1*4882a593Smuzhiyun /* 2*4882a593Smuzhiyun * (C) Copyright 2016 3*4882a593Smuzhiyun * Texas Instruments, <www.ti.com> 4*4882a593Smuzhiyun * 5*4882a593Smuzhiyun * Andreas Dannenberg <dannenberg@ti.com> 6*4882a593Smuzhiyun * 7*4882a593Smuzhiyun * SPDX-License-Identifier: GPL-2.0+ 8*4882a593Smuzhiyun */ 9*4882a593Smuzhiyun #ifndef _OMAP_SEC_COMMON_H_ 10*4882a593Smuzhiyun #define _OMAP_SEC_COMMON_H_ 11*4882a593Smuzhiyun 12*4882a593Smuzhiyun #include <common.h> 13*4882a593Smuzhiyun 14*4882a593Smuzhiyun /* 15*4882a593Smuzhiyun * Invoke secure ROM API on high-security (HS) device variants. It formats 16*4882a593Smuzhiyun * the variable argument list into the format expected by the ROM code before 17*4882a593Smuzhiyun * triggering the actual low-level smc entry. 18*4882a593Smuzhiyun */ 19*4882a593Smuzhiyun u32 secure_rom_call(u32 service, u32 proc_id, u32 flag, ...); 20*4882a593Smuzhiyun 21*4882a593Smuzhiyun /* 22*4882a593Smuzhiyun * Invoke a secure ROM API on high-secure (HS) device variants that can be used 23*4882a593Smuzhiyun * to verify a secure blob by authenticating and optionally decrypting it. The 24*4882a593Smuzhiyun * exact operation performed depends on how the certificate that was embedded 25*4882a593Smuzhiyun * into the blob during the signing/encryption step when the secure blob was 26*4882a593Smuzhiyun * first created. 27*4882a593Smuzhiyun */ 28*4882a593Smuzhiyun int secure_boot_verify_image(void **p_image, size_t *p_size); 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun /* 31*4882a593Smuzhiyun * Return the start of secure reserved RAM, if a default start address has 32*4882a593Smuzhiyun * not been configured then return a region at the end of the external DRAM. 33*4882a593Smuzhiyun */ 34*4882a593Smuzhiyun u32 get_sec_mem_start(void); 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun /* 37*4882a593Smuzhiyun * Invoke a secure HAL API that allows configuration of the external memory 38*4882a593Smuzhiyun * firewall regions. 39*4882a593Smuzhiyun */ 40*4882a593Smuzhiyun int secure_emif_firewall_setup(uint8_t region_num, uint32_t start_addr, 41*4882a593Smuzhiyun uint32_t size, uint32_t access_perm, 42*4882a593Smuzhiyun uint32_t initiator_perm); 43*4882a593Smuzhiyun 44*4882a593Smuzhiyun /* 45*4882a593Smuzhiyun * Invoke a secure HAL API on high-secure (HS) device variants that reserves a 46*4882a593Smuzhiyun * region of external memory for secure world use, and protects it using memory 47*4882a593Smuzhiyun * firewalls that prevent public world access. This API is intended to setaside 48*4882a593Smuzhiyun * memory that will be used for a secure world OS/TEE. 49*4882a593Smuzhiyun */ 50*4882a593Smuzhiyun int secure_emif_reserve(void); 51*4882a593Smuzhiyun 52*4882a593Smuzhiyun /* 53*4882a593Smuzhiyun * Invoke a secure HAL API to lock the external memory firewall configurations. 54*4882a593Smuzhiyun * After this API is called, none of the HAL APIs for configuring the that 55*4882a593Smuzhiyun * firewall will be usable (calls to those APIs will return failure and have 56*4882a593Smuzhiyun * no effect). 57*4882a593Smuzhiyun */ 58*4882a593Smuzhiyun int secure_emif_firewall_lock(void); 59*4882a593Smuzhiyun 60*4882a593Smuzhiyun /* 61*4882a593Smuzhiyun * Invoke a secure HAL API to authenticate and install a Trusted Execution 62*4882a593Smuzhiyun * Environment (TEE) image. 63*4882a593Smuzhiyun */ 64*4882a593Smuzhiyun int secure_tee_install(u32 tee_image); 65*4882a593Smuzhiyun 66*4882a593Smuzhiyun #endif /* _OMAP_SEC_COMMON_H_ */ 67