Author: wmb Date: 2008-11-18 00:50:36 +0100 (Tue, 18 Nov 2008) New Revision: 1008
Modified: dev/geode/smi.fth Log: Commented the Geode SMI code.
Modified: dev/geode/smi.fth =================================================================== --- dev/geode/smi.fth 2008-11-17 20:53:53 UTC (rev 1007) +++ dev/geode/smi.fth 2008-11-17 23:50:36 UTC (rev 1008) @@ -1,14 +1,16 @@ purpose: SMI setup and handler for Geode LX
+\ Extend the assembler with some Geode-specific (I think) instructions +\ related to SMI handling. + also assembler definitions - : smint ( -- ) prefix-0f h# 38 asm8, ; : rsm ( -- ) prefix-0f h# aa asm8, ; : svdc ( sr m80 -- ) prefix-0f h# 78 asm8, rot r/m, ; : rsdc ( m80 sr -- ) prefix-0f h# 79 asm8, r/m, ; - previous definitions
+\ Location of the SMM handler code... \ The general naming convention here is that smm-* refers to \ addresses within the memory that is set aside for SMI handling. \ smi-* refers to stuff in the Forth domain. @@ -18,6 +20,13 @@ : +smm ( segment-relative-adr -- adr ) smm-base + ; : -smm ( adr -- segment-relative-adr ) smm-base - ;
+\ This is a trick for using SMM to handle BIOS INTs. The problem it solves +\ is that Windows sometimes calls the BIOS from V86 mode instead of real mode. +\ V86 mode prevents easy entry into protected mode (and we want to run OFW +\ in protected mode), so we first trap into SMM by accessing some emulated +\ registers, and run OFW code from SMM protected mode. The following is a +\ table of "INT handler" instruction sequences indexed by the INT number. + label int-entry 16-bit al h# 30 # out iret nop @@ -40,6 +49,8 @@ here int-entry - constant /int-entry
+\ Data structures for the SMM gateway + h# 28 constant /smm-gdt h# 8 constant smm-c16 h# 10 constant smm-d16 @@ -101,6 +112,13 @@ h# 400 pm-stack smm-rp0 \ SMM Forth return stack drop
+ +\ The basic SMI gateway. This code lives at (is copied to) smm-base. +\ It executes when the processor enters System Management Mode (SMM) +\ for whatever reason. It saves a bunch of state, sets up the world +\ so Forth code can run (in 32-bit protected mode), and runs the Forth +\ handler - typically "smi-dispatch" (via smm-exec and handle-smi). + label smi-handler 16-bit
@@ -178,6 +196,10 @@
cld c; + +\ When the Forth SMI handler finishes, it calls (smi-return) to return +\ to the context that invoked the SMI. This is the inverse of smi-handler. + code (smi-return) \ This code field must be relocated after copying to SMM memory cli
@@ -231,6 +253,10 @@ end-code here smi-handler - constant /smi-handler
+\ Access words for fields within the processor state that the +\ Geode CPU saves on entry to SMM. See the description of the +\ RSM instruction in the Geode LX databook (section 8.3.4.7). + : smm-dr7 ( -- l ) smm-header h# 4 - l@ ; : smm-eflags ( -- l ) smm-header h# 8 - l@ ; : smm-cr0 ( -- l ) smm-header h# c - l@ ; @@ -256,11 +282,16 @@ : smm-eax ( -- adr ) smm-gregs 7 la+ ; : smm-ebp ( -- adr ) smm-gregs 2 la+ ;
+\ Finds a page table or page directory entry +\ Implementation factor of (smm>physical) : >ptable ( table vadr shift -- table' unmapped? ) rshift h# ffc and + l@ dup h# fff invert and swap 1 and 0= ;
+\ Converts a virtual address to a physical address via the page tables +\ This is used by debugging tools, so that we can look at OS resources +\ via their virtual addresses while we are running with paging disabled. \ XXX need to handle mapped-at-pde-level defer smm>physical : (smm>physical) ( vadr -- padr ) @@ -288,15 +319,23 @@ : use-physical ( -- ) ['] noop to smm>physical ; : use-virtual ( -- ) ['] (smm>physical) to smm>physical ;
+\ Some simple glue code to help make the transition from assembly language +\ to Forth and back.
