Newer
Older
AMI-Aptio-BIOS-Reversed / FpgaDxe / FpgaDxe.md
@Ajax Dong Ajax Dong 2 days ago 10 KB Init

FpgaDxe

Function Table

Address Name Description
InternalAssert
GetDxeServicesTable
GetPcdProtocol
GetMmPciBaseProtocol
GetHobList
GetUsraProtocol
GetSmmCommunication
S3BootScriptEventNotify
S3BootScriptBackupNotify
CompareGuid
InitializeLibServices
DebugPrint
PcdGet64
UsraReadMmio
UsraWriteMmio
UsraReadPciCfg
UsraReadPciCfgByte
SaveLockBox
SetLockBoxAttributes
RestoreLockBox
S3BootScriptSyncNotify
S3BootScriptLibInit
FpgaConfigurationGetValues
FpgaDxeEntryPoint
ModuleEntryPoint
FpgaOnReadyToBoot
ProcessLibraryDestructor
Global variable storage
EFI_HANDLE gImageHandle = NULL;
qword_67B0 VOID *mPcd = NULL; // qword_67A0
qword_67B8 VOID *mUsra = NULL; // qword_6808
qword_67C0 VOID *mEventDxeSmmReadyToLock = NULL; // qword_67E0
qword_67E8 UINTN gPciExpressBaseAddress = 0; // qword_67C8
qword_6818 VOID *mSmmCommRegion = NULL; // qword_6810
FPGA HOB configuration data (from unk_6880)
UINT8 gFpgaConfigValid; // byte_6880 non-zero if HOB is valid
byte_6883 -- bitmask of active sockets
byte_6885 UINT8 gFpgaSktConfig6; // byte_6886
byte_689F UINT8 gFpgaSktConfig32; // byte_68A0
byte_68A5 -- if ==1, skip DXE lock config
unk_6887 (per-socket fields)
qword_6840 (4 entries)
qword_68A8 //
S3 boot script context
UINT8 *gS3BootScriptBuf = NULL; // qword_6828
qword_6830 UINT8 gBootScriptFlag1 = 0; // byte_67D8
byte_6800 VOID *gSmmReadyToLockEvent1= NULL; // qword_67F0
qword_67D0 VOID *gSmmReadyToLockEvent3= NULL; // qword_67F8
LockBox GUID storage (mutable runtime data, unk_6740/60/70/50)
UINT8 gLockBoxGuid1[16]; // qword_6740
qword_6760 UINT8 gLockBoxGuid3[16]; // qword_6770
Internal helper prototypes
Zero in 8-byte chunks, then remaining bytes.
ZeroMem (Buffer, Length);
1 -- Library constructor: UefiBootServicesTableLib, UefiRuntimeServicesTableLib
2 -- DxeServicesTableLib constructor
3 -- PcdLib constructor
4 -- DxeMmPciBaseLib constructor
5 -- DxeHobLib constructor
6 -- Guid comparison helper
7 -- HOB traversal helpers
8 -- Debug library: DebugPrint / DebugAssert wrappers
Check whether this error level should be displayed and whether
the debug protocol supports it.
if (DebugProtocol->IsValid (ErrorLevel)) {
9 -- PCI Express MMIO access
Value = ((PCD_PROTOCOL *)mPcd)->Get64 (TokenNumber);
10 -- USRA (Universal Segment Resource Access) wrappers
512 **Descriptor.Address = (Offset & 0xFFF) **
PCI byte read
11 -- SMM LockBox protocol locate
12 -- SMM LockBox: SaveLockBox
fallback to stack buffer
Initialize the LockBox command structure
InternalCopyMem (CommBuffer, &gLockBoxGuid1, 16);
13 -- SMM LockBox: SetLockBoxAttributes
14 -- SMM LockBox: RestoreLockBox
15 -- Boot script save event notification
mark saved
clear lock
16 -- Boot script backup notification
Calculate new length and save the boot script to LockBox
if (gS3BootScriptBackup != NULL) {
17 -- Boot script context sync (S3 Ready-To-Lock notification event)
If primary and backup are different, copy primary -> backup
if (gS3BootScriptBuf != gS3BootScriptBackup) {
18 -- S3 Boot Script Library init
137 if (PcdS3BootScriptBufferSize == 0) {
Allocate boot script table from boot services data
Status = gBS->AllocatePool (
InternalZeroMem (gS3BootScriptBuf, 32);
Register event notification for when SMM Ready-To-Lock protocol appears
mEventDxeSmmReadyToLock = EfiCreateEventReadyToBoot (
store low byte as flag
Locate SMM Ready-To-Lock protocol and register additional notifications
if (!EFI_ERROR (gBS->LocateProtocol (
Get S3 boot script backup buffer
BufferSize = PcdGet64 (PcdS3BootScriptBufferSizeToken); // 138
Register event for the backup save
InternalZeroMem (gS3BootScriptBackup, 32);
Register sync notification for the final protocol
Status = gEfiSmmReadyToLockProtocol2->RegisterNotification (
19 -- FPGA Configuration HOB retrieval / creation
Search for the FPGA configuration HOB by its GUID
FpgaHob = (FPGA_CONFIG_HOB *)GetFirstGuidHob (&gFpgaConfigHobGuid);
HOB not found create it
