1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33#include "qemu/osdep.h"
34#include "hw/hw.h"
35#include "hw/isa/isa.h"
36#include "ui/console.h"
37#include "qemu/timer.h"
38
39
40
41#define APPLESMC_DEFAULT_IOBASE 0x300
42
43enum {
44 APPLESMC_DATA_PORT = 0x00,
45 APPLESMC_CMD_PORT = 0x04,
46 APPLESMC_ERR_PORT = 0x1e,
47 APPLESMC_NUM_PORTS = 0x20,
48};
49
50enum {
51 APPLESMC_READ_CMD = 0x10,
52 APPLESMC_WRITE_CMD = 0x11,
53 APPLESMC_GET_KEY_BY_INDEX_CMD = 0x12,
54 APPLESMC_GET_KEY_TYPE_CMD = 0x13,
55};
56
57enum {
58 APPLESMC_ST_CMD_DONE = 0x00,
59 APPLESMC_ST_DATA_READY = 0x01,
60 APPLESMC_ST_BUSY = 0x02,
61 APPLESMC_ST_ACK = 0x04,
62 APPLESMC_ST_NEW_CMD = 0x08,
63};
64
65enum {
66 APPLESMC_ST_1E_CMD_INTRUPTED = 0x80,
67 APPLESMC_ST_1E_STILL_BAD_CMD = 0x81,
68 APPLESMC_ST_1E_BAD_CMD = 0x82,
69 APPLESMC_ST_1E_NOEXIST = 0x84,
70 APPLESMC_ST_1E_WRITEONLY = 0x85,
71 APPLESMC_ST_1E_READONLY = 0x86,
72 APPLESMC_ST_1E_BAD_INDEX = 0xb8,
73};
74
75#ifdef DEBUG_SMC
76#define smc_debug(...) fprintf(stderr, "AppleSMC: " __VA_ARGS__)
77#else
78#define smc_debug(...) do { } while (0)
79#endif
80
81static char default_osk[64] = "This is a dummy key. Enter the real key "
82 "using the -osk parameter";
83
84struct AppleSMCData {
85 uint8_t len;
86 const char *key;
87 const char *data;
88 QLIST_ENTRY(AppleSMCData) node;
89};
90
91#define APPLE_SMC(obj) OBJECT_CHECK(AppleSMCState, (obj), TYPE_APPLE_SMC)
92
93typedef struct AppleSMCState AppleSMCState;
94struct AppleSMCState {
95 ISADevice parent_obj;
96
97 MemoryRegion io_data;
98 MemoryRegion io_cmd;
99 MemoryRegion io_err;
100 uint32_t iobase;
101 uint8_t cmd;
102 uint8_t status;
103 uint8_t status_1e;
104 uint8_t last_ret;
105 char key[4];
106 uint8_t read_pos;
107 uint8_t data_len;
108 uint8_t data_pos;
109 uint8_t data[255];
110 char *osk;
111 QLIST_HEAD(, AppleSMCData) data_def;
112};
113
114static void applesmc_io_cmd_write(void *opaque, hwaddr addr, uint64_t val,
115 unsigned size)
116{
117 AppleSMCState *s = opaque;
118 uint8_t status = s->status & 0x0f;
119
120 smc_debug("CMD received: 0x%02x\n", (uint8_t)val);
121 switch (val) {
122 case APPLESMC_READ_CMD:
123
124 if (status == APPLESMC_ST_CMD_DONE || status == APPLESMC_ST_NEW_CMD) {
125 s->cmd = val;
126 s->status = APPLESMC_ST_NEW_CMD | APPLESMC_ST_ACK;
127 } else {
128 smc_debug("ERROR: previous command interrupted!\n");
129 s->status = APPLESMC_ST_NEW_CMD;
130 s->status_1e = APPLESMC_ST_1E_CMD_INTRUPTED;
131 }
132 break;
133 default:
134 smc_debug("UNEXPECTED CMD 0x%02x\n", (uint8_t)val);
135 s->status = APPLESMC_ST_NEW_CMD;
136 s->status_1e = APPLESMC_ST_1E_BAD_CMD;
137 }
138 s->read_pos = 0;
139 s->data_pos = 0;
140}
141
142static struct AppleSMCData *applesmc_find_key(AppleSMCState *s)
143{
144 struct AppleSMCData *d;
145
146 QLIST_FOREACH(d, &s->data_def, node) {
147 if (!memcmp(d->key, s->key, 4)) {
148 return d;
149 }
150 }
151 return NULL;
152}
153
154static void applesmc_io_data_write(void *opaque, hwaddr addr, uint64_t val,
