** Patch Theory: PCI Bus Enumeration in Ventura with Thunderbolt and WiFi Enabled **
Click here for the patch itself
This post explains how the problem was investigated, leading to development of the patch. Thanks to
@mariettosun for showing us that on-board Thunderbolt conflicted with on-board WiFi. This told us that on-board Thunderbolt could in fact work in Ventura. Comparing PCI debug logs between Monterey and Ventura revealed that Ventura was not discovering and enumerating devices properly on the PCI bus. Based on experience gained from the earlier and much lengthier investigation of PCI Zombies, initial suspicion fell on the
IOPCIConfigurator class, which is part of the
IOPCIFamily kext. PCI bus discovery and enumeration is handled almost entirely by
IOPCIConfigurator.
Fortunately, Apple has open-sourced the entire code for
IOPCIFamily, and Apple continues to post regular updates as new versions of macOS are released. It was then a relatively straightforward task to compare
IOPCIConfigurator.cpp between Monterey and Ventura. This was done using the free
Meld application, which can be installed via Home-brew (
https://brew.sh). A screenshot of the comparison is shown here:
On the
far right side of the window we get a glimpse of all of the differences between the two files. These are marked in Blue and Red boxes on the right side. Fortunately there aren't too many changes. Most of the changes involve functions that extend the discovery of
PCIExpressCapabilities. But there is one small change shown in the big green/red box that involves a second method of discovering whether a PCI bridge supports native hot plug capability. This second method does not exist in earlier versions of macOS, so it's not a necessary addition.
Because Thunderbolt supports hot plug, I suspected that this change might be the source of the problem. It was just a hunch, but it seemed plausible given that all other differences between the source files seemed unrelated to the problem at hand. The next step was to extract the IOPCIFamily executable, which is not present in
/System/Library/Extensions
. In Ventura, Apple has removed nearly all kext executable files that would normally appear in the kext's
MacOS folder. Fortunately there's still a way to access those files. We do this by installing the Kernel Debug Kit (KDK) for Ventura 13.2 (release version) so that kexts inside the KDK are release-mode builds (
reference). Next we create a temporary snapshot of the system (
livemount) and
ditto the KDK
System folder into the livemount
System folder. This is much easier done than said!
And now we have full access to all
MacOS folders inside each kext. This allows us to open
IOPCIFamily in a disassembler, which in my case is the
Hopper app. It is now straightforward to locate the assembly code for the green/red section. I modified the assembly code to jump over the
if (type == KPCIStatic) block and return from the function early.
So the patch makes this change:
And this is sufficient to bypass the problem.