Newer
Older
AMI-Aptio-BIOS-Reversed / CapsulePei / CapsulePei.md
@Ajax Dong Ajax Dong 2 days ago 4 KB Init

CapsulePei

Function Table

Address Name Description
_ModuleEntryPoint
ReadIdtr
WriteGdtr
Cpuid
LShiftU64
ReadUnaligned64
SetJump
LongJump
SetJumpValidateBuffer
AsmEnablePaging64
AsmEnablePaging64Wrapper
PageTableInitialization
CapsuleLongModeSwitch
Thunk32To64Call
LocatePpi
AllocatePages
InstallCapsulePpi
CompareGuid
DebugPrint
AssertPrint
ZeroMem
GetPlatformType
IsOverlap
StrSizeCheck
StrLenCapsuleUpdateData
StrLen
AsciiSPrintUnicodeCheck
InternalPrintLibSPrint
FindCapsuleX64PeImage
GetLongModeBufferVariable
GetPhysicalAddressBits
GetSystemMemoryResources
GetCapsuleVariableList
GetCapsuleVariableCount
CapsuleDataCoalesceEntry
CapsuleCacheAndCoalesce
ValidateMemoryAddress
ValidateCapsuleIntegrity
CapsuleRelocateOverlap
CapsuleRelocateDescriptors
GetCapsuleInfo
CapsuleTestPatternPreCoalesce
BuildCapsuleDescriptors
CapsuleDataCoalesce
CapsuleCoalesce
GetPeCoffEntryPoint
Forward declarations
EFI_STATUS EFIAPI
Copies Length bytes from Source to Destination.
If Source < Destination and ranges overlap, copies backward.
Otherwise uses dword-aligned copy then residual.
Uses InternalSetMem32-style write in a counted loop
Saves callee-saved registers, stack pointer, and return address
Prepare return address
Jump to continuation
If ModeFlags != 0 (x64): creates PML4[0..511] each pointing to
a PDP table with 512 PDEs mapping 0x200000 pages.
If ModeFlags == 0: creates 512 PML4 entries with 0x40000000 pages.
Unused entries zeroed.
should not return
First call: set up page tables and long mode
Installs the Capsule PPI with gEfiPeiCapsulePpiGuid
Read CMOS index 0x4A
Normal range - small value
Server return EFI_ACCESS_DENIED; // Other known
Overlap check against L"CapsuleUpdateData" storage
Returns length of L"CapsuleUpdateData" (15 characters)
Copies "CapsuleUpdateData\0" to destination
Converts Value to decimal string, stores in Buffer
Full format string parser with number conversion
Found the capsule PE image
Locate PE32 section, get entry point
Walk the HOB list, collect EFI_RESOURCE_MEMORY resources.
Returns the resource with largest descriptor.
Enumerate all "CapsuleUpdateData" variable instances
Variable is gEfiCapsuleVendorGuid + L"CapsuleUpdateData" Name
Allocate storage for capsule variable list
Validate signature = 0x50637343 ("Csc")
Read capsule sizes and counts
Allocate pages for coalesced data
Copy segment by segment
Call CapsuleDataCoalesce to build final capsule
Check Address + Size does not overflow
Verify range falls within one of the memory resources
Validate data block
First capsule header
Check flags: must have CAPSULE_FLAGS_PERSIST_ACROSS_RESET
but not INITIATE_RESET or some other exclude bit
Continuation pointer
Given a capsule descriptor chain at SourceEnd, walks
continuation entries to compute a safe relocation
destination that doesn't overlap source data.
Walks all descriptors, copies data blocks
Handles overlap via CapsuleRelocateOverlap
Walk descriptors, sum lengths, find capsule header
If the first data block has signature 0x54534554 ("TEST")
followed by sequence 0,1,2,..., then it passes as test pattern.
Chains all valid capsule descriptors together
Check platform capabilities
Determine if long mode is available
Parse capsule buffer layout
Validate capsule range against system memory
Populate descriptor context
StackBase VariableEntries[3] = CapsuleBuffer + 3;
Reserved param
CapsuleStart VariableEntries[10] = MemoryResources; // Memory descriptors
SGDT for GDTR save
TE image
Already notified - this is expected on repeat calls
Install the Capsule PPI

Generated by HR650X BIOS Decompilation Project