155 unsigned size)
156{
157 AppleSMCState *s = opaque;
158 struct AppleSMCData *d;
159
160 smc_debug("DATA received: 0x%02x\n", (uint8_t)val);
161 switch (s->cmd) {
162 case APPLESMC_READ_CMD:
163 if ((s->status & 0x0f) == APPLESMC_ST_CMD_DONE) {
164 break;
165 }
166 if (s->read_pos < 4) {
167 s->key[s->read_pos] = val;
168 s->status = APPLESMC_ST_ACK;
169 } else if (s->read_pos == 4) {
170 d = applesmc_find_key(s);
171 if (d != NULL) {
172 memcpy(s->data, d->data, d->len);
173 s->data_len = d->len;
174 s->data_pos = 0;
175 s->status = APPLESMC_ST_ACK | APPLESMC_ST_DATA_READY;
176 s->status_1e = APPLESMC_ST_CMD_DONE;
177 } else {
178 smc_debug("READ_CMD: key '%c%c%c%c' not found!\n",
179 s->key[0], s->key[1], s->key[2], s->key[3]);
180 s->status = APPLESMC_ST_CMD_DONE;
181 s->status_1e = APPLESMC_ST_1E_NOEXIST;
182 }
183 }
184 s->read_pos++;
185 break;
186 default:
187 s->status = APPLESMC_ST_CMD_DONE;
188 s->status_1e = APPLESMC_ST_1E_STILL_BAD_CMD;
189 }
190}
191
192static void applesmc_io_err_write(void *opaque, hwaddr addr, uint64_t val,
193 unsigned size)
194{
195 smc_debug("ERR_CODE received: 0x%02x, ignoring!\n", (uint8_t)val);
196
197}
198
199static uint64_t applesmc_io_data_read(void *opaque, hwaddr addr, unsigned size)
200{
201 AppleSMCState *s = opaque;
202
203 switch (s->cmd) {
204 case APPLESMC_READ_CMD:
205 if (!(s->status & APPLESMC_ST_DATA_READY)) {
206 break;
207 }
208 if (s->data_pos < s->data_len) {
209 s->last_ret = s->data[s->data_pos];
210 smc_debug("READ '%c%c%c%c'[%d] = %02x\n",
211 s->key[0], s->key[1], s->key[2], s->key[3],
212 s->data_pos, s->last_ret);
213 s->data_pos++;
214 if (s->data_pos == s->data_len) {
215 s->status = APPLESMC_ST_CMD_DONE;
216 smc_debug("READ '%c%c%c%c' Len=%d complete!\n",
217 s->key[0], s->key[1], s->key[2], s->key[3],
218 s->data_len);
219 } else {
220 s->status = APPLESMC_ST_ACK | APPLESMC_ST_DATA_READY;
221 }
222 }
223 break;
224 default:
225 s->status = APPLESMC_ST_CMD_DONE;
226 s->status_1e = APPLESMC_ST_1E_STILL_BAD_CMD;
227 }
228 smc_debug("DATA sent: 0x%02x\n", s->last_ret);
229
230 return s->last_ret;
231}
232
233static uint64_t applesmc_io_cmd_read(void *opaque, hwaddr addr, unsigned size)
234{
235 AppleSMCState *s = opaque;
236
237 smc_debug("CMD sent: 0x%02x\n", s->status);
238 return s->status;
239}
240
241static uint64_t applesmc_io_err_read(void *opaque, hwaddr addr, unsigned size)
242{
243 AppleSMCState *s = opaque;
244
245
246 smc_debug("ERR_CODE sent: 0x%02x\n", s->status_1e);
247 return s->status_1e;
248}
249
250static void applesmc_add_key(AppleSMCState *s, const char *key,
251 int len, const char *data)
252{
253 struct AppleSMCData *def;
254
255 def = g_malloc0(sizeof(struct AppleSMCData));
256 def->key = key;
257 def->len = len;
258 def->data = data;
259
260 QLIST_INSERT_HEAD(&s->data_def, def, node);
261}
262
263static void qdev_applesmc_isa_reset(DeviceState *dev)
264{
265 AppleSMCState *s = APPLE_SMC(dev);
266 struct AppleSMCData *d, *next;
267
268
