SMM Architecture
The Ring -2 stack is split between a DXE runtime driver (DioProcessDxe.efi) and an SMM driver (DioProcessSmm.efi). They coordinate via a shared communication buffer whose address is published to NVRAM at boot.
Two-driver split is not optional
The OS/kernel cannot invoke SMM code directly — an SMI is the only entry point. The DXE driver acts as a mailbox setup layer, and the kernel side reads its published NVRAM entry to know where to write commands.
Boot Flow
- Firmware loads DXE phase drivers, including
DioProcessDxe.efi - DXE allocates a communication buffer using
EFI_MM_COMMUNICATION2_PROTOCOL - DXE publishes the buffer's physical address to a UEFI NVRAM variable
- SMM driver
DioProcessSmm.efiis dispatched into SMRAM by the SMM IPL - SMM driver registers an SMI handler with a unique handler GUID
- OS boots — buffer address and handler GUID remain accessible via NVRAM
Runtime Flow
Usermode (dioprocess.exe)
│ DeviceIoControl(IOCTL_SMM_*)
▼
Kernel (DioProcess.sys · SmmCommunication.cpp)
1. Read NVRAM: buffer address + handler GUID
2. Map communication buffer into kernel virtual space
3. Write command struct into buffer
4. Trigger software SMI (OUT 0xB2, cmd)
│
▼ (all cores enter SMM)
SMRAM (DioProcessSmm.efi)
1. SMI handler fires — matches handler GUID
2. Reads command from buffer
3. Executes: read/write phys memory, walk CR3, etc.
4. Writes response back to buffer
5. Returns (RSM instruction — resumes OS)
│
▼
Kernel reads response from buffer → returns to usermodeCommunication Buffer Layout
// Shared struct between kernel and SMM
typedef struct _SMM_COMM_BUFFER {
UINT32 Signature; // 'DPSM' magic
UINT32 Command; // Command opcode
UINT64 Arg1; // Command-specific
UINT64 Arg2; // Command-specific
UINT64 Arg3; // Command-specific
UINT32 Size; // Data length
UINT32 Status; // Response status
UINT8 Data[4096]; // Inline data buffer
} SMM_COMM_BUFFER;Command Opcodes
| Opcode | Name | Description |
|---|---|---|
| 0x01 | READ_PHYS | Read N bytes from a physical address |
| 0x02 | WRITE_PHYS | Write N bytes to a physical address |
| 0x03 | TRANSLATE_VA | Walk CR3 to translate a virtual address to physical |
| 0x04 | PING | Sanity-check that the SMM handler is reachable |
Implementation
| Layer | Location |
|---|---|
| SMM driver (SMRAM) | efi/DioProcessSmm/SmmMain.c |
| SMI handler | efi/DioProcessSmm/Smi.c |
| Command dispatcher | efi/DioProcessSmm/Commands.c |
| DXE bridge | efi/DioProcessDxe/DxeMain.c |
| Kernel-side SMI trigger | kernelmode/DioProcess/DioProcessDriver/SMM/SmmCommunication.cpp |
| Rust bindings | crates/smm/src/driver.rs |