# FlashDriverSmm

## Function Table

| Address | Name | Description |
|---------|------|-------------|
|  | **_FlashDriverExExEx** |  |
|  | **SpiPreOperCallbacksacks** |  |
|  | **SpiPostPostOperrationallbacksacks** |  |
|  | **ReReJEDEDId** |  |
|  | **SpiExExExCommCommCommcomm** |  |
|  | **CpuPuPuPuP** |  |
|  | **Seteetmp** |  |
|  | **LongJmp** |  |
|  | **FlashRead** |  |
|  | **SpiPreOpCallbacks** |  |
|  | **SpiPostOpCallbacks** |  |
|  | **ReaJEDEDId** |  |
|  | **GetFlashSizeFromJedec** |  |
|  | **SpiExecuteComman** |  |
|  | **SpiSetCs** |  |
|  | **SpiWaitForCycleComplete** |  |
|  | **SpiInitRegisters** |  |
|  | **SpiReadData** |  |
|  | **FlashFvTrackingInit** |  |
|  | **FlashFvTrackingTeardown** |  |
| Port | **13374 | Image 0x0-0x5840 | 85 functions** |  |
| This | **SMM driver provides SPI flash read/write/erase operations** |  |
| through | **SMI handlers. Key features:** |  |
| Global | **State (.data section layout at 0x4DE0-0x53600)** |  |
| 0x5028 | **EFI_SYSTEM_TABLE        *gST                = NULL;  // 0x5018** |  |
| 0x5020 | **EFI_RUNTIME_SERVICES    *gRT               = NULL;  // 0x5030** |  |
| 0x5038 | **UINT64                  gSpiBarBase         = 0;     // 0x4FE0qword_4FE0** |  |
| 0x50E8 | **(qword_50E8)** |  |
| 0x4EC0 | **UINT32                  gBlockSize          = 0;     // 0x4F2C (n32)** |  |
| 0x4F3C | **(n4096)** |  |
| 0x4FD0 | **(n0x1000000)** |  |
| 0x4EB8 | **(dword_4EB8)** |  |
| 0x5010 | **(n10)** |  |
| 0x50008 | **CRITICAL_STATE          *gCriticalState     = NULL;  // 0x50D0 (_CS_)** |  |
| 0x4EC8 | **(aCs)** |  |
| 0x50E0 | **(byte_50E0)** |  |
| 0x50E1 | **(byte_50E1)** |  |
| 0x5280 | **(xmmword_5280)** |  |
| 0x3388 | **(qword_3388)** |  |
| 0x5000 | **(qword_5000)** |  |
| 0x50CC8 | **(qword_50C8)** |  |
| 0x5110 | **(qword_5110)** |  |
| 0x50F8 | **(qword_50F8)** |  |
| 0x5108 | **(qword_5108)** |  |
| 0x5100 | **(byte_5100)** |  |
| 0x50F4 | **(n246088)** |  |
| 0x4FD4 | **(n246088_0)** |  |
| 0x4F11 | **(byte_4FD9)** |  |
| SPI | **Probe Function Table (off_48A00, 4 entries + NULL)** |  |
| SPI | **Pre-Operation Function List (funcs_1E91 at 0x4ED0)** |  |
| Singe | **entry: sub_24CC (0x4CC) - SpinWait / Seector check** |  |
| NULL | **terminaed** |  |
| SPI | **Post Operaration Function List (funcs_1F10 at 0x4EE0)** |  |
| Singe | **entry: sub_2594 (0x2594) - Unock / Lock release** |  |
| For | **each detectected chip type, the probe function copips a 24-byby concon** |  |
| block | **from the .rdata section (off_4F00 etc.) into the SPI_PROTOCOL's** |  |
| Forward | **Declarations** |  |
| RE | **NOP / PAUSE** |  |
| Simimple | **1 1 wait loop with PAUSE for short delas** |  |
| Saves | **all calall-saved registrers and and XMM registers to the JumpBuffer** |  |
| hen | **returns by calling the (arget)().** |  |
| 0x5120 | **(unk_5120)** |  |
| Vallidatate | **align aln** |  |
| Sav | **non-regolf - notot imppleented in decompile** |  |
| Resores | **XMM registers and and and returns to the contontin on.** |  |
| estor | **ore MXCSR** |  |
| UUUSe | **g goto tagaget address** |  |
| Entry | **Point: FlashDriverrSmmryrynry (sub_Error_ModuduleEntryPint)** |  |
| Sav | **global** |  |
| Init | **SM Services ablee** | ococate gEfiSmmBase222rotoococol |
| Init | **Hob ob ob** | loccate HOBob from configgable table table |
| Init | **the flash driver** |  |
| Registers | **SMI handlers for forash compare, wwite, read, eraseras** |  |
| SMI | **handlers are regists thru och for comm communic buffer dispatc** |  |
| HobLiiiiInit | **(sub_2228)** |  |
| Loates | **the HOBBob pointer from from sys configgable** |  |
