TcgPlatformSetupPolicy

Function Table

Address	Name	Description
	ReportAssert
	CompareGuid
	ReadUnaligned64
	TpmBootPathCmosCheck
	TcgPlatformInitPolicyFromSetup
	TcgPlatformSetPolicyData
	TcgPlatformSetupPolicyNotify
	TcgPlatformSetupPolicyDxeEntryPoint
GUID	Definitions
TCG	Platform Setup Policy Protocol GUID:
EFI_GUID	gTcgPlatformSetupPolicyProtocolGuid = TCG_PLATFORM_SETUP_POLICY_PROTOCOL_GUID;
TCG	Internal Sync Flag variable GUID:
EFI_GUID	gTcgInternalSyncFlagGuid = TCG_INTERNAL_SYNC_FLAG_GUID;
Setup	variable GUID:
EFI_GUID	gSetupVariableGuid = SETUP_VARIABLE_GUID;
EFI_GUID	gPcrBitmapVariableGuid = PCR_BITMAP_VARIABLE_GUID;
Global	Variables	.data section (0x1410..0x1467)
mTcgPolicyBuffer	-- qword_1410
The	allocated protocol interface buffer (40 bytes allocated, 32 used).
byte	[0] = Revision (3)
bytes	[1..27] = TCG_PLATFORM_SETUP_POLICY data
TCG_PLATFORM_SETUP_POLICY_PROTOCOL	*mTcgPolicyProtocol = NULL;
mHobList	-- qword_1440
Cached	pointer to the HOB list, located from the system configuration table.
VOID	*mHobList = NULL;
mDebugProtocol	-- qword_1438
Cached	pointer to the debug/assert protocol interface.
Located	(under TPL protection) and cached on first use.
Protocol	interface has a function pointer at offset +8 for assert.
VOID	*mDebugProtocol = NULL;
mVariableAttributes	-- n3 at 0x1448
Attributes	used for GetVariable/SetVariable calls.
Set	**to 3 (EFI_VARIABLE_NON_VOLATILE	EFI_VARIABLE_BOOTSERVICE_ACCESS).**
UINT32	mVariableAttributes = 3;
Shadow	copies of policy bytes	byte_1450..byte_1466
These	are populated by the entry point and can be read by external
debug	tools or other firmware components via direct memory access.
UINT8	mTpm1Enable = 0; // byte_1450	Policy[0]: TPM 1.2 Enable
byte_1451	-- Policy[1]: TPM Operation
byte_1452	-- Policy[2]: TPM 2.0 Enable
byte_1453	-- Policy[3]: TPM Select
byte_1454	-- (not set by entry point)
byte_1455	-- Policy[5]: PCR Bank TPM2
byte_1456	-- Policy[6]: PCR Bank TPM1.2
byte_1458	-- Policy[8]: TPM 1.2 Support
byte_1459	-- Policy[9]: TPM 2.0 Support
byte_145A	-- Policy[10]: TPM Existence
byte_145D	-- Policy[13]: TPM Policy
byte_145E	-- Policy[15]: TPM Physical Presence
byte_145F	-- Policy[16]: (reserved / extra)
byte_1460	-- (not set)
byte_1463	(actually at 0x1462 in IDA, but Policy[19])
byte_1464	-- Policy[20]
byte_1465	-- Policy[21]
byte_1466	-- Policy[22]
dword_1467	-- Policy[23..26]
Library	Helpers
Raise	TPL to TPL_HIGH_LEVEL (31) to guard against re-entrancy.
OldTpl	= gBS->RaiseTPL (TPL_HIGH_LEVEL);
Only	proceed if the system was at TPL_NOTIFY or below.
if	(OldTpl <= TPL_NOTIFY) {
Locate	the debug protocol via its custom GUID.
The	actual GUID is proprietary to Lenovo.
The	function pointer is at offset +8 in the protocol interface.
AssertFunc	*= (VOID ()(CONST CHAR8* , UINTN, CONST CHAR8 ))*
HOB	list not found	assert (this is a fatal firmware error).
ReportAssert	(
Write	CMOS address 0x4B to port 0x70 (preserving NMI disable bit 7).
IoWrite8	**(0x70, (IoRead8 (0x70) & 0x80)	0x4B);**
Read	the TPM boot path value from CMOS port 0x71.
CmosValue	= IoRead8 (0x71);
Read	the platform type register at MMIO 0xFDAF0490.
CmosValue	**= (IoRead8 (0xFDAF0490) & 2)	1;**
Translate	CMOS value:
CmosValue	== 1 -> TPM boot is disabled
CmosValue	== 2 -> TPM1 boot path
CmosValue	== 3 -> TPM2 boot path
if	(CmosValue == 1) {
Feature	0x8000000C (debug print) is active.
ExecuteFunc	*= (UINT64 ()(UINT32, UINT64, ...))**
Features	0x80000004-0x8000000C may be active.
return	(BOOLEAN)((FeatureMask & TCG_BOOT_PATH_ENABLE) != 0);
Core	Driver Functions
Zero	the entire 27-byte policy structure.
ZeroMem	(Bytes, TCG_PLATFORM_SETUP_POLICY_DATA_SIZE);
Map	each Setup field to the corresponding policy byte.
TPM1	Enable
TPM	Operation
TPM	Select
PCR	Bank TPM2
PCR	Bank TPM1.2
TPM1	Support
