ARM: Add armv7/Kconfig and allow booting in secure mode on non-secure boot capable systems
Subsystems (4)
v2 cover ARM: Add armv7/Kconfig and allow booting in secure mode on non-secure boot capable systems
Hi Albert,
Here is v2 of my patchset to allow booting in secure mode on non-secure boot capable systems. See inside the patch commit messages for a detailed changelog, the 3th patch in the set goes to a higher version as it also was posted on its own 2 times.
The first patch is from Tom, and is included because my patches depend on it, AFAIK it is ready for merging (so it can go in through your tree), it is just waiting for someone to actually use the EXPERT option which this patch-set does.
Please review, and if you're happy with the patches, merge them.
Thanks & Regards,
Hans
PATCH v2 1/3 Kconfig: Add EXPERT option
From: Tom Rini <[email protected]>
For similar reasons to why the Linux Kernel has an EXPERT option, we too want an option to allow for tweaking of some options that while normally should remain hidden, may need to be changed in some cases.
--- Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+)
Kconfig +8 -0
@@ -58,6 +58,14 @@ config CC_OPTIMIZE_FOR_SIZE endmenu # General setup +menuconfig EXPERT + bool "Configure standard U-Boot features (expert users)" + help + This option allows certain base U-Boot options and settings + to be disabled or tweaked. This is for specialized + environments which can tolerate a "non-standard" U-Boot. + Only use this if you really know what you are doing. + menu "Boot images" config SPL_BUILD
Signature · 1 line
2.1.0
PATCH v2 1/3 Kconfig: Add EXPERT option
This is identical to
http://patchwork.ozlabs.org/patch/399458/
posted by Tom Rini a month ago.
Why is it taking so long for this patch?
I prefer describing the patch dependency in the cover letter to resending the same patch.
Quoted 39 lines · On Thu, 13 Nov 2014 20:37:40 +0100 Hans de Goede <[email protected]> wrote:
From: Tom Rini <[email protected]>
For similar reasons to why the Linux Kernel has an EXPERT option, we too want an option to allow for tweaking of some options that while normally should remain hidden, may need to be changed in some cases.
Signed-off-by Tom Rini <[email protected]>Acked-by Hans de Goede <[email protected]>Signed-off-by Hans de Goede <[email protected]>--- Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+)Kconfig +8
-0@@ -58,6 +58,14 @@ config CC_OPTIMIZE_FOR_SIZE endmenu # General setup +menuconfig EXPERT + bool "Configure standard U-Boot features (expert users)" + help + This option allows certain base U-Boot options and settings + to be disabled or tweaked. This is for specialized + environments which can tolerate a "non-standard" U-Boot. + Only use this if you really know what you are doing. + menu "Boot images" config SPL_BUILDSignature · 6 lines
2.1.0 _______________________________________________ U-Boot mailing list U-Boot at lists.denx.de http://lists.denx.de/mailman/listinfo/u-boot
PATCH v2 1/3 Kconfig: Add EXPERT option
Hello Masahiro,
Quoted 2 lines
I prefer describing the patch dependency in the cover letter to resending the same patch.
Ditto -- but since patch numbers won't matter once applied and since Tom is properly attributed, it won't matter much whether Tom applies his own patch or I apply it as part of this series.
I'll apply the series.
Amicalement,
Signature · 1 line
Albert.
PATCH v2 1/3 Kconfig: Add EXPERT option
Hi Albert,
Quoted 11 lines · On Fri, 14 Nov 2014 08:08:05 +0100 Albert ARIBAUD <[email protected]>…
Hello Masahiro,
Quoted 2 lines
I prefer describing the patch dependency in the cover letter to resending the same patch.
Ditto -- but since patch numbers won't matter once applied and since Tom is properly attributed, it won't matter much whether Tom applies his own patch or I apply it as part of this series.
I'll apply the series.
Yup, it won't make much of difference, although I issued my Acked-by to Tom's one and it is missing from Hans's.
Best Regards
Masahiro Yamada
PATCH v2 1/3 Kconfig: Add EXPERT option
Hello Masahiro,
Quoted 15 lines · Masahiro Yamada
Hi Albert,
Quoted 9 lines · On Fri, 14 Nov 2014 08:08:05 +0100 Albert ARIBAUD <[email protected]>…
Hello Masahiro,
Quoted 2 lines
I prefer describing the patch dependency in the cover letter to resending the same patch.
Ditto -- but since patch numbers won't matter once applied and since Tom is properly attributed, it won't matter much whether Tom applies his own patch or I apply it as part of this series.
Quoted 5 lines
Quoted 2 lines
I'll apply the series.
Yup, it won't make much of difference, although I issued my Acked-by to Tom's one and it is missing from Hans's.
Fair point. I'll make sure I add your Acked-by if I'm the one applying this patch.
Quoted 3 lines
Best Regards
Masahiro Yamada
Amicalement,
Signature · 1 line
Albert.
PATCH v2 1/3 Kconfig: Add EXPERT option
In reply to Hans de GoedeHello Hans,
Quoted 35 lines · Hans de Goede
From: Tom Rini <[email protected]>
For similar reasons to why the Linux Kernel has an EXPERT option, we too want an option to allow for tweaking of some options that while normally should remain hidden, may need to be changed in some cases.
