4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qemu/main-loop.h"
23 #include "exec/helper-proto.h"
25 #include "helper-tcg.h"
30 #if defined(CONFIG_USER_ONLY)
32 void do_smm_enter(X86CPU
*cpu
)
36 void helper_rsm(CPUX86State
*env
)
43 #define SMM_REVISION_ID 0x00020064
45 #define SMM_REVISION_ID 0x00020000
48 void do_smm_enter(X86CPU
*cpu
)
50 CPUX86State
*env
= &cpu
->env
;
51 CPUState
*cs
= CPU(cpu
);
52 target_ulong sm_state
;
56 qemu_log_mask(CPU_LOG_INT
, "SMM: enter\n");
57 log_cpu_state_mask(CPU_LOG_INT
, CPU(cpu
), CPU_DUMP_CCOP
);
60 env
->hflags
|= HF_SMM_MASK
;
61 if (env
->hflags2
& HF2_NMI_MASK
) {
62 env
->hflags2
|= HF2_SMM_INSIDE_NMI_MASK
;
64 env
->hflags2
|= HF2_NMI_MASK
;
67 sm_state
= env
->smbase
+ 0x8000;
70 for (i
= 0; i
< 6; i
++) {
72 offset
= 0x7e00 + i
* 16;
73 x86_stw_phys(cs
, sm_state
+ offset
, dt
->selector
);
74 x86_stw_phys(cs
, sm_state
+ offset
+ 2, (dt
->flags
>> 8) & 0xf0ff);
75 x86_stl_phys(cs
, sm_state
+ offset
+ 4, dt
->limit
);
76 x86_stq_phys(cs
, sm_state
+ offset
+ 8, dt
->base
);
79 x86_stq_phys(cs
, sm_state
+ 0x7e68, env
->gdt
.base
);
80 x86_stl_phys(cs
, sm_state
+ 0x7e64, env
->gdt
.limit
);
82 x86_stw_phys(cs
, sm_state
+ 0x7e70, env
->ldt
.selector
);
83 x86_stq_phys(cs
, sm_state
+ 0x7e78, env
->ldt
.base
);
84 x86_stl_phys(cs
, sm_state
+ 0x7e74, env
->ldt
.limit
);
85 x86_stw_phys(cs
, sm_state
+ 0x7e72, (env
->ldt
.flags
>> 8) & 0xf0ff);
87 x86_stq_phys(cs
, sm_state
+ 0x7e88, env
->idt
.base
);
88 x86_stl_phys(cs
, sm_state
+ 0x7e84, env
->idt
.limit
);
90 x86_stw_phys(cs
, sm_state
+ 0x7e90, env
->tr
.selector
);
91 x86_stq_phys(cs
, sm_state
+ 0x7e98, env
->tr
.base
);
92 x86_stl_phys(cs
, sm_state
+ 0x7e94, env
->tr
.limit
);
93 x86_stw_phys(cs
, sm_state
+ 0x7e92, (env
->tr
.flags
>> 8) & 0xf0ff);
95 /* ??? Vol 1, 16.5.6 Intel MPX and SMM says that IA32_BNDCFGS
96 is saved at offset 7ED0. Vol 3, 34.4.1.1, Table 32-2, has
97 7EA0-7ED7 as "reserved". What's this, and what's really
98 supposed to happen? */
99 x86_stq_phys(cs
, sm_state
+ 0x7ed0, env
->efer
);
101 x86_stq_phys(cs
, sm_state
+ 0x7ff8, env
->regs
[R_EAX
]);
102 x86_stq_phys(cs
, sm_state
+ 0x7ff0, env
->regs
[R_ECX
]);
103 x86_stq_phys(cs
, sm_state
+ 0x7fe8, env
->regs
[R_EDX
]);
104 x86_stq_phys(cs
, sm_state
+ 0x7fe0, env
->regs
[R_EBX
]);
105 x86_stq_phys(cs
, sm_state
+ 0x7fd8, env
->regs
[R_ESP
]);
106 x86_stq_phys(cs
, sm_state
+ 0x7fd0, env
->regs
[R_EBP
]);
107 x86_stq_phys(cs
, sm_state
+ 0x7fc8, env
->regs
[R_ESI
]);
108 x86_stq_phys(cs
, sm_state
+ 0x7fc0, env
->regs
[R_EDI
]);
109 for (i
= 8; i
< 16; i
++) {
110 x86_stq_phys(cs
, sm_state
+ 0x7ff8 - i
* 8, env
->regs
[i
]);
112 x86_stq_phys(cs
, sm_state
+ 0x7f78, env
->eip
);
113 x86_stl_phys(cs
, sm_state
+ 0x7f70, cpu_compute_eflags(env
));
114 x86_stl_phys(cs
, sm_state
+ 0x7f68, env
->dr
[6]);
115 x86_stl_phys(cs
, sm_state
+ 0x7f60, env
->dr
[7]);
117 x86_stl_phys(cs
, sm_state
+ 0x7f48, env
->cr
[4]);
118 x86_stq_phys(cs
, sm_state
