/* * Apple SMC controller * * Copyright (c) 2007 Alexander Graf * * Authors: Alexander Graf * Susanne Graf * * This library is free software; you can redistribute it and/or * modify it under the terms of the GNU Lesser General Public * License as published by the Free Software Foundation; either * version 2.1 of the License, or (at your option) any later version. * * This library is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public * License along with this library; if not, see . * * ***************************************************************** * * In all Intel-based Apple hardware there is an SMC chip to control the * backlight, fans and several other generic device parameters. It also * contains the magic keys used to dongle Mac OS X to the device. * * This driver was mostly created by looking at the Linux AppleSMC driver * implementation and does not support IRQ. * */ #include "qemu/osdep.h" #include "hw/isa/isa.h" #include "hw/qdev-properties.h" #include "ui/console.h" #include "qemu/module.h" #include "qemu/timer.h" #include "qom/object.h" #if defined(__APPLE__) && defined(__MACH__) #include enum { kSMCSuccess = 0x00, kSMCKeyNotFound = 0x84 }; enum { kSMCUserClientOpen = 0x00, kSMCUserClientClose = 0x01, kSMCHandleYPCEvent = 0x02, kSMCReadKey = 0x05, kSMCGetKeyInfo = 0x09 }; typedef struct SMCVersion { uint8_t major; uint8_t minor; uint8_t build; uint8_t reserved; uint16_t release; } SMCVersion; typedef struct SMCPLimitData { uint16_t version; uint16_t length; uint32_t cpuPLimit; uint32_t gpuPLimit; uint32_t memPLimit; } SMCPLimitData; typedef struct SMCKeyInfoData { IOByteCount dataSize; uint32_t dataType; uint8_t dataAttributes; } SMCKeyInfoData; typedef struct { uint32_t key; SMCVersion vers; SMCPLimitData pLimitData; SMCKeyInfoData keyInfo; uint8_t result; uint8_t status; uint8_t data8; uint32_t data32; uint8_t bytes[32]; } SMCParamStruct; static IOReturn smc_call_struct_method(uint32_t selector, SMCParamStruct *inputStruct, SMCParamStruct *outputStruct) { IOReturn ret; size_t inputStructCnt = sizeof(SMCParamStruct); size_t outputStructCnt = sizeof(SMCParamStruct); io_service_t smcService = IO_OBJECT_NULL; io_connect_t smcConnect = IO_OBJECT_NULL; smcService = IOServiceGetMatchingService(kIOMasterPortDefault, IOServiceMatching("AppleSMC")); if (smcService == IO_OBJECT_NULL) { ret = kIOReturnNotFound; goto exit; } ret = IOServiceOpen(smcService, mach_task_self(), 1, &smcConnect); if (ret != kIOReturnSuccess) { smcConnect = IO_OBJECT_NULL; goto exit; } if (smcConnect == IO_OBJECT_NULL) { ret = kIOReturnError; goto exit; } ret = IOConnectCallMethod(smcConnect, kSMCUserClientOpen, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL); if (ret != kIOReturnSuccess) { goto exit; } ret = IOConnectCallStructMethod(smcConnect, selector, inputStruct, inputStructCnt, outputStruct, &outputStructCnt); exit: if (smcConnect != IO_OBJECT_NULL) { IOConnectCallMethod(smcConnect, kSMCUserClientClose, NULL, 0, NULL, 0, NULL, NULL, NULL, NULL); IOServiceClose(smcConnect); } return ret; } static IOReturn smc_read_key(uint32_t key, uint8_t *bytes, IOByteCount *dataSize) { IOReturn ret; SMCParamStruct