1 | /* |
2 | * x86 SMM helpers |
3 | * |
4 | * Copyright (c) 2003 Fabrice Bellard |
5 | * |
6 | * This library is free software; you can redistribute it and/or |
7 | * modify it under the terms of the GNU Lesser General Public |
8 | * License as published by the Free Software Foundation; either |
9 | * version 2 of the License, or (at your option) any later version. |
10 | * |
11 | * This library is distributed in the hope that it will be useful, |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
14 | * Lesser General Public License for more details. |
15 | * |
16 | * You should have received a copy of the GNU Lesser General Public |
17 | * License along with this library; if not, see <http://www.gnu.org/licenses/>. |
18 | */ |
19 | |
20 | #include "qemu/osdep.h" |
21 | #include "qemu/main-loop.h" |
22 | #include "cpu.h" |
23 | #include "exec/helper-proto.h" |
24 | #include "exec/log.h" |
25 | |
26 | /* SMM support */ |
27 | |
28 | #if defined(CONFIG_USER_ONLY) |
29 | |
30 | void do_smm_enter(X86CPU *cpu) |
31 | { |
32 | } |
33 | |
34 | void helper_rsm(CPUX86State *env) |
35 | { |
36 | } |
37 | |
38 | #else |
39 | |
40 | #ifdef TARGET_X86_64 |
41 | #define SMM_REVISION_ID 0x00020064 |
42 | #else |
43 | #define SMM_REVISION_ID 0x00020000 |
44 | #endif |
45 | |
46 | void do_smm_enter(X86CPU *cpu) |
47 | { |
48 | CPUX86State *env = &cpu->env; |
49 | CPUState *cs = CPU(cpu); |
50 | target_ulong sm_state; |
51 | SegmentCache *dt; |
52 | int i, offset; |
53 | |
54 | qemu_log_mask(CPU_LOG_INT, "SMM: enter\n" ); |
55 | log_cpu_state_mask(CPU_LOG_INT, CPU(cpu), CPU_DUMP_CCOP); |
56 | |
57 | env->msr_smi_count++; |
58 | env->hflags |= HF_SMM_MASK; |
59 | if (env->hflags2 & HF2_NMI_MASK) { |
60 | env->hflags2 |= HF2_SMM_INSIDE_NMI_MASK; |
61 | } else { |
62 | env->hflags2 |= HF2_NMI_MASK; |
63 | } |
64 | |
65 | sm_state = env->smbase + 0x8000; |
66 | |
67 | #ifdef TARGET_X86_64 |
68 | for (i = 0; i < 6; i++) { |
69 | dt = &env->segs[i]; |
70 | offset = 0x7e00 + i * 16; |
71 | x86_stw_phys(cs, sm_state + offset, dt->selector); |
72 | x86_stw_phys(cs, sm_state + offset + 2, (dt->flags >> 8) & 0xf0ff); |
73 | x86_stl_phys(cs, sm_state + offset + 4, dt->limit); |
74 | x86_stq_phys(cs, sm_state + offset + 8, dt->base); |
75 | } |
76 | |
77 | x86_stq_phys(cs, sm_state + 0x7e68, env->gdt.base); |
78 | x86_stl_phys(cs, sm_state + 0x7e64, env->gdt.limit); |
79 | |
80 | x86_stw_phys(cs, sm_state + 0x7e70, env->ldt.selector); |
81 | x86_stq_phys(cs, sm_state + 0x7e78, env->ldt.base); |
82 | x86_stl_phys(cs, sm_state + 0x7e74, env->ldt.limit); |
83 | x86_stw_phys(cs, sm_state + 0x7e72, (env->ldt.flags >> 8) & 0xf0ff); |
84 | |
85 | x86_stq_phys(cs, sm_state + 0x7e88, env->idt.base); |
86 | x86_stl_phys(cs, sm_state + 0x7e84, env->idt.limit); |
87 | |