Signed-off-by Tom Rini <[email protected]>Acked-by Hans de Goede <[email protected]>Signed-off-by Hans de Goede <[email protected]>--- Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+)Kconfig +8
-0@@ -58,6 +58,14 @@ config CC_OPTIMIZE_FOR_SIZE endmenu # General setup +menuconfig EXPERT + bool "Configure standard U-Boot features (expert users)" + help + This option allows certain base U-Boot options and settings + to be disabled or tweaked. This is for specialized + environments which can tolerate a "non-standard" U-Boot. + Only use this if you really know what you are doing. + menu "Boot images" config SPL_BUILDSignature · 1 line
2.1.0
Applied to u-boot-arm/master, thanks!
Amicalement,
Signature · 1 line
Albert.
PATCH v2 2/3 ARM: Add arch/arm/cpu/armv7/Kconfig with non-secure and virt options
In reply to Hans de GoedeAdd arch/arm/cpu/armv7/Kconfig with non-secure and virt options, this is a preparation patch for adding an env variable to choose between secure / non-secure boot on non-secure boot capable systems, specifically this prepares for adding CONFIG_CPU_V7_SEC_BY_DEFAULT as a proper Kconfig option.
--
Changes in v2:
-Drop all the FIXME-s, use proper CPU_V7 and CPU_V7_HAS_foo checks instead
--- arch/arm/Kconfig | 4 ++++ arch/arm/cpu/armv7/Kconfig | 23 +++++++++++++++++++++++ arch/arm/cpu/armv7/exynos/Kconfig | 2 ++ board/sunxi/Kconfig | 2 ++ include/configs/arndale.h | 2 -- include/configs/sun7i.h | 2 -- include/configs/vexpress_ca15_tc2.h | 2 -- 7 files changed, 31 insertions(+), 6 deletions(-) create mode 100644 arch/arm/cpu/armv7/Kconfig
arch/arm/Kconfig +4 -0
@@ -410,6 +410,8 @@ config TARGET_INTEGRATORCP_CM946ES config TARGET_VEXPRESS_CA15_TC2 bool "Support vexpress_ca15_tc2" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT config TARGET_VEXPRESS_CA5X2 bool "Support vexpress_ca5x2"
@@ -809,6 +811,8 @@ source "arch/arm/cpu/arm926ejs/versatile/Kconfig" source "arch/arm/cpu/armv7/zynq/Kconfig" +source "arch/arm/cpu/armv7/Kconfig" + source "board/aristainetos/Kconfig" source "board/BuR/kwb/Kconfig" source "board/BuR/tseries/Kconfig"
arch/arm/cpu/armv7/Kconfig new file +23 -0
@@ -0,0 +1,23 @@ +if CPU_V7 + +config CPU_V7_HAS_NONSEC + bool + +config CPU_V7_HAS_VIRT + bool + +config ARMV7_NONSEC + boolean "Enable support for booting in non-secure mode" if EXPERT + depends on CPU_V7_HAS_NONSEC + default y + ---help--- + Say Y here to enable support for booting in non-secure / SVC mode. + +config ARMV7_VIRT + boolean "Enable support for hardware virtualization" if EXPERT + depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC + default y + ---help--- + Say Y here to boot in hypervisor (HYP) mode when booting non-secure. + +endif
arch/arm/cpu/armv7/exynos/Kconfig +2 -0
@@ -26,6 +26,8 @@ config TARGET_ODROID config TARGET_ARNDALE bool "Exynos5250 Arndale board" + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL select OF_CONTROL if !SPL_BUILD
board/sunxi/Kconfig +2 -0
@@ -21,6 +21,8 @@ config MACH_SUN6I config MACH_SUN7I bool "sun7i (Allwinner A20)" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL config MACH_SUN8I
include/configs/arndale.h +0 -2
@@ -60,6 +60,4 @@/* The PERIPHBASE in the CBAR register is wrong on the Arndale, so override it */ #define CONFIG_ARM_GIC_BASE_ADDRESS 0x10480000 -#define CONFIG_ARMV7_VIRT -#endif /* __CONFIG_H */
include/configs/sun7i.h +0 -2
@@ -22,8 +22,6 @@#define CONFIG_USB_MAX_CONTROLLER_COUNT 2#endif -#define CONFIG_ARMV7_VIRT 1 -#define CONFIG_ARMV7_NONSEC 1#define CONFIG_ARMV7_PSCI 1#define CONFIG_ARMV7_PSCI_NR_CPUS 2#define CONFIG_ARMV7_SECURE_BASE SUNXI_SRAM_B_BASE
include/configs/vexpress_ca15_tc2.h +0 -2
@@ -18,6 +18,4 @@#define CONFIG_SYSFLAGS_ADDR 0x1c010030#define CONFIG_SMP_PEN_ADDR CONFIG_SYSFLAGS_ADDR -#define CONFIG_ARMV7_VIRT -#endif
Signature · 1 line
2.1.0
PATCH v2 2/3 ARM: Add arch/arm/cpu/armv7/Kconfig with non-secure and virt options
Hello Hans,
Quoted 4 lines · Hans de Goede
Add
arch/arm/cpu/armv7/Kconfigwith non-secure and virt options, this is a preparation patch for adding an env variable to choose between secure / non-secure boot on non-secure boot capable systems, specifically this prepares for addingCONFIG_CPU_V7_SEC_BY_DEFAULTas a properKconfigoption.
Does not seem like CONFIG_CPU_V7_SEC_BY_DEFAULT is ever defined once all three patches are applied.
OTOH, patch 3/3 defines CONFIG_ARMV7_BOOT_SEC_DEFAULT (but see my comments on it)
Quoted 45 lines
Signed-off-by Hans de Goede <[email protected]>--
Changes in v2:(quoted diff) +0
-2-Drop all the FIXME-s, use proper CPU_V7 and CPU_V7_HAS_foo checks instead --- arch/arm/Kconfig | 4 ++++ arch/arm/cpu/armv7/Kconfig | 23 +++++++++++++++++++++++ arch/arm/cpu/armv7/exynos/Kconfig | 2 ++ board/sunxi/Kconfig | 2 ++ include/configs/arndale.h | 2 -- include/configs/sun7i.h | 2 -- include/configs/vexpress_ca15_tc2.h | 2 -- 7 files changed, 31 insertions(+), 6 deletions(-) create mode 100644 arch/arm/cpu/armv7/Kconfigarch/arm/Kconfig +4
-0@@ -410,6 +410,8 @@ config TARGET_INTEGRATORCP_CM946ES config TARGET_VEXPRESS_CA15_TC2 bool "Support vexpress_ca15_tc2" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT config TARGET_VEXPRESS_CA5X2 bool "Support vexpress_ca5x2"@@ -809,6 +811,8 @@ source "arch/arm/cpu/arm926ejs/versatile/Kconfig" source "arch/arm/cpu/armv7/zynq/Kconfig" +source "arch/arm/cpu/armv7/Kconfig" + source "board/aristainetos/Kconfig" source "board/BuR/kwb/Kconfig" source "board/BuR/tseries/Kconfig"arch/arm/cpu/armv7/Kconfig new file +2
-0@@ -0,0 +1,23 @@ +if CPU_V7 +
arch/arm/cpu/armv7/Kconfig line 12
Quoted 10 lines
arch/arm/cpu/armv7/Kconfig new file +10
-0+config CPU_V7_HAS_NONSEC + bool + +config CPU_V7_HAS_VIRT + bool + +config ARMV7_NONSEC + boolean "Enable support for booting in non-secure mode" if EXPERT + depends on CPU_V7_HAS_NONSEC + default y
I'm not a Kconfig expert, but doesn't this "y" here mean that support for non-secure mode is enabled by default? And should'nt it be more logical / secure that the default b "n" to avoid accidentally building a non-secure-capable U-Boot?
arch/arm/cpu/armv7/Kconfig line 19
Quoted 7 lines
arch/arm/cpu/armv7/Kconfig new file +7
-0+ ---help--- + Say Y here to enable support for booting in non-secure / SVC mode. + +config ARMV7_VIRT + boolean "Enable support for hardware virtualization" if EXPERT + depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC + default y
Same here.
Quoted 68 lines
arch/arm/cpu/armv7/Kconfig new file +4
-0+ ---help--- + Say Y here to boot in hypervisor (HYP) mode when booting non-secure. + +endifarch/arm/cpu/armv7/exynos/Kconfig +2
-0@@ -26,6 +26,8 @@ config TARGET_ODROID config TARGET_ARNDALE bool "Exynos5250 Arndale board" + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL select OF_CONTROL if !SPL_BUILDboard/sunxi/Kconfig +2
-0@@ -21,6 +21,8 @@ config MACH_SUN6I config MACH_SUN7I bool "sun7i (Allwinner A20)" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL config MACH_SUN8Iinclude/configs/arndale.h +0
-2@@ -60,6 +60,4 @@/* The PERIPHBASE in the CBAR register is wrong on the Arndale, so override it */ #define CONFIG_ARM_GIC_BASE_ADDRESS 0x10480000 -#define CONFIG_ARMV7_VIRT -#endif /* __CONFIG_H */ include/configs/sun7i.h +0
-2@@ -22,8 +22,6 @@#define CONFIG_USB_MAX_CONTROLLER_COUNT 2#endif -#define CONFIG_ARMV7_VIRT 1 -#define CONFIG_ARMV7_NONSEC 1#define CONFIG_ARMV7_PSCI 1#define CONFIG_ARMV7_PSCI_NR_CPUS 2#define CONFIG_ARMV7_SECURE_BASE SUNXI_SRAM_B_BASEinclude/configs/vexpress_ca15_tc2.h +0
-2@@ -18,6 +18,4 @@#define CONFIG_SYSFLAGS_ADDR 0x1c010030#define CONFIG_SMP_PEN_ADDR CONFIG_SYSFLAGS_ADDR -#define CONFIG_ARMV7_VIRT -#endif Signature · 1 line
2.1.0
Amicalement,
Signature · 1 line
Albert.
PATCH v2 2/3 ARM: Add arch/arm/cpu/armv7/Kconfig with non-secure and virt options
Hi,
Quoted 9 lines · Albert ARIBAUD
Hello Hans,
Quoted 4 lines · Hans de Goede
Add
arch/arm/cpu/armv7/Kconfigwith non-secure and virt options, this is a preparation patch for adding an env variable to choose between secure / non-secure boot on non-secure boot capable systems, specifically this prepares for addingCONFIG_CPU_V7_SEC_BY_DEFAULTas a properKconfigoption.
Quoted 5 lines
Does not seem like
CONFIG_CPU_V7_SEC_BY_DEFAULTis ever defined once all three patches are applied.OTOH, patch 3/3 defines
CONFIG_ARMV7_BOOT_SEC_DEFAULT(but see my comments on it)
Yes, my bad, I'll fix up the commit message.
Quoted 51 lines
Quoted 51 lines
Signed-off-by Hans de Goede <[email protected]>--
Changes in v2:(quoted diff) +0
-2-Drop all the FIXME-s, use proper CPU_V7 and CPU_V7_HAS_foo checks instead --- arch/arm/Kconfig | 4 ++++ arch/arm/cpu/armv7/Kconfig | 23 +++++++++++++++++++++++ arch/arm/cpu/armv7/exynos/Kconfig | 2 ++ board/sunxi/Kconfig | 2 ++ include/configs/arndale.h | 2 -- include/configs/sun7i.h | 2 -- include/configs/vexpress_ca15_tc2.h | 2 -- 7 files changed, 31 insertions(+), 6 deletions(-) create mode 100644 arch/arm/cpu/armv7/Kconfigarch/arm/Kconfig +4
-0@@ -410,6 +410,8 @@ config TARGET_INTEGRATORCP_CM946ES config TARGET_VEXPRESS_CA15_TC2 bool "Support vexpress_ca15_tc2" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT config TARGET_VEXPRESS_CA5X2 bool "Support vexpress_ca5x2"@@ -809,6 +811,8 @@ source "arch/arm/cpu/arm926ejs/versatile/Kconfig" source "arch/arm/cpu/armv7/zynq/Kconfig" +source "arch/arm/cpu/armv7/Kconfig" + source "board/aristainetos/Kconfig" source "board/BuR/kwb/Kconfig" source "board/BuR/tseries/Kconfig"arch/arm/cpu/armv7/Kconfig new file +7
-0@@ -0,0 +1,23 @@ +if CPU_V7 + +config CPU_V7_HAS_NONSEC + bool + +config CPU_V7_HAS_VIRT + bool
Quoted 8 lines
arch/arm/cpu/armv7/Kconfig line 12
Quoted 5 lines
arch/arm/cpu/armv7/Kconfig new file +5
-0+ +config ARMV7_NONSEC + boolean "Enable support for booting in non-secure mode" if EXPERT + depends on CPU_V7_HAS_NONSEC + default yI'm not a
Kconfigexpert, but doesn't this "y" here mean that support for non-secure mode is enabled by default?
It does.
Quoted 3 lines
And should'nt it be more
logical / secure that the default b "n" to avoid accidentally building a non-secure-capable U-Boot?
This is preserving the current default behavior, where all non-secure boot capable platforms default to building with non-secure boot enabled.
Quoted 10 lines
arch/arm/cpu/armv7/Kconfig line 19
Quoted 8 lines
arch/arm/cpu/armv7/Kconfig new file +7
-0+ ---help--- + Say Y here to enable support for booting in non-secure / SVC mode. + +config ARMV7_VIRT + boolean "Enable support for hardware virtualization" if EXPERT + depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC + default ySame here.
Same.
Quoted 63 lines
Quoted 63 lines
arch/arm/cpu/armv7/Kconfig new file +4
-0+ ---help--- + Say Y here to boot in hypervisor (HYP) mode when booting non-secure. + +endifarch/arm/cpu/armv7/exynos/Kconfig +2
-0@@ -26,6 +26,8 @@ config TARGET_ODROID config TARGET_ARNDALE bool "Exynos5250 Arndale board" + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL select OF_CONTROL if !SPL_BUILDboard/sunxi/Kconfig +2
-0@@ -21,6 +21,8 @@ config MACH_SUN6I config MACH_SUN7I bool "sun7i (Allwinner A20)" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL config MACH_SUN8Iinclude/configs/arndale.h +0
-2@@ -60,6 +60,4 @@/* The PERIPHBASE in the CBAR register is wrong on the Arndale, so override it */ #define CONFIG_ARM_GIC_BASE_ADDRESS 0x10480000 -#define CONFIG_ARMV7_VIRT -#endif /* __CONFIG_H */ include/configs/sun7i.h +0
-2@@ -22,8 +22,6 @@#define CONFIG_USB_MAX_CONTROLLER_COUNT 2#endif -#define CONFIG_ARMV7_VIRT 1 -#define CONFIG_ARMV7_NONSEC 1#define CONFIG_ARMV7_PSCI 1#define CONFIG_ARMV7_PSCI_NR_CPUS 2#define CONFIG_ARMV7_SECURE_BASE SUNXI_SRAM_B_BASEinclude/configs/vexpress_ca15_tc2.h +0
-0@@ -18,6 +18,4 @@#define CONFIG_SYSFLAGS_ADDR 0x1c010030#define CONFIG_SMP_PEN_ADDR CONFIG_SYSFLAGS_ADDR
Quoted 5 lines
Quoted 5 lines
include/configs/vexpress_ca15_tc2.h +0
-2-#define CONFIG_ARMV7_VIRT -#endif Signature · 1 line
2.1.0
Regards,
Hans
PATCH v2 2/3 ARM: Add arch/arm/cpu/armv7/Kconfig with non-secure and virt options
In reply to Hans de GoedeHello Hans,
Quoted 135 lines · Hans de Goede
Add
arch/arm/cpu/armv7/Kconfigwith non-secure and virt options, this is a preparation patch for adding an env variable to choose between secure / non-secure boot on non-secure boot capable systems, specifically this prepares for addingCONFIG_CPU_V7_SEC_BY_DEFAULTas a properKconfigoption.Signed-off-by Hans de Goede <[email protected]>--
Changes in v2:(quoted diff) +0
-2-Drop all the FIXME-s, use proper CPU_V7 and CPU_V7_HAS_foo checks instead --- arch/arm/Kconfig | 4 ++++ arch/arm/cpu/armv7/Kconfig | 23 +++++++++++++++++++++++ arch/arm/cpu/armv7/exynos/Kconfig | 2 ++ board/sunxi/Kconfig | 2 ++ include/configs/arndale.h | 2 -- include/configs/sun7i.h | 2 -- include/configs/vexpress_ca15_tc2.h | 2 -- 7 files changed, 31 insertions(+), 6 deletions(-) create mode 100644 arch/arm/cpu/armv7/Kconfigarch/arm/Kconfig +4
-0@@ -410,6 +410,8 @@ config TARGET_INTEGRATORCP_CM946ES config TARGET_VEXPRESS_CA15_TC2 bool "Support vexpress_ca15_tc2" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT config TARGET_VEXPRESS_CA5X2 bool "Support vexpress_ca5x2"@@ -809,6 +811,8 @@ source "arch/arm/cpu/arm926ejs/versatile/Kconfig" source "arch/arm/cpu/armv7/zynq/Kconfig" +source "arch/arm/cpu/armv7/Kconfig" + source "board/aristainetos/Kconfig" source "board/BuR/kwb/Kconfig" source "board/BuR/tseries/Kconfig"arch/arm/cpu/armv7/Kconfig new file +23
-0@@ -0,0 +1,23 @@ +if CPU_V7 + +config CPU_V7_HAS_NONSEC + bool + +config CPU_V7_HAS_VIRT + bool + +config ARMV7_NONSEC + boolean "Enable support for booting in non-secure mode" if EXPERT + depends on CPU_V7_HAS_NONSEC + default y + ---help--- + Say Y here to enable support for booting in non-secure / SVC mode. + +config ARMV7_VIRT + boolean "Enable support for hardware virtualization" if EXPERT + depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC + default y + ---help--- + Say Y here to boot in hypervisor (HYP) mode when booting non-secure. + +endifarch/arm/cpu/armv7/exynos/Kconfig +2
-0@@ -26,6 +26,8 @@ config TARGET_ODROID config TARGET_ARNDALE bool "Exynos5250 Arndale board" + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL select OF_CONTROL if !SPL_BUILDboard/sunxi/Kconfig +2
-0@@ -21,6 +21,8 @@ config MACH_SUN6I config MACH_SUN7I bool "sun7i (Allwinner A20)" select CPU_V7 + select CPU_V7_HAS_NONSEC + select CPU_V7_HAS_VIRT select SUPPORT_SPL config MACH_SUN8Iinclude/configs/arndale.h +0
-2@@ -60,6 +60,4 @@/* The PERIPHBASE in the CBAR register is wrong on the Arndale, so override it */ #define CONFIG_ARM_GIC_BASE_ADDRESS 0x10480000 -#define CONFIG_ARMV7_VIRT -#endif /* __CONFIG_H */ include/configs/sun7i.h +0
-2@@ -22,8 +22,6 @@#define CONFIG_USB_MAX_CONTROLLER_COUNT 2#endif -#define CONFIG_ARMV7_VIRT 1 -#define CONFIG_ARMV7_NONSEC 1#define CONFIG_ARMV7_PSCI 1#define CONFIG_ARMV7_PSCI_NR_CPUS 2#define CONFIG_ARMV7_SECURE_BASE SUNXI_SRAM_B_BASEinclude/configs/vexpress_ca15_tc2.h +0
-2@@ -18,6 +18,4 @@#define CONFIG_SYSFLAGS_ADDR 0x1c010030#define CONFIG_SMP_PEN_ADDR CONFIG_SYSFLAGS_ADDR -#define CONFIG_ARMV7_VIRT -#endif Signature · 1 line
2.1.0
Applied to u-boot-arm/master, thanks!
Amicalement,
Signature · 1 line
Albert.
PATCH v2 3/3 ARM: bootm: Allow booting in secure mode on hyp capable systems
In reply to Hans de GoedeOlder Linux kernels will not properly boot in hyp mode, add support for a bootm_boot_mode environment variable, which can be set to "sec" or "nonsec" to force booting in secure or non-secure mode when build with non-sec support.
The default behavior can be selected through CONFIG_ARMV7_BOOT_SEC_DEFAULT, when this is set booting in secure mode is the default. The default setting for this Kconfig option is N, preserving the current behavior of booting in non-secure mode by default when non-secure mode is supported.
--
Changes in v2:
-Allow changing the default boot mode to secure through defining
CONFIG_ARMV7_BOOT_SEC_DEFAULT, this is useful for archs which have a Kconfig option for compatibility with older kernels
Changes in v3:
-Add an else at the end of the #ifdef NONSEC block so that if do_nonsec_entry
fails we do not end up re-trying in secure mode
Changes in v4:
-Add a Kconfig option to select to boot in secure or non-secure mode by default
--- arch/arm/cpu/armv7/Kconfig | 11 +++++++++++ arch/arm/lib/bootm.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 37 insertions(+), 5 deletions(-)
arch/arm/cpu/armv7/Kconfig +11 -0
@@ -13,6 +13,17 @@ config ARMV7_NONSEC ---help--- Say Y here to enable support for booting in non-secure / SVC mode. +config ARMV7_BOOT_SEC_DEFAULT + boolean "Boot in secure mode by default" if EXPERT + depends on ARMV7_NONSEC + default n + ---help--- + Say Y here to boot in secure mode by default even if non-secure mode + is supported. This option is useful to boot kernels which do not + suppport booting in secure mode. Only set this if you need it. + This can be overriden at run-time by setting the bootm_boot_mode env. + variable to "sec" or "nonsec". + config ARMV7_VIRT boolean "Enable support for hardware virtualization" if EXPERT depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC
arch/arm/lib/bootm.c +26 -5
@@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images) } } +#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) +static bool boot_nonsec (void ) +{ +char *s =getenv ("bootm_boot_mode" ); +#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT +bool nonsec = false; +#else +bool nonsec = true; +#endif + +if (s && !strcmp (s,"sec" )) + nonsec = false; + +if (s && !strcmp (s,"nonsec" )) + nonsec = true; + +return nonsec; +} +#endif +/* Subcommand: GO */ static void boot_jump_linux (bootm_headers_t *images,int flag) {
@@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)if (!fake) {#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) -armv7_init_nonsec (); -secure_ram_addr (_do_nonsec_entry)(kernel_entry, -0 , machid, r2); -#else -kernel_entry (0 , machid, r2); +if (boot_nonsec ()) { +armv7_init_nonsec (); +secure_ram_addr (_do_nonsec_entry)(kernel_entry, +0 , machid, r2); + } else#endif +kernel_entry (0 , machid, r2); }#endif }
Signature · 1 line
2.1.0
PATCH v2 3/3 ARM: bootm: Allow booting in secure mode on hyp capable systems
Hello Hans,
Quoted 35 lines · Hans de Goede
Older Linux kernels will not properly boot in hyp mode, add support for a
bootm_boot_modeenvironment variable, which can be set to "sec" or "nonsec" to force booting in secure or non-secure mode when build with non-sec support.The default behavior can be selected through
CONFIG_ARMV7_BOOT_SEC_DEFAULT, when this is set booting in secure mode is the default. The default setting for thisKconfigoption is N, preserving the current behavior of booting in non-secure mode by default when non-secure mode is supported.Signed-off-by Hans de Goede <[email protected]>Acked-by Marc Zyngier <[email protected]>--
Changes in v2:
-Allow changing the default boot mode to secure through defining
CONFIG_ARMV7_BOOT_SEC_DEFAULT, this is useful for archs which have aKconfigoption for compatibility with older kernels
Changes in v3:
-Add an else at the end of the #ifdef NONSEC block so that ifdo_nonsec_entry
fails we do not end up re-trying in secure mode
Changes in v4:(quoted diff) +0
-2-Add a Kconfig option to select to boot in secure or non-secure mode by default --- arch/arm/cpu/armv7/Kconfig | 11 +++++++++++ arch/arm/lib/bootm.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 37 insertions(+), 5 deletions(-)arch/arm/cpu/armv7/Kconfig +0
-0@@ -13,6 +13,17 @@ config ARMV7_NONSEC ---help--- Say Y here to enable support for booting in non-secure / SVC mode.
arch/arm/cpu/armv7/Kconfig config ARMV7_NONSEC · line 25
Quoted 10 lines
arch/arm/cpu/armv7/Kconfig +10
-0+config ARMV7_BOOT_SEC_DEFAULT + boolean "Boot in secure mode by default" if EXPERT + depends on ARMV7_NONSEC + default n + ---help--- + Say Y here to boot in secure mode by default even if non-secure mode + is supported. This option is useful to boot kernels which do not + suppport booting in secure mode. Only set this if you need it. + This can be overriden at run-time by setting the bootm_boot_mode env. + variable to "sec" or "nonsec".
Not sure I'm getting this right, but it seems to me that forcing secure boot mode for kernels that don't support secure boot mode is kind of contradictory. Did you mean "... for kernels which do not suport booting in *non*-secure mode..." ?
Quoted 56 lines
arch/arm/cpu/armv7/Kconfig +0
-0config ARMV7_VIRT boolean "Enable support for hardware virtualization" if EXPERT depends on CPU_V7_HAS_VIRT && ARMV7_NONSECarch/arm/lib/bootm.c +26
-5@@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images) } } +#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) +static bool boot_nonsec (void ) +{ +char *s =getenv ("bootm_boot_mode" ); +#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT +bool nonsec = false; +#else +bool nonsec = true; +#endif + +if (s && !strcmp (s,"sec" )) + nonsec = false; + +if (s && !strcmp (s,"nonsec" )) + nonsec = true; + +return nonsec; +} +#endif +/* Subcommand: GO */ static void boot_jump_linux (bootm_headers_t *images,int flag) {@@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)if (!fake) {#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) -armv7_init_nonsec (); -secure_ram_addr (_do_nonsec_entry)(kernel_entry, -0 , machid, r2); -#else -kernel_entry (0 , machid, r2); +if (boot_nonsec ()) { +armv7_init_nonsec (); +secure_ram_addr (_do_nonsec_entry)(kernel_entry, +0 , machid, r2); + } else#endif +kernel_entry (0 , machid, r2); }#endif }Signature · 1 line
2.1.0
Amicalement,
Signature · 1 line
Albert.
PATCH v2 3/3 ARM: bootm: Allow booting in secure mode on hyp capable systems
Hi,
Quoted 39 lines · Albert ARIBAUD
Hello Hans,
Quoted 35 lines · Hans de Goede
Older Linux kernels will not properly boot in hyp mode, add support for a
bootm_boot_modeenvironment variable, which can be set to "sec" or "nonsec" to force booting in secure or non-secure mode when build with non-sec support.The default behavior can be selected through
CONFIG_ARMV7_BOOT_SEC_DEFAULT, when this is set booting in secure mode is the default. The default setting for thisKconfigoption is N, preserving the current behavior of booting in non-secure mode by default when non-secure mode is supported.Signed-off-by Hans de Goede <[email protected]>Acked-by Marc Zyngier <[email protected]>--
Changes in v2:
-Allow changing the default boot mode to secure through defining
CONFIG_ARMV7_BOOT_SEC_DEFAULT, this is useful for archs which have aKconfigoption for compatibility with older kernels
Changes in v3:
-Add an else at the end of the #ifdef NONSEC block so that ifdo_nonsec_entry
fails we do not end up re-trying in secure mode
Changes in v4:(quoted diff) +0
-2-Add a Kconfig option to select to boot in secure or non-secure mode by default --- arch/arm/cpu/armv7/Kconfig | 11 +++++++++++ arch/arm/lib/bootm.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 37 insertions(+), 5 deletions(-)arch/arm/cpu/armv7/Kconfig +0
-0@@ -13,6 +13,17 @@ config ARMV7_NONSEC ---help--- Say Y here to enable support for booting in non-secure / SVC mode.
Quoted 15 lines
arch/arm/cpu/armv7/Kconfig config ARMV7_NONSEC · line 25
Quoted 10 lines
arch/arm/cpu/armv7/Kconfig +10
-0+config ARMV7_BOOT_SEC_DEFAULT + boolean "Boot in secure mode by default" if EXPERT + depends on ARMV7_NONSEC + default n + ---help--- + Say Y here to boot in secure mode by default even if non-secure mode + is supported. This option is useful to boot kernels which do not + suppport booting in secure mode. Only set this if you need it. + This can be overriden at run-time by setting the bootm_boot_mode env. + variable to "sec" or "nonsec".Not sure I'm getting this right, but it seems to me that forcing secure boot mode for kernels that don't support secure boot mode is kind of contradictory. Did you mean "... for kernels which do not suport booting in *non*-secure mode..." ?
Yes, my bad will fix in v5.
Quoted 48 lines
Quoted 48 lines
arch/arm/cpu/armv7/Kconfig +0
-0config ARMV7_VIRT boolean "Enable support for hardware virtualization" if EXPERT depends on CPU_V7_HAS_VIRT && ARMV7_NONSECarch/arm/lib/bootm.c +24
-5@@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images) } } +#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) +static bool boot_nonsec (void ) +{ +char *s =getenv ("bootm_boot_mode" ); +#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT +bool nonsec = false; +#else +bool nonsec = true; +#endif + +if (s && !strcmp (s,"sec" )) + nonsec = false; + +if (s && !strcmp (s,"nonsec" )) + nonsec = true; + +return nonsec; +} +#endif +/* Subcommand: GO */ static void boot_jump_linux (bootm_headers_t *images,int flag) {@@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)if (!fake) {#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) -armv7_init_nonsec (); -secure_ram_addr (_do_nonsec_entry)(kernel_entry, -0 , machid, r2); -#else -kernel_entry (0 , machid, r2); +if (boot_nonsec ()) { +armv7_init_nonsec (); +secure_ram_addr (_do_nonsec_entry)(kernel_entry, +0 , machid, r2);
Quoted 8 lines
Quoted 8 lines
arch/arm/lib/bootm.c +2
-0+ } else#endif +kernel_entry (0 , machid, r2); }#endif }Signature · 1 line
2.1.0
Regards,
Hans
PATCH v2 3/3 ARM: bootm: Allow booting in secure mode on hyp capable systems
In reply to Hans de GoedeHello Hans,
Quoted 102 lines · Hans de Goede
Older Linux kernels will not properly boot in hyp mode, add support for a
bootm_boot_modeenvironment variable, which can be set to "sec" or "nonsec" to force booting in secure or non-secure mode when build with non-sec support.The default behavior can be selected through
CONFIG_ARMV7_BOOT_SEC_DEFAULT, when this is set booting in secure mode is the default. The default setting for thisKconfigoption is N, preserving the current behavior of booting in non-secure mode by default when non-secure mode is supported.Signed-off-by Hans de Goede <[email protected]>Acked-by Marc Zyngier <[email protected]>--
Changes in v2:
-Allow changing the default boot mode to secure through defining
CONFIG_ARMV7_BOOT_SEC_DEFAULT, this is useful for archs which have aKconfigoption for compatibility with older kernels
Changes in v3:
-Add an else at the end of the #ifdef NONSEC block so that ifdo_nonsec_entry
fails we do not end up re-trying in secure mode
Changes in v4:(quoted diff) +0
-2-Add a Kconfig option to select to boot in secure or non-secure mode by default --- arch/arm/cpu/armv7/Kconfig | 11 +++++++++++ arch/arm/lib/bootm.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 37 insertions(+), 5 deletions(-)arch/arm/cpu/armv7/Kconfig +11
-0@@ -13,6 +13,17 @@ config ARMV7_NONSEC ---help--- Say Y here to enable support for booting in non-secure / SVC mode. +config ARMV7_BOOT_SEC_DEFAULT + boolean "Boot in secure mode by default" if EXPERT + depends on ARMV7_NONSEC + default n + ---help--- + Say Y here to boot in secure mode by default even if non-secure mode + is supported. This option is useful to boot kernels which do not + suppport booting in secure mode. Only set this if you need it. + This can be overriden at run-time by setting the bootm_boot_mode env. + variable to "sec" or "nonsec". + config ARMV7_VIRT boolean "Enable support for hardware virtualization" if EXPERT depends on CPU_V7_HAS_VIRT && ARMV7_NONSECarch/arm/lib/bootm.c +26
-5@@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images) } } +#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) +static bool boot_nonsec (void ) +{ +char *s =getenv ("bootm_boot_mode" ); +#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT +bool nonsec = false; +#else +bool nonsec = true; +#endif + +if (s && !strcmp (s,"sec" )) + nonsec = false; + +if (s && !strcmp (s,"nonsec" )) + nonsec = true; + +return nonsec; +} +#endif +/* Subcommand: GO */ static void boot_jump_linux (bootm_headers_t *images,int flag) {@@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)if (!fake) {#if defined(CONFIG_ARMV7_NONSEC ) || defined(CONFIG_ARMV7_VIRT ) -armv7_init_nonsec (); -secure_ram_addr (_do_nonsec_entry)(kernel_entry, -0 , machid, r2); -#else -kernel_entry (0 , machid, r2); +if (boot_nonsec ()) { +armv7_init_nonsec (); +secure_ram_addr (_do_nonsec_entry)(kernel_entry, +0 , machid, r2); + } else#endif +kernel_entry (0 , machid, r2); }#endif }Signature · 1 line
2.1.0
Applied to u-boot-arm/master, thanks!
Amicalement,
Signature · 1 line
Albert.
v2 cover ARM: Add armv7/Kconfig and allow booting in secure mode on non-secure boot capable systems
In reply to Hans de GoedeHello Hans,
Quoted 6 lines · Hans de Goede
Hi Albert,
Here is v2 of my patchset to allow booting in secure mode on non-secure boot capable systems. See inside the patch commit messages for a detailed changelog, the 3th patch in the set goes to a higher version as it also was posted on its own 2 times.
Noted. If you ever find yourself in the same situation again, please bump up patchset version to the patch version (here, that would have meant bumping up 0/3, 1/3 and 2/3 to v4).
You can automate a lot of this by using tools/patman.
Quoted 6 lines
The first patch is from Tom, and is included because my patches depend on it, AFAIK it is ready for merging (so it can go in through your tree), it is just waiting for someone to actually use the EXPERT option which this patch-set does.
Please review, and if you're happy with the patches, merge them.
Reviewing them right now.
Quoted 3 lines
Thanks & Regards,
Hans
Amicalement,
Signature · 1 line
Albert.