/**
 *LnvOobDriverDxe.c
 *HR650X BIOS - LnvOobDriver DXE Driver
 *
 *Binary: LnvOobDriverDxe.efi (index 0103, 218 KB)
 *SHA256: f28fabb95b4f8f6e806f006eaa7aed3ef38db282e2070ce4722ea8c22d9bc280
 *
 *Decompiled from IDA Pro 9.0 (port 13364)
 *
 *This driver provides OOB (Out-of-Band) data store management for
 *IPMI-based BMC communication on Lenovo HR650X platforms.
 *
 *Key responsibilities:
 * - Locate and bind the IPMI transport protocol
 * - Validate the OOB map table (OobMapTable) embedded in the driver
 * - Detect product ID (BMC PID) changes via IPMI or NVRAM
 * - Synchronize BIOS variables (gDsVar) with BMC data stores
 * - Push CPU configuration (SocketPower, SocketProcessor) into NVRAM
 * - Trigger system reset when configuration changes require it
 */

#include "LnvOobDriverDxe.h"

/* ===================================================================
 *Global Data Definitions
 * =================================================================== */

EFI_HANDLE gImageHandle;
EFI_SYSTEM_TABLE *gSystemTable;
EFI_BOOT_SERVICES *gBootServices;

/*The IPMI transport protocol instance */
void *gIpmiTransportProtocol = NULL; /*qword_11B70 */

/*Data store valid bitmap from BMC */
UINT32 gDsValidMap; /*dword_11B78 */

/*Reset-needed flag */
UINT8 gResetNeed; /*byte_11B7C */

/*Is-default PID flag */
UINT8 gIsDefault; /*byte_5520 */

/*Debug print protocol singleton */
void *gDebugPrintProtocol = NULL; /*qword_35208 */

/*HOB list pointer */
void *gHobList = NULL; /*qword_35210 */

/*Working data store array (8 KB) - each entry is 2 bytes, 0x2000 entries */
UINT8 gDsVar[0x2000]; /*byte_3520, byte_3521 interlaced */

/*Map table for 32 data store type bitmaps (128 bytes each) */
UINT16 gOobMapTable[32][64]; /*unk_3600 */

/*OOB Map Table definitions */
extern volatile UINT8 gOobMapTableDefs[]; /*unk_5530 (172 bytes *0x127 entries) */

/* ===================================================================
 *Forward declarations for internal helpers
 * =================================================================== */

__int64 GetDebugPrintProtocol(VOID);
UINT64 OOBGetDataStoreByType(UINT8 Type, UINT8 SubType, UINT8 *Data);
UINT64 OOBGetAllDataStoreByType(UINT8 Type, UINT8 *Data);
__int64 OOBGetDataStoreMap(__int64 Param);
__int64 OOBSetDataStoreByType(UINT8 Type, UINT8 SubType, UINT8 *Data);
__int64 BmcDsBitMapToDsVar(__int64 Param);
__int64 DsVarToBmcDs(__int64 Param);
UINT64 BmcDsBitMapToDsVarSync(UINT8 SyncType, __int64 Param2);
BOOLEAN CheckOobDataStoreValid(VOID);
__int64 LnvOOBSettingsDxeEntry(__int64 Param);
__int64 LnvGetProductID(__int64 a1, __int64 a2, __int64 a3, __int64 a4);
__int64 LnvUpdateOOBSettingsttoSetup(VOID);
__int64 sub_2240(VOID);
__int64 GetHobList(__int64 Param);

/* ===================================================================
 *Library constructors and HOB protocol locators
 * =================================================================== */

/**
 *sub_20B0: ASSERT wrapper - calls gDebugPrintProtocol->AssertBreak
 */
__int64 AssertBreak(__int64 a1, __int64 a2, __int64 a3)
{
 __int64 result;

 result = GetDebugPrintProtocol();
 if ( result )
 return (*(__int64 ( **)(__int64, __int64, __int64))(result + 8))(a1, a2, a3);
 return result;
}

/**
 *sub_20F0: Get HOB list pointer from SystemTable.
 *Walks the configuration table to find the HOB list GUID match.
 */
__int64 GetHobList(__int64 a1)
{
 __int64 result;
 __int64 st;
 UINT64 i;
 __int64 Protocol;

 result = (__int64)gHobList;
 if ( !gHobList )
 {
 st = (__int64)gSystemTable;
 i = 0;
 gHobList = 0;
 if ( *(_QWORD *)(st + 104) )
 {
 Protocol = 0;
 while ( !(unsigned __int8)CompareHobGuid(a1, Protocol + *(_QWORD *)(st + 112)) )
 {
 ++i;
 Protocol += 24;
 if ( i >= *(_QWORD *)(st + 104) )
 goto LABEL_6;
 }
 result = *(_QWORD *)(*(_QWORD *)(st + 112) + 24 *i + 16);
 gHobList = (void *)result;
 }
 else
 {
LABEL_6:
 DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", 0x800000000000000ELL);
 AssertBreak((__int64)"e:\\hs\\MdePkg\\Library\\DxeHobLib\\HobLib.c", 54, (__int64)"!EFI_ERROR (Status)");
 result = (__int64)gHobList;
 }
 if ( !result )
 {
 AssertBreak((__int64)"e:\\hs\\MdePkg\\Library\\DxeHobLib\\HobLib.c", 55, (__int64)"mHobList != ((void *) 0)");
 return (__int64)gHobList;
 }
 }
 return result;
}

/**
 *sub_2240: IPMI protocol notification callback.
 *Locates gEfiDxeIpmiTransportProtocolGuid, asserts on failure.
 */
__int64 sub_2240()
{
 __int64 Status;
 __int64 Result;

 Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 Result = Status;
 if ( Status < 0 )
 {
 DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", Status);
 AssertBreak(
 (__int64)"e:\\hs\\LenovoServerPkg\\Library\\LnvIpmiLib\\IpmiCmd\\DxeLnvSendIpmiCmdLib.c",
 578,
 (__int64)"!EFI_ERROR (Status)");
 }
 return Result;
}

/* ===================================================================
 *Protocol / Library initialization
 * =================================================================== */

/**
 *sub_1FA8: Locate gDebugPrintProtocol singleton.
 *Allocates boot services pool, checks GbE presence via CPUID,
 *then locates protocol.
 */
__int64 GetDebugPrintProtocol()
{
 __int64 result;
 UINT64 poolSize;
 __int64 v2;
 __int64 Result;

 result = (__int64)gDebugPrintProtocol;
 if ( !gDebugPrintProtocol )
 {
 poolSize = (*(__int64 ( **)(__int64))(gBootServices + 24))(31);
 (*(void ( **)(UINT64))(gBootServices + 32))(poolSize);
 if ( poolSize <= 0x10 )
 {
 v2 = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gDebugPrintGuid, 0, &gDebugPrintProtocol);
 Result = (__int64)gDebugPrintProtocol;
 if ( v2 < 0 )
 Result = 0;
 gDebugPrintProtocol = (void *)Result;
 return Result;
 }
 else
 {
 return 0;
 }
 }
 return result;
}

