Newer
Older
AMI-Aptio-BIOS-Reversed / CapsuleRuntimeDxe / CapsuleRuntimeDxe.md
@Ajax Dong Ajax Dong 2 days ago 5 KB Init

CapsuleRuntimeDxe

Function Table

Address Name Description
CapsuleRuntimeDxeDriverEntryPoint
CapsuleUpdateCapsule
CapsuleQueryCapsuleCapabilities
IsCapspaceGuidEqual
ReadUnaligned64
CheckCapsuleType
GetCapsuleRuntimeProtocol
ModuleEntryPoint
DebugAssertInternal
DebugPrint
VirtualAddressChangeEvent
ExitBootServicesEvent
RuntimeCapsuleEvent
CapsuleRuntimeVariableEvent
AsmCpuid
Global data - boot-time only references
EFI_HANDLE gImageHandle = NULL;
Saved copies for runtime transition
EFI_BOOT_SERVICES *gBS_Runtime = NULL;
Capsule configuration globals
UINT64 gCapsuleMaxSize = 104857600; // 100 MB
33 MB
Runtime services function table (obtained via gBS->LocateProtocol)
and the protocol GUID.
STATIC VOID *mCapsuleRuntimeProtocol = NULL;
EFI_GUID {0x...} for the capsule runtime protocol (placeholder)
unk_3020 and unk_3030 are GUID structures used for GUID comparison
unk_3070 is a GUID table used by capsule type detection
Function prototypes (forward declarations for local functions)
EFI_STATUS EFIAPI
Initialize UEFI Boot/Runtime Services Library state
and register the capsule runtime protocol.
CapsuleRuntimeDxeDriverEntryPoint (ImageHandle, SystemTable);
Install the capsule runtime protocol.
or gBS->InstallMultipleProtocolInterfaces. Here we approximate the
call that sets up gRT->UpdateCapsule / gRT->QueryCapsuleCapabilities.
The decompiled code writes:
offset 14
offset 15
Locate and install the capsule runtime protocol
Status = gBS->InstallMultipleProtocolInterfaces (
Assert on failure (debug builds only)
DEBUG ((EFI_D_ERROR, "\nASSERT_EFI_ERROR (Status = %r)\n", Status));
UefiBootServicesTableLib constructor
gImageHandle = ImageHandle;
gRT = SystemTable->RuntimeServices;
Save copies for VirtualAddressChange event
gBS_Runtime = gBS;
Create VirtualAddressChange event (TPL_NOTIFY, EFI_EVENT_SIGNAL_VIRTUAL_ADDRESS_CHANGE)
Status = gBS->CreateEvent (
Create ExitBootServices event (TPL_CALLBACK, EFI_EVENT_SIGNAL_EXIT_BOOT_SERVICES)
Status = gBS->CreateEventEx (
UefiRuntimeLib constructor: initialize HOB list and register runtime capsule event
if (gRT == NULL) {
Create event for runtime capsule update notification
Create runtime event for capsule variable (EfiRuntimeServicesData)
CapsuleUpdateCapsule (sub_14FC)
Check capsule flags:
CapsuleFlag bit 17 (0x20000) = POPULATE_SYSTEM_TABLE
CapsuleFlag bit 18 (0x40000) = INITIATE_RESET
Combined bit 17+18 (0x30000) mask
Combined bit 18+19 (0x50000) mask
If both bits 17 and 18 are clear (0x20000 check) or
bit 18 is set and bit 17 is clear (0x40000 check), this
capsule needs runtime protocol validation.
if **(((ThisCapsule->Flags & 0x30000) == 0x20000) **
Populate system table capsule - break out and process below
Not a populate-system-table capsule; capsule type check required
Status = CheckCapsuleType (ThisCapsule);
All capsules processed, check if any need reset populate
if (CapsuleCount == 0) {
All capsules have bit 16 set - need a reset capsule
ReturnValue = (UINT64)EFI_UNSUPPORTED;
Found a capsule without bit 16 set
ReturnValue = (UINT64)EFI_INVALID_PARAMETER;
If we broke out above (populate system table capsule found)
fall through to success path
return EFI_SUCCESS;
CapsuleQueryCapsuleCapabilities (sub_1608)
Same capsule flag checks as UpdateCapsule
IsCapspaceGuidEqual (sub_1710)
ReadUnaligned64 (sub_1778)
GetCapsuleRuntimeProtocol (sub_17A8)
Check if HOB list has room (<= 16 bytes header)
HobSize = gBS->GetHobListSize ();
DebugAssert (sub_1830)
Read debug level from CMOS
DebugLevel = IoRead8 (0x70);
Map debug level to severity mask
switch (DebugLevel) {
DebugPrint (sub_18B0)
VirtualAddressChangeEvent (sub_18F0)
ExitBootServicesEvent (sub_18FC)
GetHobList (sub_1924)
CheckCapsuleType (sub_1A04)
First check against 2 known capsule GUIDs in the local table
for (TableIndex = 0; TableIndex < 2; TableIndex++) {
Then check against the extern capsule GUID list
if (&gExternCapsuleGuidList == NULL) {
RuntimeCapsuleEvent (sub_1A94)
CapsuleRuntimeVariableEvent (sub_1A8C)
AsmCpuid (sub_1020)

Generated by HR650X BIOS Decompilation Project