Newer
Older
AMI-Aptio-BIOS-Reversed / ServerCommonPkg / Universal / GetSec / Dxe / TxtDxe / TxtDxe.md
@Ajax Dong Ajax Dong 2 days ago 13 KB Restructure the repo

TxtDxe

Function Table

Address Name Description
TxtDxeLaunchBiosAcm
DebugPrint
AssertBreak
GetPlatformConfigVariable
SetPlatformConfigVariable
IsLtProcessor
IsBiosAcmSuccessful
IsTxtEnabled
LocateTxtDeviceMemoryPolicy
LocateTxtPlatformPolicy
GetMpTableApicIds
ConfigureMachineCheckBanks
GetLtDxeLibSetupOption
GetAcmErrorType
HandleAcmError
ClearLtTpmCmosState
ApplyTxtPolicyToPlatformConfig
RegisterForScheckLockConfigCallback
CloseS3BootScriptResources
InstallTxtDxeProtocol
PlatformLaunchBiosAcm
InitializeLtDxeLib
DriverInit
TxtDxeMain
TxtDxeCleanup
TxtDxeUnload
_ModuleEntryPoint
Global Variables
UEFI core handles populated by DriverInit (sub_47C)
EFI_HANDLE gImageHandle = NULL;
MM PCI User Access (DxeMmPciBaseLib)
Protocol and database pointers
VOID *mPcdProtocol = NULL; // PCD Protocol
HOB list (DxeHobLib)
Debug print protocol (gEfiDebugPortProtocolGuid)
SMM Communication protocol
SMM Base2 protocol
SMM LockBox protocol
PI SMM Communication protocol
TXT policy data pointers populated from platform HOBs
TXT_DEVICE_MEMORY_POLICY *mTxtDeviceMemoryPolicy = NULL; // gEfiPlatformTxtDeviceMemoryGuid
gEfiPlatformTxtPolicyDataGuid //
AP / wake-up state
UINT16 mApCount = 0; // Number of enabled APs (from MP services)
SIPI vector for AP wake-up
APIC ID table populated from MP services
ACM state tracking
BOOLEAN mBiosAcmCalled = FALSE;
TXT DXE Protocol instance
TXT_DXE_PROTOCOL gTxtDxeProtocol;
Forward declarations of local functions
EFI_STATUS EFIAPI
Library helper prototypes that are linked from other compilation units:
Debug Print and Assert Helpers
Raise TPL to avoid re-entrancy during protocol lookup
Tpl = gBootServices->RaiseTPL (TPL_NOTIFY);
Check CMOS byte 0x4B for the platform debug level.
If debug level indicates this message should be printed, do so.
UINT8 DebugLevel;
Check if this error level should be displayed
Filter = 0;
DEBUG_ERROR }
UEFI Library Protocol Locators
CopyMem wrapper
Validate that the copy range does not overflow UINTN
if ((Length - 1) > (UINTN)(-1) - (UINTN)Destination) {
Platform Configuration / UEFI Variable Helpers
LT (LaGrande Technology / TXT) Feature Checks
Platform feature MSR
Platform TXT Policy HOB Access
The HOB data starts after the GUID extension header
mTxtDeviceMemoryPolicy = (TXT_DEVICE_MEMORY_POLICY )((UINT8 )Hob + sizeof (EFI_HOB_GUID_TYPE));
AP Wake-up Vector and APIC Setup
Search for the MP floating pointer structure in the BIOS ROM area
MP table not found; fall back to allocating a wake-up buffer
at a fixed address.
No MP table found; allocate a 0xFFFFF-sized page-aligned buffer
for the wake-up vector.
EFI_PHYSICAL_ADDRESS WakeUpBuffer;
MP table found; configure the wake-up vector from the MP config table
EFI_MP_SERVICES_PROTOCOL *MpServices;
Use MP services to get APIC IDs
Set up the wake-up buffer: write the magic value.
The WakeUpBuffer address is stored in mApWakeUpVector.
