The "NATi", "NATJ" and "OSWD" keys drive the SMC shutdown watchdog: a guest arms a countdown and the SMC forces the machine down if the guest stops refreshing it. The previous patch lets writes to these keys succeed; model them as the watchdog they are instead of discarding the value, so a guest that arms the watchdog gets the reset or power-off it asked for.
NATi sets the timeout in seconds, NATJ selects the job and arms it (0 disarms, 1 powers the machine down, 2 restarts it), and OSWD is a one-shot shutdown timer. A write arms, refreshes or disarms a QEMU_CLOCK_VIRTUAL timer whose expiry raises a guest shutdown or reset request. A traced macOS guest writes OSWD with a zero countdown to disarm on its way down and does not otherwise arm the watchdog; the arm-and-expiry path is the documented behaviour for a guest that does arm it. Signed-off-by: Daniel Golle <[email protected]> --- hw/misc/applesmc.c | 66 ++++++++++++++++++++++++++++++++++++++++++++ hw/misc/trace-events | 3 ++ 2 files changed, 69 insertions(+) diff --git a/hw/misc/applesmc.c b/hw/misc/applesmc.c index 4a82a36a2a..e329b2e1e6 100644 --- a/hw/misc/applesmc.c +++ b/hw/misc/applesmc.c @@ -40,6 +40,7 @@ #include "qemu/timer.h" #include "qom/object.h" #include "hw/acpi/acpi_aml_interface.h" +#include "system/runstate.h" #include "trace.h" /* #define DEBUG_SMC */ @@ -81,6 +82,12 @@ enum { APPLESMC_ST_1E_BAD_INDEX = 0xb8, }; +enum { + APPLESMC_WDT_DISARM = 0, + APPLESMC_WDT_SHUTDOWN = 1, + APPLESMC_WDT_RESTART = 2, +}; + #ifdef DEBUG_SMC #define smc_debug(...) fprintf(stderr, "AppleSMC: " __VA_ARGS__) #else @@ -117,6 +124,9 @@ struct AppleSMCState { uint8_t data[255]; char *osk; QLIST_HEAD(, AppleSMCData) data_def; + QEMUTimer *wdt_timer; + uint16_t wdt_timeout; + uint8_t wdt_job; }; static void applesmc_io_cmd_write(void *opaque, hwaddr addr, uint64_t val, @@ -169,6 +179,53 @@ static const struct AppleSMCData *applesmc_find_key(AppleSMCState *s) return NULL; } +static void applesmc_wdt_expired(void *opaque) +{ + AppleSMCState *s = opaque; + + trace_applesmc_wdt_expired(s->wdt_job); + if (s->wdt_job == APPLESMC_WDT_RESTART) { + qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); + } else { + qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN); + } +} + +static void applesmc_wdt_update(AppleSMCState *s) +{ + if (s->wdt_job == APPLESMC_WDT_DISARM || s->wdt_timeout == 0) { + timer_del(s->wdt_timer); + trace_applesmc_wdt_disarm(); + return; + } + timer_mod(s->wdt_timer, + qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + + (uint64_t)s->wdt_timeout * NANOSECONDS_PER_SECOND); + trace_applesmc_wdt_arm(s->wdt_job, s->wdt_timeout); +} + +/* + * The "NATi"/"NATJ"/"OSWD" keys are the SMC shutdown watchdog macOS uses to + * force the machine down if userspace stops petting it: NATi sets the + * timeout in seconds, NATJ selects and arms the job (0 disarm, 1 shutdown, + * 2 restart), and OSWD is a one-shot shutdown timer. A write to one of them + * arms, refreshes or disarms the timer