/**
 *sub_2028: DEBUG print function.
 *Reads CMOS 0x4B to determine debug level, calls protocol print if level matches.
 */
UINT8 DebugPrint(__int64 ErrorLevel, const char *Format, ...)
{
 __int64 Protocol;
 __int64 ErrorLevel;
 __int64 ( **v5)(__int64, const char *, __int64 *);
 UINT8 v6;
 UINT8 n3;
 UINT8 n3_1;
 va_list va;

 va_start(va, Format);
 Protocol = GetDebugPrintProtocol();
 ErrorLevel = 0;
 v5 = (__int64 ( **)(__int64, const char *, __int64 *))Protocol;
 if ( Protocol )
 {
 v6 = __inbyte(CMOS_ADDR_REG);
 __outbyte(CMOS_ADDR_REG, v6 & 0x80 | 0x4B);
 n3 = __inbyte(CMOS_DATA_REG);
 n3_1 = n3;
 if ( (UINT8)n3 > 3u )
 {
 n3_1 = n3;
 if ( !n3 )
 n3_1 = *(volatile UINT8 *)0xFDAF0490 & 2 | 1;
 }
 Protocol = n3_1 - 1;
 if ( (UINT8)(n3_1 - 1) <= 0xFDu )
 {
 Protocol = 4;
 ErrorLevel = 0x80000000 | 0x46LL; /*DP_VERBOSE */
 if ( n3_1 == 1 )
 ErrorLevel = 0x80000000 | 0x04LL; /*DP_INFO */
 }
 if ( (ErrorLevel & ErrorLevel) != 0 )
 Protocol = (*v5)(ErrorLevel, Format, (__int64 *)va);
 }
 return (UINT8)Protocol;
}

/* ===================================================================
 *Library constructor (sub_384)
 * =================================================================== */

/**
 *sub_384: UEFI library constructor.
 *Saves ImageHandle, SystemTable, BootServices, RuntimeServices.
 *Locates HII protocols (HiiDatabase, HiiString, HiiConfigRouting,
 *HiiFont, HiiImage), and IPMI protocol with notification.
 */
__int64 sub_384(__int64 ImageHandle, EFI_SYSTEM_TABLE *SystemTable)
{
 __int64 Status;
 __int64 Status;
 __int64 Status;
 __int64 result;
 UINT8 v7;

 gImageHandle = (EFI_HANDLE)ImageHandle;
 if ( !ImageHandle )
 AssertBreak(
 "e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c",
 51,
 "gImageHandle != ((void *) 0)");
 gSystemTable = SystemTable;
 if ( !SystemTable )
 AssertBreak("e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c", 57, "gST != ((void *) 0)");
 gBootServices = SystemTable->BootServices;
 if ( !gBootServices )
 AssertBreak("e:\\hs\\MdePkg\\Library\\UefiBootServicesTableLib\\UefiBootServicesTableLib.c", 63, "gBS != ((void *) 0)");
 gRuntimeServices = SystemTable->RuntimeServices;
 if ( !gRuntimeServices )
 AssertBreak(
 "e:\\hs\\MdePkg\\Library\\UefiRuntimeServicesTableLib\\UefiRuntimeServicesTableLib.c",
 47,
 "gRT != ((void *) 0)");
 GetHobList(0);
 Status = (*(__int64 ( **)(void *, _QWORD, void *))(gBootServices + 320))(
 &gHiiDatabaseGuid, 0, &gHiiDatabaseHandle);
 if ( Status < 0 )
 {
 DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", Status);
 AssertBreak("e:\\hs\\MdeModulePkg\\Library\\UefiHiiServicesLib\\UefiHiiServicesLib.c", 88, "!EFI_ERROR (Status)");
 }
 Status = (*(__int64 ( **)(void *, _QWORD, void *))(gBootServices + 320))(
 &gHiiStringGuid, 0, &gHiiStringHandle);
 if ( Status < 0 )
 {
 DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", Status);
 AssertBreak("e:\\hs\\MdeModulePkg\\Library\\UefiHiiServicesLib\\UefiHiiServicesLib.c", 94, "!EFI_ERROR (Status)");
 }
 Status = (*(__int64 ( **)(void *, _QWORD, void *))(gBootServices + 320))(
 &gHiiConfigRoutingGuid, 0, &gHiiConfigRoutingHandle);
 if ( Status < 0 )
 {
 DebugPrint(0x80000000LL, "\nASSERT_EFI_ERROR (Status = %r)\n", Status);
 AssertBreak("e:\\hs\\MdeModulePkg\\Library\\UefiHiiServicesLib\\UefiHiiServicesLib.c", 100, "!EFI_ERROR (Status)");
 }
 (*(void ( **)(void *, _QWORD, void *))(gBootServices + 320))(
 &gHiiFontGuid, 0, &gHiiFontHandle);
 (*(void ( **)(void *, _QWORD, void *))(gBootServices + 320))(
 &gHiiImageGuid, 0, &gHiiImageHandle);
 result = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 if ( result < 0 )
 {
 result = (*(__int64 ( **)(void *, __int64 ( *)(), UINT8 *))(gBootServices + 168))(
 &gIpmiProtocolGuid, sub_2240, &v7);
 if ( result < 0 )
 return DebugPrint(-1, "DxeLnvSendIpmiCmdLibConstructor Status = %r \n", result);
 }
 return result;
}

/* ===================================================================
 *OOB Data Store Operations
 * =================================================================== */

/**
 *sub_5A4: Store a data entry in the global OOB data array.
 *Finds first free slot (byte_11B80[x] == 0), copies 128 bytes of data
 *and 16 bytes of name, marks slot as used.
 */
UINT64 sub_5A4(__int64 a1, __int64 a2)
{
 UINT16 Index;
 __int64 Index;

 Index = 0;
 while ( 1 )
 {
 Index = 145LL *Index;
 if ( !gOobEntryUsed[Index] )
 break;
 if ( ++Index >= 0x3E8u )
 return 0x8000000000000005uLL; /*EFI_NOT_FOUND */
 }
 (*(void ( **)(UINT8 *, __int64, __int64))(gBootServices + 352))(
 &gOobEntryData[Index], a1, 128);
 (*(void ( **)(UINT8 *, __int64, __int64))(gBootServices + 352))(
 &gOobEntryName[Index], a2, 16);
 gOobEntryUsed[145 *Index] = 1;
 return 0; /*EFI_SUCCESS */
}

/**
 *OOBGetDataStoreByType (sub_654):
 *Sends IPMI command to retrieve a specific SubType within a Type.
 *If SubType is 0xFF, returns EFI_INVALID_PARAMETER (use GetAll instead).
 *Returns 2 bytes of data.
 */
UINT64 OOBGetDataStoreByType(UINT8 Type, UINT8 SubType, UINT8 *Data)
{
 UINT64 Status;
 UINT64 Size;
 UINT64 Status;
 UINT64 Status;
 UINT8 Response[16];
 UINT8 ResponseSize;

 ResponseSize = 3;
 DebugPrint(64, "%a Type = 0x%x , SubType = 0x%x \n", Type, SubType);

 if ( Type >= 0x20 )
 {
 Status = OOB_STORE_INVALID;
 DebugPrint(64, " Type should be ' 0 ~ 0x%x ', Status = %r\n", 127, OOB_STORE_INVALID);
 return Status;
 }

 if ( SubType == 0xFF )
 {
 Status = OOB_STORE_INVALID;
 DebugPrint(64, " SubType = 0xff should use OOBGetAllDataStoreByType , Status = %r\n", OOB_STORE_INVALID);
 return Status;
 }

 Size = (__int64)gIpmiTransportProtocol;
 if ( !gIpmiTransportProtocol )
 {
 Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 Status = Status;
 if ( Status )
 {
 DebugPrint(64, "%a Locate IPMI Protocol Fail, Status = %r \n", "OOBGetDataStoreByType", Status);
 return Status;
 }
 Size = (__int64)gIpmiTransportProtocol;
 }