: smi-return ( -- ) [ ' (smi-return) smi-handler - +smm ] literal execute ; defer handle-smi ' noop is handle-smi create smm-exec ] handle-smi smi-return [
+\ Set to true to display brief messages showing every entry to SMM false value smi-debug? + +\ Set to true to invoke the Forth debugger when the OS tries to suspend (S3) false value resume-debug?
+\ Set to true to show all the OS's PCI config space accesses false value vpci-debug? + +\ Turns on PCI virtualization (called from setup-smi) : enable-virtual-pci ( -- ) \ Virtualize devices f and 1, or all devices if debugging vpci-debug? if h# ffff else h# 8002 then >r @@ -304,6 +343,9 @@ h# 5000.2002 msr@ swap 8 invert and swap h# 5000.2002 msr! \ Enable SSMI for config accesses ;
+\ Some tools for dispatching to the right sub-handler, by reading and ACKing +\ the various MSRs that tell you the cause of this SMI. + \ : msr-ack ( msr# -- ) >r r@ msr@ r> msr! ; code msr-ack ( msr# -- ) cx pop rdmsr wrmsr c; code msr@! ( msr# -- d.value ) cx pop rdmsr wrmsr ax push dx push c; @@ -337,6 +379,12 @@ c;
alias msr. .msr + +\ Turns on I/O register virtualization (called by setup-smi) +\ We virtualize ACPI registers and the 0xAC1C "virtual register". +\ The "virtual register" is not a legacy hardware register, but +\ rather an API to call the VSA module to do various things. + : enable-io-smis ( -- ) \ XXX these settings need to be folded into the MSR table for resume h# 0000.0009.c00fffc0. h# 5101.00e4 msr! \ Virtualize ACPI registers @@ -361,6 +409,10 @@ h# ff00 h# 4000.0082 msr-clr h# ff00 h# 4000.0083 msr-clr h# 38. h# 1301 msr! ; + +\ Some debugging tools to display MSRs related to SMI dispatch +\ These are useful for figuring out how to turn on SMIs for various things. + \ 10002002 records ac1c accesses in bit 0 (1) \ 51010002 records 9c00 accesses in bit 32 (1.0000.0000) \ 51000002 records 9c00 accesses in bit 18 ( 4.0000) @@ -390,6 +442,7 @@ h# 4000 .msr4 ." " h# 1301 msr.. cr ; +\ Ack all the SMI dispatch MSRs : ma h# 10002002 msr-ack h# 10002003 msr-ack h# 40002002 msr-ack h# 40002003 msr-ack @@ -400,15 +453,31 @@ \ h# 51010083 msr-ack \ This one has status bits, but they are RO ;
+\ This is a stub SMI handler that just invokes the Forth command +\ interpreter so you can poke around. Normally handle-smi calls +\ smi-dispatch to do all the virtualization work, instead of this. + : smi-interact ( -- ) ." In SMI" cr interact ; ' smi-interact is handle-smi
: vr-spoof? ( -- handled? ) false ;
+\ Handler for PCI config space virtualization. +\ This determines the PCI config register number and the access size +\ from the information saved by the SMI gateway, then calls OFW's +\ PCI config access functions to do the work. + : pci-smi ( event-mask -- ) smi-debug? if ." PCI" cr then + + \ Error checks 8 and 0= if exit then smm-io-port 3 invert and h# cfc <> if exit then + + \ If we are tracing all PCI config accesses, not just the ones that + \ don't really exist, we must turn off virtualization while Forth + \ is accessing the "real" PCI config registers, otherwise we'll + \ hang due to recursion. vpci-debug? if h# 5000.2012 msr@ 2>r 0. h# 5000.2012 msr! then
\ The existing Forth config spoofer does the hard work @@ -429,10 +498,18 @@ h# f of config-l@ smm-eax l! endof endcase then + + \ Reinstate virtualization vpci-debug? if 2r> h# 5000.2012 msr! then ; + : smm-eax-c! ( b -- ) smm-eax c! ; : smm-eax-c@ ( -- b ) smm-eax c@ ; + +\ "SoftVG" display functions (subset) as documented in +\ _AMD Geode(TM) GX Processors Graphics Software Specification" +\ (available to OEMs via AMD's restricted web site) + 0 value requested-mode 0 value color-depth \ 1:8bpp 2:XRGB444 3:RGB555 4:RGB565 5:24bpp 0 value refresh-rate @@ -501,7 +578,16 @@ ; [then]
+\ Partial implementation of 0xAC1C Virtual Registers as documented in +\ _AMD Geode(TM) GX and LX Processor Based Systems Virtual Register Specification_ +\ (available to OEMs via AMD's restricted web site) +\ Ironically, none of the VR's that we actually implement are actually +\ described in that document; most are described in the Graphics Software +\ spec mentioned earlier. + 0 value vr-index + +\ Set to true to display accesses to 0xAC1C Virtual Registers false value vr-debug?
