I decided to purchase the CalDigit Element Hub instead of the OWC Thunderbolt 4 hub because CalDigit has additional type A ports, and because the OWC product page is still pre-order. My tests are at https://forums.macrumors.com/thread...ts-and-four-usb-a-ports.2283180/post-29718129
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
OWC's Upcoming Thunderbolt Hub Adds More Thunderbolt 3 Ports to Your Mac
- Thread starter MacRumors
- Start date
- Sort by reaction score
Possible a dongle that supports DisplayLink may work?
Really? I'm not using the right searches I suppose. All I've found is the Caldigit Element 4 TB2 hub. It also offers two additional USB ports. That clocks at $180 and only from Caldigit until May or later. Could you share some brands that you've found? I really need something before May and wouldn't mind spending less so I can buy more crap.
Thanks!
Last edited:
So I installed the 11.3 beta8 yesterday and it seems all of my OWC Hub problems have been fixed (with M1 Macbook Air).. Now I can boot with USB-C - DP display connected without display staying black, monitor is not turning off after wake, haven't experienced "unclickable" menu bar after wake anymore, 60hz does not switch to 30hz, usb-a port does not selectively disconnect devices after waje... 
Looking forward to the final release!
Looking forward to the final release!Apologies for resurrecting this thread. But I have an OWC Thunderbolt Dock and noticed that none of my USB-C NVMe drives connect with UASP (i.e., ioreg shows no indication of IOUSBMassStorageUASDriver when the drives are connected via the dock). So their performance is degraded substantially compared to when they are directly connected to one of the ports on my M1 Mac. I'd like to know if other Thunderbolt docks have the same issue or if this is specific to the OWC dock. Thanks in advance for any help.
Which OWC Thunderbolt Dock? What port?
What USB controller is the USB-C NVMe connected to?
On the M1 Mac, did you connect to Thunderbolt port or USB port? Is it an M1 Mac mini, or M1 iMac, or different M1 Mac?
Maybe the OWC Thunderbolt Dock is the Thunderbolt 4 version, in that case it may use USB tunnelling which would use the USB controller of the M1 Mac instead of the USB controller of the dock. But you say UASP works from the M1 Mac so that shouldn't be a problem - unless you have an M1 iMac, in which case the USB ports do not use the USB controller of the M1 chip (but the Thunderbolt ports do). But maybe the M1 chip supports UASP so something else is going on.
I have a Mac mini 2018 and UASP works from it's Titan Ridge controller and also the Titan Ridge controller of an HP Thunderbolt Dock G2 and the Alpine Ridge of a OWC Thunderbolt 3 Dock and a FL1100 of the same dock and a ASM1142 controller installed in my Mac Pro 2008.
It's the M1 MacBook Pro, so I'm connected through a Thunderbolt/USB4 port. The dock in question is the 2021 "OWC Thunderbolt Dock" (the Thunderbolt 4 Dock). And to round out the info, the drives I'm connecting use the ASMedia 2364 and ASMedia 1351 chipsets.
This is exactly the kind of info I was looking for. Thanks so much. So this is not generalized behavior for macOS and Thunderbolt docks. Other docks work with UASP, even the older OWC Thunderbolt 3 Dock. Very interesting, I wonder if I can expect this to be fixed with an update to Big Sur (or maybe I'll have to wait for Monterey).
Can you verify the upstream USB controller that the USB-NVMe drive is connected to?
Do you have any other Thunderbolt devices (dock, display, ...) you can connect the USB-NVMe drive to?
My USB NVMe drives use JMicron JMS583 and ASMedia ASM2364. I still need to try connecting the ASM2364 to a ASM3242 controller to get 20 Gbps. I don't think macOS supports 20 Gbps so I'll need to try the GenericUSBXHCI.kext (might need to be updated for Catalina/Big Sur/M1 and modified so it doesn't interfere with other XHCI Gen 2x1 controllers).
In terms of the upstream USB controller, I believe that it's using an AppleT8103USBXHCI. The NVMe drive seems to be connected to the OWC Thunderbolt Dock at 10 Gbps through an Intel USB3.0 Hub if I use a Thunderbolt/USB-C port. That caught my eye as being a bit strange. I thought USB3.0 was limited to 5 Gbps. If I plug it into a USB-A port in the dock, then it is connected at 10 Gbps through an OWC USB3.1 Hub which connects to that root Intel USB3.0 Hub.
