Newer
Older
AMI-Aptio-BIOS-Reversed / UsbOcUpdateDxeLightningRidgeEXECB2 / UsbOcUpdateDxeLightningRidgeEXECB2.md
@Ajax Dong Ajax Dong 2 days ago 12 KB Init

UsbOcUpdateDxeLightningRidgeEXECB2

Function Table

Address Name Description
ReadUnaligned64
CompareGuid
DebugPrint
AssertPrint
UsbOcGetConfigTables
UsbOcUpdateEntryPoint
Global Variables
Cache of the EFI System Table pointer.
Address 0xC50 in .data.
EFI_SYSTEM_TABLE *gSystemTable = NULL;
Cache of the EFI Boot Services table pointer.
Address 0xC58 in .data, populated from gSystemTable->BootServices (offset
0x60 in EFI_SYSTEM_TABLE).
EFI_BOOT_SERVICES *gBootServices = NULL;
Cache of the ImageHandle passed to the entry point.
Address 0xC60 in .data.
EFI_HANDLE gImageHandle = NULL;
Cache of the EFI Runtime Services table pointer.
Address 0xC68 in .data, populated from gSystemTable->RuntimeServices
EFI_RUNTIME_SERVICES *gRuntimeServices = NULL;
Cached pointer to the UBA Debug Print Protocol interface.
Address 0xC70 in .data. Lazily initialized by GetDebugPrintProtocol().
The protocol is located once and cached for all subsequent calls.
UBA_DEBUG_PRINT_PROTOCOL *gDebugPrintProtocol = NULL;
Cached HOB list pointer.
Address 0xC78 in .data. Populated by GetHobList() which searches
the system configuration table for the gEfiAcpiTableGuid entry.
VOID *gHobList = NULL;
Value read from CMOS register 0x4B, used to determine the debug output
verbosity level.
Address 0xC80 in .data.
UINT8 gCmosDebugLevel = 0;
GUID definitions used by the driver.
static CONST EFI_GUID mUsbOcProtocolGuid = UBA_USB_OC_PROTOCOL_GUID;
Static configuration data tables provided by this driver.
These are returned by UsbOcGetConfigTables().
static CONST UINT32 mConfigTable1[] = {
ReadUnaligned64 (sub_740)
Reads a 64-bit value from the given address with NULL pointer validation.
This function is used as an unaligned memory read helper (generated from
via AssertPrint().
UINT64 EFIAPI
Validate the buffer pointer. If NULL, assert with the source file
location from BaseLib/Unaligned.c (line 192).
if (Buffer == NULL) {
Dereference the pointer to read the QWORD. In the original binary this
is an unaligned load; on x64 the hardware handles misalignment natively.
return (CONST UINT64 )Buffer;
CompareGuid (sub_6D0)
Compares two GUIDs for equality by comparing their 64-bit halves.
Each GUID is read as two 64-bit values (little-endian QWORDs representing
This is NOT the standard EFI_GUID comparison (which would use the full
struct comparison), but rather a UBA-specific inline comparison that avoids
calling into the full MemCmp.
Read the first 64-bit half of each GUID and compare.
Compare the second 64-bit half of each GUID.
return ReadUnaligned64(&Guid1->Data1) == ReadUnaligned64(&Guid2->Data1) &&
GetDebugPrintProtocol (sub_4B0)
Lazily locates and caches the UBA Debug Print Protocol.
This function is called by DebugPrint() and AssertPrint() to obtain the
protocol interface for debug output. The protocol is located exactly once
via gBS->LocateProtocol() with the UBA_DEBUG_PRINT_PROTOCOL_GUID.
Before accessing the cache flag, the function raises TPL to NOTIFY level
restores the original TPL. If the resulting TPL was below 0x10 (indicating
a normal execution context), the protocol is looked up.
If the LocateProtocol call fails (returns EFI_ERROR), the cache remains
NULL and all subsequent calls return NULL without attempting to locate
protocol is not installed or could not be located.
UBA_DEBUG_PRINT_PROTOCOL *
Fast path: check if the protocol has already been located.
if (gDebugPrintProtocol != NULL) {
Raise TPL to TPL_NOTIFY level (0x1F = 31) to synchronize access.
UINTN OldTpl;
Restore the original TPL immediately.
Check if the TPL value indicates we are in a context where we can safely
locate a protocol. A TPL value <= 0x10 means we are at or below TPL_CALLBACK.
if (OldTpl <= TPL_CALLBACK) {
Locate the UBA Debug Print Protocol.
EFI_STATUS Status;
Registration (no notify)
If LocateProtocol failed (Status < 0 / high bit set), clear the cache so
that we return NULL. The CMOVS instruction in the original binary
conditionally sets gDebugPrintProtocol to NULL on error.
if (EFI_ERROR(Status)) {
DebugPrint (sub_530)
Reads CMOS register 0x4B via I/O ports 0x70/0x71 to determine the boot-time
debug verbosity level, then filters the requested ErrorLevel against the
enabled mask before calling the UBA Debug Print protocol.
CMOS register 0x4B decoding:
Bits [7:2] - Preserved from the original CMOS index byte.
Bits [1:0] - Debug level indicator:
0 -> Read from MMIO at 0xFDAF0490, bit 1 OR'd with 1.
1 **-> Filter mask = 0x80000004 (DEBUG_ERROR DEBUG_INFO)**
0x80000000 for DEBUG_ERROR, 0x80000004 for DEBUG_INFO).
debug protocol was not available.
UINT8 DebugPrint(
Get the debug print protocol (may be NULL if not installed).
Protocol = GetDebugPrintProtocol();
Read CMOS register 0x4B to determine the debug verbosity filter.
Preserve bit 7 of CMOS index 0x70 (NMI mask).
CmosIndex = __inbyte(0x70);
Decode the CMOS value to select the filter mask.
values 0 and >3 are treated similarly, while values 1, 2, 3 have distinct
