blob: d90e43a9ef65755bc2cd5f6c04267e4d001680c0 [file] [log] [blame]
// System Management Mode support (on emulators)
//
// Copyright (C) 2008-2014 Kevin O'Connor <kevin@koconnor.net>
// Copyright (C) 2006 Fabrice Bellard
//
// This file may be distributed under the terms of the GNU LGPLv3 license.
#include "config.h" // CONFIG_*
#include "dev-q35.h"
#include "dev-piix.h"
#include "hw/pci.h" // pci_config_writel
#include "hw/pcidevice.h" // pci_find_device
#include "hw/pci_ids.h" // PCI_VENDOR_ID_INTEL
#include "hw/pci_regs.h" // PCI_DEVICE_ID
#include "output.h" // dprintf
#include "paravirt.h" // PORT_SMI_STATUS
#include "stacks.h" // HaveSmmCall32
#include "string.h" // memcpy
#include "util.h" // smm_setup
#include "x86.h" // wbinvd
/*
* Check SMM state save area format (bits 0-15) and require support
* for SMBASE relocation.
*/
#define SMM_REV_MASK 0x0002ffff
#define SMM_REV_I32 0x00020000
#define SMM_REV_I64 0x00020064
struct smm_state {
union {
struct {
u8 pad_000[0xf8];
u32 smm_base;
u32 smm_rev;
u8 pad_100[0xd0];
u32 eax, ecx, edx, ebx, esp, ebp, esi, edi, eip, eflags;
u8 pad_1f8[0x08];
} i32;
struct {
u8 pad_000[0xfc];
u32 smm_rev;
u32 smm_base;
u8 pad_104[0x6c];
u64 rflags, rip, r15, r14, r13, r12, r11, r10, r9, r8;
u64 rdi, rsi, rbp, rsp, rbx, rdx, rcx, rax;
} i64;
};
};
struct smm_layout {
struct smm_state backup1;
struct smm_state backup2;
u32 backup_a20;
u8 stack[0x8000 - sizeof(struct smm_state)*2 - sizeof(u32)];
u64 codeentry;
u8 pad_8008[0x7df8];
struct smm_state cpu;
};
void VISIBLE32FLAT
handle_smi(u16 cs)
{
if (!CONFIG_USE_SMM)
return;
u8 cmd = inb(PORT_SMI_CMD);
struct smm_layout *smm = MAKE_FLATPTR(cs, 0);
u32 rev = smm->cpu.i32.smm_rev & SMM_REV_MASK;
dprintf(DEBUG_HDL_smi, "handle_smi cmd=%x smbase=%p\n", cmd, smm);
if (smm == (void*)BUILD_SMM_INIT_ADDR) {
// relocate SMBASE to 0xa0000
if (rev == SMM_REV_I32) {
smm->cpu.i32.smm_base = BUILD_SMM_ADDR;
} else if (rev == SMM_REV_I64) {
smm->cpu.i64.smm_base = BUILD_SMM_ADDR;
} else {
warn_internalerror();
return;
}
// indicate to smm_relocate_and_restore() that the SMM code was executed
outb(0x00, PORT_SMI_STATUS);
if (CONFIG_CALL32_SMM) {
// Backup current cpu state for SMM trampolining
struct smm_layout *newsmm = (void*)BUILD_SMM_ADDR;
memcpy(&newsmm->backup1, &smm->cpu, sizeof(newsmm->backup1));
memcpy(&newsmm->backup2, &smm->cpu, sizeof(newsmm->backup2));
HaveSmmCall32 = 1;
}
return;
}
if (CONFIG_CALL32_SMM && cmd == CALL32SMM_CMDID) {
if (rev == SMM_REV_I32) {
u32 regs[8];
memcpy(regs, &smm->cpu.i32.eax, sizeof(regs));
if (smm->cpu.i32.ecx == CALL32SMM_ENTERID) {
dprintf(9, "smm cpu call pc=%x esp=%x\n", regs[3], regs[4]);
memcpy(&smm->backup2, &smm->cpu, sizeof(smm->backup2));
memcpy(&smm->cpu, &smm->backup1, sizeof(smm->cpu));
memcpy(&smm->cpu.i32.eax, regs, sizeof(regs));
smm->cpu.i32.eip = regs[3];
// Enable a20 and backup its previous state
smm->backup_a20 = set_a20(1);
} else if (smm->cpu.i32.ecx == CALL32SMM_RETURNID) {
dprintf(9, "smm cpu ret %x esp=%x\n", regs[3], regs[4]);
memcpy(&smm->cpu, &smm->backup2, sizeof(smm->cpu));
memcpy(&smm->cpu.i32.eax, regs, sizeof(regs));
if (!smm->backup_a20)
set_a20(0);
smm->cpu.i32.eip = regs[3];
}
} else if (rev == SMM_REV_I64) {
u64 regs[8];
memcpy(regs, &smm->cpu.i64.rdi, sizeof(regs));
if ((u32)smm->cpu.i64.rcx == CALL32SMM_ENTERID) {
memcpy(&smm->backup2, &smm->cpu, sizeof(smm->backup2));
memcpy(&smm->cpu, &smm->backup1, sizeof(smm->cpu));
memcpy(&smm->cpu.i64.rdi, regs, sizeof(regs));
smm->cpu.i64.rip = (u32)regs[4];
// Enable a20 and backup its previous state
smm->backup_a20 = set_a20(1);
} else if ((u32)smm->cpu.i64.rcx == CALL32SMM_RETURNID) {
memcpy(&smm->cpu, &smm->backup2, sizeof(smm->cpu));
memcpy(&smm->cpu.i64.rdi, regs, sizeof(regs));
if (!smm->backup_a20)
set_a20(0);
smm->cpu.i64.rip = (u32)regs[4];
}
}
}
}
extern void entry_smi(void);
// movw %cs, %ax; ljmpw $SEG_BIOS, $(entry_smi - BUILD_BIOS_ADDR)
#define SMI_INSN (0xeac88c | ((u64)SEG_BIOS<<40) \
| ((u64)((u32)entry_smi - BUILD_BIOS_ADDR) << 24))
static void
smm_save_and_copy(void)
{
// save original memory content
struct smm_layout *initsmm = (void*)BUILD_SMM_INIT_ADDR;
struct smm_layout *smm = (void*)BUILD_SMM_ADDR;
memcpy(&smm->cpu, &initsmm->cpu, sizeof(smm->cpu));
memcpy(&smm->codeentry, &initsmm->codeentry, sizeof(smm->codeentry));
// Setup code entry point.