TPM	Existence
TPM	Policy
TPM	Physical Presence
TPM	Firmware Update
TPM	Supplier Config
TPM	Supplier
TPM	Device
PCR	Bitmap: DWORD at Setup offsets 38-41.
PcrBitmapValue	= SetupBuffer[38];
Update	shadow global variables from the policy data.
mTpm1Enable	= Bytes[ 0];
Read	the current Setup variable.
Attributes	= mVariableAttributes;
Write	back all policy fields at their respective Setup offsets.
PCR	Bitmap DWORD at offsets 38-41.
PcrBitmapCopy	*= (UINT32* )(Bytes + 23);**
Write	the modified Setup variable.
Status	= gRT->SetVariable (
Apply	PCR variable flags (bits 0-4 -> SHA1/SHA256/SHA384/SHA512/SM3).
Read	the PCRBitmap variable.
PcrBitmapSize	= sizeof (PcrBitmapArray);
Apply	PCR enable bits to policy.
Bit	0 -> Bytes[4] = 1 (SHA1 enable	v12 in dec)
Bit	1 -> Bytes[5] = 1 (SHA256 enable	v13 in dec)
Bit	2 -> Bytes[6] = 1 (SHA384 enable	v14 in dec)
Bit	3 -> Bytes[7] = 1 (SHA512 enable	v15 in dec)
Bit	4 -> Bytes[8] = 1 (SM3 enable	v16 in dec)
if	(PcrBitmapArray[0] & 1) Bytes[4] = 1;
Write	TcgInternalSyncFlag to 1 to signal sync completion.
Set	the sync flag in policy
Variable	does not exist yet; create it.
Notification	Callback
Locate	our protocol interface.
Status	= gBS->LocateProtocol (
Copy	the 27-byte policy data from the protocol interface (offset 1).
Call	the SetPolicy function (at offset 32 in the protocol interface).
Close	the notification event.
Driver	Entry Point
The	UEFI core initializes gImageHandle, gST, gBS, gRT in the
library	constructors. sub_DD8 (GetHobList) is called here in the
original	decompilation.
GetHobList	();
Allocate	runtime pool for the protocol interface (40 bytes).
Status	= gBS->AllocatePool (
Read	the TcgInternalSyncFlag to check for pending sync.
SyncFlagSize	= 1;
Read	the Setup variable.
Initialize	policy from Setup.
Propagate	TcgInternalSyncFlag.
if	(SyncFlagSize == 1) {
Read	PCRBitmap variable and apply PCR enable bits.
Apply	PCR bits to the policy structure (v12..v16 fields).
UINT8	PolicyBytes = (UINT8 )&mTcgPolicyProtocol->PolicyData;
v12	if (PcrBitmapArray[0] & 1) PolicyBytes[ 4] = 1; // SHA1
SHA256	(actually
already	set from
Setup	variable not found; policy was zeroed by ZeroMem.
Cache	all policy fields to shadow global variables.
byte_1450	mTpmOperation = Bytes[ 1]; // byte_1451
byte_1452	mTpmSelect = Bytes[ 3]; // byte_1453
byte_1454	-- NOT saved to global!
byte_1455	mPcrBankTpm12 = Bytes[ 6]; // byte_1456
byte_1458	mTpm2Support = Bytes[ 9]; // byte_1459
byte_145A	// Bytes[11]; // byte_145B	NOT saved to global!
byte_145D	mTpmPhysicalPresence = Bytes[15]; // byte_145E
byte_145F	// Bytes[17]; // byte_1460	NOT saved to global!
byte_1462	mTpmSupplierConfig = Bytes[20]; // byte_1463
byte_1464	mTpmDevice = Bytes[22]; // byte_1465
dword_1467	}
Install	the protocol on ImageHandle.
Type	= EVT_NOTIFY_SIGNAL (512), NotifyTpl = TPL_CALLBACK (8)
NotifyFunction	= TcgPlatformSetupPolicyNotify
notification	event fails.
Function	Summary for Reference
Address	Name Size Role
0x280	ZeroBuffer 17 memset(buf, val, size)
0x350	_ModuleEntryPoint 184 UEFI entry, calls sub_DD8 + sub_860
0x408	TcgPlatformSetPolicyData 1002 Read Setup, merge policy, write NV
0x7F4	TcgPlatformSetupPolicyNotify 107 Locate protocol, copy policy, call SetPolicy
0x860	TcgPlatformSetupPolicyDxe.. 990 Main entry: alloc, init, install protocol
0xC40	ZeroMem/SetMem 80 Wrapper for ZeroBuffer
0xC90	LocateDebugProtocol 127 RaiseTPL, LocateProtocol, cache result
0xD10	TpmBootPathCmosCheck 136 Read CMOS 0x4B for TPM boot path
0xD98	ReportAssert 62 Call assert via debug protocol offset+8
0xDD8	GetHobList 214 Search config table for gEfiHobListGuid
0xEB0	ReadUnaligned64 47 64-bit unaligned read with NULL check
0xEE0	CompareGuid 110 Compare two GUIDs via 64-bit halves

Generated by HR650X BIOS Decompilation Project