+ 0x7f50, env
->cr
[3]);
119 x86_stl_phys(cs
, sm_state
+ 0x7f58, env
->cr
[0]);
121 x86_stl_phys(cs
, sm_state
+ 0x7efc, SMM_REVISION_ID
);
122 x86_stl_phys(cs
, sm_state
+ 0x7f00, env
->smbase
);
124 x86_stl_phys(cs
, sm_state
+ 0x7ffc, env
->cr
[0]);
125 x86_stl_phys(cs
, sm_state
+ 0x7ff8, env
->cr
[3]);
126 x86_stl_phys(cs
, sm_state
+ 0x7ff4, cpu_compute_eflags(env
));
127 x86_stl_phys(cs
, sm_state
+ 0x7ff0, env
->eip
);
128 x86_stl_phys(cs
, sm_state
+ 0x7fec, env
->regs
[R_EDI
]);
129 x86_stl_phys(cs
, sm_state
+ 0x7fe8, env
->regs
[R_ESI
]);
130 x86_stl_phys(cs
, sm_state
+ 0x7fe4, env
->regs
[R_EBP
]);
131 x86_stl_phys(cs
, sm_state
+ 0x7fe0, env
->regs
[R_ESP
]);
132 x86_stl_phys(cs
, sm_state
+ 0x7fdc, env
->regs
[R_EBX
]);
133 x86_stl_phys(cs
, sm_state
+ 0x7fd8, env
->regs
[R_EDX
]);
134 x86_stl_phys(cs
, sm_state
+ 0x7fd4, env
->regs
[R_ECX
]);
135 x86_stl_phys(cs
, sm_state
+ 0x7fd0, env
->regs
[R_EAX
]);
136 x86_stl_phys(cs
, sm_state
+ 0x7fcc, env
->dr
[6]);
137 x86_stl_phys(cs
, sm_state
+ 0x7fc8, env
->dr
[7]);
139 x86_stl_phys(cs
, sm_state
+ 0x7fc4, env
->tr
.selector
);
140 x86_stl_phys(cs
, sm_state
+ 0x7f64, env
->tr
.base
);
141 x86_stl_phys(cs
, sm_state
+ 0x7f60, env
->tr
.limit
);
142 x86_stl_phys(cs
, sm_state
+ 0x7f5c, (env
->tr
.flags
>> 8) & 0xf0ff);
144 x86_stl_phys(cs
, sm_state
+ 0x7fc0, env
->ldt
.selector
);
145 x86_stl_phys(cs
, sm_state
+ 0x7f80, env
->ldt
.base
);
146 x86_stl_phys(cs
, sm_state
+ 0x7f7c, env
->ldt
.limit
);
147 x86_stl_phys(cs
, sm_state
+ 0x7f78, (env
->ldt
.flags
>> 8) & 0xf0ff);
149 x86_stl_phys(cs
, sm_state
+ 0x7f74, env
->gdt
.base
);
150 x86_stl_phys(cs
, sm_state
+ 0x7f70, env
->gdt
.limit
);
152 x86_stl_phys(cs
, sm_state
+ 0x7f58, env
->idt
.base
);
153 x86_stl_phys(cs
, sm_state
+ 0x7f54, env
->idt
.limit
);
155 for (i
= 0; i
< 6; i
++) {
158 offset
= 0x7f84 + i
* 12;
160 offset
= 0x7f2c + (i
- 3) * 12;
162 x86_stl_phys(cs
, sm_state
+ 0x7fa8 + i
* 4, dt
->selector
);
163 x86_stl_phys(cs
, sm_state
+ offset
+ 8, dt
->base
);
164 x86_stl_phys(cs
, sm_state
+ offset
+ 4, dt
->limit
);
165 x86_stl_phys(cs
, sm_state
+ offset
, (dt
->flags
>> 8) & 0xf0ff);
167 x86_stl_phys(cs
, sm_state
+ 0x7f14, env
->cr
[4]);
169 x86_stl_phys(cs
, sm_state
+ 0x7efc, SMM_REVISION_ID
);
170 x86_stl_phys(cs
, sm_state
+ 0x7ef8, env
->smbase
);
172 /* init SMM cpu state */
175 cpu_load_efer(env
, 0);
177 cpu_load_eflags(env
, 0, ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
|
179 env
->eip
= 0x00008000;
180 cpu_x86_update_cr0(env
,
181 env
->cr
[0] & ~(CR0_PE_MASK
| CR0_EM_MASK
| CR0_TS_MASK
|
183 cpu_x86_update_cr4(env
, 0);
184 env
->dr
[7] = 0x00000400;
186 cpu_x86_load_seg_cache(env
, R_CS
, (env
->smbase
>> 4) & 0xffff, env
->smbase
,
188 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
189 DESC_G_MASK
| DESC_A_MASK
);
190 cpu_x86_load_seg_cache(env
, R_DS
, 0, 0, 0xffffffff,
191 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
192 DESC_G_MASK
| DESC_A_MASK
);