true value vr-locked? @@ -544,10 +630,17 @@ endcase then ; + +\ The GLIU0 SMI encompasses Virtual Register (0xAC1C) accesses and +\ also accesses to the 0x30..0x3f I/O port bank that we "steal" for +\ bouncing BIOS INTs into SMM. + : gliu0-smi ( event-mask -- ) smi-debug? if ." GLIU" cr then 1 and 0= if exit then \ We only care about virtual register accesses
+ \ Handle BIOS INTs that were bounced into SMM by accessing + \ I/O ports 0x30..0x3f smm-io-port h# fff0 and h# 30 = if smm-io-port h# 20 - to rm-int@ rm-sp la1+ >caller-physical w@ smm-rmeflags w! @@ -560,14 +653,23 @@ do-vr ;
+\ This hook can be set to turn off devices that the firmware uses. +\ It is called when the OS takes responsibility for power management +\ by writing a 1 to bit 0 of the ACPI PM1_CNT . + defer quiesce-devices ' noop to quiesce-devices
\ We just discard the event about I/O registers because we handle it in sb-smi . \ We don't have to deal with statistics counters because we don't enable them : cgliu-smi ( event-mask -- ) smi-debug? if ." CGLIU" cr then drop ;
+\ Trap into SMM from Forth code smi smint c;
+\ This is a gateway to get into real mode by going through SMM . +\ It's used to implement the ACPI "resume from S3" semantics that +\ require jumping to a given address in real mode. + -1 value rm-entry-adr : rm-run ( eip -- ) to rm-entry-adr smi ;
@@ -629,6 +731,8 @@ smi-return ;
+\ Call this to enable SMI support + : setup-smi ( -- ) \ This is how you would map the SMM region to physical memory at 4000.0000 \ This is a Base Mask Offset descriptor - the base address @@ -675,6 +779,10 @@ enable-io-smis ;
+\ Implement the ACPI S3 (suspend to RAM) semantics using the OFW +\ "S3 looks like a subroutine call" semantics. This requires +\ some fancy mode switching. + : win-s3 ( -- ) \ The trick here is to transfer to "non-smi-s3" while leaving \ System Management Mode. We won't need to return to the caller @@ -689,6 +797,14 @@ facs-adr h# c + l@ rm-run ;
+\ Emulate the ACPI PM_CNT power management control register semantics; +\ the 5536 partially implements that register in hardware, but software +\ must handle a lot of the details, particularly bits 0 and 12:10 +\ The way we do this is by telling the OS that the register bank starts +\ at port 9c00, but it really starts at port 1840. We trap accesses +\ to the 9cxx range, run the emulation code, then the emulation code +\ accesses the real register as needed. + : power-mode ( value offset -- ) over 1 and if quiesce-devices then ( value offset )
@@ -703,11 +819,15 @@ then ( ) ;
+\ Handler for emulated port 92 for system reset + : divil-smi ( event-mask -- ) smi-debug? if ." DIVIL" cr then h# 80 and if bye then ;
+\ Handler for southbridge SMIs - ACPI registers + : sb-smi ( event-mask -- ) smi-debug? if ." SB" cr then 4 and 0= if exit then \ We only care about virtualized I/O registers @@ -785,12 +905,18 @@ then ;
+\ SMI breakpoints - simple (but very useful) debugging tool. + variable sbpval variable sbpadr sbpadr off defer sbp-hook
