Newer
Older
AMI-Aptio-BIOS-Reversed / CsmDxe / CsmDxe.md
@Ajax Dong Ajax Dong 2 days ago 8 KB Init

CsmDxe

Function Table

Address Name Description
CsmDxeConstructor
CsmDxeDriverEntryPoint
CsmDxeUnload
_mm_pause_w
__rdtsc_w
_enable_w
_disable_w
__getcallerseflags_w
CsmThunk16Entry
ModuleEntryPoint
CsmLegacyBiosInstallProtocol
CsmRegisterBootEventCallbacks
CsmLocateAmiBoardInfo2
CsmAllConnectedCallback
CsmInstallProtocolNotifications
CsmShadowAllLegacyOproms
CsmInitializePciPlatform
CsmInitializeLegacyBios
CsmLegacyBiosGetBbsInfo
CsmLegacyBiosSetBdaComPort
CsmLegacyBiosBoot
CsmLegacyBiosBootUnconventionalDevice
CsmLegacyBiosUpdateKeyboardLedStatus
CsmLegacyBiosPrepareToBootEfi
CsmLegacyBiosShadowAllLegacyOproms
CsmLegacyBiosInstall
CsmLegacyBiosUninstall
CsmLegacyBiosSetBdaBase
CsmLegacyBiosGetBbsInfo_GetCount
CsmSaveBootScriptToLockBox
CsmDebugPrint
CsmAssert
nullsub_1
These functions are library-internal wrappers linked from:
sub_B638 = DebugPrint (EfiDLevel, Format, ...)
sub_B680 = Assert (FileName, Line, Expression)
sub_B6C0 = LibPcdGetPtr (or LibPcdGetSize)
sub_B74C = DxeServicesTableLib constructor
sub_B588 = ReadTimeStampCounter (via __rdtsc)
sub_B8FC = MmPciBaseLib constructor
sub_B980 = PcdGetPtr (by token number)
sub_BA94 = DebugClearMemory / gBS->SetMem
sub_D71C = MmioWrite32 (or similar)
sub_D7B0 = PcieSegBusTableInit
sub_CA38 = gBS->InstallMultipleProtocolInterfaces
sub_CD38 = DriverBinding / handle protocol uninstalls
sub_CFB4 = gBS->LocateProtocol for AMI_BOARD_INFO2_PROTOCOL
sub_D03C = gBS->LocateHandleBuffer
Implementation not shown - thunk to 16-bit code
This is the "library constructor" pattern. The original source is
The real work of the driver happens in CsmDxeDriverEntryPoint.
Standard UEFI BootServicesTableLib constructor
gImageHandle = (EFI_HANDLE)qword_10BE0;
DxeServicesTableLib constructor
Status = DxeServicesTableLibConstructor (&ProtocolGuid, &gDS);
DxeMmPciBaseLib constructor - initialize PCI USRA protocol
if (mPciUsra == NULL) {
Initialize the MMIO PCI Base library
MmPciBaseLibInit ();
Get PCD value and enable VGA legacy decoding if needed
PcdValue = LibPcdGetPtr (Token5);
Check caller EFLAGS for interrupt state (IF bit = bit 9)
Use __getcallerseflags() intrinsic
CallerFlags = (UINT16)__getcallerseflags_w ();
TscStart = __rdtsc_w () & 0xFFFFFF;
Restore interrupt state
if (InterruptsEnabled) {
Initialize PCIe Segment Bus Table
PcieSegBusTableSize = LibPcdGetSize (Token7);
Register protocol interfaces via AutoGen
Status = gBS->InstallMultipleProtocolInterfaces (
Point to our EFI system table and boot/runtime services
if (gST == NULL) {
Register protocol notify for EfiLegacyInterruptProtocol
Check SecureBoot variable
SecureBootVar = '\0';
If SecureBoot is enabled, clear the CSM "Setup" variable
SetupVarSize = CSM16_CONFIG_SIZE;
Read the CSM "Setup" variable to determine whether CSM should be enabled
offset derived from byte_11DA2
Install the Legacy BIOS protocol interface
Status = CsmLegacyBiosInstallProtocol (ImageHandle);
Register boot event callbacks
Status = CsmRegisterBootEventCallbacks ();
Locate AMI_BOARD_INFO2_PROTOCOL
if (mBoardInfo2 == NULL) {
Allocate the main CSM context (6328 bytes)