269 QLIST_FOREACH_SAFE(d, &s->data_def, node, next) {
270 QLIST_REMOVE(d, node);
271 }
272 s->status = 0x00;
273 s->status_1e = 0x00;
274 s->last_ret = 0x00;
275
276 applesmc_add_key(s, "REV ", 6, "\x01\x13\x0f\x00\x00\x03");
277 applesmc_add_key(s, "OSK0", 32, s->osk);
278 applesmc_add_key(s, "OSK1", 32, s->osk + 32);
279 applesmc_add_key(s, "NATJ", 1, "\0");
280 applesmc_add_key(s, "MSSP", 1, "\0");
281 applesmc_add_key(s, "MSSD", 1, "\0x3");
282}
283
284static const MemoryRegionOps applesmc_data_io_ops = {
285 .write = applesmc_io_data_write,
286 .read = applesmc_io_data_read,
287 .endianness = DEVICE_NATIVE_ENDIAN,
288 .impl = {
289 .min_access_size = 1,
290 .max_access_size = 1,
291 },
292};
293
294static const MemoryRegionOps applesmc_cmd_io_ops = {
295 .write = applesmc_io_cmd_write,
296 .read = applesmc_io_cmd_read,
297 .endianness = DEVICE_NATIVE_ENDIAN,
298 .impl = {
299 .min_access_size = 1,
300 .max_access_size = 1,
301 },
302};
303
304static const MemoryRegionOps applesmc_err_io_ops = {
305 .write = applesmc_io_err_write,
306 .read = applesmc_io_err_read,
307 .endianness = DEVICE_NATIVE_ENDIAN,
308 .impl = {
309 .min_access_size = 1,
310 .max_access_size = 1,
311 },
312};
313
314static void applesmc_isa_realize(DeviceState *dev, Error **errp)
315{
316 AppleSMCState *s = APPLE_SMC(dev);
317
318 memory_region_init_io(&s->io_data, OBJECT(s), &applesmc_data_io_ops, s,
319 "applesmc-data", 1);
320 isa_register_ioport(&s->parent_obj, &s->io_data,
321 s->iobase + APPLESMC_DATA_PORT);
322
323 memory_region_init_io(&s->io_cmd, OBJECT(s), &applesmc_cmd_io_ops, s,
324 "applesmc-cmd", 1);
325 isa_register_ioport(&s->parent_obj, &s->io_cmd,
326 s->iobase + APPLESMC_CMD_PORT);
327
328 memory_region_init_io(&s->io_err, OBJECT(s), &applesmc_err_io_ops, s,
329 "applesmc-err", 1);
330 isa_register_ioport(&s->parent_obj, &s->io_err,
331 s->iobase + APPLESMC_ERR_PORT);
332
333 if (!s->osk || (strlen(s->osk) != 64)) {
334 warn_report("Using AppleSMC with invalid key");
335 s->osk = default_osk;
336 }
337
338 QLIST_INIT(&s->data_def);
339 qdev_applesmc_isa_reset(dev);
340}
341
342static Property applesmc_isa_properties[] = {
343 DEFINE_PROP_UINT32(APPLESMC_PROP_IO_BASE, AppleSMCState, iobase,
344 APPLESMC_DEFAULT_IOBASE),
345 DEFINE_PROP_STRING("osk", AppleSMCState, osk),
346 DEFINE_PROP_END_OF_LIST(),
347};
348
349static void qdev_applesmc_class_init(ObjectClass *klass, void *data)
350{
351 DeviceClass *dc = DEVICE_CLASS(klass);
352
353 dc->realize = applesmc_isa_realize;
354 dc->reset = qdev_applesmc_isa_reset;
355 dc->props = applesmc_isa_properties;
356 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
357}
358
359static const TypeInfo applesmc_isa_info = {
360 .name = TYPE_APPLE_SMC,
361 .parent = TYPE_ISA_DEVICE,
362 .instance_size = sizeof(AppleSMCState),
363 .class_init = qdev_applesmc_class_init,
364};
365
366static void applesmc_register_types(void)
367{
368 type_register_static(&applesmc_isa_info);
369}
370
371type_init(applesmc_register_types)
372
