1.2.4. Platform config (uefiplat.cfg)

The top-level FREEFORM file inside the embedded UEFI FV (Embedded UEFI firmware volume) is the human-readable platform config XBL’s DXE phase consumes — the same blob that carries DefaultBDSBootApp = "LinuxLoader" and the reserved-memory map documented in XBL → ABL hand-off contract (bounded), plus flags such as EnableQseeLogsFlag and SecBootEnableFlag (a config flag, not the fuse — decoded below) and the ## PIL configuration base/size entries used by the peripheral image loader.

1.2.4.1. The security flag is a single composite byte

The live line is SecurityFlag = 0xC4; the # …Flag = 0x… lines beneath it are only a bit-legend the parser ignores (they are commented out). 0xC4 decodes as LoadKeymasterFlag (0x80) | LoadSecAppFlag (0x40) | CommonMbnLoadFlag (0x04):

Bit

Mask

State in 0xC4

Meaning

SecBootEnableFlag

0x01

clear

XBL’s own secure-boot config bit is not asserted

TreeTpmEnableFlag

0x02

clear

measured-boot / TPM event log off

CommonMbnLoadFlag

0x04

set

load the common-MBN image set

DxHdcp2LoadFlag

0x08

clear

HDCP2 app not loaded

VariableServicesFlag

0x10

clear

—

WinsecappFlag

0x20

clear

Windows SecApp not loaded (Android target)

LoadSecAppFlag

0x40

set

load uefisecapp

LoadKeymasterFlag

0x80

set

load keymaster

So the SecBootEnableFlag config bit is clear on this unit. This is XBL’s config-plane switch, distinct from the QFPROM SEC_BOOT hardware fuse (which is read at runtime, not stored in any partition — Secure boot and image signing, Open questions and limits of analysis); it corroborates the test-key / not-enforced posture from the config side. Companion boot constants in the same block: EnableShell = 0x1 (UEFI shell reachable in BDS), SharedIMEMBaseAddr = 0x146AA000, DloadCookieAddr = 0x01FD3000 / DloadCookieValue = 0x10 (the download-mode cookie XBL sets — EDL / 9008 entry and the deep-flash cable), NumCpusFuseAddr = 0x5C04C (the CPU-count fuse XBL reads for MPPark) and PwrBtnShutdownFlag = 0x0.

Source:

_READONLY/lun1/xbl_a.bin, decompressed embedded UEFI FV (Embedded UEFI firmware volume).

Cross-refs:

XBL, Embedded UEFI firmware volume, XBL → ABL hand-off contract (bounded), Secure boot and image signing, EDL / 9008 entry and the deep-flash cable, Open questions and limits of analysis.