Unfortunately this is the only Thunderbolt device that I have which would be able to connect the drive.
For others who may stumble on this with respect to the ASM2364, just beware that it does not connect at 20 Gbps speeds (USB3.2 2x2) to M1 Macs. The USB4 ports do not implement the optional USB3.2 2x2 20 Gbps protocol. So it drops down to USB3.1 Gen 2 10 Gbps.
AppleT8103USBXHCI means USB tunnelling is being used, which bypasses the USB controller of the Thunderbolt 4 dock. The Thunderbolt 4 dock has the Intel hub (ignore the name - it's just a string of ASCII characters) connected via USB tunnelling over Thunderbolt. The Intel hub probably handles the three downstream Thunderbolt ports directly. A second 10 Gbps hub (with the OWC identifier) is used to add 4 more USB 10 Gbps ports (probably the three type A ports), then there's probably a 3rd hub for the rest (audio, SD card, USB 2.0, Ethernet). Is the last hub a USB 3.0 hub or a USB 2.0 hub? A USB 3.x hub consists of both a USB 3.x hub and a USB 2.0 hub. SD 4.0 requires at least USB 3.0.
So if the M1 Mac is using the AppleT8103USBXHCI and the Thunderbolt dock is using the same AppleT8103USBXHCI, then why is UASP only working in the former case? Can you post the results of this command for each case?
ioreg iw0 > ioreg_usbtest1.txtor this command which includes PCIe and USB info
Code:
ioreg -filw0 | perl -0777 -pE '
s/^(([ |]+)\+-o .* <class .*(IOPCIDevice|AppleUSBHostController|IOUSBDevice|AppleUSBHostPort|IOUSBInterface).*), id 0x.*$/$1/mg;
s/^(([ |]*)\+-o .* <class .*), id 0x.*\n(\2[ |]{3} +)(?>\{\n)(.*\n)*?\3\}\n\3\n/$1\n/mg;
s/[|]/ /g;
s/^ +("IOGeneralInterest" ?= ?)("[^"]+"|\d+)\n//mg;
s/^ +\+-o (RootDomainUserClient|IOThunderboltFamilyUserClient|AppleHPMUserClient|AGXDeviceUserClient|AppleCredentialManagerUserClient|IOSurfaceRootUserClient) .*\n//mg;
s/("(kUSBAddress|USB Address|kPowerStateSleep|kPowerStateOn|kPowerStateSleep|kPortStatConnectCount|kPowerStateSuspended|kPowerStateOn|kPowerStateOff|kControllerStatIOCount|bAlternateSetting|bNumEndpoints|kPortStatEnumerationFailureCount|ChildrenPowerState|CurrentPowerState|CapabilityFlags|kPortStatRemoteWakeCount|link-error-count|Thunderbolt Entry ID|sessionID|DevicePowerState)" ?= ?)("[^"]+"|\d+)/\1/g;
' \
> ioreg.txtNeed to learn how UASP works and what limits it has. Does it not work with some USB hubs? The reply in the following thread says hubs shouldn't affect it.
https://support.plugable.com/t/usb-3-0-hub-with-uasp-support/6491
but that leads to https://forums.macrumors.com/threads/usb-3-hub-with-uasp-support.1726547/post-19009219 which points to an article that says some hubs may affect it.
http://fortysomethinggeek.blogspot.com/2013/04/osx-mountain-lion-108-uas-uasp-usb.html
I did tests with CalDigit Element Hub (a Thunderbolt 4 hub with two hubs similar to the OWC Thunderbolt dock except the second hub has CalDigit identifier instead of OWC identifier - of course the first hub is still Intel USB3.0 Hub) and a CalDigit SOHO dock. Both supported UASP.
Last edited:
The ethernet and SD-card slot is connected to the USB3.1 hub (which itself is connected to the USB3.0 hub). There is also a USB 2.0 hub which seems to only be used by the single front USB-A port.
I've attached a zip with two files. It's worth noting that this was originally happening on Big Sur. However, I updated to Monterey public beta to see if anything would change. It hasn't. It's the same situation under Monterey, although I have reported this in Feedback Assistant to Apple.