88 | x86_stw_phys(cs, sm_state + 0x7e90, env->tr.selector); |
89 | x86_stq_phys(cs, sm_state + 0x7e98, env->tr.base); |
90 | x86_stl_phys(cs, sm_state + 0x7e94, env->tr.limit); |
91 | x86_stw_phys(cs, sm_state + 0x7e92, (env->tr.flags >> 8) & 0xf0ff); |
92 | |
93 | /* ??? Vol 1, 16.5.6 Intel MPX and SMM says that IA32_BNDCFGS |
94 | is saved at offset 7ED0. Vol 3, 34.4.1.1, Table 32-2, has |
95 | 7EA0-7ED7 as "reserved". What's this, and what's really |
96 | supposed to happen? */ |
97 | x86_stq_phys(cs, sm_state + 0x7ed0, env->efer); |
98 | |
99 | x86_stq_phys(cs, sm_state + 0x7ff8, env->regs[R_EAX]); |
100 | x86_stq_phys(cs, sm_state + 0x7ff0, env->regs[R_ECX]); |
101 | x86_stq_phys(cs, sm_state + 0x7fe8, env->regs[R_EDX]); |
102 | x86_stq_phys(cs, sm_state + 0x7fe0, env->regs[R_EBX]); |
103 | x86_stq_phys(cs, sm_state + 0x7fd8, env->regs[R_ESP]); |
104 | x86_stq_phys(cs, sm_state + 0x7fd0, env->regs[R_EBP]); |
105 | x86_stq_phys(cs, sm_state + 0x7fc8, env->regs[R_ESI]); |
106 | x86_stq_phys(cs, sm_state + 0x7fc0, env->regs[R_EDI]); |
107 | for (i = 8; i < 16; i++) { |
108 | x86_stq_phys(cs, sm_state + 0x7ff8 - i * 8, env->regs[i]); |
109 | } |
110 | x86_stq_phys(cs, sm_state + 0x7f78, env->eip); |
111 | x86_stl_phys(cs, sm_state + 0x7f70, cpu_compute_eflags(env)); |
112 | x86_stl_phys(cs, sm_state + 0x7f68, env->dr[6]); |
113 | x86_stl_phys(cs, sm_state + 0x7f60, env->dr[7]); |
114 | |
115 | x86_stl_phys(cs, sm_state + 0x7f48, env->cr[4]); |
116 | x86_stq_phys(cs, sm_state + 0x7f50, env->cr[3]); |
117 | x86_stl_phys(cs, sm_state + 0x7f58, env->cr[0]); |
118 | |
119 | x86_stl_phys(cs, sm_state + 0x7efc, SMM_REVISION_ID); |
120 | x86_stl_phys(cs, sm_state + 0x7f00, env->smbase); |
121 | #else |
122 | x86_stl_phys(cs, sm_state + 0x7ffc, env->cr[0]); |
123 | x86_stl_phys(cs, sm_state + 0x7ff8, env->cr[3]); |
124 | x86_stl_phys(cs, sm_state + 0x7ff4, cpu_compute_eflags(env)); |
125 | x86_stl_phys(cs, sm_state + 0x7ff0, env->eip); |
126 | x86_stl_phys(cs, sm_state + 0x7fec, env->regs[R_EDI]); |
127 | x86_stl_phys(cs, sm_state + 0x7fe8, env->regs[R_ESI]); |
128 | x86_stl_phys(cs, sm_state + 0x7fe4, env->regs[R_EBP]); |
129 | x86_stl_phys(cs, sm_state + 0x7fe0, env->regs[R_ESP]); |
130 | x86_stl_phys(cs, sm_state + 0x7fdc, env->regs[R_EBX]); |
131 | x86_stl_phys(cs, sm_state + 0x7fd8, env->regs[R_EDX]); |
132 | x86_stl_phys(cs, sm_state + 0x7fd4, env->regs[R_ECX]); |
133 | x86_stl_phys(cs, sm_state + 0x7fd0, env->regs[R_EAX]); |
134 | x86_stl_phys(cs, sm_state + 0x7fcc, env->dr[6]); |
135 | x86_stl_phys(cs, sm_state + 0x7fc8, env->dr[7]); |
136 | |
137 | x86_stl_phys(cs, sm_state + 0x7fc4, env->tr.selector); |
138 | x86_stl_phys(cs, sm_state + 0x7f64, env->tr.base); |
139 | x86_stl_phys(cs, sm_state + 0x7f60, env->tr.limit); |
140 | x86_stl_phys(cs, sm_state + 0x7f5c, (env->tr.flags >> 8) & 0xf0ff); |
141 | |
142 | x86_stl_phys(cs, sm_state + 0x7fc0, env->ldt.selector); |
143 | x86_stl_phys(cs, sm_state + 0x7f80, env->ldt.base); |
144 | x86_stl_phys(cs, sm_state + 0x7f7c, env->ldt.limit); |
145 | x86_stl_phys(cs, sm_state + 0x7f78, (env->ldt.flags >> 8) & 0xf0ff); |
146 | |
147 | x86_stl_phys(cs, sm_state + 0x7f74, env->gdt.base); |
148 | x86_stl_phys(cs, sm_state + 0x7f70, env->gdt.limit); |
149 | |
150 | x86_stl_phys(cs, sm_state + 0x7f58, env->idt.base); |
151 | x86_stl_phys(cs, sm_state + 0x7f54, env->idt.limit); |
152 | |
153 | for (i = 0; i < 6; i++) { |
154 | dt = &env->segs[i]; |
155 | if (i < 3) { |
156 | offset = 0x7f84 + i * 12; |
157 | } else { |
158 | offset = 0x7f2c + (i - 3) * 12; |
159 | } |
160 | x86_stl_phys(cs, sm_state + 0x7fa8 + i * 4, dt->selector); |
161 | x86_stl_phys(cs, sm_state + offset + 8, dt->base); |
162 | x86_stl_phys(cs, sm_state + offset + 4, dt->limit); |
163 | x86_stl_phys(cs, sm_state + offset, (dt->flags >> 8) & 0xf0ff); |
164 | } |
165 | x86_stl_phys(cs, sm_state + 0x7f14, env->cr[4]); |
166 | |
167 | x86_stl_phys(cs, sm_state + 0x7efc, SMM_REVISION_ID); |
168 | x86_stl_phys(cs, sm_state + 0x7ef8, env->smbase); |
169 | #endif |
170 | /* init SMM cpu state */ |
171 | |
172 | #ifdef TARGET_X86_64 |
173 | cpu_load_efer(env, 0); |
174 | #endif |
175 | cpu_load_eflags(env, 0, ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | |
176 | DF_MASK)); |
177 | env->eip = 0x00008000; |
178 | cpu_x86_update_cr0(env, |
179 | env->cr[0] & ~(CR0_PE_MASK | CR0_EM_MASK | CR0_TS_MASK | |
180 | CR0_PG_MASK)); |
181 | cpu_x86_update_cr4(env, 0); |
182 | env->dr[7] = 0x00000400; |
183 | |
184 | cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase, |
185 | 0xffffffff, |
186 | DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | |
187 | DESC_G_MASK | DESC_A_MASK); |
188 | cpu_x86_load_seg_cache(env, R_DS, 0, 0, 0xffffffff, |
189 | DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | |
190 | DESC_G_MASK | DESC_A_MASK); |
191 | cpu_x86_load_seg_cache(env, R_ES, 0, 0, 0xffffffff, |
192 | DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | |
193 | DESC_G_MASK | DESC_A_MASK); |
194 | cpu_x86_load_seg_cache(env, R_SS, 0, 0, 0xffffffff, |
195 | DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | |
196 | DESC_G_MASK | DESC_A_MASK); |
197 | cpu_x86_load_seg_cache(env, R_FS, 0, 0, 0xffffffff, |
198 | DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | |
199 | DESC_G_MASK | DESC_A_MASK); |
200 | cpu_x86_load_seg_cache(env, R_GS, 0, 0, 0xffffffff, |
201 | DESC_P_MASK | DESC_S_MASK | DESC_W_MASK | |
202 | DESC_G_MASK | DESC_A_MASK); |
203 | } |
204 | |
205 | void helper_rsm(CPUX86State *env) |
206 | { |
207 | X86CPU *cpu = env_archcpu(env); |
208 | CPUState *cs = env_cpu(env); |