if (CmosReg4B == 0) {
CMOS value is 0: read an MMIO register at 0xFDAF0490, extract bit 1
and OR with 1 to get the effective level.
CmosReg4B *= ((volatile UINT8 *)0xFDAF0490 & 2) 1;**
Values > 3 are clamped to... the original value itself (no-op in the
filter logic).
CmosReg4B = CmosReg4B;
Determine the filter mask based on the decoded CMOS level.
if (CmosReg4B == 1) {
Level 1: allow DEBUG_ERROR (0x80000000) and DEBUG_INFO (0x80000004).
FilterMask = 0x80000004;
Other levels: allow more verbose output.
0x80000006 **= DEBUG_ERROR DEBUG_WARN DEBUG_INFO + verbose.**
FilterMask = 0x80000006;
Check if the requested ErrorLevel falls within the filter mask.
if ((FilterMask & ErrorLevel) != 0) {
Call the UBA Debug Print protocol's DebugPrint at offset +0.
AssertPrint (sub_5B8)
Assertion failure print handler.
Called when an ASSERT() macro fails in the driver or in library code.
Prints the assertion location (file + line) and expression using the
UBA Debug Print protocol's assert handler (at offset +8 in the protocol
protocol was not available.
Get the debug print protocol (lazy-init).
Call the assert handler at offset +8 in the protocol interface.
if (Protocol->AssertHandler != NULL) {
GetHobList (sub_5F8)
Retrieves the HOB (Hand-Off Block) list pointer by searching the UEFI
Configuration Table for the entry matching gEfiAcpiTableGuid.
In the DXE phase, the HOB list pointer is traditionally stored in the
system configuration table under gEfiHobListGuid. On this platform, the
same GUID value (0x7739F24C-93D7-11D4-9A3A-0090273FC14D) is used as a
configuration table key.
The function scans gSystemTable->ConfigurationTable[] (located at offset
0x70 in EFI_SYSTEM_TABLE) for an entry whose VendorGuid matches
gHobList and returned.
If the GUID is not found in the configuration table, a diagnostic
ASSERT_EFI_ERROR is logged via DebugPrint. If the resulting gHobList is
still NULL, a second assertion fires.
Fast path: return cached value if already initialized.
if (gHobList != NULL) {
Initialize cache to NULL.
gHobList = NULL;
Get the configuration table information from the system table.
EFI_SYSTEM_TABLE layout (offsets from the table base):
EntryCount = gSystemTable->NumberOfTableEntries;
Scan the configuration table for an entry whose GUID matches
for (Index = 0; Index < EntryCount; Index++) {
Compare GUID via CompareGuid().
Each configuration table entry is 0x18 bytes:
if (CompareGuid(
Found the entry. Cache the VendorTable pointer.
gHobList = ConfigTable[Index].VendorTable;
If the GUID was not found, emit a diagnostic.
if (gHobList == NULL) {
DEBUG_ERROR "\nASSERT_EFI_ERROR (Status = %r)\n", // from string at 0x780
EFI_NOT_FOUND );
UsbOcGetConfigTables (sub_48C)
Returns pointers to the platform-specific static data tables.
This function is referenced by the component name / configuration tables
that are installed alongside the driver. It provides three static data
arrays that contain platform-specific configuration for the USB OC
settings on LightningRidge EXEC B2.
The function is NOT called from the main entry path; it exists as a
callback accessible through the driver's static data tables.
table (mConfigTable1, at 0xBB0).
table (mConfigTable2, at 0xBF0).
table (mConfigTable3, at 0xC18).
Return pointers to the static configuration data arrays.
UsbOcUpdateEntryPoint (_ModuleEntryPoint / 0x390)
Main entry point for the UsbOcUpdateDxeLightningRidgeEXECB2 driver.
Performs the following operations in order:
appropriate file/line from the EDK2 library sources.
configuration table. This is required for the UBA framework.
platform identifier string:
status from LocateProtocol if the protocol was not found.
Step 1: Cache UEFI service table pointers
Save the ImageHandle (address 0xC60).
gImageHandle = ImageHandle;
Save the SystemTable pointer (address 0xC50).
gSystemTable = SystemTable;
Save BootServices pointer from SystemTable->BootServices (offset 0x60
in EFI_SYSTEM_TABLE). Address 0xC58.
gBootServices = SystemTable->BootServices;
Save RuntimeServices pointer from SystemTable->RuntimeServices (offset
0x58 in EFI_SYSTEM_TABLE). Address 0xC68.
gRuntimeServices = SystemTable->RuntimeServices;
Step 2: Retrieve the HOB list
GetHobList searches the system configuration table for the entry matching
HobList = GetHobList();
Step 3: Log the platform identifier
Print the UBA driver identifier string for debugging/auditing purposes.
DEBUG_ERROR level
from string at 0x7C0
Step 4: Locate the UBA USB Overcurrent Protocol
Locate the protocol interface by GUID.
Check if the protocol was found.
if (!EFI_ERROR(Status) && UsbOcProtocol != NULL) {
Step 5: Call the protocol method to install USB OC settings
Invoke the SetData method at offset +0x10 in the UBA USB OC protocol.
RCX = UsbOcProtocol (This pointer)
RDX = &mPlatformGuid (GUID for LightningRidge EXEC B2)
R8 = &mAcpiTableGuid (destination ACPI table GUID)
R9 = 0x10 (DataSize = size of GUID = 16 bytes)
Status = UsbOcProtocol->SetData(
Return the status from either LocateProtocol or SetData.

Generated by HR650X BIOS Decompilation Project