I've modified the perl script in my previous post to remove some info from the ioreg output to make the resulting files easier to compare.
Comparing the files I see a couple things:
The "ASM236X series" device
- bInterfaceClass is 8 (08h = Mass Storage)
- bInterfaceSubClass is 6 (06h = SCSI transparent command set)
- in the Thunderbolt dock case, bInterfaceProtocol is 80 (50h - USB Mass Storage Class Bulk-Only (BBB) Transport) and the driver is IOUSBMassStorageDriver.
- in the M1 case, bInterfaceProtocol is 98 (62h - Allocated by USB-IF for UAS. UAS is defined outside of USB) and the driver is IOUSBMassStorageUASDriver.
- in the Thunderbolt dock case, has a flag "UsbStreamsSupported" set to No.
Looking for "UsbStreamsSupported", the hub in the Thunderbolt dock case (the Intel hub named "USB3.0 Hub") has the same flag. The hub has vendor:device 8087:0B40, same as the one in the CalDigit Element Hub (I guess the hub is part of the Goshen Ridge chip), but my CalDigit Element Hub's Intel hub doesn't have the "UsbStreamsSupported" = No flag (connected to Mac mini 2018).
Wikipedia https://en.wikipedia.org/wiki/Extensible_Host_Controller_Interface says stream support was added to the USB 3.0 SuperSpeed specification
wikipedia https://en.wikipedia.org/wiki/USB_Attached_SCSI says streams is required for UASP.
Even though streams is part of USB 3.0, my USB 2.0 port (Mac Pro 2008, Catalina) still uses SCSI for the SIIG's ASM2364. This USB 2.0 support is mentioned in that wikipedia article. The wikipedia article also mentions hub support for UASP is required for device support. Looking more closely, while my USB 2.0 port uses SCSI transparent command set, that does not mean it supports UASP - they are not the same thing. So in my USB 2.0 case, the IOUSBMassStorageDriver is used instead of IOUSBMassStorageUASDriver. The difference is subtle. I redid my hub tests looking for if the IOUSBMassStorageUASDriver is used for each:
- Titan Ridge controller Mac mini 2018 - yes (mounts)
- Chipset XHCI controller of Mac mini 2018 - yes (mounts)
- hub of XV273K display - yes (mounts side top port but not side bottom port - maybe a power issue?)
- CalDigit SOHO - yes (no mount) (note: SD card reader is not UASP - the IOUSBMassStorageDriver always loads for the SD card reader even if no SD card is inserted)
- Titan Ridge controller HP Thunderbolt Dock G2 - yes (mounts)
- Alpine Ridge of a OWC Thunderbolt 3 Dock - yes (mounts)
- FL1100 of a OWC Thunderbolt 3 Dock - yes (no mount port 1 - the high powered one, mounts port 2, 3, 4)
- FL1100 of a OWC Thunderbolt 2 Dock - yes (mounts)
- ASM1142 controller installed in my Mac Pro 2008 - yes (mounts)
For my SIIG ASM2364, while the driver always loads, the disk does not always mount.
I guess we need to find out why the "UsbStreamsSupported" = No flag is set in your situation. Maybe the problem is with USB tunnelling from the M1 Mac? If you don't have a Thunderbolt 3 device with two Thunderbolt ports to block USB tunnelling, then do you have an Intel Mac to test the OWC Thunderbolt 4 Dock with?
Regarding the hub layout, from the ioreg output, I see the following:
Code:
Thunderbolt connection:
USB2.0 Hub (1d5c:5801) "Fresco Logic, Inc."
1 - .
2 - unnamed hub (0451:8142)
1 - .
2 - E30, Topping DFU (152a:8750) "Topping"
3 - .
4 - USB Controls (043e:9a39) "LG Electronics Inc."
3 - .
4 - USB 2.0 Hub (1e91:de47) "Other World Computing"
1 - .
2 - .
3 - Gaming Mouse G502 (046d:c332) "Logitech"
4 - .
5 - .
6 - YubiKey OTP+FIDO+CCID (1050:0407) "Yubico"
7 - .