inputStruct; SMCParamStruct outputStruct; if (key == 0 || bytes == NULL) { ret = kIOReturnCannotWire; goto exit; } /* determine key's data size */ memset(&inputStruct, 0, sizeof(SMCParamStruct)); inputStruct.data8 = kSMCGetKeyInfo; inputStruct.key = key; memset(&outputStruct, 0, sizeof(SMCParamStruct)); ret = smc_call_struct_method(kSMCHandleYPCEvent, &inputStruct, &outputStruct); if (ret != kIOReturnSuccess) { goto exit; } if (outputStruct.result == kSMCKeyNotFound) { ret = kIOReturnNotFound; goto exit; } if (outputStruct.result != kSMCSuccess) { ret = kIOReturnInternalError; goto exit; } /* get key value */ memset(&inputStruct, 0, sizeof(SMCParamStruct)); inputStruct.data8 = kSMCReadKey; inputStruct.key = key; inputStruct.keyInfo.dataSize = outputStruct.keyInfo.dataSize; memset(&outputStruct, 0, sizeof(SMCParamStruct)); ret = smc_call_struct_method(kSMCHandleYPCEvent, &inputStruct, &outputStruct); if (ret != kIOReturnSuccess) { goto exit; } if (outputStruct.result == kSMCKeyNotFound) { ret = kIOReturnNotFound; goto exit; } if (outputStruct.result != kSMCSuccess) { ret = kIOReturnInternalError; goto exit; } memset(bytes, 0, *dataSize); if (*dataSize > inputStruct.keyInfo.dataSize) { *dataSize = inputStruct.keyInfo.dataSize; } memcpy(bytes, outputStruct.bytes, *dataSize); exit: return ret; } #endif /* #define DEBUG_SMC */ #define APPLESMC_DEFAULT_IOBASE 0x300 enum { APPLESMC_DATA_PORT = 0x00, APPLESMC_CMD_PORT = 0x04, APPLESMC_ERR_PORT = 0x1e, APPLESMC_NUM_PORTS = 0x20, }; enum { APPLESMC_READ_CMD = 0x10, APPLESMC_WRITE_CMD = 0x11, APPLESMC_GET_KEY_BY_INDEX_CMD = 0x12, APPLESMC_GET_KEY_TYPE_CMD = 0x13, }; enum { APPLESMC_ST_CMD_DONE = 0x00, APPLESMC_ST_DATA_READY = 0x01, APPLESMC_ST_BUSY = 0x02, APPLESMC_ST_ACK = 0x04, APPLESMC_ST_NEW_CMD = 0x08, }; enum { APPLESMC_ST_1E_CMD_INTRUPTED = 0x80, APPLESMC_ST_1E_STILL_BAD_CMD = 0x81, APPLESMC_ST_1E_BAD_CMD = 0x82, APPLESMC_ST_1E_NOEXIST = 0x84, APPLESMC_ST_1E_WRITEONLY = 0x85, APPLESMC_ST_1E_READONLY = 0x86, APPLESMC_ST_1E_BAD_INDEX = 0xb8, }; #ifdef DEBUG_SMC #define smc_debug(...) fprintf(stderr, "AppleSMC: " __VA_ARGS__) #else #define smc_debug(...) do { } while (0) #endif static char default_osk[64] = "This is a dummy key. Enter the real key " "using the -osk parameter"; struct AppleSMCData { uint8_t len; const char *key; const char *data; QLIST_ENTRY(AppleSMCData) node; }; OBJECT_DECLARE_SIMPLE_TYPE(AppleSMCState, APPLE_SMC) struct AppleSMCState { ISADevice parent_obj; MemoryRegion io_data; MemoryRegion io_cmd; MemoryRegion io_err; uint32_t iobase; uint8_t cmd; uint8_t status; uint8_t status_1e; uint8_t last_ret; char key[4]; uint8_t read_pos; uint8_t data_len; uint8_t data_pos; uint8_t data[255]; char *osk; QLIST_HEAD(, AppleSMCData) data_def; }; static void applesmc_io_cmd_write(void *opaque, hwaddr addr, uint64_t val, unsigned size) { AppleSMCState *s = opaque; uint8_t status = s->status & 0x0f; smc_debug("CMD received: 0x%02x\n", (uint8_t)val); switch (val) { case APPLESMC_READ_CMD: /* did last command run through OK? */ if (status == APPLESMC_ST_CMD_DONE || status == APPLESMC_ST_NEW_CMD) { s->cmd = val; s->status = APPLESMC_ST_NEW_CMD | APPLESMC_ST_ACK; } else { smc_debug("ERROR: previous command interrupted!