193 cpu_x86_load_seg_cache(env
, R_ES
, 0, 0, 0xffffffff,
194 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
195 DESC_G_MASK
| DESC_A_MASK
);
196 cpu_x86_load_seg_cache(env
, R_SS
, 0, 0, 0xffffffff,
197 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
198 DESC_G_MASK
| DESC_A_MASK
);
199 cpu_x86_load_seg_cache(env
, R_FS
, 0, 0, 0xffffffff,
200 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
201 DESC_G_MASK
| DESC_A_MASK
);
202 cpu_x86_load_seg_cache(env
, R_GS
, 0, 0, 0xffffffff,
203 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
204 DESC_G_MASK
| DESC_A_MASK
);
207 void helper_rsm(CPUX86State
*env
)
209 X86CPU
*cpu
= env_archcpu(env
);
210 CPUState
*cs
= env_cpu(env
);
211 target_ulong sm_state
;
215 sm_state
= env
->smbase
+ 0x8000;
217 cpu_load_efer(env
, x86_ldq_phys(cs
, sm_state
+ 0x7ed0));
219 env
->gdt
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e68);
220 env
->gdt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e64);
222 env
->ldt
.selector
= x86_lduw_phys(cs
, sm_state
+ 0x7e70);
223 env
->ldt
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e78);
224 env
->ldt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e74);
225 env
->ldt
.flags
= (x86_lduw_phys(cs
, sm_state
+ 0x7e72) & 0xf0ff) << 8;
227 env
->idt
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e88);
228 env
->idt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e84);
230 env
->tr
.selector
= x86_lduw_phys(cs
, sm_state
+ 0x7e90);
231 env
->tr
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e98);
232 env
->tr
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e94);
233 env
->tr
.flags
= (x86_lduw_phys(cs
, sm_state
+ 0x7e92) & 0xf0ff) << 8;
235 env
->regs
[R_EAX
] = x86_ldq_phys(cs
, sm_state
+ 0x7ff8);
236 env
->regs
[R_ECX
] = x86_ldq_phys(cs
, sm_state
+ 0x7ff0);
237 env
->regs
[R_EDX
] = x86_ldq_phys(cs
, sm_state
+ 0x7fe8);
238 env
->regs
[R_EBX
] = x86_ldq_phys(cs
, sm_state
+ 0x7fe0);
239 env
->regs
[R_ESP
] = x86_ldq_phys(cs
, sm_state
+ 0x7fd8);
240 env
->regs
[R_EBP
] = x86_ldq_phys(cs
, sm_state
+ 0x7fd0);
241 env
->regs
[R_ESI
] = x86_ldq_phys(cs
, sm_state
+ 0x7fc8);
242 env
->regs
[R_EDI
] = x86_ldq_phys(cs
, sm_state
+ 0x7fc0);
243 for (i
= 8; i
< 16; i
++) {
244 env
->regs
[i
] = x86_ldq_phys(cs
, sm_state
+ 0x7ff8 - i
* 8);
246 env
->eip
= x86_ldq_phys(cs
, sm_state
+ 0x7f78);
247 cpu_load_eflags(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f70),
248 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
249 env
->dr
[6] = x86_ldl_phys(cs
, sm_state
+ 0x7f68);
250 env
->dr
[7] = x86_ldl_phys(cs
, sm_state
+ 0x7f60);
252 cpu_x86_update_cr4(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f48));
253 cpu_x86_update_cr3(env
, x86_ldq_phys(cs
, sm_state
+ 0x7f50));
254 cpu_x86_update_cr0(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f58));
256 for (i
= 0; i
< 6; i
++) {
257 offset
= 0x7e00 + i
* 16;
258 cpu_x86_load_seg_cache(env
, i
,
259 x86_lduw_phys(cs
, sm_state
+ offset
),