8 - Thunderbolt Dock billboard (1e91:de44) "Other World Computing"
USB3.0 Hub (8087:0b40) "Intel Corporation." ("UsbStreamsSupported" = No)
1 - ASM236X series (174c:2364) "Asmedia" ("UsbStreamsSupported" = No)
2 - .
3 - USB 10/100/1G/2.5G LAN (0bda:8156) "Realtek" ("UsbStreamsSupported" = No)
4 - USB 3.1 Hub (1e91:de48) "Other World Computing" ("UsbStreamsSupported" = No)
1 - Logitech BRIO (046d:085e) "Logitech" ("UsbStreamsSupported" = No)
2 - ASM1351 (174c:1153) "ASMT" ("UsbStreamsSupported" = No)
3 - .
4 - .
5 - USB 10/100/1000 LAN (0bda:8153) "Realtek" ("UsbStreamsSupported" = No)I see all the devices under the USB3.0 Hub have the "UsbStreamsSupported" = No flag. I wonder if disconnecting all of the other devices has any effect on the ASM236x device?
Unfortunately, I don't have a TB3 device with two ports. I do have an old eGPU case that has its own USB ports and an internal USB-SATA connection. It will work with the M1 Mac without a GPU connected to it. Also, I have some USB-C to USB-A 3.0 SuperSpeed adapters. So I could use the following connection scenario: M1 Mac -> OWC Thunderbolt Dock -> eGPU -> USB devices. I seem to recall though, that with the eGPU connected to an Intel Mac, the internal USB-SATA connection worked with UASP although any devices hanging off its hub would not work with UASP. But my memory isn't 100% on that. Let me know if you want me to investigate.
I have also reached out to a friend who may has the same OWC dock but may have access to both Intel and M1 Macs to help troubleshoot. But their availability may be limited in the next while.
joevt, this is really fascinating and I really appreciate your help! I wonder if this might help at least partially explain why a lot of YouTubers report poor external drive performance with M1 Macs vs Intel Macs. Although in their case, they're also seeing this issue with a pure Thunderbolt 3/4 configuration.
EDIT/UPDATE: I forgot to mention that I tried disconnecting all USB devices from the OWC dock, then plugging it into my Mac to see if it would make a difference for UASP. It did not. However, the OWC dock has a built-in ethernet port and SD-Card reader that would effectively still be connected in that scenario. I know the CalDigit does not have these extra connectors. That could explain the difference.
I have also reached out to a friend who may has the same OWC dock but may have access to both Intel and M1 Macs to help troubleshoot. But their availability may be limited in the next while.
joevt, this is really fascinating and I really appreciate your help! I wonder if this might help at least partially explain why a lot of YouTubers report poor external drive performance with M1 Macs vs Intel Macs. Although in their case, they're also seeing this issue with a pure Thunderbolt 3/4 configuration.
EDIT/UPDATE: I forgot to mention that I tried disconnecting all USB devices from the OWC dock, then plugging it into my Mac to see if it would make a difference for UASP. It did not. However, the OWC dock has a built-in ethernet port and SD-Card reader that would effectively still be connected in that scenario. I know the CalDigit does not have these extra connectors. That could explain the difference.
Last edited:
Actually, I just decided to investigate with that eGPU connection scenario above and there are some even more peculiar findings.
First, note that the eGPU itself has an internal ASMedia 2115 chipset. But it's not connected to anything at the moment. I hung my ASMedia 2346 NVMe drive off one of the USB-A 3.0 ports on the eGPU after connecting it to a TB4 port on the OWC dock. And sure enough, UASP was enabled. However, here's the strange part. Write speeds were terrible. Black Magic Disk Speed Test reports less than 10 MB/s on writes (that's not a typo) and a little over 300 MB/s on reads. Keep in mind it is connected at 5 Gbps due to USB 3.0 on the eGPU not 10 Gbps with the newer USB 3.1 Gen 2 ports on the OWC.
Second, I decided to connect the eGPU straight to my Mac (with the configuration otherwise remaining the same and the OWC dock connected to the 2nd TB4 port). I was expecting performance to improve at least. But no, still single digit or at best 10 MB/s write speeds and read speeds in the 300 MB/s range.
Finally, I unplugged both the OWC dock and eGPU, then only connected the eGPU. Still the same performance issue with write speeds.
