Newer
Older
AMI-Aptio-BIOS-Reversed / AtaPassThru / AtaPassThru.md
@Ajax Dong Ajax Dong 2 days ago 6 KB Init

AtaPassThru

Function Table

Address Name Description
ModuleEntryPoint
AtaPassThruInit
AtaPassThruDriverBindingStart
AtaPassThruDriverBindingStop
AtaPassThruFindDevice
AtaPassThruEnumeratePorts
AtaPassThruReadDeviceStatus
AtaPassThruSendCommand
AtaPassThruGetNextPort
AtaPassThruGetNextDevice
AtaPassThruBuildDevicePath
AtaPassThruGetDeviceFromPath
AtaPassThruResetPort
AtaPassThruResetDevice
AtaPassThruReportAssert
AtaPassThruReadDebugCmos
AtaPassThruCompareHobGuid
AtaPassThruReadUnaligned64
CpuidWrapper
Automatically generated decompilation for AtaPassThru.efi
HR650X AMI UEFI BIOS ATA Pass Thru Protocol driver
This driver implements the UEFI EFI_ATA_PASS_THRU_PROTOCOL on ATA/SATA
controllers detected by the SATA controller driver (SataController.efi).
It provides register-level ATA command passthrough to upper-layer drivers
like AtaBusDxe.
Global State
GUIDs //=============================================================================
Forward declarations of internal helpers
_ModuleEntryPoint (0x370)
AtaPassThruInit (sub_41C, 0x41C)
Allocate 16-byte private registration protocol structure
Slot 0 = Initialize callback (AtaPassThruDriverBindingStart)
Slot 1 = Unload callback (AtaPassThruDriverBindingStop)
AtaPassThruDriverBindingStart (sub_4FC, 0x4FC)
IoAlign Ctl->Reserved = 0; // Attributes
Initialize port/device context tracking
Offset +228 = current port, +230 = current device
AtaPassThruDriverBindingStop (sub_730, 0x730)
AtaPassThruFindDevice (sub_79C, 0x79C)
AtaPassThruEnumeratePorts (sub_7D4, 0x7D4)
Walk child handle linked list at controller protocol + 88
Check child type == 4 (ATA channel) at offset -909
AtaPassThruReadDeviceStatus (sub_854, 0x854)
Status / AltStatus
Device StatusBuffer[12] = (UINT8 )(DevInfoBase + 76); // DeviceControl
SectorCount StatusBuffer[8] = (UINT8 )(DevInfoBase + 72); // LbaHigh
LbaLow StatusBuffer[9] = (UINT8 )(DevInfoBase + 73); // (unused)
LbaMid StatusBuffer[10] = (UINT8 )(DevInfoBase + 74); // (unused)
LbaHigh / Error
AtaPassThruSendCommand (sub_960, 0x960)
Validate buffer alignment
Resolve child device for non-blocking mode
Detect 4K sector (IDENTIFY word 247)
Adjust transfer lengths from bytes to blocks
Max transfer: 256 sectors, or 65536 for 48-bit LBA
Build ACB from Asb register block
Asb layout used by this driver:
Features Acb[5] = Asb[5]; // SectorCount
SectorNumber Acb[7] = Asb[7]; // CylinderLow
CylinderHigh Acb[12] = Asb[2]; // SectorCountExp from Asb[2]
SectorNumberExp // Timeout conversion (100ns -> 1ms)
ATA register block construction
Detect 48-bit LBA commands by checking Asb[2]
Extended register command (48-bit LBA)
DEV bit
Dispatch by protocol type (command register [48])
Function pointer table at DeviceInterface:
ATA Non-Data
ATA Software Reset
ATA PIO Data-Out
ATA PIO Data-In
ATA PIO Data-Out (alternate)
ATAPI IDENTIFY
ATAPI Packet / FPDMA
ATA Non-Data (alt path - Set Features)
ATA Read Status
ATA DMA (alt path)
ATA Device Reset (read status to clear)
Read register status after command
AtaPassThruGetNextPort (sub_D88, 0xD88)
AtaPassThruGetNextDevice (sub_E5C, 0xE5C)
End of device list
Scan for device matching port with higher port multiplier
AtaPassThruBuildDevicePath (sub_F88, 0xF88)
Walk IDENTIFY data descriptor list (device + 856)
Found ATA target descriptor: copy type+length
Overwrite with port/multiplier info
AtaPassThruGetDeviceFromPath (sub_10A0, 0x10A0)
Active channels use ATAPI device path (type=3, submode=18, length=10)
AtaPassThruResetPort (sub_1128, 0x1128)
Call device vtable + 200 (25*8) with NonData reset signature
AtaPassThruResetDevice (sub_1188, 0x1188)
AtaPassThruReportAssert (sub_12A8, 0x12A8)
AtaPassThruGetDebugProtocol (sub_11E0, 0x11E0)
Check TPL: GetTimerValue(31), if > 0x10 return NULL
This pattern is AMI-specific for lazy debug protocol init
AtaPassThruGetHobList (sub_12E8, 0x12E8)
AtaPassThruReadDebugCmos (sub_13C0, 0x13C0)
Preserve NMI, select reg 0x4B
Read platform config from fixed address
Validate debug level (1 or 2+)
Return debug level mask
Level 1 -> 0x80000004 (EFI_D_ERROR in AMI convention)
Level **2+ -> 0x80000006 (EFI_D_INFO EFI_D_ERROR in AMI convention)**
AtaPassThruCompareHobGuid (sub_1410, 0x1410)
AtaPassThruReadUnaligned64 (sub_1480, 0x1480)
CpuidWrapper (sub_14B0, 0x14B0)
Memset32Pattern (sub_14F0, 0x14F0)
Build 32-bit repeating pattern from low 16 bits
Handle unaligned head
Fill aligned portion with 32-bit pattern
Trailing bytes
InternalMemcpy (sub_1550, 0x1550) - overlapping-safe memmove
Detect backward overlap: src < dst and src+count > dst
Fast path for aligned >= 8 byte copy
Match source/dest alignment for head
Reverse copy alignment fixup
Copy 8-byte chunks
END AtaPassThru.c

Generated by HR650X BIOS Decompilation Project