diff --git a/bdk/soc/pmc.c b/bdk/soc/pmc.c
index 62caa22..3c1fba4 100644
--- a/bdk/soc/pmc.c
+++ b/bdk/soc/pmc.c
@@ -14,10 +14,68 @@
* along with this program. If not, see .
*/
+#include
#include
#include
#include
+void pmc_scratch_lock(pmc_sec_lock_t lock_mask)
+{
+ // Lock Private key disable, Fuse write enable, MC carveout, Warmboot PA id and Warmboot address.
+ if (lock_mask & PMC_SEC_LOCK_MISC)
+ {
+ PMC(APBDEV_PMC_SEC_DISABLE) |= 0x700FF0; // RW lock: 0-3.
+ PMC(APBDEV_PMC_SEC_DISABLE2) |= 0xFC000000; // RW lock: 21-23.
+ PMC(APBDEV_PMC_SEC_DISABLE3) |= 0x3F0FFF00; // RW lock: 28-33, 36-38.
+ PMC(APBDEV_PMC_SEC_DISABLE6) |= 0xC000000; // RW lock: 85.
+ PMC(APBDEV_PMC_SEC_DISABLE8) |= 0xFF00FF00; // RW lock: 108-111, 116-119.
+
+ // SE2 context.
+ if (hw_get_chip_id() == GP_HIDREV_MAJOR_T210B01)
+ {
+ PMC(APBDEV_PMC_SEC_DISABLE9) |= 0x3FF; // RW lock: 120-124. (0xB38)
+ PMC(APBDEV_PMC_SEC_DISABLE10) = 0xFFFFFFFF; // RW lock: 135-150.
+ }
+ }
+
+ if (lock_mask & PMC_SEC_LOCK_LP0_PARAMS)
+ {
+ PMC(APBDEV_PMC_SEC_DISABLE2) |= 0x3FCFFFF; // RW lock: 8-15, 17-20.
+ PMC(APBDEV_PMC_SEC_DISABLE4) |= 0x3F3FFFFF; // RW lock: 40-50, 52-54.
+ PMC(APBDEV_PMC_SEC_DISABLE5) = 0xFFFFFFFF; // RW lock: 56-71.
+ PMC(APBDEV_PMC_SEC_DISABLE6) |= 0xF3FFC00F; // RW lock: 72-73, 79-84, 86-87.
+ PMC(APBDEV_PMC_SEC_DISABLE7) |= 0x3FFFFF; // RW lock: 88-98.
+ PMC(APBDEV_PMC_SEC_DISABLE8) |= 0xFF; // RW lock: 104-107.
+ }
+
+ if (lock_mask & PMC_SEC_LOCK_RST_VECTOR)
+ PMC(APBDEV_PMC_SEC_DISABLE3) |= 0xF00000; // RW lock: 34-35.
+
+ if (lock_mask & PMC_SEC_LOCK_CARVEOUTS)
+ {
+ PMC(APBDEV_PMC_SEC_DISABLE2) |= 0x30000; // RW lock: 16.
+ PMC(APBDEV_PMC_SEC_DISABLE3) |= 0xC0000000; // RW lock: 39.
+ PMC(APBDEV_PMC_SEC_DISABLE4) |= 0xC0C00000; // RW lock: 51, 55.
+ PMC(APBDEV_PMC_SEC_DISABLE6) |= 0x3FF0; // RW lock: 74-78.
+ PMC(APBDEV_PMC_SEC_DISABLE7) |= 0xFFC00000; // RW lock: 99-103.
+ }
+
+ if (lock_mask & PMC_SEC_LOCK_TZ_CMAC_W)
+ PMC(APBDEV_PMC_SEC_DISABLE8) |= 0x550000; // W lock: 112-115.
+
+ if (lock_mask & PMC_SEC_LOCK_TZ_CMAC_R)
+ PMC(APBDEV_PMC_SEC_DISABLE8) |= 0xAA0000; // R lock: 112-115.
+
+ if (lock_mask & PMC_SEC_LOCK_TZ_KEK_W)
+ PMC(APBDEV_PMC_SEC_DISABLE3) |= 0x55; // W lock: 24-27.
+
+ if (lock_mask & PMC_SEC_LOCK_TZ_KEK_R)
+ PMC(APBDEV_PMC_SEC_DISABLE3) |= 0xAA; // R lock: 24-27.
