Jump to content

SMC keys knowledge database

Slice

By Slice,
in Hardware Sensors

 Share
21 posts in this topic

Recommended Posts

Slice
Slice
Posted
Posted

This thread devoted to share information about different SMC keys found or investigated anywhere.

 

What are they?

SMC keys is a somehow language to speak between macOS and hardware microcontroller presented in real Mac and absent in Hackintosh.

They inform macOS about Hardware ID and current status. Moreover macOS can write something through SMC protocol to control hardware.

FakeSMC ( ©Netkas) is the driver to emulate this microcontroller on PC having no such device which is necessary to boot macOS here.

But FakeSMC contain only ~20 keys while real Mac answers ~200 keys.

Some keys we added by HWSensors project reporting temperatures, FAN speeds, voltages etc.

Some keys are model dependent was added by Clover to be sure if user changed model in GUI then corresponding keys will be changed automatically.

Clover sets

LogDataHub(&gEfiMiscSubClassGuid, L"RPlt", &gSettings.RPlt, 8);
LogDataHub(&gEfiMiscSubClassGuid, L"RBr", &gSettings.RBr, 8);
LogDataHub(&gEfiMiscSubClassGuid, L"EPCI", &gSettings.EPCI, 4);
LogDataHub(&gEfiMiscSubClassGuid, L"REV", &gSettings.REV, 6);
LogDataHub(&gEfiMiscSubClassGuid, L"BEMB", &gSettings.Mobile, 1);

BEMB - is a mobility sign. =0 -desktop, =1 - mobile.

REV - SMC hardware revision, changes sometimes with Apple updates.

RPlt, RBr and EPCI is hardware capabilities, noticed used in Intel HD drivers.

 

Structure.

All SMC keys consists of name 4 ascii chars as 32bit integer, type and value.

Types:

 "flag", len 1
 "ui8 ", len 1
 "ui16", len 2
 "sp78", len 2
 "ui32", len 4

"fp2e", len 2

"fpe2", len 2

"{rev", and others...

 

List of known keys

SMC_list.plist.zip

More keys will be discussed in the thread

 

 

Feel free to share you knowledge and ask about noticed keys.

  • Like 12
Link to comment
Share on other sites
WinstonAce
WinstonAce
Posted
Posted

Hi

my question not directly related to clover but to fakesmc bundled with it when you build the ISO

when using it I get in system log

2017-10-20 13:49:28.290609+0300  localhost kernel[0]: (AppleSMC) <AppleSMC`AppleSMC::smcPublishShutdownCause()> Previous shutdown cause: 3

but when using other fakesmc versions I get

2017-10-20 13:52:04.271683+0300  localhost kernel[0]: (AppleSMC) <AppleSMC`AppleSMC::smcPublishShutdownCause()> Previous shutdown cause: 5

this is the fakesmc log from boot:

bundled with clover:

2017-10-20 13:49:26.643794+0300  localhost kernel[0]: (kernel) FakeSMC: opensource SMC device emulator by netkas (C) 2009
2017-10-20 13:49:26.643798+0300  localhost kernel[0]: (kernel) FakeSMC: plugins & plugins support modifications by mozodojo, usr-sse2, slice (C) 2010
2017-10-20 13:49:26.643891+0300  localhost kernel[0]: (kernel) FakeSMCDevice: 26 preconfigured key(s) added
2017-10-20 13:49:26.643895+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC Platform: j78
2017-10-20 13:49:26.643898+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC Branch: j78j78a
2017-10-20 13:49:26.643902+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC Revision set to: 2.22f16
2017-10-20 13:49:26.643905+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC ConfigID set to: 08 00 f0 00
2017-10-20 13:49:26.643908+0300  localhost kernel[0]: (kernel) FakeSMCDevice: Mobile Platform: 0
2017-10-20 13:49:26.643925+0300  localhost kernel[0]: (kernel) FakeSMCDevice: successfully initialized

from rehabman repo

2017-10-20 13:52:02.587745+0300  localhost kernel[0]: (kernel) FakeSMCKeyStore: started
2017-10-20 13:52:02.613662+0300  localhost kernel[0]: (kernel) FakeSMC v6.26-322-g1b20eab7.1765 Copyright 2017 netkas, slice, usr-sse2, kozlek, navi, THe KiNG, RehabMan. All rights reserved.
2017-10-20 13:52:02.613828+0300  localhost kernel[0]: (kernel) FakeSMC: 19 preconfigured keys added
2017-10-20 13:52:02.613848+0300  localhost kernel[0]: (kernel) FakeSMC: 5 keys exported by Clover EFI
Link to comment
Share on other sites
Slice
Slice
Posted
  • Author
Posted

