4 * Copyright (c) 2003 Fabrice Bellard
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qemu/main-loop.h"
23 #include "exec/helper-proto.h"
28 #if defined(CONFIG_USER_ONLY)
30 void do_smm_enter(X86CPU
*cpu
)
34 void helper_rsm(CPUX86State
*env
)
41 #define SMM_REVISION_ID 0x00020064
43 #define SMM_REVISION_ID 0x00020000
46 /* Called with iothread lock taken */
47 void cpu_smm_update(X86CPU
*cpu
)
49 CPUX86State
*env
= &cpu
->env
;
50 bool smm_enabled
= (env
->hflags
& HF_SMM_MASK
);
52 g_assert(qemu_mutex_iothread_locked());
55 memory_region_set_enabled(cpu
->smram
, smm_enabled
);
59 void do_smm_enter(X86CPU
*cpu
)
61 CPUX86State
*env
= &cpu
->env
;
62 CPUState
*cs
= CPU(cpu
);
63 target_ulong sm_state
;
67 qemu_log_mask(CPU_LOG_INT
, "SMM: enter\n");
68 log_cpu_state_mask(CPU_LOG_INT
, CPU(cpu
), CPU_DUMP_CCOP
);
70 env
->hflags
|= HF_SMM_MASK
;
71 if (env
->hflags2
& HF2_NMI_MASK
) {
72 env
->hflags2
|= HF2_SMM_INSIDE_NMI_MASK
;
74 env
->hflags2
|= HF2_NMI_MASK
;
78 sm_state
= env
->smbase
+ 0x8000;
81 for (i
= 0; i
< 6; i
++) {
83 offset
= 0x7e00 + i
* 16;
84 x86_stw_phys(cs
, sm_state
+ offset
, dt
->selector
);
85 x86_stw_phys(cs
, sm_state
+ offset
+ 2, (dt
->flags
>> 8) & 0xf0ff);
86 x86_stl_phys(cs
, sm_state
+ offset
+ 4, dt
->limit
);
87 x86_stq_phys(cs
, sm_state
+ offset
+ 8, dt
->base
);
90 x86_stq_phys(cs
, sm_state
+ 0x7e68, env
->gdt
.base
);
91 x86_stl_phys(cs
, sm_state
+ 0x7e64, env
->gdt
.limit
);
93 x86_stw_phys(cs
, sm_state
+ 0x7e70, env
->ldt
.selector
);
94 x86_stq_phys(cs
, sm_state
+ 0x7e78, env
->ldt
.base
);
95 x86_stl_phys(cs
, sm_state
+ 0x7e74, env
->ldt
.limit
);
96 x86_stw_phys(cs
, sm_state
+ 0x7e72, (env
->ldt
.flags
>> 8) & 0xf0ff);
98 x86_stq_phys(cs
, sm_state
+ 0x7e88, env
->idt
.base
);
99 x86_stl_phys(cs
, sm_state
+ 0x7e84, env
->idt
.limit
);
101 x86_stw_phys(cs
, sm_state
+ 0x7e90, env
->tr
.selector
);
102 x86_stq_phys(cs
, sm_state
+ 0x7e98, env
->tr
.base
);
103 x86_stl_phys(cs
, sm_state
+ 0x7e94, env
->tr
.limit
);
104 x86_stw_phys(cs
, sm_state
+ 0x7e92, (env
->tr
.flags
>> 8) & 0xf0ff);
106 /* ??? Vol 1, 16.5.6 Intel MPX and SMM says that IA32_BNDCFGS
107 is saved at offset 7ED0. Vol 3, 34.4.1.1, Table 32-2, has
108 7EA0-7ED7 as "reserved". What's this, and what's really
109 supposed to happen? */
110 x86_stq_phys(cs
, sm_state
+ 0x7ed0, env
->efer
);
112 x86_stq_phys(cs
, sm_state
+ 0x7ff8, env
->regs
[R_EAX
]);
113 x86_stq_phys(cs
, sm_state
+ 0x7ff0, env
->regs
[R_ECX
]);
114 x86_stq_phys(cs
, sm_state
+ 0x7fe8, env
->regs
[R_EDX
]);
115 x86_stq_phys(cs
, sm_state
+ 0x7fe0, env
->regs
[R_EBX
]);
116 x86_stq_phys(cs
, sm_state
+ 0x7fd8, env
->regs
[R_ESP
]);
117 x86_stq_phys(cs
, sm_state
+ 0x7fd0, env
->regs
[R_EBP
]);
118 x86_stq_phys(cs
, sm_state
+ 0x7fc8, env
->regs
[R_ESI
]);
119 x86_stq_phys(cs
, sm_state
+ 0x7fc0, env
->regs
[R_EDI
]);
120 for (i
= 8; i
< 16; i
++) {
121 x86_stq_phys(cs
, sm_state
+ 0x7ff8 - i
* 8, env
->regs
[i
]);
123 x86_stq_phys(cs
, sm_state
+ 0x7f78, env
->eip
);
124 x86_stl_phys(cs
, sm_state
+ 0x7f70, cpu_compute_eflags(env
