Running u-boot in EL2

Hi,

I'm working on porting our hypervisor to the S4 platform and need u-boot to run (and later start the HV) in EL2. I already managed u-boot to start from EL2 by manually patching bl31 of the ATF. My diff looks like this:

diff --git a/bl31/bl31_main.c b/bl31/bl31_main.c
index 44bf32cb7..43e88c02e 100644
--- a/bl31/bl31_main.c
+++ b/bl31/bl31_main.c
@@ -212,8 +212,9 @@ void __init bl31_prepare_next_image_entry(void)
 	assert(next_image_info != NULL);
 	assert(image_type == GET_SECURITY_STATE(next_image_info->h.attr));
 
-	INFO("BL31: Preparing for EL3 exit to %s world\n",
-		(image_type == SECURE) ? "secure" : "normal");
+	INFO("BL31: Preparing for EL3 exit to %s world in EL%d\n",
+		(image_type == SECURE) ? "secure" : "normal",
+		GET_EL(next_image_info->spsr));
 	print_entry_point_info(next_image_info);
 	cm_init_my_context(next_image_info);
 	cm_prepare_el3_exit(image_type);
diff --git a/plat/renesas/rcar_gen4/bl31_plat_setup.c b/plat/renesas/rcar_gen4/bl31_plat_setup.c
index 78d9c9d1c..767bfbc3d 100644
--- a/plat/renesas/rcar_gen4/bl31_plat_setup.c
+++ b/plat/renesas/rcar_gen4/bl31_plat_setup.c
@@ -22,6 +22,15 @@
 #include "rcar_private.h"
 #include "rcar_version.h"
 
+#if (RCAR_BL33_EXECUTION_EL == 1)
+#define BL33_MODE MODE_EL1
+#elif (RCAR_BL33_EXECUTION_EL == 2)
+#define BL33_MODE MODE_EL2
+#else
+#warning "RCAR_BL33_EXECUTION_EL not supported, defaulting to EL1"
+#define BL33_MODE MODE_EL1
+#endif
+
 
 static u_register_t rcar_boot_mpidr;
 
@@ -46,6 +55,9 @@ struct entry_point_info *bl31_plat_get_next_image_ep_info(uint32_t type)
 	next_image_info = (type == NON_SECURE) ?
 		&from_bl2->bl33_ep_info : &from_bl2->bl32_ep_info;
 
+	next_image_info->spsr = (type == NON_SECURE) ? SPSR_64(BL33_MODE,
+			MODE_SP_ELX, DISABLE_ALL_EXCEPTIONS) : next_image_info->spsr;
+
 	return (next_image_info->pc != 0U) ? next_image_info : NULL;
 }
 
diff --git a/plat/renesas/rcar_gen4/platform.mk b/plat/renesas/rcar_gen4/platform.mk
index 5d1f21736..287134527 100644
--- a/plat/renesas/rcar_gen4/platform.mk
+++ b/plat/renesas/rcar_gen4/platform.mk
@@ -80,6 +80,12 @@ PLAT_INCLUDES	+=	-Idrivers/arm/css/scmi				\
 			-Iinclude/drivers
 #
 
+# Process RCAR_BL33_EXECUTION_EL flag
+ifndef RCAR_BL33_EXECUTION_EL
+RCAR_BL33_EXECUTION_EL := 1
+endif
+$(eval $(call add_define,RCAR_BL33_EXECUTION_EL))
+
 BL31_SOURCES	+=	${RCAR_GIC_SOURCES}				\
 			lib/cpus/aarch64/cortex_a55.S			\
 			plat/common/plat_psci_common.c			\

Basically, I change the exception level by modifying the spsr for the non secure image. While this seem to work (I booted a Linux and saw that the CPU cores get started in EL2), I would like to understand which component of the S4 bootchain provides the bl2_to_bl31_params_mem_t to bl31 at PARAMS_BASE in the first place. Also, I would be nice to know if I can simply modify the spsr at it's origin and revert my current patch.

Best regards
Matthias