Newer
Older
AMI-Aptio-BIOS-Reversed / IioCfgUpdateDxeLightningRidgeEXRP / IioCfgUpdateDxeLightningRidgeEXRP.md
@Ajax Dong Ajax Dong 2 days ago 8 KB Init

IioCfgUpdateDxeLightningRidgeEXRP

Function Table

Address Name Description
ReadUnaligned64
CompareGuid
DebugPrintUba
AssertHandler
IioCfgUpdateUnsupported
IioCfgUpdateMain
ModuleEntryPoint
Global UEFI system table pointers (initialized by ModuleEntryPoint)
EFI_HANDLE gImageHandle = NULL; ///< 0x0D88 - EFI image handle
Cached protocol/state pointers
VOID *mDebugProtocol = NULL; ///< 0x0D98 - Cached DebugLib protocol pointer
GUID Definitions
UBA Protocol GUID
static EFI_GUID mUbaProtocolGuid = { 0xE03E0D46, 0x5263, 0x4845, { 0xB0, 0xA4, 0x58, 0xD5, 0x7B, 0x31, 0x77, 0xE2 } };
IIO configuration data block GUIDs
static EFI_GUID mIioCfgUpdateGuid1 = { 0x6FE6C559, 0x4F35, 0x4111, { 0x98, 0xE1, 0x33, 0x2A, 0x25, 0x15, 0x12, 0xF3 } };
HOB GUID used to find the IIO configuration HOB in the HOB list
static EFI_GUID mIioCfgHobMatchGuid = { 0x7739F24C, 0x93D7, 0x11D4, { 0x9A, 0x3A, 0x00, 0x90, 0x27, 0x3F, 0xC1, 0x4D } };
DebugLib protocol GUID
static EFI_GUID mDebugLibProtocolGuid = { 0xE0D4DF48, 0xCB79, 0x4B33, { 0x95, 0x68, 0x20, 0xE8, 0xAA, 0xA1, 0xEC, 0x47 } };
IIO Configuration Data
IIO Configuration Update Table (PIIO structure).
Contains headers and PCIe register update entries for IIO device
configuration on Lightning Ridge EXRP platforms.
The structure is composed of:
PIIO_STRUCTURE Header - with signature, sizes, and counts
IIO_CFG_ENTRY Entries[] - array of PCIe config updates
The entries define AND/OR mask operations to apply to specific
PCIe configuration registers on specific socket/bus/device/function
targets across all IIO instances.
PIIO_STRUCTURE mIioConfigData = {
IIO Configuration Entries.
Each entry defines a PCIe register AND/OR mask update.
Entry fields: {Socket, Bus, Device, Func, Register(16-bit), AndMask, OrMask, Flags, Reserved[3]}
static IIO_CFG_ENTRY mIioConfigEntries[] = {
Socket 1
Socket 2
Socket 3
Socket 4
Socket 5 (disabled)
Socket 9 Bus1 Dev1 Reg=0x01FF AND=0x00 OR=0x40 (disabled)
Socket 21 (disabled)
Socket 22 Bus5 Dev1 (disabled)
Socket 26 Bus7 Dev0 (disabled)
Socket 30 Bus10 Dev0 (disabled)
Socket 42
Socket 43 Bus6 Dev1 (disabled)
Socket 51 Bus8 Dev0 (disabled)
Socket 47 (disabled)
Socket 63
Socket 68 Bus3 Dev1 (disabled)
Socket 72 Bus4 Dev0 (disabled)
Socket 64
Full entry count is 0x50C (1292). The entries above are the first 18.
The remaining entries follow the same IIO_CFG_ENTRY format.
A complete dump would require extracting all 1292 entries from the
original binary at offset 0xC3C.
Function Implementations
Assert if buffer is NULL (debug builds only).
if (Buffer == NULL) {
Perform direct QWORD read (may be unaligned - x86 handles this in hardware).
return (UINT64 )Buffer;
Read both halves of both GUIDs as unaligned 64-bit values.
Guid1First = ReadUnaligned64 (Guid1);
Both halves must match.
return (BOOLEAN)(Guid1First == Guid2First && Guid1Second == Guid2Second);
Return cached pointer if already initialized.
DebugProtocol = mDebugProtocol;
Allocate a small pool buffer for protocol discovery.
PoolSize is set to 0x10 + 0x1F = 0x2F (47) to align up to 32 bytes
though the actual allocation request is for 0x1F (31) = MEMORY_TYPE_BOOT_SERVICES_DATA.
PoolSize = MEMORY_TYPE_BOOT_SERVICES_DATA;
Check if allocation was reasonable. If the pointer value is > 16 bytes
if ((UINTN)mDebugProtocol > 0x10) {
Locate the DebugLib protocol by GUID.