));
125 x86_stl_phys(cs
, sm_state
+ 0x7f68, env
->dr
[6]);
126 x86_stl_phys(cs
, sm_state
+ 0x7f60, env
->dr
[7]);
128 x86_stl_phys(cs
, sm_state
+ 0x7f48, env
->cr
[4]);
129 x86_stq_phys(cs
, sm_state
+ 0x7f50, env
->cr
[3]);
130 x86_stl_phys(cs
, sm_state
+ 0x7f58, env
->cr
[0]);
132 x86_stl_phys(cs
, sm_state
+ 0x7efc, SMM_REVISION_ID
);
133 x86_stl_phys(cs
, sm_state
+ 0x7f00, env
->smbase
);
135 x86_stl_phys(cs
, sm_state
+ 0x7ffc, env
->cr
[0]);
136 x86_stl_phys(cs
, sm_state
+ 0x7ff8, env
->cr
[3]);
137 x86_stl_phys(cs
, sm_state
+ 0x7ff4, cpu_compute_eflags(env
));
138 x86_stl_phys(cs
, sm_state
+ 0x7ff0, env
->eip
);
139 x86_stl_phys(cs
, sm_state
+ 0x7fec, env
->regs
[R_EDI
]);
140 x86_stl_phys(cs
, sm_state
+ 0x7fe8, env
->regs
[R_ESI
]);
141 x86_stl_phys(cs
, sm_state
+ 0x7fe4, env
->regs
[R_EBP
]);
142 x86_stl_phys(cs
, sm_state
+ 0x7fe0, env
->regs
[R_ESP
]);
143 x86_stl_phys(cs
, sm_state
+ 0x7fdc, env
->regs
[R_EBX
]);
144 x86_stl_phys(cs
, sm_state
+ 0x7fd8, env
->regs
[R_EDX
]);
145 x86_stl_phys(cs
, sm_state
+ 0x7fd4, env
->regs
[R_ECX
]);
146 x86_stl_phys(cs
, sm_state
+ 0x7fd0, env
->regs
[R_EAX
]);
147 x86_stl_phys(cs
, sm_state
+ 0x7fcc, env
->dr
[6]);
148 x86_stl_phys(cs
, sm_state
+ 0x7fc8, env
->dr
[7]);
150 x86_stl_phys(cs
, sm_state
+ 0x7fc4, env
->tr
.selector
);
151 x86_stl_phys(cs
, sm_state
+ 0x7f64, env
->tr
.base
);
152 x86_stl_phys(cs
, sm_state
+ 0x7f60, env
->tr
.limit
);
153 x86_stl_phys(cs
, sm_state
+ 0x7f5c, (env
->tr
.flags
>> 8) & 0xf0ff);
155 x86_stl_phys(cs
, sm_state
+ 0x7fc0, env
->ldt
.selector
);
156 x86_stl_phys(cs
, sm_state
+ 0x7f80, env
->ldt
.base
);
157 x86_stl_phys(cs
, sm_state
+ 0x7f7c, env
->ldt
.limit
);
158 x86_stl_phys(cs
, sm_state
+ 0x7f78, (env
->ldt
.flags
>> 8) & 0xf0ff);
160 x86_stl_phys(cs
, sm_state
+ 0x7f74, env
->gdt
.base
);
161 x86_stl_phys(cs
, sm_state
+ 0x7f70, env
->gdt
.limit
);
163 x86_stl_phys(cs
, sm_state
+ 0x7f58, env
->idt
.base
);
164 x86_stl_phys(cs
, sm_state
+ 0x7f54, env
->idt
.limit
);
166 for (i
= 0; i
< 6; i
++) {
169 offset
= 0x7f84 + i
* 12;
171 offset
= 0x7f2c + (i
- 3) * 12;
173 x86_stl_phys(cs
, sm_state
+ 0x7fa8 + i
* 4, dt
->selector
);
174 x86_stl_phys(cs
, sm_state
+ offset
+ 8, dt
->base
);
175 x86_stl_phys(cs
, sm_state
+ offset
+ 4, dt
->limit
);
176 x86_stl_phys(cs
, sm_state
+ offset
, (dt
->flags
>> 8) & 0xf0ff);
178 x86_stl_phys(cs
, sm_state
+ 0x7f14, env
->cr
[4]);
180 x86_stl_phys(cs
, sm_state
+ 0x7efc, SMM_REVISION_ID
);
181 x86_stl_phys(cs
, sm_state
+ 0x7ef8, env
->smbase
);
183 /* init SMM cpu state */
186 cpu_load_efer(env
, 0);
188 cpu_load_eflags(env
, 0, ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
|
190 env
->eip
= 0x00008000;
191 cpu_x86_update_cr0(env
,
192 env
->cr
[0] & ~(CR0_PE_MASK
| CR0_EM_MASK
| CR0_TS_MASK
|
194 cpu_x86_update_cr4(env
, 0);
195 env
->dr
[7] = 0x00000400;
197 cpu_x86_load_seg_cache(env
, R_CS
, (env
->smbase
>> 4) & 0xffff, env
->smbase
,
199 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
200 DESC_G_MASK
| DESC_A_MASK
);
201 cpu_x86_load_seg_cache(env
, R_DS
, 0, 0, 0xffffffff,
202 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
203 DESC_G_MASK
| DESC_A_MASK
);
204 cpu_x86_load_seg_cache(env
, R_ES
, 0, 0, 0xffffffff,
205 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
206 DESC_G_MASK
| DESC_A_MASK
);
207 cpu_x86_load_seg_cache(env
, R_SS
, 0, 0, 0xffffffff,
208 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
209 DESC_G_MASK
| DESC_A_MASK
);
210 cpu_x86_load_seg_cache(env
, R_FS
, 0, 0, 0xffffffff,
211 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
212 DESC_G_MASK
| DESC_A_MASK
);
213 cpu_x86_load_seg_cache(env
, R_GS
, 0, 0, 0xffffffff,
214 DESC_P_MASK
| DESC_S_MASK
| DESC_W_MASK
|
215 DESC_G_MASK
| DESC_A_MASK
);
218 void helper_rsm(CPUX86State
*env
)
220 X86CPU
*cpu
= x86_env_get_cpu(env
);
221 CPUState
*cs
= CPU(cpu
);
222 target_ulong sm_state
;
226 sm_state
= env
->smbase
+ 0x8000;
228 cpu_load_efer(env
, x86_ldq_phys(cs
, sm_state
+ 0x7ed0));
230 env
->gdt
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e68);
231 env
->gdt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e64);
233 env
->ldt
.selector
= x86_lduw_phys(cs
, sm_state
+ 0x7e70);
234 env
->ldt
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e78);
235 env
->ldt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e74);
236 env
->ldt
.flags
= (x86_lduw_phys(cs
, sm_state
+ 0x7e72) & 0xf0ff) << 8;
238 env
->idt
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e88);
239 env
->idt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e84);
241 env
->tr
.selector
= x86_lduw_phys(cs
, sm_state
+ 0x7e90);
242 env
->tr
.base
= x86_ldq_phys(cs
, sm_state
+ 0x7e98);
243 env
->tr
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7e94);
244 env
->tr
.flags
= (x86_lduw_phys(cs
, sm_state
+ 0x7e92) & 0xf0ff) << 8;
246 env
->regs
[R_EAX
] = x86_ldq_phys(cs
, sm_state
+ 0x7ff8);
247 env
->regs
[R_ECX
] = x86_ldq_phys(cs
, sm_state
+ 0x7ff0);
248 env
->regs
[R_EDX
] = x86_ldq_phys(cs
, sm_state
+ 0x7fe8);
249 env
->regs
[R_EBX
] = x86_ldq_phys(cs
, sm_state
+ 0x7fe0);
250 env
->regs
[R_ESP
] = x86_ldq_phys(cs
, sm_state
+ 0x7fd8);
251 env
->regs
[R_EBP
] = x86_ldq_phys(cs
, sm_state
+ 0x7fd0);
252 env
->regs
[R_ESI
] = x86_ldq_phys(cs
, sm_state
+ 0x7fc8);
253 env
->regs
[R_EDI
] = x86_ldq_phys(cs
, sm_state
+ 0x7fc0);
254 for (i
= 8; i
< 16; i
++) {
255 env
->regs
[i
] = x86_ldq_phys(cs
, sm_state
+ 0x7ff8 - i
* 8);
257 env
->eip
= x86_ldq_phys(cs
, sm_state
+ 0x7f78);
258 cpu_load_eflags(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f70),
259 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
260 env
->dr
[6] = x86_ldl_phys(cs
, sm_state
+ 0x7f68);
261 env
->dr
[7] = x86_ldl_phys(cs
, sm_state
+ 0x7f60);
263 cpu_x86_update_cr4(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f48));
264 cpu_x86_update_cr3(env
, x86_ldq_phys(cs
, sm_state
+ 0x7f50));
265 cpu_x86_update_cr0(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f58));
267 for (i
= 0; i
< 6; i
++) {
268 offset
= 0x7e00 + i
* 16;
269 cpu_x86_load_seg_cache(env