rather than being silently discarded. + */ +static void applesmc_wdt_write_key(AppleSMCState *s) +{ + if (!memcmp(s->key, "NATi", 4) && s->data_len >= 2) { + s->wdt_timeout = (s->data[0] << 8) | s->data[1]; + } else if (!memcmp(s->key, "NATJ", 4) && s->data_len >= 1) { + s->wdt_job = s->data[0]; + applesmc_wdt_update(s); + } else if (!memcmp(s->key, "OSWD", 4) && s->data_len >= 2) { + s->wdt_timeout = (s->data[0] << 8) | s->data[1]; + s->wdt_job = s->wdt_timeout ? APPLESMC_WDT_SHUTDOWN + : APPLESMC_WDT_DISARM; + applesmc_wdt_update(s); + } +} + static void applesmc_io_data_write(void *opaque, hwaddr addr, uint64_t val, unsigned size) { @@ -243,6 +300,7 @@ static void applesmc_io_data_write(void *opaque, hwaddr addr, uint64_t val, s->data_len); trace_applesmc_write(s->key[0], s->key[1], s->key[2], s->key[3], s->data_len); + applesmc_wdt_write_key(s); s->status = APPLESMC_ST_CMD_DONE; s->status_1e = APPLESMC_ST_CMD_DONE; } else { @@ -449,6 +507,9 @@ static void qdev_applesmc_isa_reset(DeviceState *dev) s->status = 0x00; s->status_1e = 0x00; s->last_ret = 0x00; + s->wdt_job = APPLESMC_WDT_DISARM; + s->wdt_timeout = 0; + timer_del(s->wdt_timer); } static const MemoryRegionOps applesmc_data_io_ops = { @@ -485,6 +546,8 @@ static void applesmc_isa_realize(DeviceState *dev, Error **errp) { AppleSMCState *s = APPLE_SMC(dev); + s->wdt_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, applesmc_wdt_expired, s); + memory_region_init_io(&s->io_data, OBJECT(s), &applesmc_data_io_ops, s, "applesmc-data", 1); isa_register_ioport(&s->parent_obj, &s->io_data, @@ -511,6 +574,7 @@ static void applesmc_isa_realize(DeviceState *dev, Error **errp) applesmc_add_key(s, "REV ", 6, "\x01\x13\x0f\x00\x00\x03"); applesmc_add_key(s, "OSK0", 32, s->osk); applesmc_add_key(s, "OSK1", 32, s->osk + 32); + applesmc_add_key(s, "NATi", 2, "\0\0"); applesmc_add_key(s, "NATJ", 1, "\0"); applesmc_add_key(s, "MSSP", 1, "\0"); applesmc_add_key(s, "MSSD", 1, "\x03"); @@ -687,6 +751,8 @@ static void applesmc_unrealize(DeviceState *dev) AppleSMCState *s = APPLE_SMC(dev); struct AppleSMCData *d, *next; + timer_free(s->wdt_timer); + /* Remove existing entries */ QLIST_FOREACH_SAFE(d, &s->data_def, node, next) { QLIST_REMOVE(d, node); diff --git a/hw/misc/trace-events b/hw/misc/trace-events index 5b823182c9..a62d357213 100644 --- a/hw/misc/trace-events +++ b/hw/misc/trace-events @@ -46,6 +46,9 @@ applesmc_write(char k0, char k1, char k2, char k3, uint8_t len) "WRITE '%c%c%c%c applesmc_key_type(char k0, char k1, char k2, char k3, uint8_t len) "GET_KEY_TYPE '%c%c%c%c' size %u" applesmc_key_by_index(uint32_t idx, char k0, char k1, char k2, char k3) "GET_KEY_BY_INDEX %u -> '%c%c%c%c'" applesmc_key_by_index_end(uint32_t idx) "GET_KEY_BY_INDEX %u past end" +applesmc_wdt_arm(uint8_t job, uint16_t seconds) "arm job %u timeout %us" +applesmc_wdt_disarm(void) "disarm" +applesmc_wdt_expired(uint8_t job) "expired job %u" # avr_power.c avr_power_read(uint8_t value) "power_reduc read value:%u" -- 2.55.0
