mediatek: mt7988: add anti-rollback support

This patch adds anti-rollback v2 support for mt7988 Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
mtk-openwrt · Jul 24, 2023 · b66972f · b66972f
1 parent 29e2a3d
commit b66972f
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 1 deletion.
diff --git a/plat/mediatek/mt7988/bl2/bl2.mk b/plat/mediatek/mt7988/bl2/bl2.mk
@@ -69,6 +69,9 @@ endif
 # Trusted board boot
 include $(MTK_PLAT)/apsoc_common/bl2/tbbr.mk
 
+# Anti-rollback
+include $(MTK_PLAT)/apsoc_common/bl2/ar.mk
+
 ifeq ($(BL2_COMPRESS),1)
 BL2_CPPFLAGS		+=	-DUSING_BL2PL
 endif # END OF BL2_COMPRESS

diff --git a/plat/mediatek/mt7988/mtk_tbbr.c b/plat/mediatek/mt7988/mtk_tbbr.c
@@ -5,6 +5,7 @@
  */
 
 #include <plat/common/platform.h>
+#include <common/debug.h>
 
 extern int mtk_ar_get_efuse_bl_ar_ver(uint32_t *efuse_bl_ar_ver);
 extern char mtk_rotpk_hash[], mtk_rotpk_hash_end[];
@@ -21,13 +22,26 @@ int plat_get_rotpk_info(void *cookie, void **key_ptr, unsigned int *key_len,
 
 int plat_get_nv_ctr(void *cookie, unsigned int *nv_ctr)
 {
+#ifdef MTK_ANTI_ROLLBACK
+	int ret;
+	uint32_t efuse_bl_ar_ver;
+
+	ret = mtk_ar_get_efuse_bl_ar_ver(&efuse_bl_ar_ver);
+	if (ret) {
+		ERROR("[%s] get EFUSE_BL_AR_VER fail\n", __func__);
+		return ret;
+	}
+
+	*nv_ctr = efuse_bl_ar_ver;
+#else
 	*nv_ctr = 0;
+#endif
 	return 0;
 }
 
 int plat_set_nv_ctr(void *cookie, unsigned int nv_ctr)
 {
-	return 1;
+	return 0;
 }
 
 int plat_get_mbedtls_heap(void **heap_addr, size_t *heap_size)

diff --git a/plat/mediatek/mt7988/platform.mk b/plat/mediatek/mt7988/platform.mk
@@ -44,6 +44,7 @@ include $(MTK_PLAT_SOC)/bl31.mk
 include $(MTK_PLAT_SOC)/drivers/efuse/efuse.mk
 
 include $(MTK_PLAT)/apsoc_common/bl2/tbbr_post.mk
+include $(MTK_PLAT)/apsoc_common/bl2/ar_post.mk
 include $(MTK_PLAT)/apsoc_common/bl2/bl2_image_post.mk
 
 OPTEE_TZRAM_SIZE := 0x10000