209 | target_ulong sm_state; |
210 | int i, offset; |
211 | uint32_t val; |
212 | |
213 | sm_state = env->smbase + 0x8000; |
214 | #ifdef TARGET_X86_64 |
215 | cpu_load_efer(env, x86_ldq_phys(cs, sm_state + 0x7ed0)); |
216 | |
217 | env->gdt.base = x86_ldq_phys(cs, sm_state + 0x7e68); |
218 | env->gdt.limit = x86_ldl_phys(cs, sm_state + 0x7e64); |
219 | |
220 | env->ldt.selector = x86_lduw_phys(cs, sm_state + 0x7e70); |
221 | env->ldt.base = x86_ldq_phys(cs, sm_state + 0x7e78); |
222 | env->ldt.limit = x86_ldl_phys(cs, sm_state + 0x7e74); |
223 | env->ldt.flags = (x86_lduw_phys(cs, sm_state + 0x7e72) & 0xf0ff) << 8; |
224 | |
225 | env->idt.base = x86_ldq_phys(cs, sm_state + 0x7e88); |
226 | env->idt.limit = x86_ldl_phys(cs, sm_state + 0x7e84); |
227 | |
228 | env->tr.selector = x86_lduw_phys(cs, sm_state + 0x7e90); |
229 | env->tr.base = x86_ldq_phys(cs, sm_state + 0x7e98); |
230 | env->tr.limit = x86_ldl_phys(cs, sm_state + 0x7e94); |
231 | env->tr.flags = (x86_lduw_phys(cs, sm_state + 0x7e92) & 0xf0ff) << 8; |
232 | |
233 | env->regs[R_EAX] = x86_ldq_phys(cs, sm_state + 0x7ff8); |
234 | env->regs[R_ECX] = x86_ldq_phys(cs, sm_state + 0x7ff0); |
235 | env->regs[R_EDX] = x86_ldq_phys(cs, sm_state + 0x7fe8); |
236 | env->regs[R_EBX] = x86_ldq_phys(cs, sm_state + 0x7fe0); |
237 | env->regs[R_ESP] = x86_ldq_phys(cs, sm_state + 0x7fd8); |
238 | env->regs[R_EBP] = x86_ldq_phys(cs, sm_state + 0x7fd0); |
239 | env->regs[R_ESI] = x86_ldq_phys(cs, sm_state + 0x7fc8); |
240 | env->regs[R_EDI] = x86_ldq_phys(cs, sm_state + 0x7fc0); |
241 | for (i = 8; i < 16; i++) { |
242 | env->regs[i] = x86_ldq_phys(cs, sm_state + 0x7ff8 - i * 8); |
243 | } |
244 | env->eip = x86_ldq_phys(cs, sm_state + 0x7f78); |
245 | cpu_load_eflags(env, x86_ldl_phys(cs, sm_state + 0x7f70), |
246 | ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK)); |
247 | env->dr[6] = x86_ldl_phys(cs, sm_state + 0x7f68); |
248 | env->dr[7] = x86_ldl_phys(cs, sm_state + 0x7f60); |
249 | |
250 | cpu_x86_update_cr4(env, x86_ldl_phys(cs, sm_state + 0x7f48)); |
251 | cpu_x86_update_cr3(env, x86_ldq_phys(cs, sm_state + 0x7f50)); |
252 | cpu_x86_update_cr0(env, x86_ldl_phys(cs, sm_state + 0x7f58)); |
253 | |
254 | for (i = 0; i < 6; i++) { |
255 | offset = 0x7e00 + i * 16; |
256 | cpu_x86_load_seg_cache(env, i, |
257 | x86_lduw_phys(cs, sm_state + offset), |
258 | x86_ldq_phys(cs, sm_state + offset + 8), |
259 | x86_ldl_phys(cs, sm_state + offset + 4), |
260 | (x86_lduw_phys(cs, sm_state + offset + 2) & |
261 | 0xf0ff) << 8); |
262 | } |
263 | |
264 | val = x86_ldl_phys(cs, sm_state + 0x7efc); /* revision ID */ |
265 | if (val & 0x20000) { |
266 | env->smbase = x86_ldl_phys(cs, sm_state + 0x7f00); |
267 | } |
268 | #else |
269 | cpu_x86_update_cr0(env, x86_ldl_phys(cs, sm_state + 0x7ffc)); |
