Newer
Older
AMI-Aptio-BIOS-Reversed / PurleyRpPkg / Uba / UbaMain / Dxe / SmbiosDataUpdateDxeLightningRidgeEXECB1 / SmbiosDataUpdateDxeLightningRidgeEXECB1.md
@Ajax Dong Ajax Dong 2 days ago 12 KB Restructure the repo

SmbiosDataUpdateDxeLightningRidgeEXECB1

Function Table

Address Name Description
SmbiosDataUpdateDxeEntryPoint
SmbiosDataUpdateInit
SmbiosDataUpdateEntry
DebugPrint
AssertHandler
CompareGuid
ReadUnaligned32
ReadUnaligned64
WriteUnaligned64
FreePool
GetConfigTable
GetPlatformLang
BuildSmbiosStringRecord
UpdateSmbiosStringField
GetSmbiosStructuresAfterField
AddSmbiosString
FindFirstSmbiosString
RemoveAndAddSmbiosString
RemoveAllSmbiosStringsOfType
SmbiosDataUpdateDispatch
BuildSmbiosType9Record
BuildSmbiosType41Record
AsciiStrLen
StrLen
AsciiStrnLenS
UnicodeStrnToAsciiStrS
Global Variables (.data section at 0x3910-0x39A8)
HII handle for SMBIOS string package (address 0x3910)
System table pointer (address 0x3918)
Boot services table pointer (address 0x3920)
Image handle (address 0x3928)
Runtime services table pointer (address 0x3930)
Cached DebugLib protocol pointer (address 0x3938)
Cached HOB list pointer (address 0x3940)
HII Font protocol interface (address 0x3948)
HII Database protocol handle (address 0x3950)
HII Package List (address 0x3968)
HII Config Routing protocol (address 0x3958)
HII String protocol (address 0x3960)
DXE Services Table (address 0x3970)
SMBIOS protocol instances (addresses 0x3978, 0x3988, 0x3990, 0x3998)
for AddSmbiosString (0x3990)
for RemoveAllSmbiosStringsOfType (0x3988)
for AddSmbiosString alt path (0x3978)
for RemoveAndAddSmbiosString (0x3998)
UBA SMBIOS Data protocol (address 0x3980)
MM PCIe base protocol (address 0x39A0)
SMBIOS String Descriptor Table (embedded in BuildSmbiosStringRecord)
The descriptor table is constructed as local variable initializers in
sub_77C (0x77C). Each entry is 10 bytes:
30 entries for SMBIOS Type 2 (Baseboard), indexed 0-29.
Called from sub_F54 (SmbiosDataUpdateDispatch).
Zero the 8-byte aligned bulk first, then the trailing bytes.
Buffer is returned.
VOID *Buf = Buffer;
memset 8 bytes at a time for aligned portion
memset (Buf, 0, 8 * AlignedSize);
memset trailing bytes
memset ((UINT8 )Buf + 8 AlignedSize, 0, TrailingSize);
Check for overlap: copy backwards if src < dst and src + count - 1 >= dst
if ((CONST UINT8 )Src < (UINT8 )Dst &&
BulkSize = Count;
BulkSize = Count / 8;
UEFI Entry Point
Phase 1: global initialization (save service pointers, locate protocols)
Status = SmbiosDataUpdateInit (ImageHandle, SystemTable);
Phase 2: main entry (UBA config, HII registration, SMBIOS update dispatch)
Status = SmbiosDataUpdateEntry (ImageHandle);
Initialization // ============================================================================
Save ImageHandle global
gImageHandle = ImageHandle;
Save SystemTable global
gST = SystemTable;
Save BootServices global
gBS = SystemTable->BootServices;
Save RuntimeServices global
gRT = SystemTable->RuntimeServices;
Initialize HOB list (DxeHobLib)
HobLibInit ();
Locate HII Database protocol (guid at 0x38B0)
Status = gBS->LocateProtocol (&gEfiHiiFontProtocolGuid, NULL, &mHiiFont);
Locate HII Font/String protocol (guid at 0x38A0)
Status = gBS->LocateProtocol (&gEfiHiiStringProtocolGuid, NULL, &mHiiString);
Locate HII Config Routing protocol (guid at 0x3220)
Result stored at mHiiPackageList (0x3958)
Status = gBS->LocateProtocol (&gEfiHiiConfigRoutingProtocolGuid, NULL, &mHiiPackageList);
Locate HII Image protocol (guid at 0x38E0)
Result stored at mHiiImage (0x3950)
Status = gBS->LocateProtocol (&gEfiHiiImageProtocolGuid, NULL, &mHiiDatabase);
Locate HII Config Access protocol (guid at 0x3890)
Result stored at mHiiString2 (0x3960)
Status = gBS->LocateProtocol (&gEfiHiiConfigAccessProtocolGuid, NULL, &mHiiString);
Find DXE Services Table via SystemTable->ConfigurationTable
This searches for gEfiDxeServicesTableGuid (0x05AD34BA...)