Status = gBootServices->LocateProtocol (
Allocation returned an unexpectedly small value - treat as failure.
mDebugProtocol = NULL;
Get the DebugLib protocol; if not available, skip the print.
DebugProtocol = GetDebugLibProtocol ();
Read the platform SKU from RTC CMOS register 0x4B.
CMOS index 0x4B is selected via I/O port 0x70, data read via port 0x71.
The NMI-disable bit (0x80) is preserved in the index write.
RTC CMOS register layout:
Bit 7 of port 0x70 = NMI disable
Bits 6-0 of port 0x70 = CMOS register index
IoWrite8 **(RTC_CMOS_INDEX_PORT, (IoRead8 (RTC_CMOS_INDEX_PORT) & 0x80) RTC_CMOS_INDEX_SKU);**
Determine effective SKU:
register at 0xFDAF0490 bit 1 (VT-d / IIO mode indicator).
EffectiveSku = CmosSku;
Read platform info register to determine IIO mode.
Bit 1 of 0xFDAF0490 indicates IIO configuration mode.
0xFDAF0490 is a memory-mapped register in the platform controller hub.
EffectiveSku *= ((volatile UINT8 *)PLATFORM_INFO_REGISTER & 0x02) 0x01;**
Map platform SKU to debug level filter mask.
SKU 0 (uninitialized) -> UBA_DEBUG_ERROR (0x80000000)
SKU 1 (Type1) -> UBA_DEBUG_INFO (0x80000040)
SKU 2 (Type2) -> UBA_DEBUG_ERROR (0x80000000)
SKU >3 (Type3+) -> UBA_DEBUG_ERROR (0x80000000)
while SKU 1 gets the higher verbosity UBA_DEBUG_INFO mask.
Valid SKU range (1-4 maps to 0-3 after decrement).
FilterMask = UBA_DEBUG_ERROR; // Default: only errors
Out of range or zero - use debug error level only.
FilterMask = UBA_DEBUG_ERROR;
If the requested debug level passes the filter, call the DebugLib
if ((FilterMask & DebugLevel) != 0) {
DebugProtocol layout:
Call DebugProtocol->Assert (at offset +8).
Return cached HOB pointer if already found.
Result = mHobList;
Initialize HOB list to NULL.
Iterate through the SystemTable's configuration table entries.
SystemTable layout (offsets from SystemTable pointer):
Each entry = 24 bytes: VendorGuid (16) + VendorTable (8)
TableCount = gSystemTable->NumberOfTableEntries;
No configuration table entries - ASSERT and return NULL.
DebugPrintUba (
Search through all configuration table entries.
for (TableIndex = 0; TableIndex < TableCount; TableIndex++) {
Check if this entry's GUID matches our IIO HOB match GUID.
if (CompareGuid (&ConfigTable[TableIndex].VendorGuid, &mIioCfgHobMatchGuid)) {
Found the matching HOB - return its data pointer.
Result = ConfigTable[TableIndex].VendorTable;
No matching HOB found - ASSERT.
Initialize config size to sizeof(IIO_CFG_ENTRY) = 0x3C = 60 bytes.
This is the per-entry size used by the UBA protocol handler.
ConfigSize = sizeof (IIO_CFG_ENTRY);
Print module identification string for debug/trace purposes.
Locate the UBA protocol.
in the BootServices table (function index 41 since each entry is 8 bytes).
Register each of the four IIO configuration blocks.
Each call uses the same PIIO configuration data structure but
is identified by a different GUID, allowing the UBA core to
distinguish between different IIO config block types.
SetIIOConfigData is at UbaProtocol offset +16 (function index 2).
Status = UbaProtocol->SetIIOConfigData (
Save image handle pointer.
gImageHandle = ImageHandle;
Save system table pointer.
gSystemTable = SystemTable;
Save boot services table.
gBootServices = SystemTable->BootServices;
Save runtime services table.
gRuntimeServices = SystemTable->RuntimeServices;
Initialize HOB list (find IIO configuration HOB).
HobLibInit (ImageHandle);
Perform the IIO configuration data update.
Status = IioCfgUpdateMain ();

Generated by HR650X BIOS Decompilation Project