BmcLanConfig UEFI Module Analysis

Overview

Module: BmcLanConfig.efi (PE32+ image, DXE driver)
Source: HR650X BIOS -- Lenovo ThinkSystem server
Architecture: x86-64
Image Size: 0x25c0 (9,664 bytes)
MD5: d4c865b5f727f727f3f3c45ac5ddc7a2
SHA256: 99bdd4660988c49b1083dd7285ad72fbda897f6ee5b903bf3bbb3275c1e9a392
IDA Port: 13339
Index in PE collection: 0253

Purpose

This DXE (Driver eXecution Environment) module configures BMC (Baseboard Management Controller) LAN (Local Area Network) parameters during the UEFI boot process. It enumerates the available LAN channels on the BMC and for each active channel programs:

• Station IP address
• Subnet mask
• Default gateway (router) IP address
• Default gateway MAC address

The programming is done via IPMI (Intelligent Platform Management Interface) commands sent through the IPMI transport protocol, which is located via UEFI's LocateProtocol() boot service.

Module Structure

Segments

Function Map (19 total, 18 unnamed -> renamed)

Call Graph

_ModuleEntryPoint (0x350)

  +-> GetHobList (0x14C4)
     +-> IsGuidMatch (0x17C4)
           +-> ReadUnaligned64 (0x1834)

  +-> InitializeBmcLanConfig (0xA30)

        +-> GetLanChannelNumbers (0x159C)
     +-> IpmiGetChannelNumber (0x9C0)
     +-> IpmiSendCommandWithRetry (0x6B4)
     +-> CopyMemWithAssert (0x12DC)
     +-> DebugPrint (0x13FC)
           +-> GetDebugOutputProtocol (0x137C)

        +-> IpmiSetLanConfigParams (0x750)
     +-> IpmiSendCommandWithRetry (0x6B4)
     +-> CopyMemWithAssert (0x12DC)
     +-> IpmiSetLanConfigParamBytes (0x8D0)

        +-> DebugPrint (0x13FC)

Key Data Structures

Protocol GUIDs (in .data section)

Global Variables (.data segment, zero-initialized BSS)

ServerSetup Configuration Data (at 0x1940)

The string "ServerSetup" at 0x1940 (in UTF-16) appears to identify the HII variable
that stores the BMC LAN configuration data. The configuration data is organized as
a 19-byte block per channel:

Offset  Size  Field
------  ----  -----
 0       1    Channel number
 1       4    Station IP address
 5       4    Subnet mask
 9       4    Default gateway IP address
13       6    Default gateway MAC address

The ###################### string (0x1958) is a debug output separator that
appears before each channel's configuration dump.

IPMI Commands Used

Set LAN Configuration Parameters

• NetFn: 0x0C (LAN / Chassis)
• Command: 0x01 (Set LAN Configuration Parameters)
• LUN: 1 (BMC)
• Request format: [ChannelNumber, ParameterSelector, ParameterBytes...]
• Parameters programmed:
  • Selector 3: Station IP address (4 bytes)
  • Selector 6: Subnet mask (4 bytes)
  • Selector 12: Default gateway IP (4 bytes)
  • Selector 13: Default gateway MAC (6 bytes)

Get LAN Configuration Parameters

• NetFn: 0x0C (LAN)
• Command: 0x02 (Get LAN Configuration Parameters)
• LUN: 2 (OEM)
• Request: [ChannelNumber, ParamSelector, SetSelector]
• Response: [ParameterData...] with bit 7 indicating parameter revision

Get Channel Number (Application command)

• NetFn: 0x06 (Application)
• Command: 0x42 (Get Channel Number)
• LUN: 66 (OEM-specific)
• Medium type check: Response byte bits [6:0] == 4 means dedicated LAN

Retry Logic

• Commands retry up to 10 times when the BMC returns a "busy" status
  (checked via bits [1:0] of the response).
• 1-second delay between retries via gBS->Stall(1000 * 1000).

String Reference

Analysis Notes

1. This module is a UEFI DXE driver, not a standalone executable. It depends on the
   UEFI boot/runtime services provided by the firmware.

2. IPMI transport protocol is located via LocateProtocol() using the GUID at
   0x1F20. The protocol interface pointer is stored in qword_23F0 (mIpmiTransport).

3. Debug output uses a CMOS-based debug level check (I/O ports 0x70/0x71):

   • Reads register 0x4B of CMOS
   • Checks debug level bits
   • Only prints debug messages if the level is set appropriately

4. Channel discovery scans IPMB channels 1 through 11, querying each for
   medium type. Only channels with medium type 4 (dedicated LAN, likely NC-SI or
   USB-over-LAN) are configured.

5. The "ServerSetup" string at 0x1940 is in UTF-16 format and is likely the
   name of an HII variable or form that stores the LAN configuration data input
   by the user through the BIOS setup menu.

6. Build environment: The source paths (e:\hs\MdePkg\...) indicate this was
   built using a Windows-based EDK II build environment with the MdePkg and
   MdeModulePkg packages from the UEFI firmware development kit.

7. Assertion behavior: All library functions include ASSERT() calls that
   trigger ReportAssertionFailure(). This is standard UEFI debug/free builds.
   In a release build, these assertions are compiled out.

Related IPMI Specification References

• IPMI Specification v2.0, Section 18: LAN Configuration Parameters
• IPMI Specification v2.0, Section 22.20: Get/Set LAN Configuration Parameters commands
• DMTF NC-SI (Network Controller Sideband Interface) specification for the sideband
  channel medium type (type 4)