In this configuration, the USB 3.1 Bus for the eGPU seems to be using AppleUSBXHCIAR as the Host Controller Driver. I've attached the output of the ioreg command as well as the full output of ioreg (so you can see IOUSBMassStorageUASDriver being used) with the eGPU connected via the OWC dock and also with it connected directly to my Mac.
First, note that the eGPU itself has an internal ASMedia 2115 chipset. But it's not connected to anything at the moment. I hung my ASMedia 2346 NVMe drive off one of the USB-A 3.0 ports on the eGPU after connecting it to a TB4 port on the OWC dock. And sure enough, UASP was enabled. However, here's the strange part. Write speeds were terrible. Black Magic Disk Speed Test reports less than 10 MB/s on writes (that's not a typo) and a little over 300 MB/s on reads. Keep in mind it is connected at 5 Gbps due to USB 3.0 on the eGPU not 10 Gbps with the newer USB 3.1 Gen 2 ports on the OWC.
Second, I decided to connect the eGPU straight to my Mac (with the configuration otherwise remaining the same and the OWC dock connected to the 2nd TB4 port). I was expecting performance to improve at least. But no, still single digit or at best 10 MB/s write speeds and read speeds in the 300 MB/s range.
Finally, I unplugged both the OWC dock and eGPU, then only connected the eGPU. Still the same performance issue with write speeds.
In this configuration, the USB 3.1 Bus for the eGPU seems to be using AppleUSBXHCIAR as the Host Controller Driver. I've attached the output of the ioreg command as well as the full output of ioreg (so you can see IOUSBMassStorageUASDriver being used) with the eGPU connected via the OWC dock and also with it connected directly to my Mac.
The old eGPU should work. It uses Alpine Ridge (only the new Sonnet and Blackmagic eGPUs with two Thunderbolt ports and built-in GPU have Titan Ridge and none use Goshen Ridge). The old eGPU will probably only have USB ports from a hub connected to the Alpine Ridge (the second Thunderbolt port is not exposed - it is used for the USB hub). Definitely you should try it to see if it has UASP support. Oh, looks like you just did:
ASM2115 is a USB to SATA bridge but there's no media connected to it. I guess it works like an SD card reader - where a mass storage driver is attached even if no media is inserted.
AppleUSBXHCIAR: XHCI = USB 3.x host controller; AR = Alpine Ridge.
Your results so far:
M1 Mac -> ASM2346 UASP (no benchmark result)
M1 Mac -> TB4 dock -> ASM2346 BOT (Bulk only Transport) (no benchmark results)
M1 Mac -> TB4 dock -> eGPU -> ASM2346 UASP. 300/10 MB/s Read/Write. Which benchmark? Try AmorphousDiskMark?
M1 Mac -> eGPU -> ASM2346 UASP (no change in benchmark)
Maybe this is a problem with the ASM2346. Maybe the ASM2346 doesn't like USB 3.0. In what situations do you get normal write speeds?
What about your ASM1351?
The OWC Thunderbolt 4 dock should have support for non-Thunderbolt upstream connection. Therefore, you can test connecting the OWC Thunderbolt 4 dock's upstream Thunderbolt port to the eGPU's USB port via a USB-A to USB-C cable. Like this:
M1 Mac -> eGPU -> TB4 dock -> ASM2346
with that test, you can see if the hubs in the TB4 dock can support UASP while they are not being controlled by the M1 Mac's USB controller (since the eGPU between the M1 Mac and the TB4 dock blocks the USB tunnelling feature of USB4/TB4).
I tried my SIIG ASM2346 with this:
Intel Mac -> HP Thunderbolt Dock G2 -> OWC Thunderbolt 3 Dock -> OWC Thunderbolt 2 Dock FL1100 -> SIIG UASP 361/292 MB/s Read/Write.
Intel Mac chipset XHCI -> SIIG UASP 454/413 MB/s Read/Write.
Intel Mac Titan Ridge -> SIIG UASP 1061/1063 MB/s Read/Write.
so it means the ASM2346 can get reasonable read/writes with USB 3.0 and USB 3.1 Gen 2. I haven't tried my USB 3.2 Gen2x2 controller yet. The FL1100 is slow because it's at the end of a Thunderbolt chain, but also because it is a PCIe Gen 2 x1 controller which has less data bandwidth than USB 3.0 (even though both are 4 Gbps, PCIe 2.0 has maybe more protocol overhead).
