Newer
Older
AMI-Aptio-BIOS-Reversed / StaticSkuDataDxeLightningRidgeEXECB1 / StaticSkuDataDxeLightningRidgeEXECB1.md
@Ajax Dong Ajax Dong 2 days ago 8 KB Init

StaticSkuDataDxeLightningRidgeEXECB1

Function Table

Address Name Description
ModuleEntryPoint
UbaAssert
UbaCheckCmosSku
CompareGuidQwords
ReadUnaligned64
ReadUnaligned32
GUID Definitions (instantiation)
EFI_GUID gSkuDataProtocolGuid = SKU_DATA_PROTOCOL_GUID;
Global Variables
gImageHandle -- EFI_HANDLE for this driver image, set by
ModuleEntryPoint (sub_390). Used primarily for assertions.
EFI_HANDLE gImageHandle = NULL;
gST -- Pointer to the UEFI System Table.
Set by ModuleEntryPoint (sub_390) at 0x396.
EFI_SYSTEM_TABLE *gST = NULL;
gBS -- Pointer to BootServices from the System Table.
Set by ModuleEntryPoint at 0x3E1.
Used for AllocatePool (offset 24) and LocateProtocol (offset 320).
EFI_BOOT_SERVICES *gBS = NULL;
gRT -- Pointer to RuntimeServices from the System Table.
Set by ModuleEntryPoint at 0x407.
EFI_RUNTIME_SERVICES *gRT = NULL;
gUbaProtocol -- Cached pointer to the UBA protocol interface.
Initialized by GetUbaProtocol() (sub_4C0).
UBA_PROTOCOL *gUbaProtocol = NULL;
gHobList -- Cached pointer to the start of the UEFI HOB list.
Initialized by GetHobList() (sub_608).
VOID *gHobList = NULL;
Data used for CMOS SKU check in UbaCheckCmosSku().
UINT8 gCmosSkuValue; // Cached CMOS register 0x4B value
External data tables (defined in the .data section of the binary).
extern volatile UINT8 gSkuDataProtocolGuidData[16]; // at 0x4080
at 0x40A0
SKU data protocol interfaces installed via UBA protocol:
at 0x40B0
at 0x40D8
at 0x9020
SKU configuration table (HOB data-derived entries):
at 0x40F0
CMOS register index 0x4B (decimal 75).
On Intel Purley platforms, this register encodes the board SKU
0 -> Board uses MMIO-based SKU detection.
RTC index port bits.
Bit 7 is the NMI (Non-Maskable Interrupt) enable bit.
When set, NMI is disabled; when clear, NMI is enabled.
This is in the MMIO configuration space, typically an Intel
platform register at:
Bit 1 of the MMIO register indicates the board variant.
ACPI method name strings used in the SKU table.
These are ASL method paths in the SB (System Bus) scope.
Core Count Throttle (0-8)
CPU Family/Health
Platform SKU info (0, X, V, Y, W)
ModuleEntryPoint (sub_390)
Step 1: Save UEFI core pointers to globals.
These are used by the UBA ASSERT macros and protocol lookups.
gImageHandle = ImageHandle;
UbaAssert (
Step 2: Initialize the HOB list.
This scans SystemTable->ConfigurationTable for the HOB list GUID.
GetHobList ();
Step 3: Locate the UBA protocol handle.
in the function table). Returns a handle through which we
register sub-protocols.
UbaHandle = NULL;
Registration (none)
Step 4a: Register UMPT protocol.
Method at offset 0x10 of the UBA_PROTOCOL.
Status = ((UBA_PROTOCOL *)UbaHandle)->RegisterProtocol (
Step 4b: Register PIRQ protocol.
Step 4c: Register ACPF protocol.
GetUbaProtocol (sub_4C0 at 0x4C0)
Return cached pointer if already located.
if (gUbaProtocol != NULL) {
Attempt a probing pool allocation.
Pool type 31 = EfiBootServicesData.
PoolBuffer = gBS->AllocatePool (31);
Pool allocation succeeded and resulted in a low address
Now try to locate the UBA protocol.
Status = gBS->LocateProtocol (
LocateProtocol failed; clear the cached pointer.
UbaAssert (sub_5C8 at 0x5C8)
Call the ASSERT/debug method at protocol offset 0x08.
This is not the same as RegisterProtocol (offset 0x10).
The offset 0x08 method signature is:
UbaCheckCmosSku (sub_540 at 0x540)
impossible since n3>3 here, so
