# Thunderbolt 1 Into deep. Notes, Boardviews etc.



## bigguygeo (Dec 2, 2021)

Everything begin a year ago. Few of thunderbolt dongles failed because of cable damage. Influence of time. Okay easy to buy a new, that is cheap. Okay i did it, but decided to look inside and maybe repair for fun. So Disassembly was pretty hard, but successful. one of wires was partially frayed i have cut that wires to resolder them back. It was hard, wires are shielded 36 or 32 AWG. So a year i decided to come back to project and rebuild Thunderbolt dongle to cheap pci expansion for x1 pcie cards like USB 3.0 hub or soundcard.



*The first files:*
Apple Thunderbolt Ethernet - SPI Eeprom flash - 4096 bytes - 32 b.bin
HPM-em-00020007.bin
iMac-21.4-22-01.bin
iMac-27-22-01.bin
MBP-22-01.bin
ThorUtil.efi

from two dongles - spi roms.zip with two firmwares for comparison

*Problem:
Thunderbolt require patching to make dsl2210 to work as root or switch*



>








>


----------



## bigguygeo (Dec 3, 2021)

If disconnect clockrequest, wake, nc dongle still working fine at S0 state hotplug only test


Also if connect 3.3v dp power and 3.3v power_en Drain then there is no reason to use “G” wire - Power_Enable.

So only important wires are:
3.3v dp power
1.05v dsl2210 power
Gnd

Pci rx, tx, refclk, pairs and Reset PERST#


----------



## bigguygeo (Dec 3, 2021)

Next steps:
1. Find Broadcom option rom for 1 and 2 ics. It seems like that ic is clean and requires oprom from dsl spi flash.
2. Capture traffic signals at uart (thunderbolt connector. Jtag signals from cortex processor that goes to dsl2210
3. Analyze spi rom data, offsets, possibly whitelist


----------



## bigguygeo (Dec 3, 2021)

Yeah that Broadcom require Option ROM


----------



## bigguygeo (Dec 3, 2021)




----------



## bigguygeo (Dec 3, 2021)

At least I do have a cheap cool Ethernet pcb for joy

Pins are okay.

Important to solder TXD on Apple Ethernet pcb to RXD pcie pin to make it work


----------



## bigguygeo (Dec 3, 2021)

> ****** INPUT ********
> 
> 
> FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1370F816060200010048314D98016E0001000380010508810000602A00000B820001400A00000000000E014170706C652C20496E632E002A025468756E646572626F6C7420746F20476967616269742045746865726E65742041646170746572001A3044544E363236373030343444574B48424D000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
> ...


----------



## bigguygeo (Dec 4, 2021)

Logic Analyzing

The only problem: I don’t know how to decode uart data. What the speed and bits


----------



## bigguygeo (Dec 5, 2021)

*DECODING SIGNALS

TX Data*
*FE050690110A020260185753D8958C4F030000F5C1EDFE40FE05030460F2FE40FE050A01A6A1FE40FE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFEA15EFEA05FFE817EFE807FFE817EFE827DFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05FFEA15EFEA05F*

*RX Data*
*FE040690008D15FE40FE0403044150502086C6FE40FE040A011F614EFE40FE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE807FFE817EFE827D*


*I2C Data*


> name    ack    address    read    data
> I2C
> I2C    true    0x15    false
> I2C    true            0x0F
> ...






The last signal to analyze is SPI from ARM to DSL2210


----------



## bigguygeo (Dec 5, 2021)

How to dump cortex firmware? The cortex schematic show that it has internal flash rom


----------



## 4ts9v (Dec 5, 2021)

bigguygeo said:


> How to dump cortex firmware? The cortex schematic show that it has internal flash rom


I'm not certain at this moment but this is a very cool/neat project!

I'd love to help and this gives me ideas for some things we might work on together...

Do you have some Instant Messenger or something? PM me (I'm new) and I'll add you. I would happily fund/help out if it would expedite things for the current internal flash read... Actually I think I know how we can do that.


----------



## bigguygeo (Dec 7, 2021)

interesting info:





						eeprom.c source code [linux/drivers/thunderbolt/eeprom.c] - Codebrowser
					






					code.woboq.org
				




never tested under linux, and that is interesting environment for research


----------



## bigguygeo (Dec 8, 2021)

New soldering iron arrives and I continued research, and what I do know now:


Spi interface from arm to dsl2210 is quite, none data signals at any power states.





Also I soldered dsl pcie wires to pcie slot female, insert there working Ethernet (second part of dongle) which was soldered to pcie male and nothing happened. I check everything few times and electrically it should work but actually not.





I measured voltages of pcie lanes and seems Ethernet ic is not responding. Okay that means that ic trx wont transmit. 





Okay I connected that to pc pcie and everything is working. Solder dsl wires directly to Ethernet ic (second part of dongle) and all working again.





So I solder dsl2210 pcie wires directly to pcie male and it still won’t work.





Why Apple engineers used covered wires ( with gnd isolated)?





Maybe signals from dsl2210 have no filters and they are dirty enough to be unrecognizable by Ethernet ic. 





Hate those tiny wires soldering...








The next step: connect dsl2210 pcie wires to additional same wires to see if pcie signals will work correctly.





Anyway that dsl2210 isn’t good for creating of something like pcie adapter. Even if I will cut half of the oem wire it could not work...


----------



## bigguygeo (Dec 8, 2021)

Actually there is no data or clock at spi:


Then how this two ics are communicating?


----------



## bigguygeo (Dec 9, 2021)

That’s how it should be



Tried long cable ( two wires covered by ground. Results: no initialization


Directly connected to pcie card. Result: no initialization but ic stars because of pcireset

So that’s the long wire or whitelist



Low light but LED affects

I will try to cut wire for 60%. If that’s not work, then that’s whitelist. For solving that need FireWire firmware to unlock proper device id


----------



## bigguygeo (Dec 9, 2021)

other firmware apple updates 1.2 from apple


----------



## bigguygeo (Dec 12, 2021)

Spi captured data  70% of data is important to boot. 30% data is ... maybe for os recognazion (cosmetics)





> FFFFFF
> 
> ========================================================================================
> ========BOOTLOADER:
> ...


----------



## bigguygeo (Dec 13, 2021)

some new. cant map code to decompiler



> ============================================================================
> ============================================================================
> *************** HEX DATA OF ROM (WHOLE)
> ============================================================================
> ...


----------



## bigguygeo (Dec 16, 2021)

_Ethernet_ArmCode.bin
_Ethernet_Bootloader.bin
_Ethernet_PcieINIT.bin
_Ethernet_ThunderboltFirmware.bin



In that parts, disassemblers can open code


----------



## bigguygeo (Aug 31, 2022)

Interesting Card


			https://h20195.www2.hp.com/v2/getpdf.aspx/4AA7-6445ENW.pdf


----------

