SMM

Ring -2

System Management Mode is the deepest execution level on x86, running below even the hypervisor. The DioProcess SMM driver provides physical memory operations from this privileged environment, hidden inside SMRAM.

Extreme Caution — Firmware Level

SMM code runs in hidden SMRAM outside OS visibility. Bugs here can corrupt hardware state, brick the machine, or leave the system in an unrecoverable state. Test only in QEMU/OVMF or on expendable hardware with a known-good SPI flash recovery path (e.g. CH341A programmer).

Why Ring -2?

SMM is isolated from every other execution level on the CPU. Code running in SMRAM cannot be inspected by the kernel, cannot be trapped by the hypervisor, and is not subject to PatchGuard. It is triggered only by a System Management Interrupt (SMI), which puts every CPU core into SMM in a well-defined state.

Isolation

Runs in SMRAM — a chipset-locked memory region invisible to Ring 0/-1

No PatchGuard

KPP cannot monitor SMM code — it does not exist from the OS perspective

Trigger via SMI

Software SMI (port 0xB2) forces every CPU into SMM to service the request

Physical Memory Access

Direct physical memory read/write via CR3 page table walk

Architecture Overview

┌─────────────────────────────────────────────────────────┐
│  DioProcess UI (Dioxus) — SMM Tab [Ring -2]             │
└──────────────────────────┬──────────────────────────────┘
                           │ DeviceIoControl
┌──────────────────────────▼──────────────────────────────┐
│  Kernel Driver (DioProcess.sys)                          │
│  SMM/SmmCommunication.cpp — reads NVRAM, triggers SMI    │
└──────────────────────────┬──────────────────────────────┘
                           │ SMI (port 0xB2)
┌──────────────────────────▼──────────────────────────────┐
│  DioProcessDxe.efi (DXE Runtime Driver)                  │
│  - Allocates communication buffer at boot                │
│  - Publishes buffer address to NVRAM variable            │
│  - Bridges kernel driver ↔ SMM handler                   │
└──────────────────────────┬──────────────────────────────┘
                           │ MM_COMMUNICATE
┌──────────────────────────▼──────────────────────────────┐
│  DioProcessSmm.efi (SMM Driver)                          │
│  - Runs in SMRAM (hidden from OS)                        │
│  - Handles SMI requests                                  │
│  - Physical memory read/write via CR3 page table walk    │
└─────────────────────────────────────────────────────────┘

Why Both DXE and SMM Drivers?

• SMM is isolated — runs in hidden SMRAM, only accessible via SMI interrupt
• No direct calls — the OS/kernel cannot call SMM functions directly
• DXE sets up the mailbox — allocates communication buffer during boot, publishes address to NVRAM
• Kernel reads NVRAM — gets buffer address, writes command, triggers SMI
• SMM reads buffer — executes command, writes result, returns from SMI

Features

Architecture

DXE + SMM driver split, communication buffer, SMI trigger flow

Physical Memory

Read/write physical memory from SMM via CR3 page table walk

SMI Communication

NVRAM-published communication buffer + software SMI trigger

QEMU Testing

Pre-built OVMF firmware with embedded SMM/DXE drivers for safe testing

Requirements

• UEFI firmware with SMM support — both DXE and SMM drivers must be embedded in the platform firmware volume, or loaded from a modified OVMF build
• DioProcess kernel driver loaded — required to trigger SMI from the OS
• Administrator privileges — for kernel driver installation and NVRAM reads
• QEMU + OVMF for development — do not test on production hardware

Source Files

efi/
├── DioProcessSmm/          # SMM driver (Ring -2) — EDK2 DXE_SMM_DRIVER
│   ├── SmmMain.c           # SMM entry point, SMI handler registration
│   ├── Smi.c               # SMI handler implementation
│   ├── Commands.c          # Command dispatcher (read/write physical memory)
│   ├── Memory.c            # Physical memory ops via CR3 page table walk
│   └── Nt.c                # NT kernel structure parsing (EPROCESS offsets)
├── DioProcessDxe/          # DXE runtime driver — kernel ↔ SMM bridge
│   ├── DxeMain.c           # DXE entry, MM_COMMUNICATION2 setup
│   └── Utils.c             # Virtual address translation helpers
├── build/                  # Pre-built .efi binaries
│   ├── DioProcessSmm.efi
│   └── DioProcessDxe.efi
└── ovmf/                   # QEMU testing files
    ├── OVMF_CODE.fd        # OVMF with embedded SMM/DXE drivers
    ├── OVMF_VARS.fd        # NVRAM variables
    └── run_qemu.bat        # QEMU launch script with SMM support

kernelmode/DioProcess/DioProcessDriver/
└── SMM/SmmCommunication.cpp   # Kernel-side SMI trigger + NVRAM reader

crates/smm/                    # Rust bindings
├── src/driver.rs              # SMM IOCTL wrappers
├── src/types.rs               # SmmCommand, SmmResponse, SmmStatus
└── src/error.rs               # SmmError enum