DEBUG ((DEBUG_ERROR, "FPGA Configuration Get HOB-> HOB is not found, create it!\n"));
Initialize per-socket entries (at offset 15)
Dst = (UINT8 *)&FpgaHob->Socket[0];
bus start
device Dst[2] = 0xFF; // max bus
subordinate Dst[4] = 0; // reserved
reserved Dst[6] = 0; // temp threshold N0
temp threshold N1
Try to restore from UEFI variable "FpgaSocketConfig"
VariableSize = 27;
Copy per-socket data (indices 0..4)
Src = VariableData;
bus Dst[4] = Src[11]; // gap
temp N0
temp N1
20 -- FpgaDxe entry point
Step 1: Initialize library service globals
InitializeLibServices (ImageHandle, SystemTable);
Step 2: Get DXE Services Table
Status = GetDxeServicesTable ();
Step 3: Get PCD protocol
Status = GetPcdProtocol ();
Step 4: Get MM PCI base protocol (for ECAM access)
Status = GetMmPciBaseProtocol ();
Step 5: Get HOB list
Status = GetHobList ();
Step 6: Get PCI Express base address from PCD
gPciExpressBaseAddress = PcdGet64 (PcdPciExpressBaseAddress); // Token 5
Step 7: Enable PCI Express MMIO access via PCD bit
PcdData = PcdGet64 (PcdPciExpressEnable); // Token 4
PcdGet8 wrapper
Step 8: Read CMOS diagnostic status
TimerValue = IoRead32 (0x508); // CMOS port 0x508
Step 9: Short delay to stabilize FPGA
TimerValue = IoRead32 (0x508) & 0xFFFFFF;
Restore CMOS access
if (FpgaActive) {
reset request
No special action needed
Step 10: Initialize S3 Boot Script Library
Status = S3BootScriptLibInit ();
Step 11: Locate USRA protocol
Status = gBS->LocateProtocol (
Step 12: Get FPGA configuration from HOB
Status = FpgaConfigurationGetValues (&FpgaHob);
Extract configuration bytes from HOB
gFpgaConfigValid = (UINT8 )((UINT8 *)FpgaHob + 0);
Copy per-socket data
InternalCopyMem (&gFpgaSktConfigBuf, (UINT8 *)FpgaHob + 7, 7);
Step 13: If no FPGA is active, return successfully (nothing to do)
if (gFpgaSktActive == 0) {
Step 14: Locate GlobalNvsArea ACPI protocol and cache pointer
Step 15: Program per-socket FPGA active state into NVS
for (SocketIndex = 0; SocketIndex < 4; SocketIndex++) {
Step 16: Locate protocol for OEM FPGA data
Step 17: Initialize SMBus for FPGA access
SMBUS_PROTOCOL_OP SMBusOp;
SMBus read byte
Step 18: Register ReadyToBoot notification callback
EfiCreateEventReadyToBoot (
21 -- Module entry point (AutoGen)
Call the driver unload / cleanup handler
22 -- FpgaOnReadyToBoot (ReadyToBoot notification)
Signal that we have entered ReadyToBoot
Initialize SMBus
Zero FME BAR array
InternalZeroMem (&gFmeBar, sizeof (gFmeBar));
Process each active socket
SocketIndex = 0;
Get MCP limit bus and socket bus number
McpLimitBus = (UINT8 )((UINTN)gGlobalNvsArea + SocketBit * 6 + 6904);
Read current PCI secondary/subordinate buses
SecondaryBus = UsraReadPciCfgByte (SocketBit, BusNum, 25);
Get segment number from protocol
SegmentNum = (UINT8 )((UINTN)gFpgaSkuProtocol + SocketBit * 43 + 31);
Enumerate PCI devices to find the virtual FPGA bus
HandleBuffer = NULL;
Program subordinate bus limit
DEBUG ((DEBUG_INFO, "Update Device on B%x:D%x:F%x\n", Bus, Device, Func));
Program the FPGA device behind this root port
FpgaPcieDeviceConfig (PciIo, SocketBit);
Write secondary/subordinate limits via USRA
UsraWriteMmio (SocketBit, BusNum, 0, 25, McpLimitBus - 1);
Read FME BAR
RegValue = UsraReadMmio (SocketBit, (UINT8)(McpLimitBus - 1), 0, 16);
Set primary bus
UsraWriteMmio (SocketBit, BusNum, 2, 25, McpLimitBus);
Dump Blue BitStream version for active sockets
DEBUG ((DEBUG_INFO, "DumpBbsVersion () ...\n"));
Program temperature threshold registers
MCP power limit configuration
if (FpgaMcpPowerLimitConfig () < 0) {
FPGA miscellaneous initialization
FpgaPcieEarlyConfig ();
PCIe device config
DEBUG ((DEBUG_INFO, "FpgaPcieDeviceConfig() ...\n"));
DXE lock configuration (unless unlock flag is set)
if (gFpgaDxeUnlock == 1) {
Token 182
23 -- S3 boot script library destructor / cleanup
Close SMM Ready-To-Lock event notifications
if (gEfiSmmReadyToLockProtocol != NULL) {
Close SMM communication protocol
if (mSmmCommunication != NULL) {

Generated by HR650X BIOS Decompilation Project