Newer
Older
AMI-Aptio-BIOS-Reversed / AmiModulePkg / SmmS3SaveState / S3SaveStateDxe / S3SaveStateDxe.md
@Ajax Dong Ajax Dong 2 days ago 6 KB Full restructure

S3SaveStateDxe

Function Table

Address Name Description
DriverEntryPoint
ProcessLibraryConstructorList
AcpiS3ContextInitialize
AllocateS3NvsPageTable
LocateAcpiFacsTable
BootScriptTableInit
ScriptWriteTerminator
ScriptFinalizeEntry
BootScriptResync
SaveLockBox
SetLockBoxAttributes
UpdateLockBox
RestoreLockBox
GetSystemConfigurationTable
ScriptIoWriteEntry
ScriptIoReadWriteEntry
ScriptMemWriteEntry
ScriptMemReadWriteEntry
ScriptPciCfgWriteEntry
ScriptPciCfgReadWriteEntry
ScriptSmbusExecuteEntry
ScriptStallEntry
ScriptDispatchEntry
ScriptInformationEntry
ScriptPciCfg2WriteEntry
ScriptPollInsert
BootScriptClose
EFI System Table (from UefiBootServicesTableLib)
0x5458 EFI_BOOT_SERVICES *gBootServices = NULL; // 0x5460
0x5468 EFI_RUNTIME_SERVICES *gRuntimeServices = NULL; // 0x5470
Cached protocol pointers
0x5478 (DebugPort)
0x5480 (PCD)
0x5488 (HOB list)
0x5490 (PCIe MMIO base)
0x5498 (SMM Comm Region)
0x54A0 (SMM Comm protocol)
0x54A8 UINT8 gBootScriptInSmm = 0; // 0x54B0
0x54B8 VOID *gS3SmmSaveStateProtocol = NULL; // 0x54C0
0x54C8 VOID *gS3SmmSaveStateNotify = NULL; // 0x54D0
0x54D8 BOOT_SCRIPT_TABLE *gBootScriptTable = NULL; // 0x54E0
0x54E8 /*===========================================================================
unk_52C0 extern EFI_GUID gEfiDebugPortProtocolGuid; // unk_52D0
unk_52E0 extern EFI_GUID gAcpiS3ContextGuid; // unk_52F0, 0x5360, 0x5400
unk_5300 extern EFI_GUID gEfiLockBoxProtocolGuid; // unk_5310
unk_5320 extern EFI_GUID gEfiS3SaveStateProtocolGuid; // unk_5330, 0x5340
unk_5350 extern EFI_GUID gEfiAcpiTableGuid2; // unk_53B0
unk_5390 extern EFI_GUID gEfiHobListGuid; // unk_53A0
Initialize library globals (gImageHandle, gST, gBS, gRT, etc.)
Schedule AcpiS3ContextInitialize as a timer event (10ms, TPL_CALLBACK)
10 ms
Install the EFI S3 Save State protocol
Initialize HOB list pointer
Get PCD protocol
Get PCI Express base address from PCD
Check if PCIe is enabled (bit 7 of PcdPciExpressEnable)
Read PCIe extended config BAR length
Wait for PCIe bus master enable (poll bit)
spin }
Enable or disable PCIe based on platform config
Check if LockBox is available
Allocate the ACPI S3 context structure (48 bytes)
Locate FACS table via ACPI config tables
Build IDTR profile buffer
This is a self-referencing 4096-byte structure:
Limit field at buffer[4096..4097] = 4095
Save IDTR profile into LockBox (10 bytes)
Determine NX page table requirements
Boot script stack
Debug buffer (4KB, filled with 0xFF)
Debug prints of AcpiS3Context fields
Save ACPI S3 context into lockbox
Mark as restore-in-place
Finalize boot script initialization
Determine physical address width from CPUID
Get physical address bits from HOB or CPUID
Clamp to 48 bits for 4-level paging
Calculate page table levels
Find ACPI RSDP from system configuration tables
Use XSDT if revision >= 2 (ACPI 3.0+)
Search for either FACS or FADT (from FADT we get the FACS address)
Direct FACS match (rare — usually FACS is pointed to by FADT)
Found FADT — extract FACS address
Fall through to RSDT if XSDT didn't help
Use RSDT (32-bit entries)
Get PCD value for initial number of entries
Allocate boot script descriptor table
initial 4 pages = 16KB
Set up SMM communication if available
Communicate with SMM: share boot script table descriptor
If SMM side exists, allocate a second buffer for SMM boot script
Second buffer in SMM for S3 save state
Register S3 Save State protocol notification
Register SMM ready-to-lock notification
Register S3 SMM Save State notification
Mode 1: Pre-SMM (DXE-owned buffer)
Mode 2: Post-SMM (SMM-owned buffer)
Resync from LockBox if needed
Check available space
Update the boot script data in LockBox
Update the total length field in LockBox
Initialize buffer header:
Check if we need to grow
Copy old data to new buffer
First call to RestoreLockBox retrieves the current data size
Then we need to get the actual data
Read back the total length from LockBox
Locate the SMM Communication Region Table via system config table
fallback to stack-local buffer
Build the SMM communication buffer:
Function 1 = SaveLockBox
HeaderSize CopyMem ((VOID *)((UINTN)CommBuffer + sizeof (EFI_GUID) + sizeof (UINT64) + sizeof (UINT64) + sizeof (UINT64))
Target LockBox GUID
Build SMM communication buffer for SetAttributes:
Function = 4 (SetLockBoxAttributes)
MessageLength (UINT64 )((UINTN)CommBuffer + sizeof (EFI_GUID) + sizeof (UINT64)) = (UINT64)-1;
Function (UINT32 )((UINTN)CommBuffer + sizeof (EFI_GUID) + sizeof (UINT64) + sizeof (UINT64)) = 40; // HeaderSize
Function 2 = UpdateLockBox
Function 3 = RestoreLockBox
Signal once to catch already-installed protocols
Forward declarations for functions referenced solely via function pointers:

Generated by HR650X BIOS Decompilation Project