Newer
Older
AMI-Aptio-BIOS-Reversed / RegAccessSMM / RegAccessSMM.md
@Ajax Dong Ajax Dong 2 days ago 4 KB Init

RegAccessSMM

Function Table

Address Name Description
ModuleEntryPoint
RegAccessSmmConstructor
RegAccessSmmDestructor
RegAccessSmmEntryPoint
S3BootScriptLibInitialize
CopyMem
ZeroMem
DebugPrint
DebugAssert
AcquireSpinLock
ReleaseSpinLock
S3BootScriptNotifyDxeSmmReadyToLock
UsraDecodeAddress
UsraSocketDataInit
Global Variables (.data segment: 0x6380-0x67E0)
SMM System State
0x6508 EFI_RUNTIME_SERVICES *gRuntimeServices = NULL; // 0x6510
0x6520 VOID *gDebugProtocol = NULL; // 0x6528
0x6530 UINT64 gPciExpressBaseAddr = 0; // 0x6538
0x6540 UINT64 gTscFrequency = 0; // 0x6548
0x6550 byte
0x6558 // USRA / IIO Topology
0x6560 BOOLEAN gCsrViaMsr = FALSE; // 0x6568 byte
0x65A8 BOOLEAN gUsraBatchActive = FALSE; // 0x65B0 byte
0x65C0 UINT64 gModuleStatus = 0; // 0x66C8
0x66D0 UINT8 *gIioProtocolData = NULL; // 0x66D8
0x66E0 UINT8 gSocketTopoData[24]; // 0x66E4
0x670C UINT8 gSocketCnt = 0; // 0x670D
0x670E UINT32 gSockPrMask = 0; // 0x6712
0x6716 UINT8 gCpuStepping = 0; // 0x671A
0x671B UINT8 gMaxPciePorts = 0; // 0x671C
0x6740 UINT8 gIioPresenceActive = 0; // 0x676C
0x676E UINT32 gSockPrMaskActive = 0; // 0x6772
0x677A UINT8 gMaxPciePortsActive = 0; // 0x677C
S3 Boot Script State
0x6570 BOOLEAN gS3ReadyToLockFlag = FALSE; // 0x6578 byte
0x6580 EFI_SMM_S3_PROTOCOL *gSmmS3Protocol = NULL; // 0x6588
0x6590 VOID *gS3RdyBootReg = NULL; // 0x6598
0x67A0 UINT8 *gS3BootScriptData2 = NULL; // 0x67A8
SmmLockBox State
0x67B0 16 bytes
0x67B8 UINT64 gSmramRangeCnt = 0; // 0x67C0
0x67C8 // ---------------------------------------------------------------------------
Module Entry Point (AutoGen)
These are debug ASSERT_NOT_REACHED markers from AutoGen
Query SMRAM range count
Count of UINT64 pairs
TSC ticks per 10 ms
Install LockBox communication configuration table
Detect IioProtocol and CSR/MSR routing
CLFLUSH line size in QWORDs
Intel hyper-threading: adjust for logical processors per core
Allocate cache-aligned region + spinlock at end
Close S3 boot script
Uninstall LockBox communication config table if installed
Free SMRAM ranges pool
S3 Boot Script Library
First call from constructor
Allocate default-sized boot script table
Register DxeSmmReadyToLock notification
Locate SMM S3 protocol
Allocate S3 memory descriptor
Register S3 notifications
Register ReadyToBoot notification
as per decompilation of sub_1DC8, sub_1E24, sub_2554, etc.)
Full implementation in RegAccessSMM_full.c
Helper Functions
Validate no overflow
Read CMOS debug level: port 0x70 index 0x4C, port 0x71 data
Map to standard error level
Call SMM Debug protocol print
SMM Spinlock
SmmLockBox Interface
S3 Boot Script: notify DxeSmmReadyToLock
Restore boot script data from LockBox
Save updated boot script data to LockBox
USRA Register Access
Initialize socket topology data
Mask high bits in register address
Get socket MMIO base
Get box instance
mix with original
IIO Topology Initialization
Locate IIO protocol
Extract per-socket topology data (4 sockets, 6 bytes per socket)
socket BDF data
socket type
mmcfg addr
reserved // Copy raw IO data (6 bytes per socket)
Copy to active set

Generated by HR650X BIOS Decompilation Project