260 x86_ldq_phys(cs
, sm_state
+ offset
+ 8),
261 x86_ldl_phys(cs
, sm_state
+ offset
+ 4),
262 (x86_lduw_phys(cs
, sm_state
+ offset
+ 2) &
266 val
= x86_ldl_phys(cs
, sm_state
+ 0x7efc); /* revision ID */
268 env
->smbase
= x86_ldl_phys(cs
, sm_state
+ 0x7f00);
271 cpu_x86_update_cr0(env
, x86_ldl_phys(cs
, sm_state
+ 0x7ffc));
272 cpu_x86_update_cr3(env
, x86_ldl_phys(cs
, sm_state
+ 0x7ff8));
273 cpu_load_eflags(env
, x86_ldl_phys(cs
, sm_state
+ 0x7ff4),
274 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
275 env
->eip
= x86_ldl_phys(cs
, sm_state
+ 0x7ff0);
276 env
->regs
[R_EDI
] = x86_ldl_phys(cs
, sm_state
+ 0x7fec);
277 env
->regs
[R_ESI
] = x86_ldl_phys(cs
, sm_state
+ 0x7fe8);
278 env
->regs
[R_EBP
] = x86_ldl_phys(cs
, sm_state
+ 0x7fe4);
279 env
->regs
[R_ESP
] = x86_ldl_phys(cs
, sm_state
+ 0x7fe0);
280 env
->regs
[R_EBX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fdc);
281 env
->regs
[R_EDX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fd8);
282 env
->regs
[R_ECX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fd4);
283 env
->regs
[R_EAX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fd0);
284 env
->dr
[6] = x86_ldl_phys(cs
, sm_state
+ 0x7fcc);
285 env
->dr
[7] = x86_ldl_phys(cs
, sm_state
+ 0x7fc8);
287 env
->tr
.selector
= x86_ldl_phys(cs
, sm_state
+ 0x7fc4) & 0xffff;
288 env
->tr
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f64);
289 env
->tr
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f60);
290 env
->tr
.flags
= (x86_ldl_phys(cs
, sm_state
+ 0x7f5c) & 0xf0ff) << 8;
292 env
->ldt
.selector
= x86_ldl_phys(cs
, sm_state
+ 0x7fc0) & 0xffff;
293 env
->ldt
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f80);
294 env
->ldt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f7c);
295 env
->ldt
.flags
= (x86_ldl_phys(cs
, sm_state
+ 0x7f78) & 0xf0ff) << 8;
297 env
->gdt
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f74);
298 env
->gdt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f70);
300 env
->idt
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f58);
301 env
->idt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f54);
303 for (i
= 0; i
< 6; i
++) {
305 offset
= 0x7f84 + i
* 12;
307 offset
= 0x7f2c + (i
- 3) * 12;
309 cpu_x86_load_seg_cache(env
, i
,
311 sm_state
+ 0x7fa8 + i
* 4) & 0xffff,
312 x86_ldl_phys(cs
, sm_state
+ offset
+ 8),
313 x86_ldl_phys(cs
, sm_state
+ offset
+ 4),
315 sm_state
+ offset
) & 0xf0ff) << 8);
317 cpu_x86_update_cr4(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f14));
319 val
= x86_ldl_phys(cs
, sm_state
+ 0x7efc); /* revision ID */
321 env
->smbase
= x86_ldl_phys(cs
, sm_state
+ 0x7ef8);
324 if ((env
->hflags2
& HF2_SMM_INSIDE_NMI_MASK
) == 0) {
325 env
->hflags2
&= ~HF2_NMI_MASK
;
327 env
->hflags2
&= ~HF2_SMM_INSIDE_NMI_MASK
;
328 env
->hflags
&= ~HF_SMM_MASK
;
330 qemu_log_mask(CPU_LOG_INT
, "SMM: after RSM\n");
331 log_cpu_state_mask(CPU_LOG_INT
, CPU(cpu
), CPU_DUMP_CCOP
);
334 #endif /* !CONFIG_USER_ONLY */