From ea624e1951f1208ae619888be4c03f058e65c572 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Fri, 14 Nov 2014 09:34:30 +0100 Subject: ARM: Add arch/arm/cpu/armv7/Kconfig with non-secure and virt options Add arch/arm/cpu/armv7/Kconfig with non-secure and virt options, this is a preparation patch for adding an env variable to choose between secure / non-secure boot on non-secure boot capable systems, specifically this prepares for adding CONFIG_ARMV7_BOOT_SEC_DEFAULT as a proper Kconfig option. Signed-off-by: Hans de Goede --- arch/arm/Kconfig | 4 ++++ arch/arm/cpu/armv7/Kconfig | 23 +++++++++++++++++++++++ arch/arm/cpu/armv7/exynos/Kconfig | 2 ++ 3 files changed, 29 insertions(+) create mode 100644 arch/arm/cpu/armv7/Kconfig (limited to 'arch/arm') diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index 3955978fbe..329c323fab 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -413,6 +413,8 @@ config TARGET_INTEGRATORCP_CM946ES config TARGET_VEXPRESS_CA15_TC2 bool "Support vexpress_ca15_tc2" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT config TARGET_VEXPRESS_CA5X2 bool "Support vexpress_ca5x2" @@ -812,6 +814,8 @@ source "arch/arm/cpu/arm926ejs/versatile/Kconfig" source "arch/arm/cpu/armv7/zynq/Kconfig" +source "arch/arm/cpu/armv7/Kconfig" + source "board/aristainetos/Kconfig" source "board/BuR/kwb/Kconfig" source "board/BuR/tseries/Kconfig" diff --git a/arch/arm/cpu/armv7/Kconfig b/arch/arm/cpu/armv7/Kconfig new file mode 100644 index 0000000000..15c5155b1c --- /dev/null +++ b/arch/arm/cpu/armv7/Kconfig @@ -0,0 +1,23 @@ +if CPU_V7 + +config CPU_V7_HAS_NONSEC + bool + +config CPU_V7_HAS_VIRT + bool + +config ARMV7_NONSEC + boolean "Enable support for booting in non-secure mode" if EXPERT + depends on CPU_V7_HAS_NONSEC + default y + ---help--- + Say Y here to enable support for booting in non-secure / SVC mode. + +config ARMV7_VIRT + boolean "Enable support for hardware virtualization" if EXPERT + depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC + default y + ---help--- + Say Y here to boot in hypervisor (HYP) mode when booting non-secure. + +endif diff --git a/arch/arm/cpu/armv7/exynos/Kconfig b/arch/arm/cpu/armv7/exynos/Kconfig index 090be9383f..e9a102ce3c 100644 --- a/arch/arm/cpu/armv7/exynos/Kconfig +++ b/arch/arm/cpu/armv7/exynos/Kconfig @@ -26,6 +26,8 @@ config TARGET_ODROID config TARGET_ARNDALE bool "Exynos5250 Arndale board" + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL select OF_CONTROL if !SPL_BUILD -- cgit v1.2.3 From 8bc347e2ec17bca44b1639a001eeed50d042f0db Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Fri, 14 Nov 2014 09:34:31 +0100 Subject: ARM: bootm: Allow booting in secure mode on hyp capable systems Older Linux kernels will not properly boot in hyp mode, add support for a bootm_boot_mode environment variable, which can be set to "sec" or "nonsec" to force booting in secure or non-secure mode when build with non-sec support. The default behavior can be selected through CONFIG_ARMV7_BOOT_SEC_DEFAULT, when this is set booting in secure mode is the default. The default setting for this Kconfig option is N, preserving the current behavior of booting in non-secure mode by default when non-secure mode is supported. Signed-off-by: Hans de Goede Acked-by: Marc Zyngier Acked-by: Siarhei Siamashka --- arch/arm/cpu/armv7/Kconfig | 11 +++++++++++ arch/arm/lib/bootm.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 37 insertions(+), 5 deletions(-) (limited to 'arch/arm') diff --git a/arch/arm/cpu/armv7/Kconfig b/arch/arm/cpu/armv7/Kconfig index 15c5155b1c..61e7c82459 100644 --- a/arch/arm/cpu/armv7/Kconfig +++ b/arch/arm/cpu/armv7/Kconfig @@ -13,6 +13,17 @@ config ARMV7_NONSEC ---help--- Say Y here to enable support for booting in non-secure / SVC mode. +config ARMV7_BOOT_SEC_DEFAULT + boolean "Boot in secure mode by default" if EXPERT + depends on ARMV7_NONSEC + default n + ---help--- + Say Y here to boot in secure mode by default even if non-secure mode + is supported. This option is useful to boot kernels which do not + suppport booting in non-secure mode. Only set this if you need it. + This can be overriden at run-time by setting the bootm_boot_mode env. + variable to "sec" or "nonsec". + config ARMV7_VIRT boolean "Enable support for hardware virtualization" if EXPERT depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c index 4949d573af..a7f7c67997 100644 --- a/arch/arm/lib/bootm.c +++ b/arch/arm/lib/bootm.c @@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images) } } +#if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT) +static bool boot_nonsec(void) +{ + char *s = getenv("bootm_boot_mode"); +#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT + bool nonsec = false; +#else + bool nonsec = true; +#endif + + if (s && !strcmp(s, "sec")) + nonsec = false; + + if (s && !strcmp(s, "nonsec")) + nonsec = true; + + return nonsec; +} +#endif + /* Subcommand: GO */ static void boot_jump_linux(bootm_headers_t *images, int flag) { @@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag) if (!fake) { #if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT) - armv7_init_nonsec(); - secure_ram_addr(_do_nonsec_entry)(kernel_entry, - 0, machid, r2); -#else - kernel_entry(0, machid, r2); + if (boot_nonsec()) { + armv7_init_nonsec(); + secure_ram_addr(_do_nonsec_entry)(kernel_entry, + 0, machid, r2); + } else #endif + kernel_entry(0, machid, r2); } #endif } -- cgit v1.2.3