Debugging SMM with JTAG: Part 2
Summary
I use the term magic loosely, but in some ways it’s pretty amazing: SMM clears the Intel hardware debug registers upon entry/exit, and it has its own separate memory address space, so under normal circumstances all breakpoints are disabled. I’m in UEFI, at the BIOS settings password entry prompt, where only one CPU thread is running; but this approach can be used anywhere in the boot process, all the way from the reset vector to the OS desktop and beyond. Here is a screenshot of the Code window and the LBR Trace window display where we are in the code, and how we got there, all the way back to the first branch instruction that triggered the write to the 1st LBR MSR pair: And for interest’s sake, you can use SourcePoint’s Register window to inspect the 32 To/From LBR MSR pairs to see how the addresses are tracked: You can see that the last branch pair written to were at LASTBRANCH 13 (SourcePoint highlights the last change in green above), that captured 83 instructions (if I counted these correctly). Note that starting with Alder Lake, Intel moved to an “architectural MSR” approach, and the addresses changed. For the UP Xtreme i12 Alder Lake board, delete the lines: and replace these with: In a future blog, I’ll be writing more about SMRAM, and how to use SourcePoint’s Device View to create a visual depiction of the SMRAM Save State Area and watch it change as you use run-control and trace with SMM entries and exits.
Classifications
AskAI Classifications
LabelsLinked Companies