The issue you're having with write speed might be an incompatibility with the NVMe.
I'm using a mushkin gen 4 4TB NVME. It's a bit overkill to be using PCIe Gen 4 but these newer gen 4 NVMe controller chips seem to have better behavior in Thunderbolt 3 enclosures and maybe USB enclosures.
Actually, here's a full listing of my results (in some cases I did not test unencrypted APFS, only encrypted APFS):
M1 Mac -> ASM2346 UASP (unencrypted APFS) ~925 MB/s Read/Write
M1 Mac -> ASM2346 UASP (encrypted APFS) ~800 MB/s Read/Write
M1 Mac -> TB4 dock -> ASM2346 BOT (unencrypted APFS) ~550 MB/s Read/Write
M1 Mac -> TB4 dock -> ASM2346 BOT (encrypted APFS) ~150 MB/s Read/Write
M1 Mac -> TB4 dock -> eGPU -> ASM2346 UASP (encrypted APFS) 300/10 MB/s Read/Write
M1 Mac -> eGPU -> ASM2346 UASP (encrypted APFS) 300/10 MB/s Read/Write
I get normal speeds when it is directly connected to the M1 Mac. Same situation for the ASM1351. It behaves well when directly connected to the M1 Mac. But it has a similar performance degradation -- just relative given it uses SATA SSDs or HDDs.
I will try this tomorrow and report back. I just never figured this sort of connection setup was possible, I learn something new everyday!
You haven't found a situation with normal speeds for USB 3.0 though. Maybe a USB 3.0 hub that's not part of a Thunderbolt dock?
Yup. The Thunderbolt dock won't be able to do any Thunderbolt stuff, but these new Thunderbolt 3 and Thunderbolt 4 docks with Titan Ridge and Goshen Ridge are usually mostly USB anyway (the only problem is no downstream Thunderbolt support and DisplayPort support drops from 8 lanes to 2 lanes; or no lanes if you're not connecting to a USB-C with DisplayPort Alt Mode port).
Sorry for the very lengthy delay but I can confirm the following:
1. When the OWC Thunderbolt 4 dock is connected to an Intel Mac, UASP is enabled as expected from any of my UASP-compatible USB devices that are connected via the dock. It is disabled when the OWC dock is connected to an M1 Mac. I'm speculating, but I'm not sure if UASP is supported while tunnelling USB. It seems to only work when using "native" USB.
2. When I plugged a Mantiz Venus Thunderbolt 3 eGPU enclosure (which has a built-in USB 3.0 hub) into my M1 Mac and the OWC Thunderbolt 4 dock into one of the USB ports on the Mantiz as you suggested, UASP was enabled on all of the USB devices plugged into the OWC TB4 dock. However, performance was terrible. I was getting 10 MB/s or even slower than that -- yes that's not a typo, 10 MB/s -- from UASP enabled USB drives connected this way.
Unfortunately, I don't have a TB3 device with two ports in order to connect a M1 Mac to it first, then from the TB3 device to the OWC TB4 dock.
At this point I'm contemplating "downgrading" to a TB3 dock. There have been other problems with the OWC TB4 dock including really crappy macOS driver support for the built-in ethernet.
I agree. I'm worried that Apple is doing USB tunnelling everywhere with USB4 because of worries about PCIe DMA security exploits in Thunderbolt 3 like the ones reported last year. Here's what the Linux folks have to say about this:
https://www.kernel.org/doc/html/latest/admin-guide/thunderbolt.html
Starting with Intel Falcon Ridge Thunderbolt controller there are 4 security levels available. Intel Titan Ridge added one more security level (usbonly). The reason for these is the fact that the connected devices can be DMA masters and thus read contents of the host memory without CPU and OS knowing about it. There are ways to prevent this by setting up an IOMMU but it is not always available for various reasons.
Some USB4 systems have a BIOS setting to disable PCIe tunneling. This is treated as another security level (nopcie).
The security levels are as follows:
If I were to make a guess, Apple has chosen to use the usbonly or nopcie approach with M1 Macs and Thunderbolt 4/USB4 hubs and this worries me that we'll be doomed to sub-par performance due to protocol tunnelling overhead with USB4/TB4.