UINT32 *WakeUpBuffer;
Page number for SIPI
ACM Launch Support
Save original MC9-MC11 control values and mask out bit 7 (EN)
Mc9CtlOrig = (UINT32)AsmReadMsr64 (MSR_IA32_MC9_CTL);
Optionally save IA32_MCG_CONTAIN if MCG_CMCP (bit 24) is set
if ((AsmReadMsr64 (MSR_IA32_MCG_CAP) & 0x1000000) != 0) {
Write new values with EN bit cleared
DebugPrint (DEBUG_INFO, "Ia32_Mc9_Ctl_New = 0x%08x\n", Mc9CtlOrig & ~0x80);
DebugPrint (DEBUG_INFO, "Write Ia32_Mc9_Ctl_Org = 0x%08x\n", Mc9CtlOrig);
Restore IA32_MCG_CONTAIN if saved
if (McgContainValid) {
Step 1: Disable MC9-MC11 machine check banks
ConfigureMachineCheckBanks (1);
Step 2: If APs exist, send SIPI to start them (required for SINIT)
if (mApCount > 0) {
Send INIT IPI to all (including self)
SendInitIpi ();
Step 3: Debug log and raise TPL
DebugPrint (DEBUG_INFO, "LtDxeLibLaunchBiosAcm: BiosAcmAddress = 0x%08x\n", BiosAcmAddress);
Step 4: Call the platform-specific BIOS ACM launch routine.
This is a raw assembly routine (sub_4700) that:
The ACM then executes in a special environment and returns
control via the LT.SPAD.HIGH register.
DebugPrint (DEBUG_INFO, "LtDxeLibLaunchBiosAcm: Calling LaunchBiosAcm()\n");
Step 5: Restore TPL and machine check banks
DebugPrint (DEBUG_INFO, "LtDxeLibLaunchBiosAcm: Restoring TPL\n");
Step 6: Send SIPI to wake APs after ACM
Restore MC banks to original state
ConfigureMachineCheckBanks (0);
ACM Error Handling
LtDxe lib enable/disable option
ACM error handling type
Check if LtDxeLib functions are installed
if (!GetLtDxeLibSetupOption (&LtDxeLibInstalled) && LtDxeLibInstalled) {
BIOS setup is configured to ignore ACM errors just log
if (GetAcmErrorType (&AcmType)) {
ACM failure is fatal: clear LT/TPM state and reset
DebugPrint (DEBUG_ERROR, "Bios Acm Failed. Reboot in non-ltsx mode\n");
Trigger a system reset via runtime services
Write "AcmError" variable to record the failure
AcmErrorValue = 1;
Clear LT enable bits in SocketProcessorCoreConfig
BufferSize = sizeof (Buffer);
Variable storage size
Clear LT/TPM enable field
Clear related field
TXT policy byte in platform config
SMM / S3 Boot Script Support
Send a SMM communication command for Scheck/LockConfig registration
DebugPrint (DEBUG_INFO, "Register for Scheck/LockConfig Callback\n");
S3 Boot Script Save
Close Boot Script Table Write if opened
if (mSmmCommunicationProtocol != NULL) {
if (mSmmBase2Protocol != NULL) {
Inside SMM; close SMM communication protocol
if (((EFI_SMM_BASE2_PROTOCOL *)mSmmBase2Protocol)->Communicate (
Clear SMM ready-to-lock flag and close SMM Base2
if (mSmmReadyToLockEvent != NULL) {
TXT DXE Protocol Installation
Check if protocol is already installed
Status = gBootServices->LocateProtocol (
Set up the protocol instance
Install the protocol
Status = gBootServices->InstallProtocolInterface (
Verify the protocol was installed correctly by locating it again
Interface = NULL;
Platform ACM Launch (Assembly Wrapper) sub_4700
This function is implemented in assembly (sub_4700). The equivalent C
logic is documented here for reference:
UINT64 GdtBackup[2]; // GDT limit + base
UINT64 IdtBackup[2]; // IDT limit + base
UINTN Cr0, Cr3, Cr4;
if (Flags != 0) {
Sgdt (&GdtBackup);
Sidt (&IdtBackup);
Save MCG_CAP MTRR state
Cr4 = AsmReadCr4 ();
AsmWriteCr4 **(Cr4 0x4208); // Enable MCE, OSFXSR, OSXMMEXCPT**
Cr0 = AsmReadCr0 ();
AsmWriteCr0 **((Cr0 & 0x9FFFFFDF) 0x40000020); // Set EM, MP; clear NE, TS, EM?**
if (Flags != 0) Wbinvd ();
else Invd ();
AsmWriteMsr64 (0x2FF, 0); // Disable MTRRs
Clear all MTRR pairs
for (Index = 0; Index < N; Index++) {
AsmWriteMsr64 (0x200 + Index*2, 0); // MTRR_PHYSBASE
AsmWriteMsr64 (0x200 + Index*2 + 1, 0); // MTRR_PHYSMASK
Set up MTRRs for ACM memory range
for (Remaining = AcmSize; Remaining > 0; ) {