: .9x push-hex 9 u.r pop-base ; : .smir ( n -- ) smm-gregs swap la+ l@ .9x ; + + +\ Displays the saved register values + : .smiregs ( -- ) ." EAX EBX ECX EDX ESI EDI EBP ESP" cr 7 .smir 4 .smir 6 .smir 5 .smir 1 .smir 0 .smir 2 .smir smm-save-esp +smm l@ .9x @@ -811,6 +937,10 @@ dup 5 - c@ h# e8 <> if 2drop exit then ( retadr pretadr ) 4 - l@ + 9 u.r ; + +\ Displays a subroutine call backtrace. This pretty dependent on compiler +\ code generation rules, so it might not work in some cases. + : smm-trace ( -- ) ." EBP RETADR CALLTO" cr smm-ebp @@ -829,14 +959,28 @@ ;
: unboost ( adr -- adr' ) h# 7fff.ffff and ; + +\ Set an SMI breakpoint at "adr". You can only set one breakpoint. +\ "adr" is either virtual or physical depending on whether you have +\ previously executed "use-physical" or "use-virtual" + : sbp ( adr -- ) fixsbp dup smm>physical w@ sbpval ! dup sbpadr ! h# 380f swap smm>physical w! ; + +\ Disassemble starting from the breakpoint address + : sdis ( -- ) smm-pc smm>physical dis ; + +\ Resume execution of the breakpointed code + : sgo ( -- ) smm-pc smm-next-eip! resume ;
+\ This is a workaround for a problem with video mode setting from V86 mode +\ The problem was eventually fixed properly so this probably isn't needed + h# 806f1a41 constant 'bioscall : hack-fix-mode ( -- ) 'bioscall smm>physical 5 h# 90 fill \ Nop-out "call hal!HalpBiosCall" that dies @@ -848,6 +992,11 @@
code rm-lidt ( -- ) smm-rmidt #) lidt c;
+\ rm-setup fudges the saved SMM state so that, instead of returning +\ to the context that invoked the SMI, the next exit from SMM returns +\ to the address "eip" in real mode. This is an implementation +\ factor of the "rm-run" mechanism. + : rm-setup ( eip -- ) >seg:off 2>r ( r: off seg )
@@ -884,6 +1033,10 @@ ; \ : rm-init-program ( eip -- ) rm-init-program rm-return ;
+\ Handler for software SMIs, i.e. for explicit execution of the +\ SMINT instruction. It's used for things like the rm-run facility +\ and SMI breakpoints. + : soft-smi ( -- ) smi-debug? if ." SOFT" cr then rm-entry-adr -1 <> if @@ -908,6 +1061,10 @@ then ;
+\ smi-dispatch is the top-level dispatcher for SMIs. It looks +\ at various MSRs to determine the SMI cause and invokes the +\ corresponding subordinate handlers. + \ smm-flags values in various cases: \ 8080 (VGA) - ac1c read (VR), extended CRT register (dc-smi) \ 8020 (Mem read) - 9cxx (power management) register (sb-smi) @@ -952,6 +1109,8 @@ drop ;
+\ Debugging tool for displaying the saved Global Descriptor Table + : .smm-gdt ( -- ) smm-save-gdt +smm dup 2+ l@ smm>physical ( 'gdt gdt-adr ) swap w@ ( gdt-adr gdt-limit ) @@ -1056,6 +1215,9 @@
[then]
+\ setup-rm-gateway initializes the real mode interrupt vector table +\ so that real mode code can call BIOS INTs. + \ setup-rm-gateway ( -- ) Init this module \ caller-regs ( -- adr ) Base address of incoming registers \ rm-int@ ( -- n ) Incoming interrupt number
openfirmware@openfirmware.info
-
svn＠openfirmware.info