I reported my findings to Apple about huge performance discrepancies when connected via my OWC TB4/USB4 dock to my M1 in Monterey. They actually responded and said everything "worked as designed". So now I'm worried that maybe I should pickup a TB3 dock before they're gone because aside from the security risk of using a PCIe tunnel, all the performance issues seem to be solved by using TB3 with M1s.
https://www.kernel.org/doc/html/latest/admin-guide/thunderbolt.html
Starting with Intel Falcon Ridge Thunderbolt controller there are 4 security levels available. Intel Titan Ridge added one more security level (usbonly). The reason for these is the fact that the connected devices can be DMA masters and thus read contents of the host memory without CPU and OS knowing about it. There are ways to prevent this by setting up an IOMMU but it is not always available for various reasons.
Some USB4 systems have a BIOS setting to disable PCIe tunneling. This is treated as another security level (nopcie).
The security levels are as follows:
If I were to make a guess, Apple has chosen to use the usbonly or nopcie approach with M1 Macs and Thunderbolt 4/USB4 hubs and this worries me that we'll be doomed to sub-par performance due to protocol tunnelling overhead with USB4/TB4.
I reported my findings to Apple about huge performance discrepancies when connected via my OWC TB4/USB4 dock to my M1 in Monterey. They actually responded and said everything "worked as designed". So now I'm worried that maybe I should pickup a TB3 dock before they're gone because aside from the security risk of using a PCIe tunnel, all the performance issues seem to be solved by using TB3 with M1s.
But Thunderbolt 3 devices work. PCIe tunnelling is still enabled. USB tunnelling just means that the USB controller of the host is being used instead of the USB controller of the Thunderbolt 4 device. Having USB tunnelling doesn't mean PCIe tunnelling doesn't work. You can disable USB tunnelling by placing a Thunderbolt 3 device between the host and the Thunderbolt 4 device.
Absolutely yes. My concern/speculation is that Apple may be implementing security scenarios in order for Thunderbolt devices to utilize PCIe. With the first Apple Silicon devices to be TB4 certified, Apple might implement an OS update with this rollout.
As a hypothetical example, every time you connect a TB4 device that requires PCIe tunnelling, you might get a prompt like you do when you connect an iPhone/iPad to a computer for the first time: "Trust this device? This device may be able to read app data while connected. If you do not trust this device, a more secure connection with limited performance will be established." If you click "Trust" you'd get PCIe tunnelling. If you click "Do not trust" you'd get USB tunnelling. This wouldn't be so terrible and it would only be inconvenient on first connection since the device's unique identifier could be cached for later connection preferences. But this doesn't seem like an Apple thing to do. One more very widespread popup dialog to confuse users, require a Genius appointment or tech support call, etc. It might even violate Intel Thunderbolt 4 certification. Not sure on that...
What if they implement a new Startup Security Utility setting in macOS Recovery? It would look like below.
Secure Thunderbolt Connections (choose one):
- (default) Full Security: Allow Certified Thunderbolt 4 devices to connect with full performance. Secure connections to other Thunderbolt 4 devices with limited performance. Restrict connections from legacy Thunderbolt devices.
So in this scenario, the dialog is never shown. Apple maintains some sort of list of certified TB4 devices for which PCIe tunnelling would be allowed. Otherwise, ,most TB4 devices connect as they do now with USB tunnelling. Older TB1/2/3 devices are not allowed to connect.
- Reduced Security: Allow connections from all Thunderbolt devices.
In this scenario, PCIe tunnelling is allowed.
Last edited:
Interesting. Thunderbolt 3 has had security options on PCs since 2016. Maybe USB tunnelling is the thing that will prompt Apple to do Thunderbolt security in macOS.
I don't think you can have a certified list of Thunderbolt 4 devices. It's too easy to modify the ROM of a Thunderbolt device to make one vendor's device look like another vendor's device.
Thunderbolt does maintain a list of user-trusted devices in it's non-volatile memory so your "Trust this device?" feature is possible (it exists in Windows and Linux). I'm not sure you can trust for USB tunnelling while not trusting for PCIe tunnelling. I suppose that would need to be implemented in macOS connection manager instead of the Thunderbolt firmware's connection manager.