Check if n3 > 3 -> special case
normalize to 0-based
default result
flags for SKU type B/C
flags for SKU type A
Call UBA protocol RegisterProtocol with ASSERT info
Read the current RTC index register to preserve NMI state.
RegIndex = IoRead8 (RTC_INDEX_PORT);
Set RTC index to CMOS register 0x4B, preserving NMI bit.
IoWrite8 **(RTC_INDEX_PORT, (RegIndex & RTC_INDEX_NMI_DISABLE) CMOS_INDEX_SKU_TYPE);**
Read CMOS data byte.
CmosValue = IoRead8 (RTC_DATA_PORT);
Apply SKU detection logic.
if ((UINT8)CmosValue > 3) {
SKU value > 3 is unexpected. Fall back to MMIO detection.
if (CmosValue == 0) {
If n3 >= 1 and n3 <= 254, set default flags.
Result = CmosValue - 1;
Default result when no assertion fires.
Result = 4;
SKU type B/C flags
SKU type A flags
If the required assertion flag is set in the platform flags
invoke the UBA protocol's RegisterProtocol (method @ +0x10)
to register an assert-like protocol entry.
if ((Flags & AssertFlag) != 0) {
GetHobList (sub_608 at 0x608)
Return cached pointer if already initialized.
if (gHobList != NULL) {
Assume no HOB list found initially.
Iterate through configuration table entries.
Each entry is 24 bytes: 16-byte GUID + 8-byte pointer.
for (Index = 0; Index < EntryCount; Index++) {
Compare GUIDs: check if the table entry's GUID matches.
The match checks two QWORDs (16 bytes):
CompareGuidQwords reads 8 bytes from each GUID.
If first 8 bytes AND second 8 bytes both match, we found it.
if (CompareGuidQwords (&gSkuHobGuid, ConfigTable)) {
Found matching entry; extract the table pointer.
The pointer is at offset 16 = 0x10 within the entry.
HobList = *(VOID )((UINTN)ConfigTable + 16);**
If HOB list was not found, fire assertion.
if (HobList == NULL) {
Print the EFI_ERROR status first.
Verify the HOB list pointer is not NULL.
CompareGuidQwords (sub_6E0 at 0x6E0)
4 bytes at offset 0
2 bytes at offset 4
2 bytes at offset 6
8 bytes at offset 8
Read the first 8 bytes of each GUID as a UINT64.
FirstHalf1 = ReadUnaligned64 ((VOID *)Guid1);
Read the second 8 bytes of each GUID.
SecondHalf1 = ReadUnaligned64 ((VOID *)((UINTN)Guid1 + 8));
Both halves must match for the GUID to be equal.
return (FirstHalf1 == FirstHalf2) && (SecondHalf1 == SecondHalf2);
ReadUnaligned64 (sub_750 at 0x750)
Assert if Buffer is NULL.
if (Buffer == NULL) {
ReadUnaligned32 (helper wrapper, not in this binary but in standard BaseLib)
SKU Configuration Table
Starting at offset 0x40F0 from the image base, the SKU configuration
table is embedded in the .data section. Its content is HOB-derived
platform configuration data organized as an array of 32-byte entries.
The table header is:
16 bytes: SKU table identifier (GUID-like, partially zero)
Each entry (32 bytes) describes a specific platform configuration
Entry 0: "FIX0" - FIX method 0
Entries 1-9: "FIXX" (with sub-id 01-08) - Extended FIX methods
Entries 10-18: "FIXV" (with sub-id 02-08) - Vendor FIX methods
Entries 19-25: unnamed (data_type=0x0A, ASCII strings)
Entries 26-27: "FIXY"/"FIXW" - More FIX variants
The data_type field determines interpretation:
The ACPI method references SB.CCT0 through SB.CCT8 and SB.CFH0
are stored as ASCII strings in .rdata at 0x7C8-0x858 and referenced
by the SKU table entries via their offset fields.
The actual SKU data (the payloads for FIX0, FIXX, etc.) begins at
offset 0x5B80 in the image (0x5B80 + 0x4080 = 0x9C00 area), though
the precise layout depends on how the HOB data was produced by the
PEI phase via the PCD (Platform Configuration Database).

Generated by HR650X BIOS Decompilation Project