4 files changed, 66 insertions, 5 deletions
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 5241cb4..b9ac59e 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -415,6 +415,8 @@ config TARGET_INTEGRATORCP_CM946ES
 config TARGET_VEXPRESS_CA15_TC2
 	bool "Support vexpress_ca15_tc2"
 	select CPU_V7
+	select CPU_V7_HAS_NONSEC
+	select CPU_V7_HAS_VIRT
 
 config TARGET_VEXPRESS_CA5X2
 	bool "Support vexpress_ca5x2"
@@ -826,6 +828,8 @@ source "arch/arm/cpu/arm926ejs/versatile/Kconfig"
 
 source "arch/arm/cpu/armv7/zynq/Kconfig"
 
+source "arch/arm/cpu/armv7/Kconfig"
+
 source "board/aristainetos/Kconfig"
 source "board/BuR/kwb/Kconfig"
 source "board/BuR/tseries/Kconfig"
diff --git a/arch/arm/cpu/armv7/Kconfig b/arch/arm/cpu/armv7/Kconfig
new file mode 100644
index 0000000..61e7c82
--- /dev/null
+++ b/arch/arm/cpu/armv7/Kconfig
@@ -0,0 +1,34 @@
+if CPU_V7
+
+config CPU_V7_HAS_NONSEC
+        bool
+
+config CPU_V7_HAS_VIRT
+        bool
+
+config ARMV7_NONSEC
+	boolean "Enable support for booting in non-secure mode" if EXPERT
+	depends on CPU_V7_HAS_NONSEC
+	default y
+	---help---
+	Say Y here to enable support for booting in non-secure / SVC mode.
+
+config ARMV7_BOOT_SEC_DEFAULT
+	boolean "Boot in secure mode by default" if EXPERT
+	depends on ARMV7_NONSEC
+	default n
+	---help---
+	Say Y here to boot in secure mode by default even if non-secure mode
+	is supported. This option is useful to boot kernels which do not
+	suppport booting in non-secure mode. Only set this if you need it.
+	This can be overriden at run-time by setting the bootm_boot_mode env.
+	variable to "sec" or "nonsec".
+
+config ARMV7_VIRT
+	boolean "Enable support for hardware virtualization" if EXPERT
+	depends on CPU_V7_HAS_VIRT && ARMV7_NONSEC
+	default y
+	---help---
+	Say Y here to boot in hypervisor (HYP) mode when booting non-secure.
+
+endif
diff --git a/arch/arm/cpu/armv7/exynos/Kconfig b/arch/arm/cpu/armv7/exynos/Kconfig
index 090be93..e9a102c 100644
--- a/arch/arm/cpu/armv7/exynos/Kconfig
+++ b/arch/arm/cpu/armv7/exynos/Kconfig
@@ -26,6 +26,8 @@ config TARGET_ODROID
 
 config TARGET_ARNDALE
 	bool "Exynos5250 Arndale board"
+	select CPU_V7_HAS_NONSEC
+	select CPU_V7_HAS_VIRT
 	select SUPPORT_SPL
 	select OF_CONTROL if !SPL_BUILD
 
diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
index 4949d57..a7f7c67 100644
--- a/arch/arm/lib/bootm.c
+++ b/arch/arm/lib/bootm.c
@@ -237,6 +237,26 @@ static void boot_prep_linux(bootm_headers_t *images)
 	}
 }
 
+#if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
+static bool boot_nonsec(void)
+{
+	char *s = getenv("bootm_boot_mode");
+#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT
+	bool nonsec = false;
+#else
+	bool nonsec = true;
+#endif
+
+	if (s && !strcmp(s, "sec"))
+		nonsec = false;
+
+	if (s && !strcmp(s, "nonsec"))
+		nonsec = true;
+
+	return nonsec;
+}
+#endif
+
 /* Subcommand: GO */
 static void boot_jump_linux(bootm_headers_t *images, int flag)
 {
@@ -285,12 +305,13 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
 
 	if (!fake) {
 #if defined(CONFIG_ARMV7_NONSEC) || defined(CONFIG_ARMV7_VIRT)
-		armv7_init_nonsec();
-		secure_ram_addr(_do_nonsec_entry)(kernel_entry,
-						  0, machid, r2);
-#else
-		kernel_entry(0, machid, r2);
+		if (boot_nonsec()) {
+			armv7_init_nonsec();
+			secure_ram_addr(_do_nonsec_entry)(kernel_entry,
+							  0, machid, r2);
+		} else
 #endif
+			kernel_entry(0, machid, r2);
 	}
 #endif
 }