 

Hi

my question not directly related to clover but to fakesmc bundled with it when you build the ISO

when using it I get in system log

2017-10-20 13:49:28.290609+0300  localhost kernel[0]: (AppleSMC) <AppleSMC`AppleSMC::smcPublishShutdownCause()> Previous shutdown cause: 3

but when using other fakesmc versions I get

2017-10-20 13:52:04.271683+0300  localhost kernel[0]: (AppleSMC) <AppleSMC`AppleSMC::smcPublishShutdownCause()> Previous shutdown cause: 5

this is the fakesmc log from boot:

bundled with clover:

2017-10-20 13:49:26.643794+0300  localhost kernel[0]: (kernel) FakeSMC: opensource SMC device emulator by netkas (C) 2009
2017-10-20 13:49:26.643798+0300  localhost kernel[0]: (kernel) FakeSMC: plugins & plugins support modifications by mozodojo, usr-sse2, slice (C) 2010
2017-10-20 13:49:26.643891+0300  localhost kernel[0]: (kernel) FakeSMCDevice: 26 preconfigured key(s) added
2017-10-20 13:49:26.643895+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC Platform: j78
2017-10-20 13:49:26.643898+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC Branch: j78j78a
2017-10-20 13:49:26.643902+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC Revision set to: 2.22f16
2017-10-20 13:49:26.643905+0300  localhost kernel[0]: (kernel) FakeSMCDevice: SMC ConfigID set to: 08 00 f0 00
2017-10-20 13:49:26.643908+0300  localhost kernel[0]: (kernel) FakeSMCDevice: Mobile Platform: 0
2017-10-20 13:49:26.643925+0300  localhost kernel[0]: (kernel) FakeSMCDevice: successfully initialized

from rehabman repo

2017-10-20 13:52:02.587745+0300  localhost kernel[0]: (kernel) FakeSMCKeyStore: started
2017-10-20 13:52:02.613662+0300  localhost kernel[0]: (kernel) FakeSMC v6.26-322-g1b20eab7.1765 Copyright 2017 netkas, slice, usr-sse2, kozlek, navi, THe KiNG, RehabMan. All rights reserved.
2017-10-20 13:52:02.613828+0300  localhost kernel[0]: (kernel) FakeSMC: 19 preconfigured keys added
2017-10-20 13:52:02.613848+0300  localhost kernel[0]: (kernel) FakeSMC: 5 keys exported by Clover EFI

 

Compare Info.plist/KeyToAdd, something like MSDS, MSPS etc

Link to comment
Share on other sites
WinstonAce
WinstonAce
Posted
Posted

most keys are the same.

There are different values in keys:

 

$Num

ACID

ALI0

ALV0

MSSD

 

these keys are specific to clover's fakesmc

ALV1

CLKH

CLKT

EPCI

LSOF

LSSB

MOST

MSDW

MSPS

NATi

NTOK

NVPR

RPlt

 

these keys are specific to RehabMan(kozlek?) fakesmc

RVBF

RVUF

$Adr

MSLD

MSSP

 

 

 

Link to comment
Share on other sites
Slice
Slice
Posted
  • Author
Posted

Special keys

$Num - the number of SMC controllers. Should be 1.

$Adr - the address of the controller. Should be 0x0300

#Key - the number of SMC keys supported by the controller. FakeSMC always calculates the value.

ACID - power supply ID. Seems cosmetic only.

  • Like 1
Link to comment
Share on other sites
Slice
Slice
Posted
  • Author
Posted

Continue research
 

XCPMPlatformPlugin 

 

This plugin used for CPU Power Management and it is using SMC protocol for a what? Look

Read keys:

MSEW - throttling config
TsTH - threshold
TsHS - hysteresis
TsWS - width
BEMB - is the computer mobile. Clover sets this key
F0Mx, SFBR - FAN settings
LsNM, LsbV - Lightshow.  
 

Write keys

FS! - FAN control
HE0N, HI0N - frequency of eGPU & iGPU . I found both keys in my nvram.plist on Dell laptop. First for nVidia, second for Intel HD4000.
HI1N - send p-state to iGPU
QENA - ostt on/off throttling
MSFV, MSFL, MSFM, MSFE - throttling config

 

I want to say that these keys unuseful for us because we are not going to use CPU Thermal Throttling and we have no hardware to perform such command send by XCMP through SMC.

