2

Where is the legacy BIOS (the 16 bit reset code that jumps to the POST entry point at F000:E05B and indeed POST itself and all the BIOS routines) originally stored on a UEFI system before it's shadowed to 0xF0000? And the embedded option ROMs before they're shadowed to 0xC0000? And what shadows the legacy BIOS to 0xF000: ME, the Startup ACM, SEC or the legacy BIOS itself?

It doesn't appear to be in the SPI flash BIOS region (I've searched byte sequences in the dump on IDA). I thought it might be on the LPC or EC flash but my laptop doesn't appear to have one (and neither does my flash descriptor show an EC region so don't ask me where the EC ROM is stored either, but it's supposed to be on the SPI flash, and the schematic doesn't appear to show it having a private SPI flash, but it must do; maybe that's where the legacy BIOS is?); plus it looks like you can only configure the PCH to send all BIOS ranges to either LPC/eSPI or SPI and not 0xF0000 to one and 0xFFFF0000 to another. My laptop is booted into legacy BIOS and has EA at 0xFFFF0 (so obviously a legacy BIOS shadow) and 90 90 E9 at 0xFFFFFFF0. I can't find anything on this and I've been searching all sorts of combinations on verbatim search for hours, hundreds of manuals, UEFI papers, specifications, and not one mentions it.

Improve this question

1 Answer 1

Reset to default
2

The legacy BIOS code is usually stored compressed in the UEFI filesystem. You can find it in UEFITool by looking for the magic string IFE$ (49 46 45 24) - signature of the EFI_COMPATIBILITY16_TABLE structure.

In AMI based firmware it is usually a RAW subsection of a file names CSMCORE. The following script parses the AMI format raw stream and extracts the legacy BIOS as well as any option ROMs that may be present: https://github.com/coreboot/bios_extract/blob/master/csmcoreparse.py

Improve this answer
2
  • Found it by searching IFE$. I got a SMBIOS DXE driver, CsmDxe driver, TcgLegacy DXE driver, another unnamed DXE driver and a LzmaCustomDecompressGuid/Raw
    – Lewis Kelsey
    Apr 24, 2021 at 13:07
  • The reset vector was in 365C62BA-05EF-4B2E-A7F7-92C1781AF4F9/LzmaCustomDecompressGuid/Raw Body at offset 155F9
    – Lewis Kelsey
    Apr 24, 2021 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.