, i
,
270 x86_lduw_phys(cs
, sm_state
+ offset
),
271 x86_ldq_phys(cs
, sm_state
+ offset
+ 8),
272 x86_ldl_phys(cs
, sm_state
+ offset
+ 4),
273 (x86_lduw_phys(cs
, sm_state
+ offset
+ 2) &
277 val
= x86_ldl_phys(cs
, sm_state
+ 0x7efc); /* revision ID */
279 env
->smbase
= x86_ldl_phys(cs
, sm_state
+ 0x7f00);
282 cpu_x86_update_cr0(env
, x86_ldl_phys(cs
, sm_state
+ 0x7ffc));
283 cpu_x86_update_cr3(env
, x86_ldl_phys(cs
, sm_state
+ 0x7ff8));
284 cpu_load_eflags(env
, x86_ldl_phys(cs
, sm_state
+ 0x7ff4),
285 ~(CC_O
| CC_S
| CC_Z
| CC_A
| CC_P
| CC_C
| DF_MASK
));
286 env
->eip
= x86_ldl_phys(cs
, sm_state
+ 0x7ff0);
287 env
->regs
[R_EDI
] = x86_ldl_phys(cs
, sm_state
+ 0x7fec);
288 env
->regs
[R_ESI
] = x86_ldl_phys(cs
, sm_state
+ 0x7fe8);
289 env
->regs
[R_EBP
] = x86_ldl_phys(cs
, sm_state
+ 0x7fe4);
290 env
->regs
[R_ESP
] = x86_ldl_phys(cs
, sm_state
+ 0x7fe0);
291 env
->regs
[R_EBX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fdc);
292 env
->regs
[R_EDX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fd8);
293 env
->regs
[R_ECX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fd4);
294 env
->regs
[R_EAX
] = x86_ldl_phys(cs
, sm_state
+ 0x7fd0);
295 env
->dr
[6] = x86_ldl_phys(cs
, sm_state
+ 0x7fcc);
296 env
->dr
[7] = x86_ldl_phys(cs
, sm_state
+ 0x7fc8);
298 env
->tr
.selector
= x86_ldl_phys(cs
, sm_state
+ 0x7fc4) & 0xffff;
299 env
->tr
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f64);
300 env
->tr
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f60);
301 env
->tr
.flags
= (x86_ldl_phys(cs
, sm_state
+ 0x7f5c) & 0xf0ff) << 8;
303 env
->ldt
.selector
= x86_ldl_phys(cs
, sm_state
+ 0x7fc0) & 0xffff;
304 env
->ldt
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f80);
305 env
->ldt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f7c);
306 env
->ldt
.flags
= (x86_ldl_phys(cs
, sm_state
+ 0x7f78) & 0xf0ff) << 8;
308 env
->gdt
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f74);
309 env
->gdt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f70);
311 env
->idt
.base
= x86_ldl_phys(cs
, sm_state
+ 0x7f58);
312 env
->idt
.limit
= x86_ldl_phys(cs
, sm_state
+ 0x7f54);
314 for (i
= 0; i
< 6; i
++) {
316 offset
= 0x7f84 + i
* 12;
318 offset
= 0x7f2c + (i
- 3) * 12;
320 cpu_x86_load_seg_cache(env
, i
,
322 sm_state
+ 0x7fa8 + i
* 4) & 0xffff,
323 x86_ldl_phys(cs
, sm_state
+ offset
+ 8),
324 x86_ldl_phys(cs
, sm_state
+ offset
+ 4),
326 sm_state
+ offset
) & 0xf0ff) << 8);
328 cpu_x86_update_cr4(env
, x86_ldl_phys(cs
, sm_state
+ 0x7f14));
330 val
= x86_ldl_phys(cs
, sm_state
+ 0x7efc); /* revision ID */
332 env
->smbase
= x86_ldl_phys(cs
, sm_state
+ 0x7ef8);
335 if ((env
->hflags2
& HF2_SMM_INSIDE_NMI_MASK
) == 0) {
336 env
->hflags2
&= ~HF2_NMI_MASK
;
338 env
->hflags2
&= ~HF2_SMM_INSIDE_NMI_MASK
;
339 env
->hflags
&= ~HF_SMM_MASK
;
341 qemu_mutex_lock_iothread();
343 qemu_mutex_unlock_iothread();
345 qemu_log_mask(CPU_LOG_INT
, "SMM: after RSM\n");
346 log_cpu_state_mask(CPU_LOG_INT
, CPU(cpu
), CPU_DUMP_CCOP
);
349 #endif /* !CONFIG_USER_ONLY */