Re: [Qemu-devel] [PATCH v2 2/3] applesmc: implement error status port

[Phil Dennis-Jordan]

I can confirm this solves the boot-time kernel panic on macOS 10.12.4
guests. No apparent regressions for earlier OS versions I tested,
either. Code looks sane to me. I guess the only thing is I assume this
was backed by some kind of investigation into what the real hardware
does. If that investigation is documented somewhere (FakeSMC mailing
list/forum perhaps?) then it might be worth linking to that in the
commit message, assuming that's in line with Qemu policy.

Thanks for implementing this!

Reviewed-by: Phil Dennis-Jordan <address@hidden>


On Wed, Apr 5, 2017 at 5:01 AM, Gabriel L. Somlo <address@hidden> wrote:
> As of release 10.12.4, OS X (Sierra) refuses to boot unless the
> AppleSMC supports an additional I/O port, expected to provide an
> error status code.
>
> Update the [cmd|data]_write() and data_read() methods to implement
> the required state machine, and add I/O region & methods to handle
> access to the error port.
>
> Originally proposed by Eric Shelton <address@hidden>
>
> Signed-off-by: Gabriel Somlo <address@hidden>
> ---
>  hw/misc/applesmc.c | 141 
> +++++++++++++++++++++++++++++++++++++++++++----------
>  1 file changed, 115 insertions(+), 26 deletions(-)
>
> diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
> index 6381197..0d882e8 100644
> --- a/hw/misc/applesmc.c
> +++ b/hw/misc/applesmc.c
> @@ -43,6 +43,7 @@
>  enum {
>      APPLESMC_DATA_PORT               = 0x00,
>      APPLESMC_CMD_PORT                = 0x04,
> +    APPLESMC_ERR_PORT                = 0x1e,
>      APPLESMC_NUM_PORTS               = 0x20,
>  };
>
> @@ -53,6 +54,24 @@ enum {
>      APPLESMC_GET_KEY_TYPE_CMD        = 0x13,
>  };
>
> +enum {
> +    APPLESMC_ST_CMD_DONE             = 0x00,
> +    APPLESMC_ST_DATA_READY           = 0x01,
> +    APPLESMC_ST_BUSY                 = 0x02,
> +    APPLESMC_ST_ACK                  = 0x04,
> +    APPLESMC_ST_NEW_CMD              = 0x08,
> +};
> +
> +enum {
> +    APPLESMC_ST_1E_CMD_INTRUPTED     = 0x80,
> +    APPLESMC_ST_1E_STILL_BAD_CMD     = 0x81,
> +    APPLESMC_ST_1E_BAD_CMD           = 0x82,
> +    APPLESMC_ST_1E_NOEXIST           = 0x84,
> +    APPLESMC_ST_1E_WRITEONLY         = 0x85,
> +    APPLESMC_ST_1E_READONLY          = 0x86,
> +    APPLESMC_ST_1E_BAD_INDEX         = 0xb8,
> +};
> +
>  #ifdef DEBUG_SMC
>  #define smc_debug(...) fprintf(stderr, "AppleSMC: " __VA_ARGS__)
>  #else
> @@ -77,9 +96,12 @@ struct AppleSMCState {
>
>      MemoryRegion io_data;
>      MemoryRegion io_cmd;
> +    MemoryRegion io_err;
>      uint32_t iobase;
>      uint8_t cmd;
>      uint8_t status;
> +    uint8_t status_1e;
> +    uint8_t last_ret;
>      char key[4];
>      uint8_t read_pos;
>      uint8_t data_len;
> @@ -93,89 +115,138 @@ static void applesmc_io_cmd_write(void *opaque, hwaddr 
> addr, uint64_t val,
>                                    unsigned size)
>  {
>      AppleSMCState *s = opaque;
> +    uint8_t status = s->status & 0x0f;
>
> -    smc_debug("CMD Write B: %#x = %#x\n", addr, val);
> +    smc_debug("CMD received: 0x%02x\n", (uint8_t)val);
>      switch (val) {
>      case APPLESMC_READ_CMD:
> -        s->status = 0x0c;
> +        /* did last command run through OK? */
> +        if (status == APPLESMC_ST_CMD_DONE || status == APPLESMC_ST_NEW_CMD) 
> {
> +            s->cmd = val;
