How to retrieve all ACPI tables on UEFI system from Driver

Windows provides a method to retrieve entire set of DMI (SMBIOS) tables via WMI Guid (MSSmBios_RawSMBiosTablesGuid).

I’ m looking for the similar method for retrieve the full set of ACPI tables (in KM Driver).

Usual scan of memory doesn’t work on the UEFI system. An access from the user mode (GetSystemFirmwareTable()) isn’t an option. Reading of the registry is not an option as well.

Thank you in advance,

Al

There are a couple of things you could try. One is to call
ZwQuerySystemInformation (which the docs say is no longer available in Win
8), with the correct (undocumented) information class. I while back I
retrieved the iSCSI boot iBFT ACPI table this way for a debugging utility,
and believe other ACPI tables can also be retrieved. It’s also possible to
make WMI queries from kernel mode, although there might (or might not) be
limitations on this early in the boot. I know the HyperV virtual
disk/virtual FC driver makes WMI queries to fibre channel adapters to
retrieve NPIV information.

Jan

On 3/9/15, 12:56 PM, “xxxxx@hotmail.com” wrote:

>Windows provides a method to retrieve entire set of DMI (SMBIOS) tables
>via WMI Guid (MSSmBios_RawSMBiosTablesGuid).
>
>I’ m looking for the similar method for retrieve the full set of ACPI
>tables (in KM Driver).
>
>Usual scan of memory doesn’t work on the UEFI system. An access from the
>user mode (GetSystemFirmwareTable()) isn’t an option. Reading of the
>registry is not an option as well.
>
>Thank you in advance,
>
>Al
>

Hi Jan,

Thank you very much for the reply.

> ZwQuerySystemInformation (which the docs say is no longer available in Win
> 8), with the correct (undocumented) information class

Which one?

> It?s also possible to make WMI queries from kernel mode

I would prefer this way for my purpose (as I did for SMBIOS). Do you know how to place such call (what is GUID to get ACPI tables - it seems to be not documented)?

I won’t comment on undocumented APIs, but a Google search on
QuerySystemInformation might be very interesting. The book on Windows
internals, I believe 6th edition second volume, also might mention
something useful.

As for using a WMI call, you can figure out the guid for the desired class
by looking at the WMI database with a tool like wbemtest, and find the
desired class meta information. The APIs I believe are documented.

Jan

On 3/10/15, 6:37 AM, “xxxxx@hotmail.com” wrote:

>Hi Jan,
>
>Thank you very much for the reply.
>
>>> ZwQuerySystemInformation (which the docs say is no longer available in
>>>Win
>>> 8), with the correct (undocumented) information class
>
>Which one?
>
>>> It?s also possible to make WMI queries from kernel mode
>
>I would prefer this way for my purpose (as I did for SMBIOS). Do you know
>how to place such call (what is GUID to get ACPI tables - it seems to be
>not documented)?
>
>—
>NTDEV is sponsored by OSR
>
>Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
>OSR is HIRING!! See http://www.osr.com/careers
>
>For our schedule of WDF, WDM, debugging and other seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer

AuxKlibGetSystemFirmwareTable is documented (and uses ZwQuerySystemInformation internally)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Jan Bottorff
Sent: Tuesday, March 10, 2015 12:07 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] How to retrieve all ACPI tables on UEFI system from Driver

I won’t comment on undocumented APIs, but a Google search on QuerySystemInformation might be very interesting. The book on Windows internals, I believe 6th edition second volume, also might mention something useful.

As for using a WMI call, you can figure out the guid for the desired class by looking at the WMI database with a tool like wbemtest, and find the desired class meta information. The APIs I believe are documented.

Jan

On 3/10/15, 6:37 AM, “xxxxx@hotmail.com” wrote:

>Hi Jan,
>
>Thank you very much for the reply.
>
>>> ZwQuerySystemInformation (which the docs say is no longer available
>>>in Win 8), with the correct (undocumented) information class
>
>Which one?
>
>>> It?s also possible to make WMI queries from kernel mode
>
>I would prefer this way for my purpose (as I did for SMBIOS). Do you
>know how to place such call (what is GUID to get ACPI tables - it seems
>to be not documented)?
>
>—
>NTDEV is sponsored by OSR
>
>Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
>OSR is HIRING!! See http://www.osr.com/careers
>
>For our schedule of WDF, WDM, debugging and other seminars visit:
>http://www.osr.com/seminars
>
>To unsubscribe, visit the List Server section of OSR Online at
>http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Jonathan,

Thank you for the suggestion. The problem is (as documented in WDK):

“For ACPI, if the system firmware contains multiple tables with the same name, AuxKlibEnumerateSystemFirmwareTables enumerates them all. However, AuxKlibGetSystemFirmwareTable retrieves only the first table in the list that has this name.”

There is my problem: I need to retrieve ALL ACPI tables and not just first one.

Al

While a theoretical possibility, is this actually commonly encountered in the “real world”? Can somebody give me an example? Like… is this saying there’d be multiple DSDTs or FADTs? How would that work?

Peter
OSR
@OSRDrivers

Peter,

Yes, it happens in real world. Simplest example are multiple SSDT tables. For example, Dell Precision M4800 notebook have seven SSDT with OEM Table IDs ‘sensrhub’, ‘zpodd’, ‘Cpu0Ist’, ‘CpuPm’, ‘SataTabl’, ‘SgPeg’, ‘AmdTabl’. We also saw multiple DDST, multiple OEM tables, multiple SLIC and so on.

Furthermore, I did some research on WMI today. It looks like WMI “know” about SMBIOS and Raw firmware tables, but nothing about ACPI tables.

Al