Status = GetConfigTable (&gEfiDxeServicesTableGuid, (VOID )&gDS);**
Additional assertion check (build path specific)
ASSERT_EFI_ERROR (Status);
Optionally locate MM PCIe Base protocol (guid at 0x31F0)
This may fail if the platform doesn't support it
if (mMmPciUsra == NULL) {
Main Entry
UBA config protocol data
Function pointer for the SMBIOS data update dispatch callback
This is registered via UBA protocol so the UBA core can invoke it
VOID (*SmbiosDispatch)(VOID) = SmbiosDataUpdateDispatch;
Open the UBA config protocol from our ImageHandle
Protocol GUID at 0x31C0 (EFI_SMBIOS_PROTOCOL)
Status = gBS->OpenProtocol (
Extract the board-specific SMBIOS config GUID from the UBA config data
ConfigGuid points to a structure; GUID is at ConfigGuid + 32
EFI_GUID BoardGuid;
Register the HII package list with the board-specific GUID
This registers our SMBIOS string HII data
gSmbiosStringPackHandle = RegisterHiiPackageList (
String array: see below
Set up the UBA SMBIOS data protocol call
The config buffer describes the SMBIOS data update to perform
ZeroMem (ConfigBuffer, sizeof (ConfigBuffer));
Initialize config structure fields
reserved //
Store the dispatch callback pointer
Actually the structure is:
Lazy locate the UBA SMBIOS Data protocol (GUID at 0x3200)
if (mUbaSmbiosDataProtocol == NULL) {
Build the config buffer: [0]=Signature, [4]=Version
Version = 1
The UBA protocol's SetSmbiosData callback will be invoked
Call UBA SMBIOS Data protocol to register our SMBIOS data
The protocol at +16 has: SetSmbiosData(This, Guid, Buffer, Size)
return ((UBA_SMBIOS_DATA_PROTOCOL *)mUbaSmbiosDataProtocol)->SetSmbiosData (
Check cached protocol first
if (mDebugProtocol != NULL) {
Check if CMOS indicates debug is enabled
Limit check: only proceed if we're in a valid CMOS range
if (gBS != NULL) {
arbitrary small pages count for validation
This is a heuristic; on real HW this may not be reliable
Locate the DebugLib protocol
Status = gBS->LocateProtocol (
Get the DebugLib protocol (locate on first call)
Protocol = GetDebugLibProtocol ();
Read CMOS register 0x4B to get current debug level
__outbyte **(0x70, (__inbyte (0x70) & 0x80) 0x4B);**
Determine filter mask based on debug level
if (DebugLevel > 3) {
Convert 1-3 to 0-2
Determine appropriate filter mask
if (DebugLevel == 0) {
Error level: EFI_D_ERROR
Error level: EFI_D_INFO
No filtering for higher levels
Only print if the error level is enabled by the filter
if ((FilterMask & ErrorLevel) != 0) {
Call the DebugLib protocol's DebugPrint method
Call the protocol's Assert function at +8
GUID Utilities
Copy first 64-bit half, then second 64-bit half
WriteUnaligned64 (
Compare both 64-bit halves
if (ReadUnaligned64 ((CONST UINT64 *)Guid1) !=
Assert that Buffer is not NULL
ASSERT (Buffer != NULL);
Assert that Length doesn't overflow Buffer
ASSERT (Length <= (UINTN)-1 - (UINTN)Buffer + 1);
Call the base zero implementation
return ZeroMemBase (Buffer, Length);
Allocate boot services data memory
Status = gBS->AllocatePool (EfiBootServicesData, Size, &Buffer);