 /*IPMI command: NetFn=0x2E (0x2E), Cmd=0x3B -> actually
 *the code uses: v7=46 (NetFn=0x2E <<1 = 0x5C? No:
 *46 decimal = 0x2E = IPMI NetFn 0x2E << 1 = 0x5C
 *Look at the raw: LOBYTE(v7)=46 (0x2E << 1 = 0x5C)
 *LOBYTE(v8)=59 (0x3B)
 *Request: [Type, SubType] (2 bytes), Response: [...]
 */
 {
 UINT8 Request[2];
 Request[0] = Type;
 Request[1] = SubType;

 Status = (*(__int64 ( **)(__int64, UINT64, _QWORD, UINT64, UINT8 *, UINT8, UINT8 *, UINT8 *))(
 Size + 16))(Size, 0x2E, 0, 0x3B, Request, 2, Response, &ResponseSize);
 Status = Status;
 }

 if ( !Status )
 {
 Data[0] = Response[0];
 Data[1] = Response[2];
 }

 if ( Status < 0 )
 {
 Status = 365;
 DebugPrint(64, "%a Return Status: %r (Line:%d)\n", "OOBGetDataStoreByType", Status, Status);
 }

 return Status;
}

/**
 *OOBGetAllDataStoreByType (sub_7D8):
 *Sends IPMI command to retrieve all data store entries for a Type.
 *Returns up to 128 bytes of data.
 */
UINT64 OOBGetAllDataStoreByType(UINT8 Type, UINT8 *Data)
{
 __int64 Size;
 UINT8 bCounter;
 __int64 Status;
 INT32 Index;
 UINT8 Response[144];
 UINT8 ResponseSize;
 UINT8 Request[2];
 UINT8 SubType;

 ResponseSize = (UINT8)-126; /*0x82 */
 DebugPrint(64, "%a Type = 0x%x \n", Type);

 if ( Type >= 0x20 )
 {
 DebugPrint(64, " Type should be ' 0 ~ 0x%x ', Status = %r\n", 127, OOB_STORE_INVALID);
 return OOB_STORE_INVALID;
 }

 Size = (__int64)gIpmiTransportProtocol;
 bCounter = 0;

 if ( gIpmiTransportProtocol )
 goto LABEL_7;

 Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 if ( !Status )
 {
 Size = (__int64)gIpmiTransportProtocol;
LABEL_7:
 Request[0] = Type;
 Request[1] = 0xFF;
 SubType = 0xFF;

 Status = (*(__int64 ( **)(__int64, UINT64, _QWORD, UINT64, UINT8 *, UINT8, UINT8 *, UINT8 *))(
 Size + 16))(Size, 0x2E, 0, 0x3B, Request, 2, Response, &ResponseSize);
 if ( Status )
 {
 DebugPrint(64, "%a Return Status: %r \n", "OOBGetAllDataStoreByType", Status);
 }
 else
 {
 Data[0] = Response[0];
 do
 {
 Index = bCounter++;
 Data[Index + 1] = Response[Index + 2];
 }
 while ( bCounter < 0x80u );
 }
 return Status;
 }
 DebugPrint(64, "%a Locate IPMI Protocol Fail, Status = %r \n", "OOBGetAllDataStoreByType", Status);
 return Status;
}

/**
 *OOBGetDataStoreMap (sub_930):
 *Sends IPMI command to retrieve the data store valid bitmap (gDsValidMap).
 */
__int64 OOBGetDataStoreMap(__int64 a1)
{
 UINT64 Size;
 __int64 Status;
 INT32 DataSize;
 UINT8 ResponseBuffer[8];
 UINT8 Request;
 UINT8 ResponseSize;

 ResponseBuffer[0] = a1 & 0xFF;
 ResponseBuffer[0] = 4; /*override to indicate "get map" */
 DebugPrint(64, "%a , Data address = 0x%x\n", (unsigned int)&gDsValidMap);

 Size = (__int64)gIpmiTransportProtocol;
 if ( !gIpmiTransportProtocol )
 {
 Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 if ( Status )
 {
 DebugPrint(64, "%a Locate IPMI Protocol Fail, Status = %r \n", "OOBGetDataStoreMap", Status);
 return Status;
 }
 Size = (__int64)gIpmiTransportProtocol;
 }

 ResponseSize = (UINT8)-1;
 Status = (*(__int64 ( **)(__int64, UINT64, _QWORD, UINT64, UINT8 *, UINT8, INT32 *, __int64 *))(
 Size + 16))(Size, 0x2E, 0, 0x3B, &ResponseSize, 1, &DataSize, (__int64 *)ResponseBuffer);

 if ( Status )
 DebugPrint(64, "%a Return Status: %r \n", "OOBGetDataStoreMap", Status);
 else gDsValidMap = DataSize;

 return Status;
}

/**
 *OOBSetDataStoreByType (sub_A18):
 *Sends IPMI command to write a data store entry.
 *Request: [Valid, Type, SubType, Reserved, Data] (5 bytes)
 */
__int64 OOBSetDataStoreByType(UINT8 Type, UINT8 SubType, UINT8 *Data)
{
 UINT64 Status;
 __int64 Size;
 INT32 v12, v13;
 INT32 v14;
 UINT8 Request[16];
 UINT8 ResponseSize;
 UINT8 ResponseByte;

 v14 = Data[1];
 v12 = *Data;
 ResponseSize = 1;
 DebugPrint(64, "%a Type = 0x%x , SubType = 0x%x , Data[0](Valid) = 0x%x, Data[1](Data) = 0x%x \n",
 Type, SubType, v12, v14);

 if ( Type >= 0x20 )
 {
 Status = OOB_STORE_INVALID;
 DebugPrint(64, " Type should be ' 0 ~ 0x%x ', Status = %r\n", 127, OOB_STORE_INVALID);
 return Status;
 }

 if ( SubType == 0xFF )
 {
 Status = OOB_STORE_INVALID;
 DebugPrint(64, " SubType = 0xff should use OOBSetAllDataStoreByType , Status = %r\n", OOB_STORE_INVALID);
 return Status;
 }

 Size = (__int64)gIpmiTransportProtocol;
 if ( !gIpmiTransportProtocol )
 {
 Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 if ( Status )
 {
 DebugPrint(64, "%a Locate IPMI Protocol Fail, Status = %r \n", "OOBSetDataStoreByType", Status);
 return Status;
 }
 Size = (__int64)gIpmiTransportProtocol;
 }

 Request[0] = *Data; /*Valid */
 Request[1] = Type;
 Request[2] = SubType;
 Request[3] = 1; /*Reserved? */
 Request[4] = Data[1]; /*Data */
 v13 = 5; /*request size */

 Status = (*(__int64 ( **)(__int64, UINT64, _QWORD, UINT64, UINT8 *, INT32, UINT8 *, UINT8 *))(
 Size + 16))(Size, 0x2E, 0, 0x3C, Request, v13, &ResponseByte, &ResponseSize);

 if ( Status < 0 )
 DebugPrint(64, "%a Return Status: %r \n", "OOBSetDataStoreByType", Status);

 return Status;
}

/* ===================================================================
 *BMC <-> BIOS Variable Synchronization
 * =================================================================== */

/**
 *BmcDsBitMapToDsVar (sub_B8C):
 *Reads all BIOS NVRAM variables (referenced by OOB map table),
 *processes the data into gDsVar[] with bit manipulation.
 *Marks gDsValidMap as 0xAA000000 on success.
 */
__int64 BmcDsBitMapToDsVar(__int64 a1, __int64 a2)
{
 __int64 RetStatus;
 UINT32 Index;
 UINT8 *pEntry;
 __int64 v6;
 __int64 Index;
 const char *v8;
 UINT32 i;
 INT32 v10;
 __int64 ErrorLevel;
 __int64 v12;
 __int64 Ptr;
 UINT8 n0x70;
 __int64 v15;
 UINT8 n0x70_1;
 __int64 Ptr;
 INT32 v18;
 __int64 v20;

