Newer
Older
AMI-Aptio-BIOS-Reversed / Tpm20Acpi / Tpm20Acpi.md
@Ajax Dong Ajax Dong 2 days ago 6 KB Init

Tpm20Acpi

Function Table

Address Name Description
ReadUnaligned64
IsHobGuidEqual
IoWrite16
IoRead32
ReadTimestampCounter
ReadCallerEflags
CpuPause
EnableInterrupts
DisableInterrupts
InitializeAcpiSupport
GetHobList
AssertHandler
DebugPrint
InitializeUefiBootServicesTable
PcdGet32
PcdSet32
AsciiStrLen
LibGetDsdt
AcpiAmlWriteInteger
IsTpmHwPresent
GetTpmInterfaceType
IsTpmAvailable
PciExpressRead
Tpm20AcpiInitEntry
ModuleEntryPoint
Global variables - UEFI boot/runtime services
EFI_HANDLE gImageHandle = NULL;
Module global variables
UINT64 mHobList = 0; ///< HOB list pointer (cached)
Static (internal) function prototypes
UEFI Boot Services Table Library initialization
Memory Operations
Overlapping with Source before Destination: copy backwards
CopyMemBackwards (Dst, Source, Length);
LengthRemaining = Length;
Unaligned and string operations
ACPI PM1a_CNT.SLP_TYPx + SLP_EN
Protocol locator helpers
Allocate 5 pages for ACPI tables
HOB list management
End of HOB list
return NULL;
Assert and Debug
Read CMOS index 0x4B to determine debug routing
CmosIndex = __inbyte (0x70);
DSDT Locator
Check cache first
if (mDsdtAddr != 0 && mXsdtDsdtAddr != 0) {
Locate ACPI Support protocol
AcpiSupport = GetAcpiSupportProtocol ();
Get the RSDT/XSDT table
TableIndex = 0;
Check for RSDT (1.0b) or XSDT (2.0+)
if ((UINT32 )Table == EFI_ACPI_RSDT_SIGNATURE) {
RSDT found - search for DSDT pointer
NumberOfTableEntries = ((UINT32 )((UINT8 *)Table + 4) - sizeof (EFI_ACPI_DESCRIPTION_HEADER)) / sizeof (UINT32);
NumberOfTableEntries = ((UINT32 )((UINT8 *)Table + 4) - sizeof (EFI_ACPI_DESCRIPTION_HEADER)) / sizeof (UINT64);
Report if we couldn't find DSDT
if (mDsdtAddr == 0 && mXsdtDsdtAddr == 0) {
ACPI AML Write Helper
Search for the signature in the DSDT
for (Offset = FoundOffset; Offset < DsdtSize; Offset += 4) {
Check the AML NameString prefix before the signature
BytePtr = (UINT8 *)(DsdtBase + FoundOffset - 1);
Skip past this match and search again
DsdtSize -= FoundOffset + 4;
Write the value based on the AML opcode after the signature
switch (*(BytePtr + 4)) {
Replace ZeroOp/OneOp with the value
if (Value > 1) {
TPM Hardware Detection
PCI Express MMIO access
Main TPM ACPI Initialization
Locate DSDT
Status = LibGetDsdt (&DsdtAddr);
Initialize ACPI tables
InitializeAcpiSupport ();
Detect TPM hardware availability
if (!IsTpmAvailable ()) {
No TPM: set defaults
No TPM
Write no-TPM configuration to DSDT
Status = AcpiAmlWriteInteger (DsdtAddr, MAX_UINT32, SIGNATURE_AMDT, 0);
Write "TPMM" with default stolen address (no TPM)
Status = AcpiAmlWriteInteger (DsdtAddr, MAX_UINT32, SIGNATURE_TPMM, 0xFED00000);
TPM is available - write TPMF=1
Status = AcpiAmlWriteInteger (DsdtAddr, MAX_UINT32, SIGNATURE_TPMF, 1);
Check if TPM has active interface
if (MEMORY[TPM_REG_BASE + TPM_CTRL_AREA_OFFSET] == 0xFFFFFFFF) {
TPM with no active interface (TPP mode)
mTpmMode = 7;
Dump CtrlAreaMap registers
DEBUG ((DEBUG_INFO, "CtrlAreaMap->Error = %x \n", MEMORY[TPM_REG_BASE + TPM_CTRL_ERROR]));
Program "DTPT" with 1
Status = AcpiAmlWriteInteger (DsdtAddr, MAX_UINT32, SIGNATURE_DTPT, 1);
TPM with active interface - find stolen address from HOB
HobPtr = GetHobList ();
Determine stolen address
StolenAddr = STOLEN_ADDR_DEFAULT;
TPM2 with DMA
Zero the stolen memory region if it's not the default location
if (StolenAddr != STOLEN_ADDR_DEFAULT) {
Set up TPM control area in stolen memory
Response (UINT32 )(StolenAddr + 36) = 0; // ResponseSize
Command buffer
Program "DTPT" with 0
Status = AcpiAmlWriteInteger (DsdtAddr, MAX_UINT32, SIGNATURE_DTPT, 0);
Install TPM2 ACPI table
if (mTpmMode == 2) {
Allocate and populate TPM2 table
Status = gBS->AllocatePool (EfiBootServicesData, 56, &BufferPtr);
Copy "TPM24" signature header (52 bytes)
CopyMem (BufferPtr, "TPM24", 52);
Install via ACPI table protocol
Status = ((EFI_ACPI_TABLE_PROTOCOL *)DsdtInterface)->InstallAcpiTable (
Direct install of TPM24 signature
Signal that initialization is complete
Status = gBS->SignalEvent ((EFI_EVENT)a1);
Module Entry Point
Initialize UEFI Boot/Runtime Services Table
InitializeUefiBootServicesTable (ImageHandle, SystemTable);
Initialize PCD database via LocateProtocol
mPcdDb = (UINT64)PcdGet32 (5);
Detect TPM hardware via EFLAGS.IF check
if (ReadCallerEflags () & 0x200) {
Timeout loop using TSC
while (((IoRead32 (1288) + 357 - IoRead32 (1288)) & 0x800000) == 0) {
Register the initialization event via CreateEvent
return gBS->CreateEvent (

Generated by HR650X BIOS Decompilation Project