IA-32 architecture system management mode
Intel/AMD processor SMM state save map |
| offset |
Intel P5 |
Intel P6 |
AMD K5 |
AMD K6 |
| 7E00..7EF7h |
reserved |
reserved |
reserved |
reserved |
| 7EF8h |
SMBASE |
SMBASE |
SMBASE |
SMBASE |
| 7EFCh |
rev ID |
rev ID |
rev ID |
rev ID |
| 7F00h |
I/O restart |
I/O restart |
I/O restart |
I/O restart |
| 7F02h |
HLT restart |
HLT restart |
HLT restart |
HLT restart |
| 7F04h |
I/O restart EDI |
I/O restart EDI |
I/O restart EDI |
I/O restart EDI |
| 7F08h |
I/O restart ECX |
I/O restart ECX |
I/O restart ECX |
I/O restart ECX |
| 7F0Ch |
I/O restart ESI |
I/O restart ESI |
I/O restart ESI |
I/O restart ESI |
| 7F10h |
I/O restart EIP |
I/O restart EIP |
CR4 |
CR4 |
| 7F14h |
reserved |
CR4 |
CR2 |
CR2 |
| 7F18 |
reserved |
A20M# |
reserved |
reserved |
| 7F1Ah |
reserved |
| 7F1Bh |
??? |
| 7F1Ch |
reserved |
| 7F1Eh |
SMM_status |
| 7F20h |
CPL |
| 7F21h |
reserved |
| 7F23h |
shutdown |
| 7F24h |
alternative DR6 |
alternative DR6 |
ES limit |
ES limit |
| 7F26h |
RSM control |
RSM control |
| 7F28h |
CR4 |
sreg_status0 |
ES base |
ES base |
| 7F2Ch |
reserved |
DS selector |
ES access rights |
ES access rights |
| 7F2Eh |
DS access rights |
| 7F30h |
ES limit |
DS limit |
CS limit |
CS limit |
| 7F34h |
ES base |
DS base |
CS base |
CS base |
| 7F38h |
ES access rights |
FS selector |
CS access rights |
CS access rights |
| 7F3Ah |
FS access rights |
| 7F3Ch |
CS limit |
FS limit |
SS limit |
SS limit |
| 7F40h |
CS base |
FS base |
SS base |
SS base |
| 7F44h |
CS access rights |
GS selector |
SS access rights |
SS access rights |
| 7F46h |
GS access rights |
| 7F48h |
SS limit |
GS limit |
DS limit |
DS limit |
| 7F4Ch |
SS base |
GS base |
DS base |
DS base |
| 7F50h |
SS access rights |
IDTR selector |
DS access rights |
DS access rights |
| 7F52h |
IDTR access rights |
| 7F54h |
DS limit |
IDTR limit |
FS limit |
FS limit |
| 7F58h |
DS base |
IDTR base |
FS base |
FS base |
| 7F5Ch |
DS access rights |
TR selector |
FS access rights |
FS access rights |
| 7F5Eh |
TR access rights |
| 7F60h |
FS limit |
TR limit |
GS limit |
GS limit |
| 7F64h |
FS base |
TR base |
GS base |
GS base |
| 7F68h |
FS access rights |
sreg_status1 |
GS access rights |
GS access rights |
| 7F6Ch |
GS limit |
GDTR selector |
LDTR limit |
LDTR high |
| 7F6Eh |
GDTR access rights |
| 7F70h |
GS base |
GDTR limit |
LDTR base |
LDTR low |
| 7F74h |
GS access rights |
GDTR base |
LDTR access rights |
reserved |
| 7F78h |
LDTR limit |
LDTR selector |
TR limit |
TR limit |
| 7F7Ah |
LDTR access rights |
| 7F7Ch |
LDTR base |
LDTR limit |
TR base |
TR base |
| 7F80h |
LDTR access rights |
LDTR base |
TR access rights |
TR access rights |
| 7F84h |
GDTR limit |
ES selector |
GDTR limit |
GDTR limit |
| 7F86h |
ES access rights |
| 7F88h |
GDTR base |
ES limit |
GDTR base |
GDTR base |
| 7F8Ch |
GDTR access rights |
ES base |
IDTR limit |
IDTR limit |
| 7F90h |
IDTR limit |
CS selector |
IDTR base |
IDTR base |
| 7F92h |
CS access rights |
| 7F94h |
IDTR base |
CS limit |
reserved |
reserved |
| 7F98h |
IDTR access rights |
CS base |
reserved |
reserved |
| 7F9Ch |
TR limit |
SS selector |
I/O restart EIP |
I/O restart EIP |
| 7F9Eh |
SS access rights |
| 7FA0h |
