Related: "Intel's System Management Mode by Robert R. Collins" Dr. Dobbs Journal, Jan 1997 (apparently): http://www.rcollins.org/ddj/Jan97/Jan97.html http://w

Related: "Intel's System Management Mode by Robert R. Collins" Dr. Dobbs Journal, Jan 1997 (apparently): http://www.rcollins.org/ddj/Jan97/Jan97.html http://www.rcollins.org/ddj/Jan97/Jan97.html >"When comparing ICE mode to System Management Mode, you could easily conclude that SMM was derived from ICE mode because their similarities are striking. Certainly, they have more similarities than differences. In reality, SMM appears to be both a subset and a superset of ICE mode. For the purposes of this comparison, I'll contrast 80386 ICE mode with Pentium SMM. Consider the following similarities: o Both modes use a microprocessor input pin to trigger invocation. On the 80386 DX, this undocumented pin is located at position B6. On SL-enhanced Intel microprocessors, this pin is named SMI#. o Both modes use a microprocessor output pin to indicate when in ICE or SMM mode. On the 80386 DX, this undocumented pin is located at position C7. On SL-enhanced Intel microprocessors, this pin is named SMIACT#. o Both modes may be entered from any processor mode at any time by asserting the applicable input pin. o Both modes have the ability to resume to any processor mode and to any CPL upon completion. o Both modes save the entire microprocessor state to a state-save map upon entrance. o The state-save map area is in a protected memory space, isolated from user memory. o Both modes restore the entire microprocessor state from the state-save map. Neither LOADALL nor the SMM- equivalent RSM instruction sanity check the data in the state save map upon resumption. On the 386 or 486, LOADALL doesn't validate any of the microprocessor state from the state-save data. Therefore it is possible to use LOADALL to perform microprocessor tricks that would otherwise be illegal. For example, you could enable paging, yet remain in real mode. SMM uses the RSM instruction to restore the microprocessor state. RSM does perform some minor sanity checks (like the real-mode paging check), but otherwise does little. Using either instruction, it is possible to change the access rights of segment descriptors to illegal values - like making the code segment writable in protected mode or setting the GDT access rights (which in theory don't exist) to Not-Present. o The ICE-mode LOADALL instruction on the 486 and the RSM instruction on all SL-enhanced microprocessors are disabled when operating outside of their respective operating modes. Both instructions generate an invalid opcode exception when executed outside of ICE mode and SMM, respectively. o The order in which the microprocessor state information is written is exactly the same, but the direction is different. ICE mode writes data from bottom to top, and SMM writes data from top to bottom (like a stack). o Both modes begin execution in real mode, with all segments as read/writable and having 4-GB limits. o Both modes begin execution of a special handler after the microprocessor state is saved. o The most compelling similarity of all is the state-save map. When viewed side-by-side, the state save map of ICE mode and SMM look virtually identical. Figure 2 (http://www.rcollins.org/ddj/Jan97/Jan97.html#Fig2 http://www.rcollins.org/ddj/Jan97/Jan97.html#Fig2) compares the two state-save maps."