System Management Mode (SMM) is a special processor mode used by firmware for low-level platform control such as power management, thermal control, flash protection, hardware emulation and OEM-specific logic. The processor enters SMM after receiving a System Management Interrupt (SMI).

SMM executes from a protected memory region called SMRAM. Normal software cannot access SMRAM while the processor is outside SMM.

SMI generation

SMIs are generated by chipset/platform logic. Common sources include:

• ACPI and power-management events
• thermal alarms
• watchdog timers
• GPIO events
• SPI flash protection events
• software-triggered IO port accesses

Software SMIs are commonly generated through writes to ports such as:

out 0xB2, al

The chipset monitors IO cycles and generates an SMI when configured ports are accessed. The written value is typically interpreted as an SMM command number. Some systems also use port B3h for parameters.

SMM entry

When the processor accepts an SMI:

• execution is synchronized
• interrupts are blocked
• processor state is automatically saved into SMRAM
• processor enters SMM state
• execution begins at the SMM entry vector

Saved state includes:

• general registers
• RIP/EIP
• RFLAGS
• segment registers
• control registers
• descriptor tables
• debug registers
• EFER and paging state

Each CPU core has its own save-state area and typically its own SMRAM region.

SMBASE

SMBASE defines the base address used for SMM entry. Historically the default value is 0x30000.

Execution starts at SMBASE + 0x8000

The CPU save-state area is located near SMBASE + 0xFE00

Firmware commonly relocates SMBASE during boot.

SMRAM mapping

SMRAM is implemented through chipset-controlled physical address remapping.

The chipset checks:

• accessed physical address
• SMRAM configuration bits
• current CPU SMM state

When the CPU is outside SMM, accesses to the SMRAM range are blocked or redirected. When the CPU enters SMM, the chipset changes memory decode behavior so the same physical address range resolves to hidden SMRAM storage.

Historically this was often implemented using the A-segment area: 0xA0000 - 0xBFFFF

Modern systems usually place SMRAM inside TSEG near the top of physical DRAM.

Typical chipset control bits include:

• D_OPEN
• D_CLS
• D_LCK

D_OPEN temporarily exposes SMRAM outside SMM. D_LCK locks SMRAM configuration until reset.

SMM handlers

SMM handlers typically:

• switch stacks
• parse save-state data
• dispatch firmware handlers
• access chipset registers
• emulate hardware behavior
• modify saved CPU state if needed

The save-state area is writable by SMM code, allowing firmware to modify execution state before returning.

RSM

SMM exits through the RSM instruction.

RSM restores:

• instruction pointer
• registers
• control registers
• paging state
• long mode state
• interrupt state

Execution resumes exactly where the SMI interrupted normal execution.

When SMM exits, the chipset hides SMRAM again.

SMRAM protection

Modern systems protect SMRAM using:

• TSEG isolation
• SMRR range protection
• locked chipset configuration
• DMA restrictions through IOMMU

Firmware usually locks SMRAM configuration before transferring control to the operating system.

SMSTATE layout

For Pentium M 6D8:

(offsets from SMBASE+0xFFFC = TMP2):

Further reading

• sandpile.org/x86/smm.htm↗
• opensecuritytraining.info/.../Day1_07_Advanced%20x86%20-%20BIOS%20and%20S....pdf↗