> +            s->status = APPLESMC_ST_NEW_CMD | APPLESMC_ST_ACK;
> +        } else {
> +            smc_debug("ERROR: previous command interrupted!\n");
> +            s->status = APPLESMC_ST_NEW_CMD;
> +            s->status_1e = APPLESMC_ST_1E_CMD_INTRUPTED;
> +        }
>          break;
> +    default:
> +        smc_debug("UNEXPECTED CMD 0x%02x\n", (uint8_t)val);
> +        s->status = APPLESMC_ST_NEW_CMD;
> +        s->status_1e = APPLESMC_ST_1E_BAD_CMD;
>      }
> -    s->cmd = val;
>      s->read_pos = 0;
>      s->data_pos = 0;
>  }
>
> -static void applesmc_fill_data(AppleSMCState *s)
> +static struct AppleSMCData *applesmc_find_key(AppleSMCState *s)
>  {
>      struct AppleSMCData *d;
>
>      QLIST_FOREACH(d, &s->data_def, node) {
>          if (!memcmp(d->key, s->key, 4)) {
> -            smc_debug("Key matched (%s Len=%d Data=%s)\n", d->key,
> -                      d->len, d->data);
> -            memcpy(s->data, d->data, d->len);
> -            return;
> +            return d;
>          }
>      }
> +    return NULL;
>  }
>
>  static void applesmc_io_data_write(void *opaque, hwaddr addr, uint64_t val,
>                                     unsigned size)
>  {
>      AppleSMCState *s = opaque;
> +    struct AppleSMCData *d;
>
> -    smc_debug("DATA Write B: %#x = %#x\n", addr, val);
> +    smc_debug("DATA received: 0x%02x\n", (uint8_t)val);
>      switch (s->cmd) {
>      case APPLESMC_READ_CMD:
> +        if ((s->status & 0x0f) == APPLESMC_ST_CMD_DONE) {
> +            break;
> +        }
>          if (s->read_pos < 4) {
>              s->key[s->read_pos] = val;
> -            s->status = 0x04;
> +            s->status = APPLESMC_ST_ACK;
>          } else if (s->read_pos == 4) {
> -            s->data_len = val;
> -            s->status = 0x05;
> -            s->data_pos = 0;
> -            smc_debug("Key = %c%c%c%c Len = %d\n", s->key[0],
> -                      s->key[1], s->key[2], s->key[3], val);
> -            applesmc_fill_data(s);
> +            d = applesmc_find_key(s);
> +            if (d != NULL) {
> +                memcpy(s->data, d->data, d->len);
> +                s->data_len = d->len;
> +                s->data_pos = 0;
> +                s->status = APPLESMC_ST_ACK | APPLESMC_ST_DATA_READY;
> +                s->status_1e = APPLESMC_ST_CMD_DONE;  /* clear on valid key 
> */
> +            } else {
> +                smc_debug("READ_CMD: key '%c%c%c%c' not found!\n",
> +                          s->key[0], s->key[1], s->key[2], s->key[3]);
> +                s->status = APPLESMC_ST_CMD_DONE;
> +                s->status_1e = APPLESMC_ST_1E_NOEXIST;
> +            }
>          }
>          s->read_pos++;
>          break;
> +    default:
> +        s->status = APPLESMC_ST_CMD_DONE;
> +        s->status_1e = APPLESMC_ST_1E_STILL_BAD_CMD;
>      }
>  }
>
> +static void applesmc_io_err_write(void *opaque, hwaddr addr, uint64_t val,
> +                                  unsigned size)
> +{
> +    smc_debug("ERR_CODE received: 0x%02x, ignoring!\n", (uint8_t)val);
> +    /* NOTE: writing to the error port not supported! */
> +}
> +
>  static uint64_t applesmc_io_data_read(void *opaque, hwaddr addr, unsigned 
> size)
>  {
>      AppleSMCState *s = opaque;
> -    uint8_t retval = 0;
>
>      switch (s->cmd) {
>      case APPLESMC_READ_CMD:
> +        if (!(s->status & APPLESMC_ST_DATA_READY)) {
> +            break;
> +        }