initsmm->codeentry = SMI_INSN;
}
static void
smm_relocate_and_restore(void)
{
/* init APM status port */
outb(0x01, PORT_SMI_STATUS);
/* raise an SMI interrupt */
outb(0x00, PORT_SMI_CMD);
/* wait until SMM code executed */
while (inb(PORT_SMI_STATUS) != 0x00)
;
/* restore original memory content */
struct smm_layout *initsmm = (void*)BUILD_SMM_INIT_ADDR;
struct smm_layout *smm = (void*)BUILD_SMM_ADDR;
memcpy(&initsmm->cpu, &smm->cpu, sizeof(initsmm->cpu));
memcpy(&initsmm->codeentry, &smm->codeentry, sizeof(initsmm->codeentry));
// Setup code entry point.
smm->codeentry = SMI_INSN;
wbinvd();
}
// This code is hardcoded for PIIX4 Power Management device.
static void piix4_apmc_smm_setup(int isabdf, int i440_bdf)
{
/* check if SMM init is already done */
u32 value = pci_config_readl(isabdf, PIIX_DEVACTB);
if (value & PIIX_DEVACTB_APMC_EN)
return;
/* enable the SMM memory window */
pci_config_writeb(i440_bdf, I440FX_SMRAM, 0x02 | 0x48);
smm_save_and_copy();
/* enable SMI generation when writing to the APMC register */
pci_config_writel(isabdf, PIIX_DEVACTB, value | PIIX_DEVACTB_APMC_EN);
/* enable SMI generation */
value = inl(acpi_pm_base + PIIX_PMIO_GLBCTL);
outl(value | PIIX_PMIO_GLBCTL_SMI_EN, acpi_pm_base + PIIX_PMIO_GLBCTL);
smm_relocate_and_restore();
/* close the SMM memory window and enable normal SMM */
pci_config_writeb(i440_bdf, I440FX_SMRAM, 0x02 | 0x08);
}
/* PCI_VENDOR_ID_INTEL && PCI_DEVICE_ID_INTEL_ICH9_LPC */
void ich9_lpc_apmc_smm_setup(int isabdf, int mch_bdf)
{
/* check if SMM init is already done */
u32 value = inl(acpi_pm_base + ICH9_PMIO_SMI_EN);
if (value & ICH9_PMIO_SMI_EN_APMC_EN)
return;
/* enable the SMM memory window */
pci_config_writeb(mch_bdf, Q35_HOST_BRIDGE_SMRAM, 0x02 | 0x48);
smm_save_and_copy();
/* enable SMI generation when writing to the APMC register */
outl(value | ICH9_PMIO_SMI_EN_APMC_EN | ICH9_PMIO_SMI_EN_GLB_SMI_EN,
acpi_pm_base + ICH9_PMIO_SMI_EN);
/* lock SMI generation */
value = pci_config_readw(isabdf, ICH9_LPC_GEN_PMCON_1);
pci_config_writel(isabdf, ICH9_LPC_GEN_PMCON_1,
value | ICH9_LPC_GEN_PMCON_1_SMI_LOCK);
smm_relocate_and_restore();
/* close the SMM memory window and enable normal SMM */
pci_config_writeb(mch_bdf, Q35_HOST_BRIDGE_SMRAM, 0x02 | 0x08);
}
static int SMMISADeviceBDF = -1, SMMPMDeviceBDF = -1;
void
smm_device_setup(void)
{
if (!CONFIG_USE_SMM)
return;
struct pci_device *isapci, *pmpci;
isapci = pci_find_device(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82371AB_3);
pmpci = pci_find_device(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82441);
if (isapci && pmpci) {
SMMISADeviceBDF = isapci->bdf;
SMMPMDeviceBDF = pmpci->bdf;
return;
}
isapci = pci_find_device(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH9_LPC);
pmpci = pci_find_device(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_Q35_MCH);
if (isapci && pmpci) {
SMMISADeviceBDF = isapci->bdf;
SMMPMDeviceBDF = pmpci->bdf;
}
}
void
smm_setup(void)
{
if (!CONFIG_USE_SMM || SMMISADeviceBDF < 0)
return;
dprintf(3, "init smm\n");
u16 device = pci_config_readw(SMMISADeviceBDF, PCI_DEVICE_ID);
if (device == PCI_DEVICE_ID_INTEL_82371AB_3)
piix4_apmc_smm_setup(SMMISADeviceBDF, SMMPMDeviceBDF);
else
ich9_lpc_apmc_smm_setup(SMMISADeviceBDF, SMMPMDeviceBDF);
}