 

The interesting keys are HE0N and HI0N. If we found a way to control Intel HD frequency then we can write a kext for perform this SMC commands.

  • Like 5
Link to comment
Share on other sites
Slice
Slice
Posted
  • Author
Posted

boot.efi

 
It uses some keys for hibernation and some keys for FileVault2
Hibernation
HBKP - len=20 bytes. It contains decoding key for mode 25 if wake from CoreStorage.
MSWr = 25, it looks like hibernate mode
MSPS - Uint16 seems should be zero
MSFW - Uint8 used in Sierra instead of key MSPS of older systems
 
And write the key
WKTP = 0 len = 1 byte.
 
If normal boot then boot.efi reads keys

->AppleSMC.SmcReadValue SMC=4D535463 (MSTc) len=1
--> data=: 00 
->AppleSMC.SmcReadValue SMC=4D534163 (MSAc) len=2
--> data=: 00 00

 
MSTc - Returns the last CPU PLIMIT sent by the SMC
MSAc - Returns the average CPU PLIMIT sent by the SMC
It is good to return 0 here because it means fastest speed.

  • Like 2
Link to comment
Share on other sites
Slice
Slice
Posted
  • Author
Posted

a little program from based on https://github.com/beltex/libsmc

 

compile with

 

 

 gcc -framework IOKit  -o smcutil smc.c 

 

./smcutil -l

 

There are 455 keys on my Macbook,

from #KEY to zDSF

missing OSK0 and OSK1 in between.

Thanks for the sharing your data. What is the MacBook?

DarwinDumper already contains this smcutil and we have many dumps from real Macs. But we want explanations what they are.

Link to comment
Share on other sites
zxv
zxv
Posted
Posted

Good list of SMC key descriptions from now defunct SystemInfoKit (working mirror of code here if interested):

