Hi,
On 11/14/2014 08:33 AM, Albert ARIBAUD wrote:
> Hello Hans,
>
> On Thu, 13 Nov 2014 20:37:42 +0100, Hans de Goede <hdego...@redhat.com>
> wrote:
>> Older Linux kernels will not properly boot in hyp mode, add support for a
>> bootm_boot_mode environment variable, which can be set to "sec" or "nonsec"
>> to force booting in secure or non-secure mode when build with non-sec
>> support.
>>
>> The default behavior can be selected through CONFIG_ARMV7_BOOT_SEC_DEFAULT,
>> when this is set booting in secure mode is the default. The default setting
>> for this Kconfig option is N, preserving the current behavior of booting in
>> non-secure mode by default when non-secure mode is supported.
>>
>> Signed-off-by: Hans de Goede <hdego...@redhat.com>
>> Acked-by: Marc Zyngier <marc.zyng...@arm.com>
>> Acked-by: Siarhei Siamashka <siarhei.siamas...@gmail.com>
>> --
>> Changes in v2:
>> -Allow changing the default boot mode to secure through defining
>> CONFIG_ARMV7_BOOT_SEC_DEFAULT, this is useful for archs which have a Kconfig
>> option for compatibility with older kernels
>> Changes in v3:
>> -Add an else at the end of the #ifdef NONSEC block so that if do_nonsec_entry
>> fails we do not end up re-trying in secure mode
>> Changes in v4:
>> -Add a Kconfig option to select to boot in secure or non-secure mode by
>> default
>> ---
>> arch/arm/cpu/armv7/Kconfig | 11 +++++++++++
>> arch/arm/lib/bootm.c | 31 ++++++++++++++++++++++++++-----
>> 2 files changed, 37 insertions(+), 5 deletions(-)
>>
>> diff --git a/arch/arm/cpu/armv7/Kconfig b/arch/arm/cpu/armv7/Kconfig
>> index 15c5155..6ee5ff8 100644
>> --- a/arch/arm/cpu/armv7/Kconfig
>> +++ b/arch/arm/cpu/armv7/Kconfig
>> @@ -13,6 +13,17 @@ config ARMV7_NONSEC
>> ---help---
>> Say Y here to enable support for booting in non-secure / SVC mode.
>>
>> +config ARMV7_BOOT_SEC_DEFAULT
>> + boolean "Boot in secure mode by default" if EXPERT
>> + depends on ARMV7_NONSEC
>> + default n
>> + ---help---
>> + Say Y here to boot in secure mode by default even if non-secure mode
>> + is supported. This option is useful to boot kernels which do not
>> + suppport booting in secure mode. Only set this if you need it.
>> + This can be overriden at run-time by setting the bootm_boot_mode env.
>> + variable to "sec" or "nonsec".
>
> Not sure I'm getting this right, but it seems to me that forcing secure
> boot mode for kernels that don't support secure boot mode is kind of
> contradictory. Did you mean "... for kernels which do not suport
> booting in *non*-secure mode..." ?
Yes, my bad will fix in v5.
>
>> config ARMV7_VIRT
>> boolean "Enable support for hardware virtualization" if EXPERT
>> depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC
>> diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
>> index 4949d57..a7f7c67 100644
>> --- a/arch/arm/lib/bootm.c
>> +++ b/arch/arm/lib/bootm.c
>> @@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images)
>> }
>> }
>>
>> +#if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
>> +static bool boot_nonsec(void)
>> +{
>> + char *s = getenv("bootm_boot_mode");
>> +#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT
>> + bool nonsec = false;
>> +#else
>> + bool nonsec = true;
>> +#endif
>> +
>> + if (s && !strcmp(s, "sec"))
>> + nonsec = false;
>> +
>> + if (s && !strcmp(s, "nonsec"))
>> + nonsec = true;
>> +
>> + return nonsec;
>> +}
>> +#endif
>> +
>> /* Subcommand: GO */
>> static void boot_jump_linux(bootm_headers_t *images, int flag)
>> {
>> @@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images,
>> int flag)
>>
>> if (!fake) {
>> #if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
>> - armv7_init_nonsec();
>> - secure_ram_addr(_do_nonsec_entry)(kernel_entry,
>> - 0, machid, r2);
>> -#else
>> - kernel_entry(0, machid, r2);
>> + if (boot_nonsec()) {
>> + armv7_init_nonsec();
>> + secure_ram_addr(_do_nonsec_entry)(kernel_entry,
>> + 0, machid, r2);
>> + } else
>> #endif
>> + kernel_entry(0, machid, r2);
>> }
>> #endif
>> }
>> --
>> 2.1.0
Regards,
Hans
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot
