===================================
Platform config (``uefiplat.cfg``)
===================================

The top-level ``FREEFORM`` file inside the embedded UEFI FV (:doc:`dxe`) is
the human-readable platform config XBL's DXE phase consumes — the same blob
that carries ``DefaultBDSBootApp = "LinuxLoader"`` and the reserved-memory
map documented in :doc:`handoff`, plus flags such as ``EnableQseeLogsFlag``
and ``SecBootEnableFlag`` (a config flag, **not** the fuse — decoded below)
and the ``## PIL configuration`` base/size entries used by the peripheral
image loader.

The security flag is a single composite byte
================================================

The live line is ``SecurityFlag = 0xC4``; the ``# …Flag = 0x…`` lines
beneath it are only a bit-legend the parser ignores (they are commented
out). ``0xC4`` decodes as ``LoadKeymasterFlag (0x80) | LoadSecAppFlag
(0x40) | CommonMbnLoadFlag (0x04)``:

.. list-table::
   :header-rows: 1
   :widths: 18 12 16 54

   * - Bit
     - Mask
     - State in ``0xC4``
     - Meaning
   * - ``SecBootEnableFlag``
     - ``0x01``
     - **clear**
     - XBL's own secure-boot config bit is *not* asserted
   * - ``TreeTpmEnableFlag``
     - ``0x02``
     - clear
     - measured-boot / TPM event log off
   * - ``CommonMbnLoadFlag``
     - ``0x04``
     - **set**
     - load the common-MBN image set
   * - ``DxHdcp2LoadFlag``
     - ``0x08``
     - clear
     - HDCP2 app not loaded
   * - ``VariableServicesFlag``
     - ``0x10``
     - clear
     - —
   * - ``WinsecappFlag``
     - ``0x20``
     - clear
     - Windows SecApp not loaded (Android target)
   * - ``LoadSecAppFlag``
     - ``0x40``
     - **set**
     - load ``uefisecapp``
   * - ``LoadKeymasterFlag``
     - ``0x80``
     - **set**
     - load ``keymaster``

So the ``SecBootEnableFlag`` config bit is **clear** on this unit. This is
XBL's config-plane switch, distinct from the QFPROM ``SEC_BOOT`` hardware
fuse (which is read at runtime, not stored in any partition —
:doc:`/boot/secure-boot`, :doc:`/open-questions`); it corroborates the
test-key / not-enforced posture from the config side. Companion boot
constants in the same block: ``EnableShell = 0x1`` (UEFI shell reachable in
BDS), ``SharedIMEMBaseAddr = 0x146AA000``, ``DloadCookieAddr = 0x01FD3000``
/ ``DloadCookieValue = 0x10`` (the download-mode cookie XBL sets —
:doc:`/edl/entry`), ``NumCpusFuseAddr = 0x5C04C`` (the CPU-count fuse XBL
reads for MPPark) and ``PwrBtnShutdownFlag = 0x0``.

:Source: ``_READONLY/lun1/xbl_a.bin``, decompressed embedded UEFI FV
   (:doc:`dxe`).
:Cross-refs: :doc:`/xbl/index`, :doc:`dxe`, :doc:`handoff`,
   :doc:`/boot/secure-boot`, :doc:`/edl/entry`, :doc:`/open-questions`.