LegacySmmSredir Module

Overview

This is a UEFI SMM (System Management Mode) driver for legacy serial redirection, sourced from AmiModulePkg/LegacySerialRedirection. It installs a protocol notification callback that intercepts SMM communication via a structured buffer (a serial redirection command/response I/O protocol), validates the buffer address against SMM allowed regions using AmiBufferValidationLib, then performs 8/16/32-bit indexed memory reads, writes, or block-fill operations on behalf of the caller. The module has no DXE-to-SMM protocol dependencies (0 imports); it resolves all dependencies at runtime via the SMM Services Table (gSmst) protocol database.

Address Range

0x2A0 - 0x1320 (20 functions, 0x1080 bytes .text segment)

Key Functions

Entry Points (Public API)

• 0x420 _ModuleEntryPoint: The sole standard entry point called by the SMM driver framework. Calls sub_44C (library init) then sub_618 (driver entry).

Internal Call Flow

1. _ModuleEntryPoint (0x420)
2. sub_44C (0x44C) -- saves UEFI handles, locates SmmBase2 and AmiBufferValidationLib protocols
3. sub_618 (0x618) -- calls sub_2A0/setjmp to check if board is supported (CMOS check); dispatches to sub_C58
4. sub_C58 (0xC58) -- locates SMM subsystem, initializes I/O protocol, calls sub_9E8
5. sub_9E8 (0x9E8) -- registers sub_6CC as SMM communicate handler (65 = EFI_SMM_COMMUNICATE_HEADER) + notification callbacks
6. sub_6CC (0x6CC) -- the actual communicate handler servicing read/write/fill commands from the caller

State Management

Global variables in .data segment:

Data Structures

• Jump Buffer at struct pointed to by sub_2A0 (0x2A0): 248 bytes = 8 GPRs (0x00-0x3F), return addr (0x40-0x47), call-thunk ptr (0x48), MXCSR (0x50), 10 XMM regs (0x58-0xE8)
• SMM Communicate Buffer: structured with command byte at +0 (1=read, 2=write, 3=fill), index at +2, data at +3, count at +4 (for fill), pointer at +5 (for fill source)
• CMOS Register 0x4C: byte at CMOS I/O ports 0x70/0x71; bit 0 determines legacy serial redirect support

Command Protocol (sub_6CC handler)

The communicate handler at 0x6CC decodes commands from the buffer:

• Case 1 (Read): Reads 8/16/32-bit value from qword_1A00 + (index * width) based on width field at +9; stores result at buffer+3
• Case 2 (Write): Writes buffer+3 value to qword_1A00 + (index * width)
• Case 3 (Block Fill): Repeatedly writes N bytes from source pointer (buffer+5) to indexed locations, count = buffer+4

Width (data element size) is determined by byte at +9: 1=byte, 2=word, 4=dword. All I/O is relative to the I/O base pointer stored in qword_1A00.

Dependencies

Consumed (this module calls SMM services)

• SmmBase2 Protocol (GUID at unk_19D0): entry point into SMM, provides SmmCommunicate
• gSmst (SMM Services Table) (offset 0x1A28): provides AllocatePool, LocateProtocol, InstallProtocolInterface, etc.
• DebugLib Protocol (GUID at unk_1940): provides DEBUG print and ASSERT support
• AmiBufferValidationLib (GUID at unk_1950): validates buffer addresses against GCD-allowed MMIO regions
• SMM Internal Protocol (GUID at unk_1960): provides SMM core internal services
• I/O Protocol (GUIDs at unk_19B0/unk_19C0): provides SMM or DXE I/O access
• SMM Communicate Protocol (GUID at unk_1930): for registering communicate handlers
• SMM SW Dispatch Protocol (GUID at unk_1970): for SMM software interrupt dispatch registration
• SMM Notification protocols (GUIDs at unk_1980/unk_19A0): for protocol notification callbacks
• Hardware: CMOS RTC ports 0x70/0x71, fixed memory address 0xFDAF0490 (hardwired platform config)

Consumed By (other modules call this)

None directly -- this is a leaf SMM driver that installs protocols and handlers consumed by the SMM framework through its communicate handler registration.