Status = gBS->AllocatePool (
Locate required protocols for the context
Status = gBS->LocateProtocol (
Populate the Legacy BIOS function table
Validate MaxOpRomAddress (must be 0xC0000-0xF0000)
Status = (*CsmCtx->PciIoProtocol->AllocateBuffer) (
Initialize PCI platform interface
Status = CsmInitializePciPlatform ();
Get current video mode
Status = (*CsmCtx->SmmLegacyBootProtocol->GetCurrentMode) (
Set VGA mode to text mode 80x25
DevicePathSize = (UINT16)-1;
Read CSM mode from Setup variable
byte_11DA2 offset
Initialize the Legacy BIOS driver
Status = CsmInitializeLegacyBios (Csm16Mode, SystemTable);
Set VGA mode again after CSM16 init
Status = (*CsmCtx->SmmLegacyBootProtocol->SetMode) (
Initialize the PCI enumeration data
Status = (*CsmCtx->PciIoProtocol->GetLocation) (
Set the base OpROM address (0xC0000)
gMaxOpRomAddress = 0xC0000;
Allocate PCI data table (1312 bytes)
Offset for internal data structure
Allocate BBS table (1728 bytes)
Offset to BBS data start
Register event notification for Legacy BIOS protocol
CsmState = (UINT64)CsmCtx;
Register notification for AllConnected (via EfiBootScriptNotify)
Status = gBS->CreateEvent (
Install protocol notification
Status = gBS->InstallProtocolInterface (
Install CSM internal protocol notifications
Register ShadowAll callback
Status = gBS->RegisterProtocolNotify (
Set up callback function pointers
Validate BoardInfo2 data
ASSERT (((AMI_BOARD_INFO2_PROTOCOL *)Interface)->DataValid);
Signal the "AllConnected" event
return EFI_SUCCESS;
Shadow each legacy Option ROM
copies Option ROM images to 0xC0000-0xF0000 region]
Initialize PCI device data and Option ROM shadow region
PciData = NULL;
Additional PCI platform configuration
return Status;
Allocate and initialize the Legacy BIOS interface
Install Legacy BIOS protocol
Initialize BBS table
Register legacy boot event handler
Install the INT19 trap handler (for legacy boot)
CSM16 entry initialization
Status = CsmThunk16Entry (Csm16Mode, 0, 0, 0, 0);
derived from Csm16 BBS table
Write COM port address to BIOS Data Area (BDA)
BDA at 0x400: COM port table at 0x400+0x00, LPT at 0x400+0x08
Parse BBS table for boot device
Execute INT 19h via CSM16 thunk
Status = CsmThunk16Entry (
Attempt boot from unconventional devices (USB, network, etc.)
Try each boot device type
Update keyboard LED status in BDA
BDA offset 0x417 bit 5-3: keyboard LED flags
Prepare to boot EFI: save legacy state, restore EFI state
Shadow all discovered legacy Option ROMs
The algorithm:
Initialize CLP (Configuration Load Protocol) support if needed
Shadow loop
for (OpRomIndex = NumberOfOpRoms; OpRomIndex < TotalSize; OpRomIndex++) {
Execute each ROM
Install Legacy BIOS protocol interfaces
Set base memory size in BDA at 0x413
Read BBS count and table from CSM context
Save memory map data to lockbox
Status = gBS->GetMemoryMap (
Original code calls a specific DebugPrint implementation
that writes to the serial port / console
DebugPrint (Level, Format, VaList);
Original code calls ASSERT via DebugLib
ASSERT (Description);
The driver registers a ComponentName2 protocol at gCsmComponentName2.
These structures are generated by the UEFI driver framework.

Generated by HR650X BIOS Decompilation Project