Newer
Older
AMI-Aptio-BIOS-Reversed / TcpDxe / TcpDxe.md
@Ajax Dong Ajax Dong 2 days ago 7 KB Init

TcpDxe

Function Table

Address Name Description
ProcessModuleEntryPoint
ModuleEntryPoint
TcpInstallDriver
TcpDriverBindingSupported
TcpDriverBindingStart
TcpDriverBindingStop
TcpCreateService
TcpDestroyService
TcpDispatcher
TcpSetState
TcpInput
TcpOutput
TcpOutputSegment
TcpSendAck
TcpTimerHandler
TcpProcessTimer
TcpSetTimer
TcpRexmitTimeOut
TcpProbeTimeout
TcpSendZeroWindowProbe
TcpSendRst
TcpCloseCallback
TcpInitSeed
TcpGetIss
TcpComputeSendWinddow
TcpGetQueuedData
TcpStartTimer
TcpStopTimer
TcpTokenComplete
Module globals
Head of global TCB list
Protocol GUID definitions
TCP state names (debug strings)
Utility wrapper functions
Linked list helpers
PROCESS MODULE ENTRY POINT (0x5A44)
Initialize TCP random seed for ISS generation
TcpInitSeed ();
Locate DPC protocol for timer management
DRIVER ENTRY (0x528)
Status = ProcessModuleEntryPoint (ImageHandle, SystemTable);
No NetworkStackVar or network stack disabled
return EFI_SUCCESS; // Not an error just don't install TCP
Status = TcpInstallDriver (ImageHandle, TCP_PROTOCOL_VERSION_4);
Status = TcpInstallDriver (ImageHandle, TCP_PROTOCOL_VERSION_6);
TcpInstallDriver -- Install driver binding prootocolls
Install TCPv4 service binding + component name2
Status = gBS->InstallMultipleProtocolInterfaces (
Interface (driver binding instance)
Component name instance
Install TCPv6 service binding
Interface NULL
TcpDriverBindingSupported (0x850)
Determine IP version from context (via image handle comparison
Try to open IP service binding on controller
Close the protocol (we were just testing)
Create TCP service for this controller
Status = TcpCreateService (
Actual code determines from context
Initialize IP IO for this service
return EFI_SUCCESS;
TcpDriverBindingStop (0xB84)
Locate TCP service on controller
Destroy service
TcpDestroyService (TcpService);
TcpCreateService (0x698)
Create IP IO instance for this service
Install service binding protocol
Destroys all child TCP instances
if (!IsListEmpty (&TcpService->TcpInstanceList)) {
Destroy each instance (actual code uses CR macro
to get TCP_INSTANCE from link and frees it)
Uninstall protocols
TcpDispatcher (0x46F4)
TcpInitTcb (Tcb);
Complete the token, release IP info
TcpTokenComplete (Tcb, Data, 0, TRUE);
Parses config data, sends SYN
Mark for output
if (Tcb->State == TCP_ESTABLISHED) {
Schedule ACK if window was closed
if (Tcb->RcvBufUsed >= Tcb->RcvBufMaax / 2) {
POLL (unused)
return EFI_UNSUPPORTED;
TcpSetState (Tcb, TCP_SY_SENT);
if (Tcb->State <= TCP_SYN_RCVD) {
if (Tcb->State >= TCP_SYN_RCVD && Tcb->State <= TCP_CLOSE_WAIT) {
TcpSetState (0x33D8)
Log state transition
DEBUG ((EFI_D_NET, "Tcb (%p) state %d -> %d\n", Tcb, Tcb->State, State));
Update state
Handle special state transitions
if (State == TCP_CLOSED) {
Connection closed: signal error to socket
Socket = Tcb->Sk;
ConnectionToken offset
State }
Connection established: signal success
TcpInput (0x9520)
Extract TCP header fields
RST in response to anything in CLOSED
if ((Flags & TCP_FLG_RST) == 0) {
Passive open: SYN received
if ((Flags & TCP_FLG_RST) != 0) {
Process SYN for passive open
1460 TcpSetState (Tcb, TCP_SY_RCVD);
Send SY-AK
Active open: SY-AK received
if ((Flags & TCP_FLG_ACK) != 0 &&
Valid SY-AK: our SY was ACKed
if (!TCP_SEQ_LT (Ack, Tcb->Iss + 1)) {
Connection refused
Data transfer states
if ((Flags & TCP_FLG_RS) != 0) {
Connection reset
TcpSetState (Tcb, TCP_CLOSED);
Unexpected SY connection reset
Process ACK
if (TCP_SEQ_GT (Ack, Tcb->SndUna)) {
New ACK: upate SndUna, congestion window
Slow start: cwnd += MSS per ACK
Congestion avoidance: cwnd += MSS*MSS/cwnd
Send new data if any pending
if (Tcb->SndNxt != Tcb->SndUna) {
Fast retransmit
Process data
if (Len > 0) {
Process FIN
if ((Flags & TCP_FLG_FIN) != 0) {
Send ACK if data was received
Closing states
Restart 2MSL timer
TcpOutput (0x6F10)
Only output in ESTABLISHED or CLOSE_WAIT
if (Tcb->State != TCP_ESTABLISHED &&
Send data from send buffer, limited by window
Set retransmit timer
TcpSetTimer (Tcb, 2, Tcb->Rto / 100); // RTO in ticks
TcpOutputSegment (0x6BC8)
Build TCP header, append options and data
compute checksum, send via IP layer
appends options and payload, computes checksum
calls IP layer send function)
TcpSendAck (0x5E3C)
TcpTimerHandler (0x6924)
Process all TCB timers
TcpProcessTimer (0x51B0)
Timer expired
switch (CurrentTcb->TimerType) {
CONNECT TcpCloseCallback (CurrentTcb);
RETX TcpRexmitTimeOut (CurrentTcb);
PROBE TcpProbeTimeOut (CurrentTcb);
KEEP_ALIVE TcpSendKeepAlive (CurrentTcb);
FIN_WAIT_2 TcpSetState (CurrentTcb, TCP_CLOSED);
TIME_WAIT (2MSL)
TcpSetTimer (0x5210)
Disable timer
If timer was not previously active, increment ref count
if (!(Tcb->Flags & TCP_FLG_TIIER_ON)) {
TcpRexmitTimeOut (0x5240)
Exponential backoff: double RTO
Set slow start threshold, reset congestion window
Reset to 1*MSS
Check if max retransmissions exceeded
if (Tcb->RetxCount > TCP_DEFAULT_MAXX_RTX) {
Too many retransmissions close
Retransmit earliest unacknowledged segment
TcpSetTimer (Tcb, 2, Tcb->Rto / 100);
TcpProbeTimeout (0x52A4)
TcpSendZeroWindowProbe (0x741C)
TcpSendRst (0x3750)
TcpCloseCallback (0x3864)
Signal connection token with error
TCP Miscellaneus Helpers
Linear congruenceial generator seed from timer
gTcpSeed = 0x4D7E80B; // Default if timer not available
Increment tick by variable amount for additional randomness
gTcpTick += 1 + (gTcpSeed % 64000);
TCP Timer Management (DPC-based)
Create periodic timer (2-second period)
Status = gBS->CreateEvent (
2000000 us = 2s
TcpTokenComplete (0x4024)

Generated by HR650X BIOS Decompilation Project