Skip to content

Add AppleSMC module: Apple SMC fan/sensor access#70

Open
JdovGamester wants to merge 1 commit into
namazso:mainfrom
JdovGamester:add-apple-smc-module-fixed
Open

Add AppleSMC module: Apple SMC fan/sensor access#70
JdovGamester wants to merge 1 commit into
namazso:mainfrom
JdovGamester:add-apple-smc-module-fixed

Conversation

@JdovGamester

Copy link
Copy Markdown

Summary

  • Adds AppleSMC.p, a module for reading/writing Apple SMC keys (fan RPM, min/max, target, mode bitmask, temperature sensors, etc.) on Intel Macs running Windows via Boot Camp.
  • Talks to the SMC over its standard I/O-port protocol (data port 0x300, command port 0x304) — the same interface documented and independently implemented by e.g. Linux's drivers/hwmon/applesmc.c.
  • Deliberately scoped to only those two fixed ports (unlike LpcIO.p's BAR-discovered range) — this module can't be used to poke arbitrary I/O, only the well-known Apple SMC handshake.
  • Exposes two IOCTLs: ioctl_smc_read(key, len) -> data and ioctl_smc_write(key, len, data).

Motivation

Built for a personal Boot Camp power/thermal management project. Wanted real fan-speed control without WinRing0 (blocklisted, CVE-2020-14979) — PawnIO's signed, scoped-module model is exactly the right fit, but there's currently no Apple SMC module in this repo.

Test plan

  • Compiles cleanly with pawncc -C64 against this repo's include/ (only pre-existing "tag mismatch" style warnings, same category as other modules comparing NTSTATUS: return values).
  • Verified with PawnIOUtil test against the signed driver: module load correctly fails at the signature-trust step (expected, since it isn't signed by the maintainer key) — confirms the module and PawnIOLib integration are structurally sound up to that boundary.
  • Full read/write behavior (SMC handshake, fan RPM decode/encode, FS! mode bitmask) is implemented per the well-documented protocol but untestable end-to-end until signed, since I don't have a way to load it through the trusted driver myself.

Happy to adjust naming/style/scope to match repo conventions — first contribution here.

…/0x304

Scoped to only these two fixed ports (unlike LpcIO's BAR-discovered range) -
this module cannot be used to poke arbitrary I/O, only the well-documented
Apple SMC protocol used by every Intel Mac (see e.g. Linux's applesmc.c for
an independent implementation of the same hardware interface).

Exposes ioctl_smc_read/ioctl_smc_write for reading/writing arbitrary SMC
keys (fan RPM, min/max, target, mode bitmask, temperature sensors, etc).

Built and tested against PawnIOLib on a MacBookPro15,1 running Windows 10
via Boot Camp; module structure validated via PawnIOUtil (fails cleanly on
the expected signature check since it isn't signed with the trusted key).
@namazso

namazso commented Jul 9, 2026

Copy link
Copy Markdown
Owner

Was this fully tested with the unrestricted driver? Note that the 2.2.0 installer is bugged, you'll need 2.1.0 or build the unrestricted version yourself.

Additionally, is it possible to restrict it more in main to only Apple devices at least? I'd assume there's some easily accessible artifact of an Apple device, unlike the other modules where manufacturers just throw random chips together on the board.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants