[U-Boot] [PATCH] ARM: bootm: Allow booting in secure mode on hyp capable systems

[Marc Zyngier <marc.zyngier@arm.com>]

On Wed, Oct 15 2014 at 11:25:10 AM, Siarhei Siamashka <siarhei.siamashka@gmail.com> wrote:
> On Wed, 15 Oct 2014 12:13:05 +0200
> Hans de Goede <hdegoede@redhat.com> wrote:
>
>> Older Linux kernels will not properly boot in hype mode, add support for a
>> bootm_boot_mode environment variable, which when set to "sec" will cause
>> u-boot to boot in secure mode even when build with non-sec (and hyp) support.
>> 
>> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
>> ---
>>  arch/arm/lib/bootm.c | 23 ++++++++++++++++++-----
>>  1 file changed, 18 insertions(+), 5 deletions(-)
>> 
>> diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
>> index 39fe7a1..037fc8d 100644
>> --- a/arch/arm/lib/bootm.c
>> +++ b/arch/arm/lib/bootm.c
>> @@ -235,6 +235,18 @@ static void boot_prep_linux(bootm_headers_t *images)
>>  	}
>>  }
>>  
>> +#if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
>> +static bool boot_nonsec(void)
>> +{
>> +	char *s = getenv("bootm_boot_mode");
>> +
>> +	if (s && !strcmp(s, "sec"))
>> +		return false;
>> +
>> +	return true;
>> +}
>> +#endif
>> +
>>  /* Subcommand: GO */
>>  static void boot_jump_linux(bootm_headers_t *images, int flag)
>>  {
>> @@ -283,12 +295,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
>>  
>>  	if (!fake) {
>>  #if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
>> -		armv7_init_nonsec();
>> -		secure_ram_addr(_do_nonsec_entry)(kernel_entry,
>> -						  0, machid, r2);
>> -#else
>> -		kernel_entry(0, machid, r2);
>> +		if (boot_nonsec()) {
>> +			armv7_init_nonsec();
>> +			secure_ram_addr(_do_nonsec_entry)(kernel_entry,
>> +							  0, machid, r2);
>> +		}
>>  #endif
>> +		kernel_entry(0, machid, r2);
>>  	}
>>  #endif
>>  }
>
> BTW, I'm currently achieving the same result, but without the need to do
> extra environment configuration gymnastics for the end users:
>     https://github.com/ssvb/u-boot-sunxi-dram/commit/e914abe551e712a59a8fc1ac9a4b8490e8e7c866

And thus preventing kernels with appended DT (not provided by u-boot),
but still using HYP/non-sec/PSCI from booting.

Sorry, but using DT as a way to distinguish between all these cases is
just wrong.

Thanks,

	M.
-- 
Jazz is not dead. It just smells funny.