TR base |
SS limit |
reserved |
reserved |
| 7FA4h |
TR access rights |
SS base |
I/O restart DWORD |
I/O restart DWORD |
| 7FA8h |
ES |
ES |
ES |
ES |
| 7FACh |
CS |
CS |
CS |
CS |
| 7FB0h |
SS |
SS |
SS |
SS |
| 7FB4h |
DS |
DS |
DS |
DS |
| 7FB8h |
FS |
FS |
FS |
FS |
| 7FBCh |
GS |
GS |
GS |
GS |
| 7FC0h |
LDTR |
LDTR |
LDTR |
LDTR |
| 7FC4h |
TR |
TR |
TR |
TR |
| 7FC8h |
DR7 |
DR7 |
DR7 |
DR7 |
| 7FCCh |
DR6 |
DR6 |
DR6 |
DR6 |
| 7FD0h |
EAX |
EAX |
EAX |
EAX |
| 7FD4h |
ECX |
ECX |
ECX |
ECX |
| 7FD8h |
EDX |
EDX |
EDX |
EDX |
| 7FDCh |
EBX |
EBX |
EBX |
EBX |
| 7FE0h |
ESP |
ESP |
ESP |
ESP |
| 7FE4h |
EBP |
EBP |
EBP |
EBP |
| 7FE8h |
ESI |
ESI |
ESI |
ESI |
| 7FECh |
EDI |
EDI |
EDI |
EDI |
| 7FF0h |
EIP |
EIP |
EIP |
EIP |
| 7FF4h |
EFLAGS |
EFLAGS |
EFLAGS |
EFLAGS |
| 7FF8h |
CR3 |
CR3 |
CR3 |
CR3 |
| 7FFCh |
CR0 |
CR0 |
CR0 |
CR0 |
Intel/AMD processor state after SMM entry |
| register |
contents |
| selector |
base |
limit |
access rights |
| CS |
3000h #1 |
SMBASE |
(FFF)F_FFFFh |
8093h #2 |
| SS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
| DS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
| ES |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
| FS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
| GS |
0000h |
0000_0000h |
(FFF)F_FFFFh |
8093h |
| EFLAGS |
0000_0002h |
| EIP |
0000_8000h |
| CR0 |
bits 0 (PE), 2 (EM), 3 (TS), and 31 (PG) cleared, rest unmodified |
| CR4 |
0000_0000h |
| DR7 |
0000_0400h |
| IN_SMM |
true |
| IN_HLT |
false |
| IN_SHUTDOWN |
false |
| IN_FP_FREEZE |
false |
| BLOCK_INIT |
true |
| BLOCK_SMI |
true |
| BLOCK_NMI |
true |
| LATCH_INIT |
true if INIT recognized together with SMI, else false |
| LATCH_SMI |
false |
| LATCH_NMI |
true if NMI recognized together with SMI, else false |
| FERR# |
unmodified |
| A20M# |
processor-specific |
| notes |
description |
| #1 |
On Intel P6-core processors the CS selector is instead loaded with SMBASE SHR 4. |
| #2 |
Like the data segments, CS is writeable too. |
Cyrix pre-M2 processor SMM state save map |
| offset |
3 1 |
3 0 |
2 9 |
2 8 |
2 7 |
2 6 |
2 5 |
2 4 |
2 3 |
2 2 |
2 1 |
2 0 |
1 9 |
1 8 |
1 7 |
1 6 |
1 5 |
1 4 |
1 3 |
1 2 |
1 1 |
1 0 |
9 |
8 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| -30h |
ESI or EDI |
| -2Ch |
I/O write data |
| -28h |
I/O write data size |
I/O write port address |
| -24h |
reserved |
H |
S |
P |
I |
r. |
| -20h |
CS descriptor (bit31..0) |
| -1Ch |
CS descriptor (bit63..31) |
| -18h |
reserved |
CPL |
reserved |
CS selector |
| -14h |
next EIP |
| -10h |
current EIP |
| -0Ch |
CR0 |
| -08h |
EFLAGS |
| -04h |
DR7 |
Cyrix M2 processor SMM state save map |
| offset |
3 1 |
3 0 |
2 9 |
2 8 |
2 7 |
2 6 |
2 5 |
2 4 |
2 3 |
2 2 |
2 1 |
2 0 |
1 9 |
1 8 |
1 7 |
1 6 |
1 5 |
1 4 |
1 3 |
1 2 |
1 1 |
1 0 |
9 |
8 |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
| -30h |
ESI or EDI |
| -2Ch |
I/O write data |
| -28h |
I/O write data size |
I/O write port address |
| -24h |
reserved |
CPL |
reserved |
N |
r. |
IS |
reserved |
H |
S |
P |
I |
C |
| -20h |
CS descriptor (bit31..0) |
| -1Ch |
CS descriptor (bit63..31) |
| -18h |
reserved |
CS selector |
| -14h |
next EIP |
| -10h |
current EIP |
| -0Ch |
CR0 |
| -08h |
EFLAGS |
| -04h |
DR7 |
|