 RetStatus = 0;
 DebugPrint(64, "= %a START = (Line:%d) \n", 611);

 Index = 0;
 pEntry = (UINT8 *)&gOobMapTableDefs[1]; /*unk_5531 */

 do
 {
 v6 = (*(__int64 ( **)(UINT64, _QWORD, __int64 *))(gBootServices + 64))(
 4, *(_QWORD *)(pEntry + 145), &v20);

 if ( v6 >= 0 )
 {
 Index = 172LL *Index;
 v8 = (const char *)&gOobMapTableDefs[Index + 1];

 v6 = (*(__int64 ( **)(char *, char *, _QWORD, char *, __int64))(gRuntimeServices + 72))(
 &gOobMapTableDefs[Index + 1],
 &gOobMapTableDefs[Index + 0x81],
 0,
 (char *)&gOobMapTableDefs[Index + 0x91],
 v20);

 if ( v6 < 0 )
 {
 DebugPrint(64, " GetVariable '%s' ERROR!! Status = %x \n", v8, (UINT32)RetStatus);
 }
 else
 {
 for ( i = 0; i < *(UINT32 *)(pEntry + 161); ++i )
 {
 v10 = *pEntry;
 ErrorLevel = *(pEntry - 1);
 v12 = *(__int64 *)(pEntry + 153) + i;
 Ptr = (ErrorLevel << 7) + i + v10;
 n0x70 = i + v10;
 v15 = v20;
 gDsVar[2 *Ptr] = 0;
 gDsVar[2 *Ptr + 1] = *(_BYTE *)(v12 + v15);
 if ( n0x70 < 0x70u )
 {
 n0x70_1 = n0x70;
 Ptr = (ErrorLevel << 7) + (n0x70 >> 3) + 112;
 v18 = (UINT8)gDsVar[2 *Ptr + 1] | (1 << (n0x70_1 & 7));
 gDsVar[2 *Ptr] = 0;
 gDsVar[2 *Ptr + 1] = v18;
 }
 else
 {
 DebugPrint(64, " %a , Type %x => SubType %x should be 0 ~ 0x6F \n", ErrorLevel, n0x70);
 AssertBreak("e:\\hs\\LenovoPlatformPkg\\LnvOobDriver\\LnvOobDriverDxe.c", 143, "((BOOLEAN)(0==1))");
 }
 }
 }
 }
 RetStatus |= v6;
 if ( v20 )
 (*(void (**)(void))(gBootServices + 72))();
 ++Index;
 pEntry += 172;
 }
 while ( Index < 0x127 );

 if ( RetStatus >= 0 )
 {
 DebugPrint(64, "= %a START = (Line:%d) \n", 292);
 gDsValidMap = 0xAA000000;
 }
 else
 {
 DebugPrint(64, "%a RetStatus: %r \n", "BiosVarToDsVar", RetStatus);
 }
 return RetStatus;
}

/**
 *DsVarToBmcDs (sub_DBC):
 *Iterates all 32 data store types, copies gDsVar[] data,
 *and sends each type to the BMC via OOBSetAllDataStoreByType.
 */
__int64 DsVarToBmcDs(__int64 a1, __int64 a2)
{
 __int64 RetStatus;
 UINT32 Type;
 char *pDsVarByte;
 UINT32 n0x127;
 UINT8 *pEntry;
 char *v8;
 char *v9;
 __int64 n128;
 char v11;
 __int64 Status;
 __int64 v13;
 __int64 v14;
 INT32 Size;
 UINT8 Request[2];
 INT16 v18;
 UINT8 DataPayload[140];
 UINT8 BulkData[128];
 UINT8 ResponseSize;
 UINT8 SetAllRespSize;

 RetStatus = 0;
 InternalSetMem((INT32 *)BulkData, 0, 128);
 DebugPrint(64, "= %a START = (Line:%d) \n", 664);

 Type = 0;
 pDsVarByte = (char *)&gDsVar[1]; /*byte_3521 */

 do
 {
 n0x127 = 0;
 pEntry = (UINT8 *)&gOobMapTableDefs[0]; /*unk_5530 */
 while ( *pEntry != (UINT8)Type )
 {
 ++n0x127;
 pEntry += 172;
 if ( n0x127 >= 0x127 )
 goto LABEL_16;
 }

 /*Copy 128 bytes interleaved -> contiguous */
 v8 = (char *)BulkData;
 v9 = pDsVarByte;
 n128 = 128;
 do
 {
 v11 = *v9;
 v9 += 2;
 *v8++ = v11;
 --n128;
 }
 while ( n128 );

 ResponseSize = 1;
 DebugPrint(64, "%a Type = 0x%x \n", (UINT8)Type);

 if ( gIpmiTransportProtocol ||
 (Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol)) == 0 )
 {
 Request[0] = 0;
 Request[1] = Type;
 v18 = (INT16)(INT8)-127; /*0xFF81 -> -127, sub-type indicator for "all" */

 (*(void ( **)(UINT8 *, UINT8 *, __int64))(gBootServices + 352))(
 DataPayload, BulkData, 128);

 Size = (INT8)-124; /*0x84 = 132 bytes request */
 Status = (*(__int64 ( **)(__int64, UINT64, _QWORD, UINT64, UINT8 *, INT32, UINT8 *, UINT8 *))(
 gIpmiTransportProtocol + 16))(
 (__int64)gIpmiTransportProtocol, 0x2E, 0, 0x3C, Request, Size, &SetAllRespSize, &ResponseSize);
 if ( Status < 0 )
 DebugPrint(64, "%a Return Status: %r \n", "OOBSetAllDataStoreByType", Status);
 }
 else
 {
 DebugPrint(64, "%a Locate IPMI Protocol Fail, Status = %r \n", "OOBSetAllDataStoreByType", Status);
 }

 if ( Status < 0 )
 DebugPrint(64, " Copy gDsVar to DS Error! Type = 0x%x\n", Type);

 RetStatus |= Status;

LABEL_16:
 ++Type;
 pDsVarByte += 256; /*each type occupies 256 bytes (128 *2) in interleaved array */
 }
 while ( Type < 0x20 );

 if ( RetStatus < 0 )
 DebugPrint(64, "%a RetStatus: %r \n", "DsVarToBmcDs", RetStatus);

 return RetStatus;
}

/* ===================================================================
 *Sync Engine (sub_FE4)
 * =================================================================== */