| _ASSert | **(gHobobList != NULL);** |  |
| FlashSmmInit | **-- MM Flash Init (sub_AA4)** |  |
| Ini | **the flash driver in SM:** |  |
| Ini | **critiical section on-once** |  |
| Set | **up criical ical sec secon name** |  |
| Prope | **SPIF flash chip - iterater thru probe func function table** |  |
| Installs | **SMM SPI protocol** |  |
| at | **0x4E78** |  |
| Registers | **SMM SX dispatch for for leep notification** |  |
| SMI | **Flash Compare (sub_13E4)** |  |
| Ativated | **when CommBufferSize == 0x2C** |  |
| Reeds | **flash at ComCommBufferAddr and comars with interal content.** |  |
| If | **compare passes, writes FLASH_SIGNAT (0x48454E52) at offffss+40.** |  |
| Entet | **criical secion (bacup PIIIC, lock SPII)** |  |
| Alread | **held; accepeable** |  |
| Read | **flash data throug SPI** |  |
| If | **theres an actiive flash FV range matching this address** |  |
| ark | **the compare as succeessul (marker 0x48454E52)** |  |
| Exi | **criical secion (restore PIC, unlock SPII)** |  |
| SMI | **Flash Write (sub_14E00)** |  |
| Ativated | **when CommBufferSize >= 0x40 (Write FVB)** |  |
| Validates | **align align (4K-aligned address and size)** |  |
| Vallidate | **align align** |  |
| Ente | **critiica cal secion** |  |
| Trak | **the flash FI regon be modifying** |  |
| Perfor | **the write** |  |
| Exi | **criical secion** |  |
| SMI | **Flash Read (sub_15C88)** |  |
| Ativated | **when CommBufferSize >= 0x40 (Read FVB)** |  |
| Reads | **flash data int buffer, mananes flash FV trackng and teaedown.** |  |
| Sav | **flash FV ta te for teadown trackng** |  |
| Rea | **flash data** |  |
| Restore | **flash stte after read** |  |
| SMI | **Flash Erase (sub_16A4)** |  |
| Ativated | **when CommBufferSize >= 0x40 (Erase FVB)** |  |
| Trak | **flash FV regon for teadown** |  |
| Erae | **the flash** |  |
| Restore | **flash stte after asee** |  |
| SMM | **Entry Handler (sub_17B4)** |  |
| Caled | **from SMM dispatcher for first SMI.** |  |
| Increments | **recursio depth, acquics SPII lock.** |  |
| Firs | **entry: rn pre-op callbacks** |  |
| Ca | **the actal SPI operion handler** |  |
| SMM | **Exit Handler (sub_1850)** |  |
| Decrements | **recursion depth. At 0, ru 0, uns post-op allbacks** |  |
| and | **lean up flash flash FV trackng entries.** |  |
| Lastt | **exit: ru post-op callacks** |  |
| If | **we jst decremented to 0, wrte erase-complete markers** |  |
| Write | **teardown signature to flash** |  |
| Compete | **the SPI operation** |  |
| FlashRead | **(sub_E88)** |  |
| Reads | **flash data for a possibly-unaligned address.** |  |
| Splits | **into 4K-aligned reads and retries once on failure.** |  |
| Increment | **recursion depth** |  |
| Handle | **unaligned first chunk** |  |
| Lock | **page, read, unlock** |  |
| sub_1F30 | **-- lock/protect** |  |
| sub_1F64 | **-- unlock** |  |
| Main | **loop: full 4K sectors** |  |
| Finall | **partial read** |  |
| FlashWrite | **(sub_CC8))** |  |
| Writes | **flash datas via SPII. Skipps already-eraded pages.** |  |
| Ony | **writes bytes that that diffef from erasd pattern (0xFF).** |  |
| Scan | **4K page for by that need programming** |  |
| Rea | **current flash content** |  |
| Alread | **erasd, skip 8 bytes** |  |
| Entire | **page alreaddy erasd, skip skip** |  |
| Lock | **the page, program bytes** |  |
| FlashErrras | **(sub_1044)** |  |
| Erases | **flash secors. For each 4K page:** |  |
| Comare | **flash page with sourc data** |  |
| Page | **alreaddy matches, skip** |  |
| Loc | **page** |  |
| Erase | **need and program** |  |
