Debug System Management Mode (SMM)

Intel® System Debugger User Guide

ID	Date	Version	Classification
648476	10/17/2024		Confidential

System Management Mode (SMM) is a special-purpose operating mode in CPUs based on Intel® architecture. SMM was designed for handling system-wide functions like power management, system hardware control, or proprietary OEM-designed code. The main benefit of SMM is that it offers a distinct and easily isolated processor environment that operates transparently to the operating system or executive and software applications.

The following SMM mechanisms make it transparent to application programs and operating systems:

The only way to enter SMM is by signaling a System Management Interrupt (SMI) through the SMI# pin on the processor or through an SMI message received through the Advanced Programmable Interrupt Controller (APIC) bus. The SMI is a non-maskable external interrupt and takes precedence over an Non-maskable Interrupt (NMI) and a maskable interrupt.
The processor executes SMM code in a separate address space that can be made inaccessible from the other operating modes.
Upon entering SMM, the processor saves the context of the interrupted program or task.
All interrupts normally handled by the operating system are disabled upon entry into SMM.
When the SMI handler has completed its operations, it executes a resume (RSM) instruction. This instruction causes the processor to reload the saved context of the processor, switch back to protected or real mode, and resume executing the interrupted application or operating-system program or task.

Upon entering SMM, the processor switches to a new address space. The critical code and data of the SMI handler reside in a memory region referred to as system-management RAM (SMRAM). The processor uses a pre-defined region within SMRAM to save the processor’s pre-SMI context. SMRAM can also be used to store system management information (such as system configuration and specific information about powered-down devices) and OEM-specific information.

Challenges in Debugging Code Running in SMM

SMI can occur at irregular intervals and detecting an SMI is a challenge by itself. Furthermore, on the Intel architecture, the debug features are controlled through a set of debug registers. The Debug Control Register (DR7) defines how the breakpoints set in Debug Address Registers should be interpreted by the processor. During SMM entry, the Debug Register DR7 is cleared. This disables software and hardware breakpoints that were set before SMM entry. Intel® System Debugger offers special features to overcome these challenges during SMM debugging.

Ingredients

Software Tools: Intel® System Debugger NDA
Debug Probe: Intel® Silicon View Technology (Intel® SVT) Closed Chassis Adapter (CCA) or Intel® SVT Debug Class (DbC) USB Debug Cable
Hardware: Whiskey Lake U platform running TianoCore EDK II BIOS with Intel® Direct Connect Interface (Intel® DCI) debug interfaces enabled.

Connect Intel® System Debugger to the Target

Follow instructions to connect to the target. Ensure that a target connection has been successfully established.

Note:

Refer to the troubleshooting section of this recipe for instructions on troubleshooting target connection issues.

Allow the target to boot up to a state where SMM debugging is needed.

Set up Breakpoints for Debugging SMM

Once the platform is ready for SMM debugging, the next step is to set up breakpoints in the code running within SMM. However, if you set breakpoints setup before entering SMM, they will be cleared at the SMM entry. To restore such breakpoints using Intel System Debugger, you can either:

Intercept the SMM entry point
Force SMI

See instructions on both operations to start SMM debugging.

Access the SMRAM State Save Map

When the processor initially enters SMM, it writes its state to the state save area of the SMRAM. The state save area on an Intel® 64 processor at [SMBASE + 8000H + 7FFFH] and extends to [SMBASE + 8000H + 7C00H]. User can access the register values of a particular thread using Intel® System Debugger. Refer to the Accessing the SMRAM State Save Map section in the product User Guide for instructions on how to display the State Save Map.

For more information of the SMRAM State Save Map, refer to the Intel® 64 and IA-32 Architectures Software Developer Manuals.

Source-Level Debugging within SMM

Various features available in Intel System Debugger for source-level debugging are also available for debugging source code running in SMM.

Debug information for SMM can be loaded only after switching to SMM protected mode. The CPU uses a far jmp instruction to jump to code located in a different segment than the current code segment but at the same privilege level, sometimes referred to as an intersegment jump. After hitting the breakpoint for SMM entry, you have to manually step through a few instructions until the far jmp instruction is executed.

far_jump_smm

For loading the debug information, follow the default approach by pressing the Load Available Debug Symbols (formerly named Load This) button. Additional settings like Path Mapping may be needed for loading debug symbols (see Manual Loading).

modules_smm

You can insert additional breakpoints within the SMM code following the instructions. Any breakpoint inserted will be disabled at SMM-exit. However, these breakpoints can be restored again by using the SMM-entry breakpoint.

You may also benefit from the Modules view, Memory Browser view, Variables view, and others, while debugging SMM. The current operation mode of the processor is indicated at bottom left corner of the Eclipse tool.

View System-management Range Registers for SMM Debugging

SMM is configured through system-management range registers, which contain a pair of model-specific register (MSRs). For example, the IA32_SMRR_PHYSBASE MSR defines the base address for the SMRAM memory range and the memory type used to access it in SMM. The IA32_SMRR_PHYSMASK MSR contains a valid bit and a mask that determines the SMRAM address range protected by the SMRR interface. These MSRs can be viewed and/or modified using the Platform Register Dictionary, Platform Register Watch and Platform Register Editor views in the Intel System Debugger.

registers_smm

Troubleshooting

Issue

Failed to connect to target

Solution

Hardware: Design guidelines to enable CCA interface over USB interface are available in the Platform Design Guide (PDG). Failure to follow the recommended design guidelines may prevent the tool from communicating to the target.
Firmware: Firmware running on the target must be configured to enable CCA interface.
BIOS: If your target is executing BIOS, then the BIOS must be configured to enable CCA interface. For more information, refer to the BIOS user guide or Intel System Debugger User Guide: Target Setup.

For additional help, refer to the platform documentation, primary Troubleshooting chapter, or contact your Intel presentative. Priority support is available for Intel System Debugger NDA users through Online Service Center or Intel® Premier Support.