/**
 *BmcDsBitMapToDsVarSync (sub_FE4):
 *Main synchronization engine. Given a sync type:
 *SYNC_FROM_DS (1) - Copy BMC data store -> gDsVar[]
 *SYNC_WITH_DS (2) - Merge BMC data store with existing gDsVar[]
 *
 *Iterates through all 32 types. For each valid type in gDsValidMap,
 *fetches all entries from BMC, stores them via sub_5A4, and updates
 *gDsVar with the interleaved byte layout.
 */
UINT64 BmcDsBitMapToDsVarSync(UINT8 SyncType, __int64 a2)
{
 UINT8 n2;
 __int64 v4;
 UINT8 v5;
 UINT8 v6;
 UINT8 Status;
 UINT8 i;
 __int64 v10;
 char *v11;
 char *v12;
 __int64 n14;
 char v14;
 _QWORD *p_n128_1;
 UINT32 n0x127;
 UINT16 n0x3E8;
 __int64 v18;
 __int64 v19;
 UINT8 *p_n0x20;
 __int64 v21;
 const char *v22;
 char *v23;
 __int64 n295;
 __int64 v25;
 char *v26;
 UINT32 v27;
 UINT8 n0x70;
 __int64 v29;
 __int64 v30;
 __int64 v31;
 __int64 v32;
 char *v33;
 __int64 v34;
 _QWORD *p_n128;
 __int128 v36;
 __int128 v37;
 __int128 v38;
 __int128 v39;
 __int128 v40;
 __int128 v41;
 __int128 v42;
 __int128 v43;
 __int128 v44;
 __int128 v45;
 __int128 v46;
 __int128 v47;
 __int128 v48;
 __int128 v49;
 UINT8 n0x20;
 UINT8 n0x20Data;
 UINT8 n128;
 UINT8 n2_v2;
 UINT8 v54;
 __int64 v55;
 __int64 v56;
 __int64 v57;
 __int64 v58;
 __int64 v59;
 UINT8 v60;
 __int64 v61;
 __int64 v62;
 __int64 v63;
 __int64 v64;
 UINT8 v65;
 char v66;
 UINT8 v67;
 UINT8 v68;
 UINT8 v69;
 UINT8 v70;
 UINT8 v71;
 __int64 v72;
 UINT8 v73;
 UINT64 Status;
 __int64 Status;
 UINT8 v76;
 __int64 v77;
 UINT8 v78;
 char v79;
 UINT8 v80;
 UINT64 Result;

 n2 = SyncType;
 DebugPrint(64, "= %a START , gDsValidMap = 0x%08x , SyncType = 0x%x = (Line:%d) \n",
 gDsValidMap, SyncType, 295);

 if ( SyncType > 2 || !SyncType )
 {
 DebugPrint(64, " !! The SyncType of %a should be SYNC_FROM_DS(1) or SYNC_FROM_DS(2) \n");
 return OOB_STORE_INVALID;
 }

 /*Clear the OOB map table bitmaps */
 InternalSetMem((INT32 *)gOobMapTable, 0, sizeof(gOobMapTable));

 /*Process each valid data store type */
 for ( n0x20 = 0; n0x20 < 0x20; ++n0x20 )
 {
 if ( (gDsValidMap & (1 << n0x20)) == 0 )
 continue;

 /*Fetch all data for this type from BMC */
 v6 = n0x20;
 Status = OOBGetAllDataStoreByType(v6, (UINT8 *)&gDsVar[256 *n0x20 + 1]);
 if ( Status < 0 )
 {
 DebugPrint(64, " %a , OOBGetAllDataStoreByType(Type %x) Status = %r \n",
 "BmcDsBitMapToDsVar", n0x20, Status);
 continue;
 }

 /*Process this type's map table entries */
 p_n0x20 = (UINT8 *)&gOobMapTableDefs[0]; /*unk_5530 */
 n0x127 = 0;

 while ( 1 )
 {
 /*Find next entry matching this type */
 while ( *p_n0x20 != n0x20 )
 {
 ++n0x127;
 p_n0x20 += 172;
 if ( n0x127 >= 0x127 )
 goto NEXT_TYPE;
 }
 break;
 }

 /*Found matching entry at index n0x127 */
 {
 /*Copy 128 bytes (interleaved -> contiguous for this entry) */
 v10 = n0x20;
 v11 = (char *)&gDsVar[0]; /*actually &gDsVar[256 *n0x20 + 1] */
 v12 = (char *)&gOobMapTable[n0x20];
 n14 = 128;
 do
 {
 v14 = *v11;
 v11 += 2;
 *v12++ = v14;
 --n14;
 }
 while ( n14 );

 /*Store the data entry */
 Status = sub_5A4((__int64)&gOobMapTable[n0x20], (__int64)p_n0x20 + 1);
 if ( Status < 0 )
 {
 DebugPrint(64, " %a , sub_5A4 store fail, Type = %x Status = %r \n", n0x20, Status);
 }
 else
 {
 /*Process sub-types using bit manipulation from gOobMapTable */
 /* (Omitted detailed bit unpacking for brevity - this is the dense
 *interleaved bit operation from the original binary) */
 }
 }

NEXT_TYPE:
 ;
 }

 Status = 0;
 DebugPrint(64, "= %a END , gDsValidMap = 0x%08x = (Line:%d) \n", gDsValidMap, 489);

 /*For SYNC_WITH_DS, check whether any NVRAM vars need updating */
 if ( SyncType == 2 && gDsValidMap == 0 )
 {
 DebugPrint(64, " == No Need to Update BiosVar --- (SyncType == SYNC_WITH_DS) && (gDsValidMap == 0) ==\n");
 return 0;
 }

 /*Update NVRAM variables based on BMC data */
 {
 UINT8 v79_data = 1;
 /*Process socket power management variables */
 /* ... (detailed variable update logic from sub_FE4 body) */

 Result = 0;
 return Result;
 }
}

/* ===================================================================
 *Data Store Validation
 * =================================================================== */

/**
 *CheckOobDataStoreValid (sub_1578):
 *Reads Type=0, SubType=0x7E and SubType=0x7F.
 *Valid if 0x7E returns 0x17 and 0x7F returns 0xAA.
 */
BOOLEAN CheckOobDataStoreValid(VOID)
{
 UINT8 v4;
 UINT8 n23;
 UINT8 v6;
 UINT8 v7;

 DebugPrint(64, "= %a START = (Line:%d) \n", 888);

 if ( (OOBGetDataStoreByType(0, 0x7Eu, &v4) & 0x8000000000000000uLL) == 0LL
 && (OOBGetDataStoreByType(0, 0x7Fu, &v6) & 0x8000000000000000uLL) == 0LL
 && n23 == 23 /*0x17 */
 && v7 == (UINT8)-86 /*0xAA */ )
 {
 DebugPrint(64, " OOB Data Store is Valid! \n");
 return TRUE;
 }
 else
 {
 DebugPrint(64, " OOB Data Store NOT Valid! \n");
 return FALSE;
 }
}

/* ===================================================================
 *Product ID Detection (sub_19A4)
 * =================================================================== */

/**
 *LnvGetProductID: Detect platform product ID.
 *Tries IPMI command first; if fails, falls back to reading
 * "Setup" NVRAM variable byte[284]. Stores result in "LnvOobSetup" variable.
 *Also checks PlatForceLoadDefaultHook via CMOS bit 0x4F.
 */
__int64 LnvGetProductID(__int64 a1, __int64 a2, __int64 a3, __int64 a4)
{
 UINT8 IsDefault;
 UINT8 v5;
 UINT32 v6;
 __int64 Protocol;
 UINT8 v8;
 UINT8 v9;
 UINT8 v10;
 UINT8 v11;
 UINT8 v12;
 char v13;
 __int64 Status;
 UINT8 Protocol;
 __int64 ErrorLevel;
 __int64 Result;
 __int64 Protocol;
 __int64 Protocol;
 __int64 n2;
 UINT8 v24[8];
 __int64 n814;
 UINT8 v26[848];
 __int64 Protocol;
 UINT8 n85_2;
 char Protocol;
 UINT8 n85_1;
 UINT8 n2_2;

 Protocol = a1;
 IsDefault = 2;
 Protocol = 0x40743C8B7DB80F64LL;
 n2 = 2;
 Protocol = 0x610C623DB451888ALL;

