On 1/6/26 17:28, Matthew Jackson wrote:
With APPLESMC_GET_KEY_BY_INDEX_CMD now functional (previous
patch), the modern macOS AppleSMC kext walks the device's key
table at boot to discover what's available. The current key
set (REV/OSK0/OSK1/NATJ/MSSP/MSSD) is sparse enough that
several macOS subsystems retry-poll keys they expect to find,
contributing to the same kSMCSpuriousData traffic the previous
patch addresses.
This patch fills the key table out to a complete iMac20,1
profile (94 additional keys plus the canonical #KEY count).
Sensor values match a real iMac20,1 idle probe published at:
https://linux-hardware.org/?probe=999fc708a4&log=sensors
Categories:
* 28 temperature sensors in sp78 format with idle readings
from the probe: CPU 40 C (TC0P) / 45 C (TC0F) / 51 C
(TCXc), GPU 36 C (TG0P) / 42 C (TG0F/TG1F/TGDD), HDD
41 C (TH0P/TH1C/TH1F), LCD 28-29 C (TL0V/TL1V), memory
34-36 C (TM0V/TM0P), ambient 24 C (TA0V), PSU 33 C
(Tp00/Tp2F), generic sensors 33 C (Ts*S, TS0V), VRM
50 C (TVMD/TVmS/TVSL/TVSR; not in the probe, conservative
estimate). Battery sensors (TB0T/TB1T/TB2T) are
present-with-zero because iMacs have no battery; macOS's
"absent vs broken" distinction relies on the key being
registered even with a zero reading.
* 4 fan keys (FNum/F0Ac/F0Mn/F0Mx) describing iMac20,1's
single chassis fan: 1 fan, current 1200 RPM (= F0Mn,
matching the probe-reported idle), min 1200, max 3600.
fpe2 encoding (raw = RPM * 4, big-endian).
* 12 power-rail keys (PC0R/PCPC/PCPG/PCPT/PfCP/PfCT/PfGT/
PfHT/PfM0/PfST/PSTR/PHDC) for telemetry; present-with-
zero satisfies macOS without claiming a specific value.
* 6 DIMM keys (DM0P/DM0S/DM1P/DM1S/MD1R/MD1W); same
rationale.
* 11 SMC-internal bookkeeping keys (CLKH/DICT/RPlt/SBFL/
VRTC/WKTP plus 5 lower-case Apple-private bookkeeping
keys cePn/cmDU/maNN/mxT1/zEPD); same rationale.
* 13 motion-sensor / wireless keys (MSAc/MSAf/MSAg/MSAi/
MSGA/MSHP/MSPA/MTLV/QCLV/QENA/WIr0/WIw0/WIz0). Present-
with-zero is the correct desktop-class answer.
* 3 write targets that must also be readable: HE0N (iGPU
power; AGPM driver writes 1 on start), MSDW, NTOK.
* 2 power-management gates required by AGPM and the
watchdog probe: HE2N (dGPU power enable), WDTC.
* 8 platform-identity / probe keys (MPRO/MPRD/LGPB/BSLN/
EPCI/BEMB/$Adr/RGEN/DPLM/MSSW/OSWD): VirtualSMC-style
identity plus the early boot-time SMC probe keys.
* 2 GPU temperature sensors (TGDD/TG0P) and #KEY (the
Apple-canonical total-keys count, computed by walking
the data_def list at realize time).
* 1 VirtualSMC-compatible $Num key (some drivers prefer it
over #KEY).
After this patch, with the protocol fix from the previous
patch in place, a Sequoia 15.7.5 guest boots without the SMC
retry storm:
Metric | Before | After
-----------------|---------:|------:
SMC errors / 5s | 9,225 | 2
kernel_task CPU | 70 % | ~2 %
WindowServer CPU | 509 % | ~6 %
Legacy macOS guests (10.11-10.13) that do not iterate the
key space see no behavioural change beyond the corrected
MSSD value (now 0x03 as on real iMac20,1 hardware) and the
fact that READ on a previously-unknown key returns zeros
instead of NOEXIST.
Signed-off-by: Matthew Jackson <[email protected]>
---
hw/misc/applesmc.c | 169 ++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 168 insertions(+), 1 deletion(-)
diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c
index 263b2251b0..38062a07b5 100644
--- a/hw/misc/applesmc.c
+++ b/hw/misc/applesmc.c
@@ -32,7 +32,7 @@
#include "qemu/osdep.h"
#include "hw/isa/isa.h"
-#include "hw/core/qdev-properties.h"
+#include "hw/qdev-properties.h"
Invalid change?
