.. _SD.Bootloader.SecurityConfig:

.. include:: /content/swdocs.rsts

.. spelling::
   pad
   init
   DTS
   sdmmc
   SDMMC
   hv
   eqos
   io
   ao
   ufs
   qspi
   DTSI
   SoC
   PMC
   IMPL
   BCT
   bct
   GPIO
   pinmux
   dtsi
   pinctrl
   lpdr
   tristate
   ps
   PADCTL
   i2c
   I2C
   DRAM
   FPS
   PWM
   MMIO
   PMIC
   Vout
   SOC
   Hz
   pwm
   mmio
   pad
   prod
   QSPI
   DDR
   ddr
   SDR
   sdr
   BootROM
   val
   qspiflash
   sata
   BPMP
   FW
   UPHY
   uphy
   SCR
   scr
   coldboot

Security Configuration
!!!!!!!!!!!!!!!!!!!!!!

MB1 and MB2 program most of the SCRs and firewalls in T23x. The list of SCRs/firewalls, their order, and their addresses are predetermined. The values are taken from the SCR configuration file.

Each entry in this configuration file is in the following form: 

.. code-block:: none

   / {
     scr {
         reg@<index> {
             <parameter> = <value>;
          };
      };
   };

where:

- ``<index>`` is the index of the SCR/firewall in the predefined list.
- ``<parameter>`` and its <value> can be as follows:

.. list-table::
   :widths: auto
   :header-rows: 1

   * - Parameters
     - Value
   * - exclusion-info
     - Exclusion info is a bit field defined as the following bits:
        - 0: 1
        - Do not program in coldboot or SC7-exit.
        - 1: Program in coldboot, but skip in the SC7-exit.
        - 2: Program at end of MB2 instead of MB1.
   * - value
     - 32-bit value for the SCR register.

.. note::
   The values of the SCRs are programmed in the increasing order of indexes and not in the order in which they appear in the configuration file. The scr/firewalls, which are not specified in the configuration file, are locked without restricting the access to the protected registers.

The scr configuration files are in the ``hardware/nvidia/platform/t23x/common/bct/scr`` directory.

Here is an example of the format of SCR the config file:

.. code-block:: none

   /dts-v1/;

   / {
      scr {
          reg@161 {
              exclusion-info = <7>;
              value = <0x3f008080>;
          };
          reg@162 {
              exclusion-info = <4>;
              value = <0x18000303>;
          };
          reg@163 {
             exclusion-info = <4>;
             value = <0x18000303>;
          };
	  };
   };

Here is the previous CFG file format:

.. code-block:: none

   scr.161.7 = 0x3f008080; // TKE_AON_SCR_WDTSCR0_0
   scr.162.4 = 0x18000303; // DMAAPB_1_SCR_BR_INTR_SCR_0
   scr.163.4 = 0x18000303; // DMAAPB_1_SCR_BR_SCR_0