Newer
Older
AMI-Aptio-BIOS-Reversed / TCMDXE / TCMDXE.md
@Ajax Dong Ajax Dong 2 days ago 5 KB Init

TCMDXE

Function Table

Address Name Description
TcmReportError
TcmAssertFail
TcmReadUnaligned64
TcmPciExpressGetAddr
TcmIoWriteEnable
TcmRegisterWrite
TcmReadWord
TcmCheckResponse
TcmMicroDelay
TcmFifoTransmit
TcmStartup
TcmContinueSelfTest
TcmPhysicalEnable
TcmPhysicalDisable
TcmPhysicalSetDeactivated
TcmForceClear
TcmGetFlags
TcmDxeEntryPoint
Global data
EFI_HANDLE gImageHandle = NULL;
TCM callback GUID from .rdata section
extern EFI_GUID gTcpaCallbackGuid; // {0x6B221186, 0x7E6F, 0x4A71, ...} @ 0x18D0
TCM vendor/device ID signature
TCM FIFO interface constants
TPM_STANY response tag
Debug print wrappers
Check CMOS register 0x4B for debug level
IoWrite8 **(0x70, (IoRead8 (0x70) & 0x80) 0x4B);**
EFI_D_INFO equivalent
UEFI Library context init
HOB list not found - assert
TcmReportError (
PCI Express / MMIO helpers
0x0500 - enable decode
TCM FIFO I/O primitives
Microsecond delay via RDTSC
Check EFLAGS.IF before disabling interrupts
InterruptsEnabled = (AsmReadEflags () & 0x200) != 0;
Disable interrupts during the calibrated delay loop
AsmDisableInterrupts ();
TCM FIFO command transmit/receive
Check TCM presence: DID_VID must not be 0xFF
if (MmioRead8 (TcmAddr + TCM_FIFO_REG_DID_VID) == 0xFF) {
Acquire locality: write active locality request
if (MmioRead8 (TcmAddr + TCM_FIFO_REG_ACCESS) == 0xFF) {
Wait for locality to be granted: Access register < 0xFF
Status = TcmRegisterWrite (
Prepare for command: set STS.commandReady
MmioWrite8 (TcmAddr + TCM_FIFO_REG_STS, TCM_STS_CMD_READY);
STS reg relative
Write command bytes to FIFO
Index = 0;
Wait for STS_EXPECT to be set
Check burst count before writing
May be unused depending on TCM model
Write data byte to FIFO
ByteVal = SendBuffer[Index];
Signal end of data
Trigger command execution: write GO bit
MmioWrite8 (TcmAddr + TCM_FIFO_REG_STS, TCM_STS_GO);
Wait for data available
Read response data
Read status word to get FIFO byte count
TcmReadWord (Locality, &FifoWord);
Buffer too small
Read remaining bytes
while (FifoWord > 0) {
Check whether we have the full response header
if (RecvIdx >= 6) {
Locality release: clear access register
MmioWrite8 (TcmAddr + TCM_FIFO_REG_ACCESS, 0x20);
Strip header: response is at offset 10 from raw data
DataSize = RecvIdx - 10;
Return success / status
return TcmCheckResponse ((UINT16 *)RecvBuffer);
TCM command wrappers
reuse buffer for response
After physical enable, set deactivated flag to FALSE
Status = TcmPhysicalSetDeactivated (FALSE);
First set deactivated flag to TRUE, then physical disable
Status = TcmPhysicalSetDeactivated (TRUE);
Get volatile flags via sub-capability 273
Ordinal = 273;
UEFI Driver Entry Point
Must have ImageHandle
if (ImageHandle == NULL) {
Must have SystemTable
if (SystemTable == NULL) {
Must have BootServices
if (gBootServices == NULL) {
Must have RuntimeServices
if (gRuntimeServices == NULL) {
Initialize HOB list
Initialize PCI Express MMIO base address
gPciExpressBaseAddress = ((UINT64 (*)(UINTN))TcmGetPcdDb ()->GetPcd ())(5);
If PCI Express decoding is enabled, write the decode enable register
if ((INT8)TcmPciExpressGetAddr (1024068) >= 0) {
Check for TCM presence via signature word at DID_VID register
TcmSignature = AsmReadEflags ();
Disable interrupts, check TCM signature
If TCM signature matches, register callback
if (MmioRead16 (TCM_BASE_ADDRESS + TCM_FIFO_REG_DID_VID) == TCM_SIGNATURE_WORD) {
Calibrated delay to ensure TCM is ready
TcmMicroDelay (1288);
Wait for TCM ready...
while ((((UINT32)TcmSignature + 357 - (UINT32)IoRead32 (1288)) & 0x800000) == 0) {
Consume remaining RDTSC delta
TCM found - register the TCG callback
AsmReadTsc (); // Flush
Register callback for TCG physical presence protocol
Status = gBootServices->RegisterProtocolNotify (
Callback function

Generated by HR650X BIOS Decompilation Project