From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43739) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YpZ37-0007n0-Nb for qemu-devel@nongnu.org; Tue, 05 May 2015 05:22:02 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YpZ32-00021s-Ln for qemu-devel@nongnu.org; Tue, 05 May 2015 05:21:57 -0400 Received: from mail-oi0-f48.google.com ([209.85.218.48]:35123) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YpZ32-00021b-HF for qemu-devel@nongnu.org; Tue, 05 May 2015 05:21:52 -0400 Received: by oign205 with SMTP id n205so137489108oig.2 for ; Tue, 05 May 2015 02:21:51 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <20150505020858.GS10142@toto> References: <1430502643-25909-1-git-send-email-peter.maydell@linaro.org> <20150505020858.GS10142@toto> From: Peter Maydell Date: Tue, 5 May 2015 10:21:31 +0100 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: Re: [Qemu-devel] [PATCH v4 00/17] arm_gic: Add security and grouping support List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Edgar E. Iglesias" Cc: Greg Bellows , QEMU Developers , Patch Tracking On 5 May 2015 at 03:08, Edgar E. Iglesias wrote: > On Fri, May 01, 2015 at 06:50:26PM +0100, Peter Maydell wrote: >> This patch series adds support for GICv1 and GICv2 security >> extensions, as well as support for GIC interrupt grouping on GICv2. > > A question. Once we enable the the security extensions on the GICs, > do you have any suggestions on howto best handle direct boots into > NS EL2/1 (Linux)? > > The GIC resets to all interrupts configured for Group0 and Linux running > in NS mode cannot change that so we need some kind of boot-loader > code or magic to do what firmware would have been expected to do > at boot time (switch some irqs to NS). This is what I had in mind with the bit about: >> * if boot.c is starting the CPUs directly in NonSecure >> mode (because we're booting a kernel directly rather than >> starting firmware, and arm_boot_info::secure_boot is false) >> then it must also manually configure the GIC distributor >> to put all interrupts into Group1. This is boot.c having >> to do a firmware configuration job since it's effectively >> acting as lightweight builtin firmware. I hadn't made up my mind whether this was easier to do via boot.c writing a bunch of values to GICD registers or by having the GIC provide a function/method to call to do the job. -- PMM