D
DioProcess

SMM Architecture

The Ring -2 stack is split between a DXE runtime driver (DioProcessDxe.efi) and an SMM driver (DioProcessSmm.efi). They coordinate via a shared communication buffer whose address is published to NVRAM at boot.

Two-driver split is not optional

The OS/kernel cannot invoke SMM code directly — an SMI is the only entry point. The DXE driver acts as a mailbox setup layer, and the kernel side reads its published NVRAM entry to know where to write commands.

Boot Flow

  1. Firmware loads DXE phase drivers, including DioProcessDxe.efi
  2. DXE allocates a communication buffer usingEFI_MM_COMMUNICATION2_PROTOCOL
  3. DXE publishes the buffer's physical address to a UEFI NVRAM variable
  4. SMM driver DioProcessSmm.efi is dispatched into SMRAM by the SMM IPL
  5. SMM driver registers an SMI handler with a unique handler GUID
  6. OS boots — buffer address and handler GUID remain accessible via NVRAM

Runtime Flow

Usermode (dioprocess.exe)
        │  DeviceIoControl(IOCTL_SMM_*)
        ▼
Kernel (DioProcess.sys · SmmCommunication.cpp)
  1. Read NVRAM: buffer address + handler GUID
  2. Map communication buffer into kernel virtual space
  3. Write command struct into buffer
  4. Trigger software SMI (OUT 0xB2, cmd)
        │
        ▼    (all cores enter SMM)
SMRAM (DioProcessSmm.efi)
  1. SMI handler fires — matches handler GUID
  2. Reads command from buffer
  3. Executes: read/write phys memory, walk CR3, etc.
  4. Writes response back to buffer
  5. Returns (RSM instruction — resumes OS)
        │
        ▼
Kernel reads response from buffer → returns to usermode

Communication Buffer Layout

// Shared struct between kernel and SMM
typedef struct _SMM_COMM_BUFFER {
    UINT32   Signature;      // 'DPSM' magic
    UINT32   Command;        // Command opcode
    UINT64   Arg1;           // Command-specific
    UINT64   Arg2;           // Command-specific
    UINT64   Arg3;           // Command-specific
    UINT32   Size;           // Data length
    UINT32   Status;         // Response status
    UINT8    Data[4096];     // Inline data buffer
} SMM_COMM_BUFFER;

Command Opcodes

OpcodeNameDescription
0x01READ_PHYSRead N bytes from a physical address
0x02WRITE_PHYSWrite N bytes to a physical address
0x03TRANSLATE_VAWalk CR3 to translate a virtual address to physical
0x04PINGSanity-check that the SMM handler is reachable

Implementation

LayerLocation
SMM driver (SMRAM)efi/DioProcessSmm/SmmMain.c
SMI handlerefi/DioProcessSmm/Smi.c
Command dispatcherefi/DioProcessSmm/Commands.c
DXE bridgeefi/DioProcessDxe/DxeMain.c
Kernel-side SMI triggerkernelmode/DioProcess/DioProcessDriver/SMM/SmmCommunication.cpp
Rust bindingscrates/smm/src/driver.rs