summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--arch/arm/cpu/armv7/Kconfig11
-rw-r--r--arch/arm/lib/bootm.c31
2 files changed, 37 insertions, 5 deletions
diff --git a/arch/arm/cpu/armv7/Kconfig b/arch/arm/cpu/armv7/Kconfig
index 15c5155b1c..61e7c82459 100644
--- a/arch/arm/cpu/armv7/Kconfig
+++ b/arch/arm/cpu/armv7/Kconfig
@@ -13,6 +13,17 @@ config ARMV7_NONSEC
---help---
Say Y here to enable support for booting in non-secure / SVC mode.
+config ARMV7_BOOT_SEC_DEFAULT
+ boolean "Boot in secure mode by default" if EXPERT
+ depends on ARMV7_NONSEC
+ default n
+ ---help---
+ Say Y here to boot in secure mode by default even if non-secure mode
+ is supported. This option is useful to boot kernels which do not
+ suppport booting in non-secure mode. Only set this if you need it.
+ This can be overriden at run-time by setting the bootm_boot_mode env.
+ variable to "sec" or "nonsec".
+
config ARMV7_VIRT
boolean "Enable support for hardware virtualization" if EXPERT
depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC
diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
index 4949d573af..a7f7c67997 100644
--- a/arch/arm/lib/bootm.c
+++ b/arch/arm/lib/bootm.c
@@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images)
}
}
+#if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
+static bool boot_nonsec(void)
+{
+ char *s = getenv("bootm_boot_mode");
+#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT
+ bool nonsec = false;
+#else
+ bool nonsec = true;
+#endif
+
+ if (s && !strcmp(s, "sec"))
+ nonsec = false;
+
+ if (s && !strcmp(s, "nonsec"))
+ nonsec = true;
+
+ return nonsec;
+}
+#endif
+
/* Subcommand: GO */
static void boot_jump_linux(bootm_headers_t *images, int flag)
{
@@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
if (!fake) {
#if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
- armv7_init_nonsec();
- secure_ram_addr(_do_nonsec_entry)(kernel_entry,
- 0, machid, r2);
-#else
- kernel_entry(0, machid, r2);
+ if (boot_nonsec()) {
+ armv7_init_nonsec();
+ secure_ram_addr(_do_nonsec_entry)(kernel_entry,
+ 0, machid, r2);
+ } else
#endif
+ kernel_entry(0, machid, r2);
}
#endif
}