RuntimeSmm Module

Overview

RuntimeSmm is a minimal UEFI SMM runtime driver (DXE_SMM_DRIVER) from AmiModulePkg\RuntimeSmm\RuntimeSmm.c that bridges boot-time and runtime SMM services. It initializes global pointers to the UEFI Boot Services, Runtime Services, and System Table, locates SmmBase2 protocol to obtain the SMM Services Table (gSmst), and registers a protocol notification handler for the SMM Runtime Services Table protocol. The driver uses SetJump/LongJump for error recovery, wrapping the main entry logic in a try/except-style pattern, and ultimately installs a GUIDed protocol event handler via SmmRegisterProtocolNotify.

Address Range

0x300 - 0xC40 (17 functions)

Key Functions

Entry Points (Public API)

• 0x420 _ModuleEntryPoint: Called by SMM core on driver load. Calls sub_44C() to initialize service table globals, then sub_58C() as the main dispatch routine.

Internal Helpers

• 0x300 sub_300: SetJump -- saves full register context (15 GP regs, 10 XMM regs, MXCSR) into a 248-byte jump buffer (unk_1380), returns via return v21().
• 0x3A0 sub_3A0: LongJump -- restores MXCSR from jump buffer and jumps to saved return address at buffer+72.
• 0x640 sub_640: Stub returning 0x8000000000000003 (EFI_UNSUPPORTED). Used as a default protocol notify handler in the registration table.
• 0x888 sub_888: Debug library support -- lazily locates gEfiStatusCodeRuntimeProtocolGuid via gSmst->LocateProtocol.
• 0x8D8 sub_8D8: ASSERT_EFI_ERROR handler -- checks DebugLib protocol and severity mask before calling ReportStatusCode.
• 0x920 sub_920: Debug ASSERT -- calls ReportStatusCodeEx on the DebugLib protocol with file/line/expression.
• 0x960 sub_960: CMOS-based runtime detection -- reads NVRAM byte at CMOS index 0x4C, checks boot mode (returns 0x80000004 for normal, 0x80000002 for S3 resume).
• 0x9B0 sub_9B0: SetJump buffer validation -- asserts non-null and 8-byte aligned.
• 0xBD4 sub_BD4: CompareMem against reference GUID unk_12B0 (little-endian aligned compare with tail handling).

State Management

Global Variables (.data segment)

Initialization Flow

1. _ModuleEntryPoint (0x420) called by SMM core
2. sub_44C (0x44C) caches gImageHandle, gST, gBS, gRT, locates SmmBase2 protocol, gets gSmst
3. sub_58C (0x58C) saves SetJump context, calls sub_768 (driver init), restores via LongJump
4. sub_768 (0x768) caches SystemTable/BootServices/RuntimeServices, locates SMM RST protocol, calls its callback, optionally swaps RuntimeServices with SMM version, registers protocol handlers via sub_9F8/sub_A80, calls sub_64C for protocol notify registration
5. sub_64C (0x64C) allocates a 136-byte buffer, fills first 3 QWORDs from protocol GUID data and the remaining 14 with sub_640 stub, registers via SmmRegisterProtocolNotify

Data Structures

• SetJump buffer at unk_1380 (248 bytes): Offset layout is 15 saved GP registers (0-64), return address (72), MXCSR value (80), 10 XMM registers (88-248). Used by sub_300/sub_3A0 for error recovery wrapping around sub_768.
• Protocol notify buffer in sub_64C (136 bytes = 17 QWORDs): First 3 QWORDs are protocol GUID, remaining 14 QWORDs initialized to sub_640 function pointer, registered via SmmRegisterProtocolNotify.

Calling Patterns

1. Try/Except pattern: SetJump(context) -> sub_768() [protected code] -> LongJump(context, status) -> check status -> unreachable ASSERT
2. Protocol registration flow: Locate SMM Base2 -> Get SMM System Table -> Locate SMM Runtime Services Table Protocol -> Call protocol callback -> Register protocol notify -> Register status code protocol handlers

Dependencies

Consumed (this module calls)

• SMM Services (gSmst): LocateProtocol (offset +208), SmmRegisterProtocolNotify (offset +40), SmmIoMemRead/protocol entry iteration (offset +152/+160 in SMM system table struct)
• Boot Services (gBS): LocateProtocol (offset +320), AllocatePool (offset +24), FreePool (offset +32)
• Hardware IO: CMOS NVRAM ports 0x70/0x71 (sub_960), fixed address 0xFDAF0490 (runtime detection byte)
• DebugLib protocol: ReportStatusCode and ReportStatusCodeEx (via gSmst->LocateProtocol)

Consumed By (other modules call this)

• SMM Core: Calls _ModuleEntryPoint (exported entry point)
• SMM Runtime Services Table protocol consumer: The protocol notify handler registered via sub_64C is invoked by SMM core when the target protocol is installed
• Callback from located protocol at 0x807: The protocol at qword_1360 is called with an Enable flag pointer; its second function (+8) provides the SMM system table

Notes

• The module has NO imports -- all protocol interfaces are resolved internally via LocateProtocol through the system tables.
• Strings reference build paths e:\hs\Build\HR6N0XMLK\DEBUG_VS2015\X64\... and e:\hs\AmiModulePkg\RuntimeSmm\RuntimeSmm.c, confirming this is a DEBUG VS2015 X64 build.
• sub_640 is a 2-instruction leaf returning EFI_UNSUPPORTED -- used as a placeholder default handler in the protocol notify registration table.
• sub_960's CMOS check at index 0x4C and the byte at 0xFDAF0490 are platform-specific runtime detection heuristics for distinguishing normal boot from S3 resume.
• The double sub_920 call after LongJump in sub_58C is unreachable code (standard EDK2 AutoGen tail after infinite loop).
• sub_BD4's alignment-sensitive comparison logic handles unaligned GUID comparison by byte-matching leading/trailing misaligned bytes.