QEMU's AppleSMC device only implements the SMC read command, so every
other command a guest issues fails with kSMCBadCommand. Tracing a macOS
guest shows it relies on two more: the write command (0x11) and
get-key-type (0x13). The missing write command delays boot (macOS retries
failed boot-time key writes) and produces a stream of
SMCWDT::setWatchdogTimer errors at shutdown; the missing get-key-type is
rejected dozens of times during boot.

This series implements what the guest actually uses, one command per
patch for reviewability:

  1/4  add trace events, so the SMC conversation can be observed with
       -trace 'applesmc*' (used to find exactly which commands and keys
       macOS issues).
  2/4  implement the write command (0x11): accept writes and return
       success, removing the boot delay and the shutdown errors.
  3/4  model the "NATi"/"NATJ"/"OSWD" keys as the SMC shutdown watchdog
       they represent, rather than silently accepting the writes: a write
       arms, refreshes or disarms a QEMUTimer whose expiry forces the
       machine down.
  4/4  implement get-key-type (0x13): give each key an SMC type and answer
       the type queries instead of rejecting them.

Traced against a macOS guest before and after: the boot-time key writes
(NTOK, MSDW, QENA, HE0N) now succeed, the shutdown "OSWD" write (a
watchdog disarm) is handled, and the get-key-type rejections become
correct replies (for example REV is reported as {rev, six bytes). The
traced guest only disarms the watchdog; the arm-and-fire path in patch 3
is the documented behaviour for a guest that arms it and was not observed
being triggered. get-key-by-index (0x12) is deliberately not implemented,
as macOS never issues it.

Daniel Golle (4):
  hw/misc/applesmc: Add trace events
  hw/misc/applesmc: Implement the write command
  hw/misc/applesmc: Emulate the SMC shutdown watchdog
  hw/misc/applesmc: Implement the get-key-type command

 hw/misc/applesmc.c   | 174 +++++++++++++++++++++++++++++++++++++++++--
 hw/misc/trace-events |  16 ++++
 2 files changed, 183 insertions(+), 7 deletions(-)


-- 
2.55.0

On Wed, 19 Aug 2026 at 07:41, Daniel Golle <daniel@makrotopia.org> wrote:
>
> QEMU's AppleSMC device only implements the SMC read command, so every
> other command a guest issues fails with kSMCBadCommand. Tracing a macOS
> guest shows it relies on two more: the write command (0x11) and
> get-key-type (0x13). The missing write command delays boot (macOS retries
> failed boot-time key writes) and produces a stream of
> SMCWDT::setWatchdogTimer errors at shutdown; the missing get-key-type is
> rejected dozens of times during boot.

How does this series fit in with Matthew Jackson's set of patches
https://patchew.org/QEMU/20260720164930.68383-1-matthew@pq.io/

?

thanks
-- PMM

On Wed, 19 Aug 2026 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
> How does this series fit in with Matthew Jackson's set of patches
> https://patchew.org/QEMU/20260720164930.68383-1-matthew@pq.io/

They do overlap, and Matthew's is the more complete of the two, so I
am dropping the overlapping parts of mine in favour of his.

We independently implemented the same two missing SMC commands (write
and get-key-type). On top of that Matthew's v4 also implements
get-key-by-index and populates a full key table, whereas my series
left get-key-by-index out (the macOS 26 guest I traced doesn't seem to
emitted them). So his series supersedes patches 2 and 4 of mine.

The only parts of my series not covered by his are the SMC shutdown
watchdog and the trace events. I have rebased those two patches on top
of his v4 and will send them as a short follow-up ("[PATCH 0/2]
hw/misc/ applesmc: SMC shutdown watchdog and trace events").
Reviewed-by/Tested-by for his series are in my replies to it.


Cheers and thanks for connecting the two threads


Daniel