14) TBT3-Model Revision: 0x1
0x15) TBT3-NVM Revision: 24
0x16)   1: 800280000000
0x1e)   2: 900180000000
0x26)   3: 800480010000
0x2e)   4: 900380010000
0x36)   5: 000000 // DP  { Preferred Lane Adapter:0, Preference Valid:0 }
0x3b)   6: 500000
0x40) - 7:
0x42)   8: 200100640000000000
0x4d)   9: 80 // TBT3-PCIe Downstream Adapter  xx:04.0
0x50)   A: 500000
0x55)   B: 500000
0x5a)   1: "ASUS" // ASCII Vendor Name
0x61)   2: "THUNDERBOLTEX 4" // ASCII Model Name
0x73)   9: 10044310f68724240000000001 // Product Descriptor  { USB Spec:4.1.0, Vendor ID:0x1043, Product ID:0x87f6, Product FW Revision:24.2.4, TID:0x00000000, Product HW Revision:1 }
0x82) End
I like your relevant information.

Moreover, about Thunderbolt 4 Linux driver patching for Maple Ridge here, we can see the following interesting information from Mika Westerberg:

"Maple Ridge is first discrete USB4 host controller from Intel. It comes
with firmware based connection manager and the flows are similar as used
in Intel Titan Ridge
.
"
 
Back
Top