Find largest power-of-two aligned region
Reg = MtrrIndex++;
AsmWriteMsr64 *(0x200 + Reg2, AcmBase 6); // WB**
AsmWriteMsr64 *(0x200 + Reg2 + 1, ~(Size-1) 0xF00000800);**
AcmBase += Size;
Remaining -= Size;
AsmWriteMsr64 (0x2FF, 0x800); // Enable MTRRs
AsmWriteMsr64 (0x17B, 0); // Clear MCG_CTL
Zero all machine check banks
for (Bank = 0; Bank < McgBankCount; Bank++) {
AsmWriteMsr64 (0x400 + Bank*4 + 1, 0); // MCi_STATUS
Far return to ACM entry point
AsmFarReturn (BiosAcmAddress, 0x08); // Code segment selector
InitializeLtDxeLib -- sub_DD0
Save ImageHandle and SystemTable globally (also set in DriverInit)
gImageHandle = ImageHandle;
Enable access to CMOS: clear NMI disable bit on port 0x70
IoWrite8 (0x70, IoRead8 (0x530) & 0xBF);
Locate the SMM Communication protocol for S3 boot script support
Locate the MP Services protocol for AP management
Check if TXT is supported on this platform via PCD
Locate TXT device memory policy from HOB
Status = LocateTxtDeviceMemoryPolicy ();
Locate TXT platform policy from HOB
Status = LocateTxtPlatformPolicy ();
Validate that the BIOS ACM address is configured
if (mTxtPlatformPolicy->BiosAcmAddress == 0) {
Get MP services info: number of processors
Status = MpServices->GetNumberOfProcessors (MpServices, &mApCount, NULL);
mApCount includes the BSP; subtract 1 to get AP count
If there are APs, get their APIC IDs and set up the wake-up vector
Query each AP for its APIC ID via GetProcessorInfo
ApStatus = GetMpTableApicIds (&mApCount, ApicIds);
Iterate and log each APIC ID
for (Index = 0; Index < mApCount; Index++) {
Entry Point and Driver Init
Save protocol pointers
Locate the DXE Services Table via the protocol database
Status = SystemTable->BootServices->LocateProtocol (
Locate the MM PCI User Access protocol (DxeMmPciBaseLib)
if (mPciUsra == NULL) {
Initialize HOB list
Get PCD protocol and enable MTRR for SINIT if not already enabled
Check if LT (TXT) is supported on this CPU
LtCheck = IsLtProcessor ();
Delay loop: read/write timer counter to wait for hardware stabilization
CmosVal **= IoRead8 (0x70) & 0x80 0x4B; // CMOS offset 0x4B, NMI preserved**
Timer value
Spin until delta >= 357
Restore LT configuration if it was modified during the delay
if (LtEnabled) {
Final initialization step (AutoGen.c line 495)
Status = FinalInitStep ();
Main Driver Entry Dispatch original sub_AA8
Step 1: Register for Scheck/LockConfig callback (SMM)
Step 2: Initialize the TXT DXE library (HOBs, protocols, APIC table)
Status = InitializeLtDxeLib (ImageHandle, SystemTable);
Step 3: Apply TXT policy from HOB to platform configuration
Byte 15 of the HOB data
Step 4: Check if this is an LT-enabled processor
Step 5: LT-enabled processor proceed with ACM launch
if (!IsTxtEnabled ()) {
TXT not enabled, fall through to non-TXT path
Status = EFI_UNSUPPORTED;
TXT is enabled check ACM result
DebugPrint (DEBUG_INFO, "LT_SPAD_HIGH (0xFED300A4): %r\n"
ACM completed successfully (or no error) install protocol
DebugPrint (DEBUG_ERROR, "Install TXT_DXE_PROTOCOL...\n");
ACM failed handle according to BIOS setup policy
HandleAcmError ((UINT32 )TXT_SPAD_HIGH_REG);
If we get here, LT is not enabled or ACM failed
DebugPrint (DEBUG_ERROR, "Lt not enabled\n");
Attempt to close S3 boot script resources for a clean state
System not resetting close S3 boot script resources
Status = TxtDxeCleanup ();
Driver Unload Handler sub_2FEC / sub_748 equivalent
Module Entry Point _ModuleEntryPoint
Step 1: Initialize UEFI core protocols and driver globals
Status = DriverInit (ImageHandle, SystemTable);
Step 2: Execute TXT-specific initialization
Status = TxtDxeMain (ImageHandle, SystemTable);
Step 3: If initialization failed, perform cleanup via unload handler
if (EFI_ERROR (Status)) {

Generated by HR650X BIOS Decompilation Project