>          if (s->data_pos < s->data_len) {
> -            retval = s->data[s->data_pos];
> -            smc_debug("READ_DATA[%d] = %#hhx\n", s->data_pos,
> -                      retval);
> +            s->last_ret = s->data[s->data_pos];
> +            smc_debug("READ '%c%c%c%c'[%d] = %02x\n",
> +                      s->key[0], s->key[1], s->key[2], s->key[3],
> +                      s->data_pos, s->last_ret);
>              s->data_pos++;
>              if (s->data_pos == s->data_len) {
> -                s->status = 0x00;
> -                smc_debug("EOF\n");
> +                s->status = APPLESMC_ST_CMD_DONE;
> +                smc_debug("READ '%c%c%c%c' Len=%d complete!\n",
> +                          s->key[0], s->key[1], s->key[2], s->key[3],
> +                          s->data_len);
>              } else {
> -                s->status = 0x05;
> +                s->status = APPLESMC_ST_ACK | APPLESMC_ST_DATA_READY;
>              }
>          }
> +        break;
> +    default:
> +        s->status = APPLESMC_ST_CMD_DONE;
> +        s->status_1e = APPLESMC_ST_1E_STILL_BAD_CMD;
>      }
> -    smc_debug("DATA Read b: %#x = %#x\n", addr, retval);
> +    smc_debug("DATA sent: 0x%02x\n", s->last_ret);
>
> -    return retval;
> +    return s->last_ret;
>  }
>
>  static uint64_t applesmc_io_cmd_read(void *opaque, hwaddr addr, unsigned 
> size)
>  {
>      AppleSMCState *s = opaque;
>
> -    smc_debug("CMD Read B: %#x\n", addr);
> +    smc_debug("CMD sent: 0x%02x\n", s->status);
>      return s->status;
>  }
>
> +static uint64_t applesmc_io_err_read(void *opaque, hwaddr addr, unsigned 
> size)
> +{
> +    AppleSMCState *s = opaque;
> +
> +    /* NOTE: read does not clear the 1e status */
> +    smc_debug("ERR_CODE sent: 0x%02x\n", s->status_1e);
> +    return s->status_1e;
> +}
> +
>  static void applesmc_add_key(AppleSMCState *s, const char *key,
>                               int len, const char *data)
>  {
> @@ -198,6 +269,9 @@ static void qdev_applesmc_isa_reset(DeviceState *dev)
>      QLIST_FOREACH_SAFE(d, &s->data_def, node, next) {
>          QLIST_REMOVE(d, node);
>      }
> +    s->status = 0x00;
> +    s->status_1e = 0x00;
> +    s->last_ret = 0x00;
>
>      applesmc_add_key(s, "REV ", 6, "\x01\x13\x0f\x00\x00\x03");
>      applesmc_add_key(s, "OSK0", 32, s->osk);
> @@ -227,6 +301,16 @@ static const MemoryRegionOps applesmc_cmd_io_ops = {
>      },
>  };
>
> +static const MemoryRegionOps applesmc_err_io_ops = {
> +    .write = applesmc_io_err_write,
> +    .read = applesmc_io_err_read,
> +    .endianness = DEVICE_NATIVE_ENDIAN,
> +    .impl = {
> +        .min_access_size = 1,
> +        .max_access_size = 1,
> +    },
> +};
> +
>  static void applesmc_isa_realize(DeviceState *dev, Error **errp)
>  {
>      AppleSMCState *s = APPLE_SMC(dev);
> @@ -241,6 +325,11 @@ static void applesmc_isa_realize(DeviceState *dev, Error 
> **errp)
>      isa_register_ioport(&s->parent_obj, &s->io_cmd,
>                          s->iobase + APPLESMC_CMD_PORT);
>
> +    memory_region_init_io(&s->io_err, OBJECT(s), &applesmc_err_io_ops, s,
> +                          "applesmc-err", 1);
> +    isa_register_ioport(&s->parent_obj, &s->io_err,
> +                        s->iobase + APPLESMC_ERR_PORT);
> +
>      if (!s->osk || (strlen(s->osk) != 64)) {
>          fprintf(stderr, "WARNING: Using AppleSMC with invalid key\n");
>          s->osk = default_osk;
> --
> 2.7.4
>
>