PECI CPU                   : TCXC
PECI CPU                   : TCXc
CPU 1 Proximity            : TC0P
CPU 1 Heatsink             : TC0H
CPU 1 Package              : TC0D
CPU 1                      : TC0E
CPU 1                      : TC0F
CPU Core 1                 : TC1C
CPU Core 2                 : TC2C
CPU Core 3                 : TC3C
CPU Core 4                 : TC4C
CPU Core 5                 : TC5C
CPU Core 6                 : TC6C
CPU Core 7                 : TC7C
CPU Core 8                 : TC8C
CPU 1 Heatsink Alt.        : TCAH
CPU 1 Package Alt.         : TCAD
CPU 2 Proximity            : TC1P
CPU 2 Heatsink             : TC1H
CPU 2 Package              : TC1D
CPU 2                      : TC1E
CPU 2                      : TC1F
CPU 2 Heatsink Alt.        : TCBH
CPU 2 Package Alt.         : TCBD
PECI SA                    : TCSC
PECI SA                    : TCSc
PECI SA                    : TCSA
PECI GPU                   : TCGC
PECI GPU                   : TCGc
GPU Proximity              : TG0P
GPU Die                    : TG0D
GPU Die                    : TG1D
GPU Heatsink               : TG0H
GPU Heatsink               : TG1H
Memory Proximity           : Ts0S
Mem Bank A1                : TM0P
Mem Bank A2                : TM1P
Mem Bank B1                : TM8P
Mem Bank B2                : TM9P
Mem Module A1              : TM0S
Mem Module A2              : TM1S
Mem Module B1              : TM8S
Mem Module B2              : TM9S
Northbridge Die            : TN0D
Northbridge Proximity 1    : TN0P
Northbridge Proximity 2    : TN1P
MCH Die                    : TN0C
MCH Heatsink               : TN0H
PCH Die                    : TP0D
PCH Die                    : TPCD
PCH Proximity              : TP0P
Airflow 1                  : TA0P
Airflow 2                  : TA1P
Heatpipe 1                 : Th0H
Heatpipe 2                 : Th1H
Heatpipe 3                 : Th2H
Mainboard Proximity        : Tm0P
Powerboard Proximity       : Tp0P
Palm Rest                  : Ts0P
BLC Proximity              : Tb0P
LCD Proximity              : TL0P
Airport Proximity          : TW0P
HDD Bay 1                  : TH0P
HDD Bay 2                  : TH1P
HDD Bay 3                  : TH2P
HDD Bay 4                  : TH3P
Optical Drive              : TO0P
Battery TS_MAX             : TB0T
Battery 1                  : TB1T
Battery 2                  : TB2T
Battery                    : TB3T
Power Supply 1             : Tp0P
Power Supply 1 Alt.        : Tp0C
Power Supply 2             : Tp1P
Power Supply 2 Alt.        : Tp1C
Power Supply 3             : Tp2P
Power Supply 4             : Tp3P
Power Supply 5             : Tp4P
Power Supply 6             : Tp5P
Expansion Slots            : TS0C
PCI Slot 1 Pos 1           : TA0S
PCI Slot 1 Pos 2           : TA1S
PCI Slot 2 Pos 1           : TA2S
PCI Slot 2 Pos 2           : TA3S
CPU Core 1                 : VC0C
CPU Core 2                 : VC1C
CPU Core 3                 : VC2C
CPU Core 4                 : VC3C
CPU Core 5                 : VC4C
CPU Core 6                 : VC5C
CPU Core 7                 : VC6C
CPU Core 8                 : VC7C
CPU VTT                    : VV1R
GPU Core                   : VG0C
Memory                     : VM0R
PCH                        : VN1R
MCH                        : VN0C
Mainboard S0 Rail          : VD0R
Mainboard S5 Rail          : VD5R
12V Rail                   : VP0R
12V Vcc                    : Vp0C
Main 3V                    : VV2S
Main 3.3V                  : VR3R
Main 5V                    : VV1S
Main 5V                    : VH05
Main 12V                   : VV9S
Main 12V                   : VD2R
Auxiliary 3V               : VV7S
Standby 3V                 : VV3S
Standby 5V                 : VV8S
PCIe 12V                   : VeES
Battery                    : VBAT
CMOS Battery               : Vb0R
CPU Core                   : IC0C
CPU VccIO                  : IC1C
CPU VccSA                  : IC2C
CPU Rail                   : IC0R
CPU DRAM                   : IC5R
CPU PLL                    : IC8R
CPU GFX                    : IC0G
CPU Memory                 : IC0M
GPU Rail                   : IG0C
Memory Controller          : IM0C
Memory Rail                : IM0R
MCH                        : IN0C
Mainboard S0 Rail          : ID0R
Mainboard S5 Rail          : ID5R
Misc. Rail                 : IO0R
Battery Rail               : IB0R
Charger BMON               : IPBR
CPU Core 1                 : PC0C
CPU Core 2                 : PC1C
CPU Core 3                 : PC2C
CPU Core 4                 : PC3C
CPU Core 5                 : PC4C
CPU Core 6                 : PC5C
CPU Core 7                 : PC6C
CPU Core 8                 : PC7C
CPU Cores                  : PCPC
CPU GFX                    : PCPG
CPU DRAM                   : PCPD
CPU Total                  : PCTR
CPU Total                  : PCPL
CPU Rail                   : PC1R
CPU S0 Rail                : PC5R
GPU Total                  : PGTR
GPU Rail                   : PG0R
Memory Rail                : PM0R
MCH                        : PN0C
PCH Rail                   : PN1R
Mainboard S0 Rail          : PC0R
Mainboard S0 Rail          : PD0R
Mainboard S5 Rail          : PD5R
Main 3.3V Rail             : PH02
Main 5V Rail               : PH05
12V Rail                   : Pp0R
Main 12V Rail              : PD2R
Misc. Rail                 : PO0R
Battery Rail               : PBLC
Battery Rail               : PB0R
DC In Total                : PDTR
System Total               : PSTR
Merge with slice's SMC key list:

SMC_list(merged).plist.zip

  • Like 4
Link to comment
Share on other sites
  • 1 month later...
Slice
Slice
Posted
  • Author
Posted

Two keys asked by FileVault2 interface

BBAD [flag] (bytes 00)

BSIn [hex_] (bytes 42)

I don't know what they mean but I see real MacBookPro has constants here.

 

EDITED. 

From vit9696

BBAD, Battery Bad, Set to 1 if battery is in a bad state. For example, if it is taken out.

BSIn, Battery System info byte. BSIn[7:0]
0=Charging
1=AC present
2=AC presence changed
3=OS Stop Charge
4=OS Calibration Req
5=BatteryQueryInProgress
6=batOK
7=adcInProgress

  • Like 5
Link to comment
Share on other sites
  • 2 weeks later...
  • 7 months later...
  • 10 months later...
Slice
Slice
Posted
  • Author
Posted

There is a question to discover.