 /*Check PlatformForceLoadDefaultHook via CMOS */
 v5 = __inbyte(CMOS_ADDR_REG);
 __outbyte(CMOS_ADDR_REG, v5 & 0x80 | 0x4F);
 v6 = (UINT32)(n2 + 111);
 Protocol = (UINT32)(n2 + 111);
 v8 = __inbyte((UINT8)(n2 + 111));
 if ( (v8 & 1) != 0 )
 {
 v9 = __inbyte(CMOS_ADDR_REG);
 __outbyte(CMOS_ADDR_REG, v9 & 0x80 | 0x4F);
 v10 = __inbyte((UINT8)v6);
 v11 = v10;
 v12 = __inbyte(CMOS_ADDR_REG);
 __outbyte(CMOS_ADDR_REG, v12 & 0x80 | 0x4F);
 Protocol = v6;
 __outbyte((UINT8)v6, v11 & 0xFE);
 v13 = 1;
 }
 else
 {
 v13 = 0;
 }

 IsDefault = 0;
 n85_2 = 0;
 Protocol = 1;
 *(UINT8 *)&Protocol = 2;
 v21 = 0x4BB5EBA4EC87D643LL;
 v22 = 0xA90DB2363E3FE5A1uLL;
 n814 = 814;

 if ( gIpmiTransportProtocol
 && (*(UINT8 *)&Protocol = 2,
 LOBYTE(a4) = 69,
 LOBYTE(Protocol) = 46,
 Status = (*(__int64 ( **)(__int64, __int64, _QWORD, __int64, __int64 *, UINT8, UINT8 *, char *, __int64, __int64, __int64, UINT64))(
 gIpmiTransportProtocol + 16))(
 (__int64)gIpmiTransportProtocol, Protocol, 0, a4, &Protocol, 1, &n85_2, &Protocol, Protocol, Protocol, v21, v22),
 Status >= 0) )
 {
 Protocol = n85_2;
 }
 else
 {
 Status = (*(__int64 ( **)(const UINT16 *, __int64 *, UINT8 *, __int64 *, UINT8 *))(gRuntimeServices + 72))(
 L"Setup", &v21, v24, &n814, v26);
 if ( Status < 0 )
 {
 Protocol = (UINT8)-1;
 Status = 0x800000000000000ELL;
 }
 else
 {
 Protocol = v26[284];
 }
 }

 if ( Status < 0 )
 {
 DebugPrint(64, "LnvGetProductID Status = %r \n", Status);
 Protocol = 85; /*default PID = 0x55 */
 }

 DebugPrint(64, "BmcPid = %x \n", Protocol);

 if ( (*(__int64 ( **)(const UINT16 *, __int64 *, _QWORD, __int64 *, UINT8 *))(gRuntimeServices + 72))(
 L"LnvOobSetup", &Protocol, 0, &n2, &n85_1) < 0
 && !v13 )
 {
 goto LABEL_14;
 }

 DebugPrint(64, "mVar.PidVar = %x from BIOS VAR \n", n85_1);

 if ( v13 == 1 )
 {
 IsDefault = 1;
 DebugPrint(64, "IsDefault = %x form PlatForceLoadDefaultHook is TRUE \n", (UINT32)IsDefault);
 }
 else if ( Protocol != n85_1 )
 {
 IsDefault = 1;
LABEL_14:
 n85_1 = Protocol;
 goto LABEL_18;
 }

LABEL_18:
 n2_2 = IsDefault;
 DebugPrint(64, "Return IsDefault = %x \n", IsDefault);
 DebugPrint(64, "mVar.PidVar = %x set to BIOS VAR \n", n85_1);

 ErrorLevel = (*(__int64 ( **)(const UINT16 *, __int64 *, __int64, __int64, UINT8 *))(gRuntimeServices + 88))(
 L"LnvOobSetup", &Protocol, 7, n2, &n85_1);
 Result = ErrorLevel;
 if ( ErrorLevel < 0 )
 DebugPrint(64, " SetVariable (LnvOobSetup) = %r (Line:%d)\n", ErrorLevel, 412);

 return Result;
}

/* ===================================================================
 *OOB Settings -> Setup Update (sub_1C74)
 * =================================================================== */

/**
 *LnvUpdateOOBSettingsttoSetup: Push OOB settings into NVRAM.
 *Reads SocketPowerManagementConfig and SocketProcessorCoreConfig
 *variables, compares current settings with new data from gDsVar[],
 *and sets gResetNeed if changes detected.
 */
__int64 LnvUpdateOOBSettingsttoSetup()
{
 char Changed;
 __int64 ErrorLevel;
 __int64 v2;
 __int64 Protocol;
 __int64 Result;
 char v6;
 char *v7;
 char v8;
 char v9;
 char v10;
 char v11;
 char v12;
 char v13;
 char v14;
 char v15;
 char v16;
 char v17;
 __int64 ErrorLevel;
 __int64 ErrorLevel;
 __int64 n0x2000000;
 INT32 v21;
 INT32 n16843008;
 INT32 n50331649;
 INT32 n117440769;
 __int64 n131073;
 INT32 v26;
 INT32 n50331648;
 INT32 v28;
 __int64 n0x1000000;
 __int64 n16843012;
 INT32 n459009;
 char v32;
 char v33[4];
 char v34;
 char v35;
 char v36;
 char v37;
 char v38;
 char v39;
 char v40;
 char v41;
 char v42;
 char v43;
 char v44;
 char v45;
 char v46;
 UINT8 Protocol[304];
 __int64 Protocol;

 n0x2000000 = 0x2000000;
 v21 = 0;
 n16843008 = 16843008;
 Changed = 0;
 n50331649 = 50331649;
 n117440769 = 117440769;
 n131073 = 131073;
 v26 = 0;
 n50331648 = 50331648;
 v28 = (INT32)&unk_10101;
 n0x1000000 = 0x1000000;
 n16843012 = 16843012;
 n459009 = 459009;
 v32 = 0;

 DebugPrint(64, "LnvUpdateOOBSettingsttoSetup Start \n");

 Protocol = 462;
 ErrorLevel = (*(__int64 ( **)(const UINT16 *, void *, _QWORD, __int64 *, char *))(gRuntimeServices + 72))(
 L"SocketPowerManagementConfig", &gSocketPowerVarGuid, 0, &Protocol, v33);
 v2 = ErrorLevel | Protocol;
 DebugPrint(64, "Get SocketPower %r \n", ErrorLevel);

 Protocol = 301;
 Protocol = (*(__int64 ( **)(const UINT16 *, void *, _QWORD, __int64 *, UINT8 *))(gRuntimeServices + 72))(
 L"SocketProcessorCoreConfig", &gSocketProcessorVarGuid, 0, &Protocol, Protocol);
 DebugPrint(64, "Get SocketProcessor %r \n", Protocol);
 Result = Protocol | v2;
 if ( Result )
 return Result;

 v6 = v45;
 v7 = (char *)&n0x2000000 + 2;
 v8 = v44;
 v9 = v43;
 v10 = v41;
 v11 = v40;
 v12 = v39;
 v13 = v38;
 v14 = v37;
 v15 = v36;
 v16 = v35;
 v17 = v34;

 Protocol = 5;
 do
 {
 if ( v46 == *(v7 - 2)
 && (v17 != *(v7 - 1)
 || v13 != *v7
 || v16 != v7[1]
 || v15 != v7[2]
 || v14 != v7[3]
 || v12 != v7[4]
 || v11 != v7[5]
 || v9 != v7[6]
 || v6 != v7[7]
 || v8 != v7[8]
 || v10 != v7[9]
 || v42 != v7[10]) )
 {
 Changed = 1;
 v17 = *(v7 - 1);
 v13 = *v7;
 v16 = v7[1];
 v15 = v7[2];
 v14 = v7[3];
 v12 = v7[4];
 v11 = v7[5];
 v9 = v7[6];
 v6 = v7[7];
 v8 = v7[8];
 v10 = v7[9];
 v42 = v7[10];
 }
 v7 += 13;
 --Protocol;
 }
 while ( Protocol );

 v40 = v11;
 v45 = v6;
 v44 = v8;
 v43 = v9;
 v41 = v10;
 v39 = v12;
 v38 = v13;
 v37 = v14;
 v36 = v15;
 v35 = v16;
 v34 = v17;

 if ( !Protocol[95] )
 {
 if ( v11 )
 {
 Changed = 1;
 v40 = 0;
 }
 }

 if ( Changed )
 {
 Protocol = 462;
 ErrorLevel = (*(__int64 ( **)(const UINT16 *, void *, __int64))(gRuntimeServices + 88))(
 L"SocketPowerManagementConfig", &gSocketPowerVarGuid, 7);
 DebugPrint(64, "Set SocketPower %r \n", ErrorLevel);

 Protocol = 301;
 ErrorLevel = (*(__int64 ( **)(const UINT16 *, void *, __int64))(gRuntimeServices + 88))(
 L"SocketProcessorCoreConfig", &gSocketProcessorVarGuid, 7);
 DebugPrint(64, "Set SocketProcessor %r \n", ErrorLevel);
 Result = ErrorLevel | ErrorLevel;
 if ( Result )
 return Result;
 gResetNeed = Changed;
 }

 return 0;
}

/* ===================================================================
 *Main Entry Point (sub_15FC)
 * =================================================================== */

/**
 *LnvOOBSettingsDxeEntry (sub_15FC):
 *Main driver routine. This function:
 *1. Validates the OOB map table embedded in the driver
 *2. Locates the IPMI transport protocol
 *3. Detects product ID (LnvGetProductID)
 *4. Clears working buffers gDsVar[] and gOobMapTable[]
 *5. Determines sync strategy based on gIsDefault:
 * - 0 (No PID Change): SYNC_WITH_DS - validates existing,
 *fetches data store map, checks OOB validity, syncs
 * - 1 (PID Changed): SYNC_TO_DS - skip BiosVar read
 * - 2 (NVRAM Crashed): SYNC_FROM_DS - forces BMC->BIOS sync
 *6. Updates setup variables (LnvUpdateOOBSettingsttoSetup)
 *7. Syncs BIOS variables from BMC (BmcDsBitMapToDsVar)
 *8. Push BIOS variables to BMC (DsVarToBmcDs)
 *9. Triggers system reset if gResetNeed is set
 */
__int64 LnvOOBSettingsDxeEntry(__int64 Param)
{
 char Table;
 UINT8 *v4;
 UINT32 i;
 __int64 n32;
 UINT8 n0x20;
 INT32 Size;
 UINT32 v9;
 UINT8 *v10;
 UINT32 i2;
 UINT32 v12;
 __int64 Status;
 __int64 Result;
 __int64 v15;
 UINT16 *v16;
 UINT16 *v17;
 __int64 n14;
 __int64 v19;
 __int64 v20;
 __int64 v21;
 __int64 v23;
 __int64 v24;
 UINT8 n2;
 __int64 v26;
 __int64 v28;
 __int64 v29;
 __int64 v30;
 UINT8 v31;
 UINT8 v32;
 UINT8 v33;
 INT32 v35;
 UINT8 *v36;

 DebugPrint(64, "LnvOOBSettingsDxeEntry Start \n");
 DebugPrint(64, "System will hang if CheckBiosOobTable detect gOOBMapTable has problem \n");
 Table = 0;
 v4 = (UINT8 *)&gOobMapTableDefs[1]; /*unk_5531 */
 i = 0;
 v36 = (UINT8 *)&gOobMapTableDefs[1];
 n32 = 32;

 /* --- Validate OOB Map Table --- */
 do
 {
 n0x20 = *(v4 - 1); /*Type */
 Size = *v4; /*SubType (base) */
 *(UINT16 *)(v4 + 165) = Size + (n0x20 << 8); /*ItemSize? */

 if ( n0x20 >= 0x20u || (v35 = v4[161], v9 = Size + v35, (UINT32)(Size + v35) > 0x70) )
 {
 DebugPrint(64, " %a , Index %x [%x][%x] space out of definition \n", i, n0x20, Size);
 Table = 1;
 }
 else
 {
 v10 = (UINT8 *)&gOobMapTableDefs[0];
 for ( i2 = 0; i2 < 0x127; ++i2 )
 {
 if ( i2 != i && *(v10 - 1) == n0x20 && *v10 >= (UINT8)Size )
 {
 v12 = (UINT8)*v10;
 if ( v12 < v9 )
 {
 Table = 1;
 DebugPrint(64,
 " %a , Index %x [%x][%x] ItemSize = %x overlap with Index %x [%x][%x] \n",
 i, n0x20, Size, v35, i2, (UINT8)*(v10 - 1), v12);
 v9 = Size + v35;
 }
 }
 v10 += 172;
 }
 v4 = v36;
 n32 = 32;
 }
 v4 += 172;
 ++i;
 v36 = v4;
 }
 while ( i < 0x127 );

 /*Hang if map table is invalid */
 if ( Table == 1 )
 {
 AssertBreak("e:\\hs\\LenovoPlatformPkg\\LnvOobDriver\\LnvOobDriverDxe.c", 102, "((BOOLEAN)(0==1))");
 while ( 1 )
 ;
 }

 /* ---- Locate IPMI Protocol ---- */
 Status = (*(__int64 ( **)(void *, _QWORD, __int64 *))(gBootServices + 320))(
 &gIpmiProtocolGuid, 0, &gIpmiTransportProtocol);
 Result = Status;
 if ( Status < 0 )
 {
 DebugPrint(0x80000000LL, "Locate gEfiDxeIpmiTransportProtocolGuid Status: %r \n", Status);
 return Result;
 }

 /* ---- Detect Product ID ---- */
 LnvGetProductID(0, 0, 0, 0);
 DebugPrint(64, "gIsDefault = %x \n", gIsDefault);

 /* ---- Clear buffers ---- */
 (*(void ( **)(UINT8 *, __int64, __int64))(gBootServices + 360))(
 gDsVar, 0x2000, (UINT8)-1);

 v16 = (UINT16 *)gOobMapTable;
 do
 {
 v17 = v16;
 n14 = 14;
 do
 {
 *v17++ = 0;
 --n14;
 }
 while ( n14 );
 v16 += 64; /*each entry is 128 bytes = 64 UINT16 */
 --n32;
 }
 while ( n32 );

 /* ---- Sync Strategy ---- */
 switch ( gIsDefault )
 {
 case 0: /*No PID Change, SYNC_WITH_DS */
 DebugPrint(64, "PID No Change, SYNC_WITH_DS \n");
 Result = OOBGetDataStoreMap(0);
 DebugPrint(64, " OOBGetDataStoreMap Status = %r , 'gDsValidMap' = %08x \n",
 Result, gDsValidMap);
 if ( !CheckOobDataStoreValid() || !gDsValidMap )
 goto LABEL_35;
 n2 = 2; /*SYNC_WITH_DS */
 goto LABEL_34;

 case 1: /*PID Changed, SYNC_TO_DS */
 DebugPrint(64, "PID Changed, SYNC_TO_DS .... Skip 'BmcDsToBiosVar' \n");
 goto LABEL_35;

 case 2: /*BIOS NVRAM Crashed, SYNC_FROM_DS */
 DebugPrint(64, "BIOS NVRAM Crashed, SYNC_FROM_DS \n");
 if ( !CheckOobDataStoreValid() )
 goto LABEL_35;
 n2 = 1; /*SYNC_FROM_DS */
LABEL_34:
 BmcDsBitMapToDsVarSync(n2, 0);
 goto LABEL_35;

 default:
 DebugPrint(64, "gIsDefault = 0x%x <-- Incorrect or new define ?\n");
 break;
 }

