Newer
Older
AMI-Aptio-BIOS-Reversed / CpuIo2Smm / CpuIo2Smm.md
@Ajax Dong Ajax Dong 2 days ago 5 KB Init

CpuIo2Smm

Function Table

Address Name Description
SmmSetJump
SmmLongJump
CpuIo2SmmValidateJumpBuffer
CpuIo2SmmInitServices
CpuIo2SmmCheckParameter
CpuIo2SmmMemRead
CpuIo2SmmMemWrite
CpuIo2SmmIoRead
CpuIo2SmmIoWrite
CpuIo2SmmInstallProtocol
CpuIo2SmmDebugVPrint
CpuIo2SmmDebugAssert
CpuIo2SmmDriverEntryPoint
Stride per width index: mSmmIoStride[Width] = { 1, 2, 4, 8 }
Stored at 0xE18.
CONST UINT8 mSmmIoStride[] = { 1, 2, 4, 8 };
Globals initialized by CpuIo2SmmInitServices
EFI_HANDLE gImageHandle = NULL; // 0x13E8
0x13D8 EFI_BOOT_SERVICES *gBS = NULL; // 0x13E0
0x13F0 VOID *gSmst = NULL; // 0x13F8 (SMM System Table 2)
0x1400 (DebugLib protocol)
SetJump buffer for SmmBase2->GetSmstLocation communication
Stored at 0x1410.
BASE_LIBRARY_JUMP_BUFFER gJumpBuffer;
EFI_SMM_CPU_IO2_PROTOCOL function table template at 0x13B0.
32 bytes: 4 x 8-byte function pointers:
EFI_SMM_CPU_IO2_PROTOCOL gCpuIoTemplate = {
Mem CpuIo2SmmMemRead, // .Read
Io CpuIo2SmmIoRead, // .Read
Protocol handle (initialized to NULL before installation)
Stored at 0x13D0.
EFI_HANDLE mCpuIo2Handle = NULL;
Module status - starts as EFI_UNSUPPORTED (0x8000000000000001)
Stored at 0x1508. Updated with result from protocol installation.
EFI_STATUS gStatus = EFI_UNSUPPORTED;
Internal Helpers (library bindings)
InternalCopyMem (0x2C0) - aligned copy with overlap handling
STATIC VOID *
SmmSetJump (0x310) - save execution context
STATIC UINTN
SmmLongJump (0x3B0) - restore execution context
STATIC VOID
CpuIo2SmmValidateJumpBuffer (0xCE8)
Validates alignment of JumpBuffer for SetJump.
CpuIo2SmmInitServices (0x524)
AutoGen function that initializes gBS, gRT, gSmst from SystemTable.
Called once during module entry.
Also locates EFI_SMM_BASE2_PROTOCOL (F4CCBFB7-F6E0-47FD-9DD4-10A8F150C191)
and retrieves the SMM System Table 2 via GetSmstLocation.
Locate EFI_SMM_BASE2_PROTOCOL
SmmBase2 = NULL;
Retrieve gSmst via SmmBase2->GetSmstLocation()
Uses SetJump/LongJump for context switching inside SMM
CpuIo2SmmValidateJumpBuffer (&gJumpBuffer);
CpuIo2SmmCheckParameter (0x664)
Validates I/O parameters for all four protocol interface functions.
EFI_SUCCESS - parameters are valid
EFI_INVALID_PARAMETER - invalid width, alignment, or out of range
Basic validation: Buffer must not be NULL, Width must be valid
and QWord I/O (Width=3) is not supported for port I/O.
if **((Buffer == NULL) (Width > SmmIoWidthUint64) **
Maximum address:
if (MmioOperation) {
If Count > 0, ensure the access range does not exceed MaxAddress.
Stride is mSmmIoStride[Width]: 1, 2, 4, or 8 bytes.
if (Count > 0) {
Check start address is within bounds
if (Address > MaxAddress) {
if ((Address & (mSmmIoStride[Width] - 1)) != 0) {
EFI_SMM_CPU_IO2_PROTOCOL Interface Functions
CpuIo2SmmMemRead (0x76C)
MMIO read via direct memory pointer dereference.
Reads Count elements of Width from Address into Buffer.
EFI_STATUS EFIAPI
CpuIo2SmmMemWrite (0x850)
MMIO write via direct memory pointer dereference.
Writes Count elements of Width from Buffer into Address.
CpuIo2SmmIoRead (0x934)
Reads Count elements of Width from I/O Port Address into Buffer.
QWord I/O port access is not supported by x86 ISA
CpuIo2SmmIoWrite (0xA10)
Writes Count elements of Width from Buffer to I/O Port Address.
CpuIo2SmmInstallProtocol (0xAF0)
Installs EFI_SMM_CPU_IO2_PROTOCOL via gSmst->SmmInstallProtocolInterface.
Also copies the function table to SmmIoMemAbstraction area of Smst.
Copy protocol function table to Smst+0x30
CopyMem (
Install protocol into SMM protocol database
Status = Smst->SmmInstallProtocolInterface (
Debug Protocol Support
The GUID at 0x1390 (441FFA18-8714-421E-8C95-587080796FEE) is used to
locate a debug print protocol via gSmst->SmmLocateProtocol.
CpuIo2SmmGetDebugProtocol (0xBD0)
CpuIo2SmmDebugVPrint (0xC20)
Debug print using the located debug protocol.
Read debug level from CMOS register 0x4C
CmosIndex **= IoRead8 (0x70) & 0x80 0x4C;**
Determine debug print level from CMOS byte
DebugLevel = 0;
CpuIo2SmmDebugAssert (0xCA8)
Debug assert call. Invokes the debug protocol's assert handler.
_ModuleEntryPoint (0x484)
Phase 1: Initialize global service table pointers
Status = CpuIo2SmmInitServices (ImageHandle, SystemTable);
Phase 2: Install EFI_SMM_CPU_IO2_PROTOCOL
if (!EFI_ERROR (Status)) {
The jump buffer at gJumpBuffer (0x1410) is used by AutoGen.
Preserve install error if init was OK but install failed
gStatus = Status;

Generated by HR650X BIOS Decompilation Project