Allocate the memory first
Buffer = AllocatePool (Size);
ZeroMem (Buffer, Size);
Free the memory via boot services
Status = gBS->FreePool (Buffer);
ASSERT on failure
Configuration Table Lookup
Get system table configuration table
Search for matching GUID
for (Index = 0; Index < NumEntries; Index++) {
Language Support
Validate parameters
ASSERT (Value != NULL);
First call: get required buffer size
BufferSize = 0;
Allocate the buffer and read the variable
Free pool on failure
FreePool (*Value);
Validate input
ASSERT (SupportedLanguages != NULL);
Loop through all target languages
while ((Language = VA_ARG (Va, CHAR8 *)) != NULL) {
Only compare first 3 chars for prefix match
Parse the supported languages string looking for a match
if (*SupportedLanguages != '\0') {
Skip semicolons between entries
while (*Supported == ';') {
Find length of this entry (up to ';' or '\0')
Continue to next language in varargs
End of language support remainder continues below for HII, SMBIOS, etc.
Return cached pointer if already initialized
if (mHobList != NULL) {
HII String Lookup
ASSERT (HiiHandle != NULL);
default as noted in build references (unk_2B0A)
ASSERT (PackageListGuid != NULL);
Actually writes 4 zero bytes
SMBIOS String Update
Encodes Type (bits 0-7), Number (bits 8-15)
Encoding UINT8 Byte5; // Offset
MaxLength UINT8 Byte7; // Flags / attributes
High bits of encoding
The record is 10 bytes but the compiler may emit differently
The descriptor table data:
30 complete entries covering SMBIOS Type 2 (Baseboard) strings
at 0x77C which sets v19..v32 stack variables to specific constants.
These constants are read during the loop at i=0..29.
Placeholder entries based on decompiled constants:
Each 10-byte entry is packed as:
The actual encoding is more complex and uses the v19..v32 stack values.
Type = 8
FieldCount (placeholder)
Handle = uninitialized
Extracted from descriptor table
This is actually the field number
Max UCS-2 len 65
Already positioned at field data start
Field header + field data
Skip the first NULL
Walk through the current string
EFI_SMBIOS_HANDLE_PI (add new)
Not used per UEFI spec
Start with "add new" handle -> first entry
No buffer size check
No flags
The actual code dispatches through qword_3998+16 which handles
the Remove operation
Start with "any" handle
Actual loop count determined by enumeration
SMBIOS Data Update Dispatch
SMBIOS Type 9
SMBIOS Type 41
Length varies
Device type instance
Device type = 3 (temperature sensor)
Segment group
Bus Buffer[8] = 28; // Device
Function break;
Device type = 2 (USB)
Device Buffer[9] = 2; // Function
Device Buffer[9] = 0; // Function
Device type = 5 (SPI/TPM)
Type 41
Length (varies)
PCIe Config Access
Register offset
Access size (512 bytes for PCIe extended config?)
The actual return is the register value at offset +25 from the address
Memory Copy (wrapper)
Overlap check (simplified actual code does a 4-way range check)
End of file

Generated by HR650X BIOS Decompilation Project