We can set SMCVersion and SMC chip revision to be like in real Mac. Is it worth to do this?

I am not sure. In this case the system will ask new SMC keys that we didn't provide.

May be better to emulate old hardware and be sure we have all needed keys provided by old chip? 

Link to comment
Share on other sites
  • 4 months later...
startergo
startergo
Posted
Posted

SMC keys in cMP5,1 seen by MFC: 

Macs Fan Control 1.4.12
MacPro5,1
CPU: Intel(R) Xeon(R) CPU X5690 @ 3.47GHz [100]
GPU: Radeon RX 480 [active], Radeon RX 480
macOS 10.15.2

Fans:
PCI-min{800}curr{798}max{4500}mode{2,TA0P,32,40}
PS-min{600}curr{914}max{2800}mode{2,Tp1C,38,48}
EXHAUST-min{600}curr{599}max{2800}mode{0}
INTAKE-min{600}curr{1864}max{2800}mode{2,TN0D,53,63}
BOOSTA-min{800}curr{3168}max{5200}mode{2,TN0D,53,63}
BOOSTB-min{800}curr{1113}max{5200}mode{0}


TempSensors:
TA0P (Ambient) - 31.625, 31.625
TCAC (CPU A core from PCECI) - 41.3125, 58.6875
TCAD (CPU A Diode) - 43.25, 43.25
TCAG () - 80, 80
TCAH (CPU A HeatSink) - 39.75, 39.75
TCAS () - 39.75, 39.75
TCBC (CPU B core from PCECI) - 33.625, 66.375
TCBD (CPU B Diode) - 36.875, 36.875
TCBG () - 80, 80
TCBH (CPU B HeatSink) - 32.875, 32.875
TCBS () - 33, 33
TH1F () - 32.5391, 32.5391
TH1P (Drive Bay 0) - 32.5, 32.5
TH1V () - 35.2227, 35.2227
TH2F () - 34.1992, 34.1992
TH2P (Drive Bay 1) - 34.375, 34.375
TH2V () - 33.4062, 33.4062
TH3F () - 33.9375, 33.9375
TH3P (Drive Bay 2) - 34, 34
TH3V () - 32.8633, 32.8633
TH4F () - 33.082, 33.082
TH4P (Drive Bay 3) - 33.125, 33.125
TH4V () - 35.3047, 35.3047
THPS () - 35.2969, 35.2969
THTG () - 58, 58
TM1P (DIMM Proximity 1) - 36.5, 36.5
TM2P (DIMM Proximity 2) - 37.375, 37.375
TM3P (DIMM Proximity 3) - 38.625, 38.625
TM4P (DIMM Proximity 4) - 38.25, 38.25
TM5P (DIMM Proximity 5) - 38.5, 38.5
TM6P (DIMM Proximity 6) - 40.625, 40.625
TM7P (DIMM Proximity 7) - 37.5, 37.5
TM8P (DIMM Proximity 8) - 29.5, 29.5
TMA1 () - 40.75, 40.75
TMA2 () - 42.5, 42.5
TMA3 () - 42.75, 42.75
TMA4 () - 42.25, 42.25
TMB1 () - 34, 34
TMB2 () - 33.5, 33.5
TMB3 () - 33.75, 33.75
TMB4 () - 32, 32
TMHS () - 42.75, 42.75
TMLS () - 32, 32
TMPS () - 42.75, 42.75
TMPV () - 40.0859, 40.0859
TMTG () - 75, 75
TN0D (IOH Diode) - 59.25, 59.25
TN0H (IOH HeatSink) - 47.125, 47.125
TNTG () - 65, 65
Te1F () - 128, 128
Te1P (PCIE Ambient) - 34.375, 34.375
Te1S () - 128, 128
Te2F () - 129, 129
Te2S () - 129, 129
Te3F () - 129, 129
Te3S () - 129, 129
Te4F () - 129, 129
Te4S () - 129, 129
Te5F () - 129, 129
Te5S () - 129, 129
TeGG () - 85, 85
TeGP () - 0, 0
TeRG () - 60, 60
TeRP () - 0, 0
Tp0C (PSMI Supply AC/DC Supply 1) - 39.8125, 39.8125
Tp1C (PSMI Supply AC/DC Supply 2) - 40.3906, 40.3906
TpPS () - 40.3906, 40.3906
TpTG () - 90, 90

 

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...