\n"); s->status = APPLESMC_ST_NEW_CMD; s->status_1e = APPLESMC_ST_1E_CMD_INTRUPTED; } break; default: smc_debug("UNEXPECTED CMD 0x%02x\n", (uint8_t)val); s->status = APPLESMC_ST_NEW_CMD; s->status_1e = APPLESMC_ST_1E_BAD_CMD; } s->read_pos = 0; s->data_pos = 0; } static struct AppleSMCData *applesmc_find_key(AppleSMCState *s) { struct AppleSMCData *d; QLIST_FOREACH(d, &s->data_def, node) { if (!memcmp(d->key, s->key, 4)) { return d; } } return NULL; } static void applesmc_io_data_write(void *opaque, hwaddr addr, uint64_t val, unsigned size) { AppleSMCState *s = opaque; struct AppleSMCData *d; smc_debug("DATA received: 0x%02x\n", (uint8_t)val); switch (s->cmd) { case APPLESMC_READ_CMD: if ((s->status & 0x0f) == APPLESMC_ST_CMD_DONE) { break; } if (s->read_pos < 4) { s->key[s->read_pos] = val; s->status = APPLESMC_ST_ACK; } else if (s->read_pos == 4) { d = applesmc_find_key(s); if (d != NULL) { memcpy(s->data, d->data, d->len); s->data_len = d->len; s->data_pos = 0; s->status = APPLESMC_ST_ACK | APPLESMC_ST_DATA_READY; s->status_1e = APPLESMC_ST_CMD_DONE; /* clear on valid key */ } else { smc_debug("READ_CMD: key '%c%c%c%c' not found!\n", s->key[0], s->key[1], s->key[2], s->key[3]); s->status = APPLESMC_ST_CMD_DONE; s->status_1e = APPLESMC_ST_1E_NOEXIST; } } s->read_pos++; break; default: s->status = APPLESMC_ST_CMD_DONE; s->status_1e = APPLESMC_ST_1E_STILL_BAD_CMD; } } static void applesmc_io_err_write(void *opaque, hwaddr addr, uint64_t val, unsigned size) { smc_debug("ERR_CODE received: 0x%02x, ignoring!\n", (uint8_t)val); /* NOTE: writing to the error port not supported! */ } static uint64_t applesmc_io_data_read(void *opaque, hwaddr addr, unsigned size) { AppleSMCState *s = opaque; switch (s->cmd) { case APPLESMC_READ_CMD: if (!(s->status & APPLESMC_ST_DATA_READY)) { break; } if (s->data_pos < s->data_len) { s->last_ret = s->data[s->data_pos]; smc_debug("READ '%c%c%c%c'[%d] = %02x\n", s->key[0], s->key[1], s->key[2], s->key[3], s->data_pos, s->last_ret); s->data_pos++; if (s->data_pos == s->data_len) { s->status = APPLESMC_ST_CMD_DONE; smc_debug("READ '%c%c%c%c' Len=%d complete!\n", s->key[0], s->key[1], s->key[2], s->key[3], s->data_len); } else { s->status = APPLESMC_ST_ACK | APPLESMC_ST_DATA_READY; } } break; default: s->status = APPLESMC_ST_CMD_DONE; s->status_1e = APPLESMC_ST_1E_STILL_BAD_CMD; } smc_debug("DATA sent: 0x%02x\n", s->last_ret); return s->last_ret; } static uint64_t applesmc_io_cmd_read(void *opaque, hwaddr addr, unsigned size) { AppleSMCState *s = opaque; smc_debug("CMD sent: 0x%02x\n", s->status); return s->status; } static uint64_t applesmc_io_err_read(void *opaque, hwaddr addr, unsigned size) { AppleSMCState *s = opaque; /* NOTE: read does not clear the 1e status */ smc_debug("ERR_CODE sent: 0x%02x\n", s->status_1e); return s->status_1e; } static void applesmc_add_key(AppleSMCState *s, const char *key, int len, const char *data) { struct AppleSMCData *def; def = g_malloc0(sizeof(struct AppleSMCData)); def->key = key; def->len = len; def->data = data; QLIST_INSERT_HEAD(&s->data_def, def, node); } static void qdev_applesmc_isa_reset(DeviceState *dev) { AppleSMCState *s = APPLE_SMC(dev); struct AppleSMCData *d, *next; /* Remove existing entries */ QLIST_FOREACH_SAFE(d, &s->data_def, node, next) { QLIST_REMOVE(d, node); } s->status = 0x00; s->status_1e = 0x00; s->last_ret = 0x00; applesmc_add_key(s, "REV ", 6, "\x01\x13\x0f\x00\x00\x03"); applesmc_add_key(s, "OSK0", 32, s->osk); applesmc_add_key(s, "OSK1", 32, s->osk + 32); applesmc_add_key(s, "NATJ", 1, "\0"); applesmc_add_key(s, "MSSP", 1, "\0"); applesmc_add_key(s, "MSSD", 1, "\0x3"); } static const MemoryRegionOps applesmc_data_io_ops = { .write = applesmc_io_data_write, .read = applesmc_io_data_read, .endianness = DEVICE_NATIVE_ENDIAN, .impl = { .min_access_size = 1, .max_access_size = 1, }, }; static const MemoryRegionOps applesmc_cmd_io_ops = { .write = applesmc_io_cmd_write, .read = applesmc_io_cmd_read, .endianness = DEVICE_NATIVE_ENDIAN, .impl = { .min_access_size = 1, .max_access_size = 1, }, }; static const MemoryRegionOps applesmc_err_io_ops = { .write = applesmc_io_err_write, .read = applesmc_io_err_read, .endianness = DEVICE_NATIVE_ENDIAN, .impl = { .min_access_size = 1, .max_access_size = 1, }, }; static void applesmc_isa_realize(DeviceState *dev, Error **errp) { AppleSMCState *s = APPLE_SMC(dev); bool valid_key = false; memory_region_init_io(&s->io_data, OBJECT(s), &applesmc_data_io_ops, s, "applesmc-data", 1); isa_register_ioport(&s->parent_obj, &s->io_data, s->iobase + APPLESMC_DATA_PORT); memory_region_init_io(&s->io_cmd, OBJECT(s), &applesmc_cmd_io_ops, s, "applesmc-cmd", 1); isa_register_ioport(&s->parent_obj, &s->io_cmd, s->iobase + APPLESMC_CMD_PORT); memory_region_init_io(&s->io_err, OBJECT(s), &applesmc_err_io_ops, s, "applesmc-err", 1); isa_register_ioport(&s->parent_obj, &s->io_err, s->iobase + APPLESMC_ERR_PORT); if (s->osk) { valid_key = strlen(s->osk) == 64; } else { #if defined(__APPLE__) && defined(__MACH__) IOReturn ret; IOByteCount size = 32; ret = smc_read_key('OSK0', (uint8_t *) default_osk, &size); if (ret != kIOReturnSuccess) { goto failure; } ret = smc_read_key('OSK1', (uint8_t *) default_osk + size, &size); if (ret != kIOReturnSuccess) { goto failure; } warn_report("Using AppleSMC with host key"); valid_key = true; s->osk = default_osk; failure:; #endif } if (!valid_key) { warn_report("Using AppleSMC with invalid key"); s->osk = default_osk; } QLIST_INIT(&s->data_def); qdev_applesmc_isa_reset(dev); } static Property applesmc_isa_properties[] = { DEFINE_PROP_UINT32(APPLESMC_PROP_IO_BASE, AppleSMCState, iobase, APPLESMC_DEFAULT_IOBASE), DEFINE_PROP_STRING("osk", AppleSMCState, osk), DEFINE_PROP_END_OF_LIST(), }; static void qdev_applesmc_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); dc->realize = applesmc_isa_realize; dc->reset = qdev_applesmc_isa_reset; device_class_set_props(dc, applesmc_isa_properties); set_bit(DEVICE_CATEGORY_MISC, dc->categories); } static const TypeInfo applesmc_isa_info = { .name = TYPE_APPLE_SMC, .parent = TYPE_ISA_DEVICE, .instance_size = sizeof(AppleSMCState), .class_init = qdev_applesmc_class_init, }; static void applesmc_register_types(void) { type_register_static(&applesmc_isa_info); } type_init(applesmc_register_types)