+
+ if (lock_mask & PMC_SEC_LOCK_SE_SRK)
+ PMC(APBDEV_PMC_SEC_DISABLE) |= 0xFF000; // RW lock: 4-7
+}
+
int pmc_enable_partition(u32 part, int enable)
{
u32 part_mask = BIT(part);
diff --git a/bdk/soc/pmc.h b/bdk/soc/pmc.h
index c27d937..d8a84e2 100644
--- a/bdk/soc/pmc.h
+++ b/bdk/soc/pmc.h
@@ -91,6 +91,8 @@
#define APBDEV_PMC_SEC_DISABLE6 0x5B8
#define APBDEV_PMC_SEC_DISABLE7 0x5BC
#define APBDEV_PMC_SEC_DISABLE8 0x5C0
+#define APBDEV_PMC_SEC_DISABLE9 0x5C4
+#define APBDEV_PMC_SEC_DISABLE10 0x5C8
#define APBDEV_PMC_SCRATCH188 0x810
#define APBDEV_PMC_SCRATCH190 0x818
#define APBDEV_PMC_SCRATCH200 0x840
@@ -98,6 +100,20 @@
#define APBDEV_PMC_TZRAM_SEC_DISABLE 0xBEC
#define APBDEV_PMC_TZRAM_NON_SEC_DISABLE 0xBF0
-int pmc_enable_partition(u32 part, int enable);
+typedef enum _pmc_sec_lock_t
+{
+ PMC_SEC_LOCK_MISC = BIT(0),
+ PMC_SEC_LOCK_LP0_PARAMS = BIT(1),
+ PMC_SEC_LOCK_RST_VECTOR = BIT(2),
+ PMC_SEC_LOCK_CARVEOUTS = BIT(3),
+ PMC_SEC_LOCK_TZ_CMAC_W = BIT(4),
+ PMC_SEC_LOCK_TZ_CMAC_R = BIT(5),
+ PMC_SEC_LOCK_TZ_KEK_W = BIT(6),
+ PMC_SEC_LOCK_TZ_KEK_R = BIT(7),
+ PMC_SEC_LOCK_SE_SRK = BIT(8),
+} pmc_sec_lock_t;
+
+void pmc_scratch_lock(pmc_sec_lock_t lock_mask);
+int pmc_enable_partition(u32 part, int enable);
#endif
diff --git a/bootloader/hos/hos.c b/bootloader/hos/hos.c
index e4ee889..7ed8712 100644
--- a/bootloader/hos/hos.c
+++ b/bootloader/hos/hos.c
@@ -152,33 +152,6 @@ static void _se_lock(bool lock_se)
gfx_hexdump(SE_BASE, (void *)SE_BASE, 0x400);*/
}
-void _pmc_scratch_lock(u32 kb)
-{
- switch (kb)
- {
- case KB_FIRMWARE_VERSION_100_200:
- case KB_FIRMWARE_VERSION_300:
- case KB_FIRMWARE_VERSION_301:
- PMC(APBDEV_PMC_SEC_DISABLE) = 0x7FFFF3;
- PMC(APBDEV_PMC_SEC_DISABLE2) = 0xFFFFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE3) = 0xFFAFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE4) = 0xFFFFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE5) = 0xFFFFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE6) = 0xFFFFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE7) = 0xFFFFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE8) = 0xFFAAFFFF;
- break;
- default:
- PMC(APBDEV_PMC_SEC_DISABLE2) |= 0x3FCFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE4) |= 0x3F3FFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE5) = 0xFFFFFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE6) |= 0xF3FFC00F;
- PMC(APBDEV_PMC_SEC_DISABLE7) |= 0x3FFFFF;
- PMC(APBDEV_PMC_SEC_DISABLE8) |= 0xFF;
- break;
- }
-}
-
void _sysctr0_reset()
{
SYSCTR0(SYSCTR0_CNTCR) = 0;
@@ -1090,8 +1063,8 @@ int hos_launch(ini_sec_t *cfg)
if (kb >= KB_FIRMWARE_VERSION_620)
_sysctr0_reset();
- // < 4.0.0 pkg1.1 locks PMC scratches.
- //_pmc_scratch_lock(kb);
+ // NX Bootloader locks LP0 Carveout secure scratch registers.
+ //pmc_scratch_lock(PMC_SEC_LOCK_LP0_PARAMS);
// Set secmon mailbox address and clear it.
if (kb >= KB_FIRMWARE_VERSION_700 || exo_new)