LABEL_35:
 /* ---- Update Setup Variables ---- */
 LnvUpdateOOBSettingsttoSetup();

 /* ---- Sync BIOS <-> BMC ---- */
 BmcDsBitMapToDsVar(0, 0);
 DsVarToBmcDs(0, 0);

 /* ---- System Reset if Needed ---- */
 if ( gResetNeed == 1 )
 {
 v31 = __inbyte(CMOS_ADDR_REG);
 __outbyte(CMOS_ADDR_REG, v31 & 0x80 | 0x50);
 v32 = __inbyte(CMOS_DATA_REG);
 if ( v32 == 0xFE )
 {
 v33 = __inbyte(CMOS_ADDR_REG);
 __outbyte(CMOS_ADDR_REG, v33 & 0x80 | 0x50);
 __outbyte(CMOS_DATA_REG, 0x55);
 }
 DebugPrint(64, " gResetNeed is TRUE (Line:%d) \n System Reset ... \n\n\n", 1047);
 (*(void ( **)(_QWORD, _QWORD, _QWORD, _QWORD))(gRuntimeServices + 104))(
 0, 0, 0, 0); /*gRT->ResetSystem */
 DebugPrint(64, " gRT->ResetSystem No service, do CF9 Reset... \n\n\n", 1049, Result);
 __outbyte(CMOS_RESET_CTRL, 0x0E); /*Full reset via CF9 */
 }
 else
 {
 DebugPrint(64, " gResetNeed is FALSE (Line:%d) - No BIOS Variable update from BMC DS \n", 1053);
 }

 DebugPrint(64, "LnvOobDriverDxeEntry End \n");
 return Result;
}

/* ===================================================================
 *Module Entry Point
 * =================================================================== */

/**
 *ModuleEntryPoint: UEFI DXE driver entry.
 *Calls library constructor (sub_384 -> saves globals, locates HII/IPMI)
 *then calls LnvOOBSettingsDxeEntry (sub_15FC -> main logic).
 */
EFI_STATUS EFIAPI ModuleEntryPoint(
 IN EFI_HANDLE ImageHandle,
 IN EFI_SYSTEM_TABLE *SystemTable
 )
{
 sub_384(ImageHandle, SystemTable);
 return (EFI_STATUS)LnvOOBSettingsDxeEntry(0);
}

/* ===================================================================
 *Internal Library Helper Functions
 * =================================================================== */

/**
 *sub_21C8: Memory compare function (BaseLib-style).
 *Compares two memory regions byte-by-byte.
 */
__int64 MemoryCompare(UINT64 a1, UINT8 *a2, UINT64 Length)
{
 UINT64 Size;
 UINT64 n8;
 UINT64 v5;

 Size = a1 + Length;
 if ( Length >= 8 )
 {
 n8 = a1 & 7;
 if ( (a1 & 7) != 0 && n8 == ((UINT8)a2 & 7) )
 {
 v5 = 8 - n8;
 if ( n8 != 8 )
 {
 do
 {
 if ( *(UINT8 *)a1 != *a2 )
 break;
 ++a1;
 ++a2;
 --v5;
 }
 while ( v5 );
 }
 }
 while ( a1 <= Size - 8 && *(_QWORD *)a1 == *(_QWORD *)a2 )
 {
 a1 += 8LL;
 a2 += 8;
 }
 }
 while ( 1 )
 {
 if ( a1 >= Size )
 return 0;
 if ( *(UINT8 *)a1 != *a2 )
 break;
 ++a1;
 ++a2;
 }
 return *(char *)a1 - (char)*a2;
}

/**
 *sub_22A0: Read unaligned UINT64 with buffer check.
 */
__int64 ReadUnaligned64(__int64 Buffer)
{
 if ( !Buffer )
 AssertBreak("e:\\hs\\MdePkg\\Library\\BaseLib\\Unaligned.c", 192, "Buffer != ((void *) 0)");
 return *(_QWORD *)Buffer;
}

/**
 *sub_22D0: Compare HOB GUID.
 */
BOOLEAN CompareHobGuid(__int64 a1, __int64 a2)
{
 __int64 v3 = ReadUnaligned64((__int64)&unk_3500);
 __int64 v4 = ReadUnaligned64(a2);
 __int64 v5 = ReadUnaligned64((__int64)&unk_3508);
 __int64 v6 = ReadUnaligned64(a2 + 8);
 return v3 == v4 && v5 == v6;
}

/**
 *sub_2340: CPUID wrapper function.
 */
__int64 Cpuid(UINT32 Leaf, UINT32 *Eax, UINT32 *Ebx, UINT32 *Ecx, UINT32 *Edx)
{
 UINT32 outEax, outEbx, outEcx, outEdx;

 __asm {
 mov eax, Leaf cpuid mov outEax, eax mov outEbx, ebx mov outEcx, ecx mov outEdx, edx
 }

 if ( Eax ) *Eax = outEax;
 if ( Ebx ) *Ebx = outEbx;
 if ( Ecx ) *Ecx = outEcx;
 if ( Edx ) *Edx = outEdx;

 return outEax;
}

/**
 *sub_2380: Internal memset - sets bytes of an int array.
 *Processes by individual byte value expansion.
 */
INT32 *InternalSetMem(INT32 *Buffer, INT32 Value, UINT64 Length)
{
 INT32 *buf;
 UINT16 val;
 INT32 wideVal;
 UINT64 remaining;
 UINT8 shift;
 UINT64 i;

 buf = Buffer;
 /*Expand byte value to fill all bytes */
 val = (UINT8)Value | ((UINT8)Value << 8);
 wideVal = val | (val << 16);

 if ( Length >= 4 )
 {
 /*Handle misalignment */
 shift = (UINT8)(UINT64)buf & 3;
 if ( shift != 0 )
 {
 memset(buf, Value, 4 - shift);
 buf = (INT32 *)((UINT8 *)buf + 4 - shift);
 Length -= (4 - shift);
 }
 /*Bulk write using 4-byte values */
 for ( i = Length >> 2; i; --i )
 *buf++ = wideVal;
 Length &= 3;
 }
 memset(buf, Value, Length);
 return Buffer;
}

/**
 *sub_23E0: memmove implementation - overlap-safe copy.
 */
char *InternalCopyMem(char *Destination, const char *Source, UINT64 Length)
{
 char *dst;
 UINT64 count;
 UINT8 reverse;
 UINT64 diff;

 dst = Destination;
 count = Length;
 reverse = 0;
 diff = Source - Destination;

 if ( Source < Destination )
 {
 diff = Destination - Source;
 if ( &Source[Length] >= Destination )
 {
 Source += Length;
 dst += Length;
 reverse = 1;
 }
 }

 if ( Length >= 8 && diff >= 8 )
 {
 /*Check alignment */
 /* ... (detailed aligned copy logic from original) */
 if ( !reverse )
 {
 count = 8 - ((UINT8)(UINT64)Source & 7);
 qmemcpy(dst, Source, count);
 Source += count;
 dst += count;
 Length -= count;
 }
 /*Bulk copy in 8-byte chunks */
 qmemcpy(dst, Source, 8 * (Length >> 3));
 dst += 8 * (Length >> 3);
 Source += 8 * (Length >> 3);
 Length &= 7;
 if ( Length )
 qmemcpy(dst, Source, Length);
 }
 else
 {
 qmemcpy(dst, Source, Length);
 }

 return Destination;
}