270 | cpu_x86_update_cr3(env, x86_ldl_phys(cs, sm_state + 0x7ff8)); |
271 | cpu_load_eflags(env, x86_ldl_phys(cs, sm_state + 0x7ff4), |
272 | ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK)); |
273 | env->eip = x86_ldl_phys(cs, sm_state + 0x7ff0); |
274 | env->regs[R_EDI] = x86_ldl_phys(cs, sm_state + 0x7fec); |
275 | env->regs[R_ESI] = x86_ldl_phys(cs, sm_state + 0x7fe8); |
276 | env->regs[R_EBP] = x86_ldl_phys(cs, sm_state + 0x7fe4); |
277 | env->regs[R_ESP] = x86_ldl_phys(cs, sm_state + 0x7fe0); |
278 | env->regs[R_EBX] = x86_ldl_phys(cs, sm_state + 0x7fdc); |
279 | env->regs[R_EDX] = x86_ldl_phys(cs, sm_state + 0x7fd8); |
280 | env->regs[R_ECX] = x86_ldl_phys(cs, sm_state + 0x7fd4); |
281 | env->regs[R_EAX] = x86_ldl_phys(cs, sm_state + 0x7fd0); |
282 | env->dr[6] = x86_ldl_phys(cs, sm_state + 0x7fcc); |
283 | env->dr[7] = x86_ldl_phys(cs, sm_state + 0x7fc8); |
284 | |
285 | env->tr.selector = x86_ldl_phys(cs, sm_state + 0x7fc4) & 0xffff; |
286 | env->tr.base = x86_ldl_phys(cs, sm_state + 0x7f64); |
287 | env->tr.limit = x86_ldl_phys(cs, sm_state + 0x7f60); |
288 | env->tr.flags = (x86_ldl_phys(cs, sm_state + 0x7f5c) & 0xf0ff) << 8; |
289 | |
290 | env->ldt.selector = x86_ldl_phys(cs, sm_state + 0x7fc0) & 0xffff; |
291 | env->ldt.base = x86_ldl_phys(cs, sm_state + 0x7f80); |
292 | env->ldt.limit = x86_ldl_phys(cs, sm_state + 0x7f7c); |
293 | env->ldt.flags = (x86_ldl_phys(cs, sm_state + 0x7f78) & 0xf0ff) << 8; |
294 | |
295 | env->gdt.base = x86_ldl_phys(cs, sm_state + 0x7f74); |
296 | env->gdt.limit = x86_ldl_phys(cs, sm_state + 0x7f70); |
297 | |
298 | env->idt.base = x86_ldl_phys(cs, sm_state + 0x7f58); |
299 | env->idt.limit = x86_ldl_phys(cs, sm_state + 0x7f54); |
300 | |
301 | for (i = 0; i < 6; i++) { |
302 | if (i < 3) { |
303 | offset = 0x7f84 + i * 12; |
304 | } else { |
305 | offset = 0x7f2c + (i - 3) * 12; |
306 | } |
307 | cpu_x86_load_seg_cache(env, i, |
308 | x86_ldl_phys(cs, |
309 | sm_state + 0x7fa8 + i * 4) & 0xffff, |
310 | x86_ldl_phys(cs, sm_state + offset + 8), |
311 | x86_ldl_phys(cs, sm_state + offset + 4), |
312 | (x86_ldl_phys(cs, |
313 | sm_state + offset) & 0xf0ff) << 8); |
314 | } |
315 | cpu_x86_update_cr4(env, x86_ldl_phys(cs, sm_state + 0x7f14)); |
316 | |
317 | val = x86_ldl_phys(cs, sm_state + 0x7efc); /* revision ID */ |
318 | if (val & 0x20000) { |
319 | env->smbase = x86_ldl_phys(cs, sm_state + 0x7ef8); |
320 | } |
321 | #endif |
322 | if ((env->hflags2 & HF2_SMM_INSIDE_NMI_MASK) == 0) { |
323 | env->hflags2 &= ~HF2_NMI_MASK; |
324 | } |
325 | env->hflags2 &= ~HF2_SMM_INSIDE_NMI_MASK; |
326 | env->hflags &= ~HF_SMM_MASK; |
327 | |
328 | qemu_log_mask(CPU_LOG_INT, "SMM: after RSM\n" ); |
329 | log_cpu_state_mask(CPU_LOG_INT, CPU(cpu), CPU_DUMP_CCOP); |
330 | } |
331 | |
332 | #endif /* !CONFIG_USER_ONLY */ |
333 | |