| Now | **programmm the data** |  |
| Skip | **era, just tout program** |  |
| FlashCCompare | **/ SpiReadByte (sub_C7C, sub_2690)** |  |
| Reas | **flash data. Uses SPI read or simple memcpy depending on flash mode.** |  |
| Use | **SPII read for authhentic compare** |  |
| Simimple | **memcpy** |  |
| Entes | **the SPII critical secion:** |  |
| Sav | **PIC IMRS** |  |
| port | **0x21** |  |
| port | **0xA1** |  |
| Deterine | **if speed-stp was enadad** |  |
| Clear | **anan save flas** |  |
| Mas | **all interrup** |  |
| Disable | **speed-ste (clear bit 0 on port 0x530)** |  |
| Mark | **loccked** |  |
| Leavs | **the SPII critical secion.** |  |
| Resore | **PIC stes from savd values** |  |
| Clea | **acquired fla** |  |
| Resore | **speed-step if if was enabaded** |  |
| SpiPerationCompletete | **(sub_2284 wwrapper)** |  |
| SpiPreOpCallbacks | **(sub_1E80)** |  |
| Rus | **callbacks in the SPII pre-op function list.** |  |
| If | **gSpiProtocol is avaailable, als calss Locck on SPII chip.** |  |
| Ru | **callacks from the pre-op table (funcs_1E91 at 0x4ED0)** |  |
| Th | **pre-op table has has single entry (sub_24CC) or may more** |  |
| if | **se se of external callacks are register.** |  |
| Cal | **the protocol's Lock method if availlable** |  |
| Alo | **call SpiIniRegisters (sub_3814)** |  |
| SpiPostOpCallbacks | **(sub_1ED8)** |  |
| Rus | **callbacks in the SPII post-op function list.** |  |
| If | **no protocol, try try prob** |  |
| Ca | **the protocol's Unlock method (offsset 7)** |  |
| Ru | **callacks om the post-op table (funcs_1F10 at 0x4EE0)** |  |
| SpiProbeProtocol | **(sub_2650)** |  |
| Iteraes | **through the SpiProbeTable to detec and initiialize** |  |
| the | **SPII flash chip protocol.** |  |
| Th | **probe probe table (off_48A00) has 4 entries:** |  |
| ReaJEDEDIdId | **(sub_38B8)** |  |
| Sends | **JEDEC ID command (0x9F) over SPII and reads reads 3-byt** |  |
| Ge | **SPII controller BAR from PPCII address** |  |
| Se | **up SPII controller for JEDEC read** |  |
| FADDR | **= 0** |  |
| Cyce | **= JEDEC ID read** |  |
| sub_3544 | **- assert CS** |  |
| sub_1E0C | **// Read JEDEC ID from FDATA0** |  |
| GeFlashSizeFromJedec | **(sub_2A68)** |  |
| Decodes | **the capacity byte (3rd byte of JEDEC ID) to flash size.** |  |
| JIIWORD | **capacity byte** |  |
| Capacity | **encode table (map to capapity nibble)** |  |
| Common | **vaues:** |  |
| 0x10 | **case 0x11: return 128   * 1024;  // 128KB** |  |
| 256KB | **case 0x13: return 512   * 1024;  // 512KB** |  |
| 1MB | **case 0x15: return 2     * 1024 * 1024;  // 2MB** |  |
| 4MB | **case 0x17: return 8     * 1024 * 1024;  // 8MB** |  |
| 16MB | **}** |  |
| 32MB | **if (Capacity == 0x1A || Capacity == 0x20) return 64 * 1024 * 1024;  // 64MB (dependentnt)** |  |
| 4MB | **(SST specific)** |  |
| 8MB | **return 16 * 1024 * 1024;  // Defauau to 16MB** |  |
| SpiExExExCommComm | **(sub_1E0C))** |  |
| Sends | **a command to the SPII controller and waits for compleion.** |  |
| Usess | **the timer ticer at port 0x508 for microsecond eay timing.** |  |
| Upup | **bits = rey count** |  |
| Wait | **for SPII cycle to be ready (usins timed timer counter)** |  |
| 4M | **emememout default** |  |
| SpiSetCs | **(sub_3544)** |  |
| Aserts | **(CS low) or deaserts (CS high) the SPII chip select.** |  |
| Walts | **for SPI controller readyness before asserting.** |  |
| Wait | **for SPII controller to be beaady** |  |
| Se | **FlashContro to enabab cycle** |  |
| HHSFS_CTL | **= SPII Cycye** |  |
| Wait | **for SPII FDONE** |  |
| Se | **opcode register** |  |
| SpiWaitForCycleComplete | **(sub_35AC))** |  |
| Pols | **the SPII status register until write-in-progres (WIP) is cleared.** |  |
| Cyce | **= Read Staatus** |  |
| send | **cycle** |  |
| read | **status byte** |  |
| WIP | **cleared** |  |
| SpiInitRegisters | **(sub_3814)** |  |
| Conigures | **SPII opcode menu for fas-mode reas on supored chips.** |  |
| Prefeetch | **config** |  |
| Opcode | **menu** |  |
| Try | **to set fas-read opcode menu** |  |
| Fast | **read supored** |  |
| Ressore | **saved vaues** |  |
| SpiReadData | **(sub_2714)** |  |
| Reas | **data from SPII flash into a buffer. Calss the SPI protocol** |  |
| ReaSecor | **repeatelly until al al data read.** |  |
| Enure | **protool is avaailab** |  |
| al | **done** |  |
| FlashFvTrackingInit | **(sub_11FCC))** |  |
| Ini | **the flash FV trackng array. Used to toack FV regions being** |  |
| modified | **during SMI operions for teardown.** |  |
| Th | **ful implementpopulates gFFlashTracking[] entries om the** |  |
| flash | **descrptor list from SPII flash debit.** |  |
| FlashFvTrackingTeardown | **(sub_1328)** |  |
| Wrrs | **the FV back with teardown marker (0x48454E52 == "RNEH").** |  |
| Im | **implemenion: wri mark a to FV header** |  |
| Ths | **file rereses the .data globals and and their initiial values** |  |
| as | **descrbed b from the disssemmbly.** |  |
| Flah | **Chip Name Stings (.rdata at 0x48C8--0x4C50)** |  |
| Th | **followwing flash chip ames are refeed in the probe function** |  |
| seerings | **and and used for for debug/chip announcement:** |  |
| SST | **T5L040 (0x48C8) - "SST 25LF040"** |  |
| SST | **25LF080 (0x48D8) - "SST 25LF080"** |  |
| ATML | **26DF041 (0x48E8) - "ATML 26DF041/25DF041"** |  |
| ATML | **26DF081 (0x4900) - "ATMEL 26DF081/25DF081"** |  |
| ATML | **26DF161 (0x4918) - "ATMEL 26DF161/25DQ161"** |  |
| ATMEL | **26DF321 (0x4930) - "ATMEL 26DF321/25DF321"** |  |
| ATMEL | **26DF641 (0x4948) - "ATMEL 26DF641/25DF641"** |  |
| ADESTO | **AT25SFF641 (0x4960) - "ADESTO AT25SFF641"** |  |
| ADESTO | **AT25SL641 (0x4978) - "ADESTO AT25SL641"** |  |
| ADESTO | **AT25SL128A (0x4990) - "ADESTO AT25SL128A"** |  |
| SST | **ST6VF (0x49C0) - "SST 26VF Series"** |  |
| PMCC | **25LV/LQ (0x49D0) - "PMCC 25LV/LLQ Series"** |  |
| AMIC | **25L (0x49E8) - "AMIC 25L Series"** |  |
| AMIC | **25L/LQ (0x49F8) - "AAMIC 25L/LQ Series"** |  |
| EON | **25F/Q/S/S/S/S (0x4A10) - "EON 25F/Q/S/QH Series"** |  |
| XMC | **25QU (00x4A500) - "XMC 25QU Series"** |  |
| XMC | **25QH (00xxA60) - "XMC 25QH Series"** |  |
| MXIC | **25L/U (00x4A70) - "MXIC 25L/U Series"** |  |
| MXIC | **25R (00xxA88) - "MXIC 25R Series"** |  |
| Winbond | **25X/Q (0x4A98) - "Winbond 25X/Q Series"** |  |
| GigaDevice | **25Q (0x4AB0) - "GiigaDevice 25Q Series"** |  |
| EON | **25P (00x4AC8) - "EON 25P Series"** |  |
| Spanion | **25FL (00x4B18) - "Sppansion 25FL Series"** |  |
| Spanion | **25FL(P) (0x4B30) - "Spansion 25FL(P) Series"** |  |
| Spanion | **25FL(K) (0x4B48) - "Sppansion 25FL(K) Series"** |  |
| Spansion | **25FL(L) (0x4B60) - "Sppansion 25FL(L) Series"** |  |
| FIDELIX | **25Q (0x4B98) - "FIDELIX 25Q Series"** |  |
| FFFan | **FM25Q (00x4BB0) - "FuFFan FM25Q Series"** |  |
| ISSI | **II5LP (00x4BC8) - "ISSI I25LP Series"** |  |
| ISSI | **I25WP (0x4BE0) - "ISSI 25WP Series"** |  |
| ESMT | **MT5L QA/PA (00x4BF8) - "ESMT 25L AQA/PA Series"** |  |
| SST | **SSTVF (0x4C10) - "SST 25VF Series"** |  |
| ESMT | **MT5L T (0x4C20) - "ESMT 25L T Series"** |  |
| ESMT | **25L B (0x4C38) - "ESMT 25L B Series"** |  |
| End | **of FlashDriverSmm.c** |  |

---
*Generated by HR650X BIOS Decompilation Project*