From: Rajesh Bhagat <rajesh.bhagat@nxp.com>
Date: Thu, 27 Dec 2018 04:37:59 +0000 (+0000)
Subject: armv8: ls2088ardb: Add TFABOOT support
X-Git-Url: http://git.dujemihanovic.xyz/img/static/gitweb.css?a=commitdiff_plain;h=9570df03ee37f437f9ba3ddc25c8c6527a396992;p=u-boot.git

armv8: ls2088ardb: Add TFABOOT support

TFABOOT support includes:
  - ls2088ardb_tfa_defconfig to be loaded by trusted firmware
  - environment address and size changes for TFABOOT
  - define BOOTCOMMAND for TFABOOT
  - remove EL3 specific erratas for TFABOOT

Signed-off-by: Pankit Garg <pankit.garg@nxp.com>
Signed-off-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Signed-off-by: Rajesh Bhagat <rajesh.bhagat@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
---

diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
index 4e6a3cb223..01c5068ab6 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
+++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
@@ -145,20 +145,20 @@ config ARCH_LS2080A
 	select SYS_FSL_SRDS_2
 	select FSL_TZASC_1
 	select FSL_TZASC_2
-	select SYS_FSL_ERRATUM_A008336
-	select SYS_FSL_ERRATUM_A008511
-	select SYS_FSL_ERRATUM_A008514
+	select SYS_FSL_ERRATUM_A008336 if !TFABOOT
+	select SYS_FSL_ERRATUM_A008511 if !TFABOOT
+	select SYS_FSL_ERRATUM_A008514 if !TFABOOT
 	select SYS_FSL_ERRATUM_A008585
 	select SYS_FSL_ERRATUM_A008997
 	select SYS_FSL_ERRATUM_A009007
 	select SYS_FSL_ERRATUM_A009008
 	select SYS_FSL_ERRATUM_A009635
-	select SYS_FSL_ERRATUM_A009663
+	select SYS_FSL_ERRATUM_A009663 if !TFABOOT
 	select SYS_FSL_ERRATUM_A009798
 	select SYS_FSL_ERRATUM_A009801
-	select SYS_FSL_ERRATUM_A009803
-	select SYS_FSL_ERRATUM_A009942
-	select SYS_FSL_ERRATUM_A010165
+	select SYS_FSL_ERRATUM_A009803 if !TFABOOT
+	select SYS_FSL_ERRATUM_A009942 if !TFABOOT
+	select SYS_FSL_ERRATUM_A010165 if !TFABOOT
 	select SYS_FSL_ERRATUM_A009203
 	select ARCH_EARLY_INIT_R
 	select BOARD_EARLY_INIT_F
diff --git a/arch/arm/dts/fsl-ls2088a-rdb-qspi.dts b/arch/arm/dts/fsl-ls2088a-rdb-qspi.dts
index c8bf9a01fe..b6d4f0f6af 100644
--- a/arch/arm/dts/fsl-ls2088a-rdb-qspi.dts
+++ b/arch/arm/dts/fsl-ls2088a-rdb-qspi.dts
@@ -56,3 +56,7 @@
 		reg = <1>;
 	};
 };
+
+&sata {
+	status = "okay";
+};
diff --git a/board/freescale/ls2080a/ls2080a.c b/board/freescale/ls2080a/ls2080a.c
index 698ae1f9a6..ad3596a8a1 100644
--- a/board/freescale/ls2080a/ls2080a.c
+++ b/board/freescale/ls2080a/ls2080a.c
@@ -142,3 +142,10 @@ void reset_phy(void)
 {
 }
 #endif
+
+#ifdef CONFIG_TFABOOT
+void *env_sf_get_env_addr(void)
+{
+	return (void *)(CONFIG_SYS_FSL_QSPI_BASE1 + CONFIG_ENV_OFFSET);
+}
+#endif
diff --git a/board/freescale/ls2080ardb/MAINTAINERS b/board/freescale/ls2080ardb/MAINTAINERS
index bbe56e2052..1f6014deed 100644
--- a/board/freescale/ls2080ardb/MAINTAINERS
+++ b/board/freescale/ls2080ardb/MAINTAINERS
@@ -9,8 +9,10 @@ F:	configs/ls2080ardb_nand_defconfig
 
 LS2088A_QSPI-boot BOARD
 M:	Priyanka Jain <priyanka.jain@nxp.com>
+M:	Rajesh Bhagat <rajesh.bhagat@nxp.com>
 S:	Maintained
 F:	configs/ls2088ardb_qspi_defconfig
+F:	configs/ls2088ardb_tfa_defconfig
 
 LS2081ARDB BOARD
 M:	Priyanka Jain <priyanka.jain@nxp.com>
diff --git a/board/freescale/ls2080ardb/ddr.c b/board/freescale/ls2080ardb/ddr.c
index 26eb14b812..72ce872c75 100644
--- a/board/freescale/ls2080ardb/ddr.c
+++ b/board/freescale/ls2080ardb/ddr.c
@@ -160,6 +160,17 @@ found:
 	}
 }
 
+#ifdef CONFIG_TFABOOT
+int fsl_initdram(void)
+{
+	gd->ram_size = tfa_get_dram_size();
+
+	if (!gd->ram_size)
+		gd->ram_size = fsl_ddr_sdram_size();
+
+	return 0;
+}
+#else
 int fsl_initdram(void)
 {
 #if defined(CONFIG_SPL) && !defined(CONFIG_SPL_BUILD)
@@ -172,3 +183,4 @@ int fsl_initdram(void)
 
 	return 0;
 }
+#endif /* CONFIG_TFABOOT */
diff --git a/board/freescale/ls2080ardb/ls2080ardb.c b/board/freescale/ls2080ardb/ls2080ardb.c
index cf91bc30fb..20e1fce0fc 100644
--- a/board/freescale/ls2080ardb/ls2080ardb.c
+++ b/board/freescale/ls2080ardb/ls2080ardb.c
@@ -346,12 +346,47 @@ void board_quiesce_devices(void)
 void fsl_fdt_fixup_flash(void *fdt)
 {
 	int offset;
+#ifdef CONFIG_TFABOOT
+	u32 __iomem *dcfg_ccsr = (u32 __iomem *)DCFG_BASE;
+	u32 val;
+#endif
 
 /*
  * IFC and QSPI are muxed on board.
  * So disable IFC node in dts if QSPI is enabled or
  * disable QSPI node in dts in case QSPI is not enabled.
  */
+#ifdef CONFIG_TFABOOT
+	enum boot_src src = get_boot_src();
+	bool disable_ifc = false;
+
+	switch (src) {
+	case BOOT_SOURCE_IFC_NOR:
+		disable_ifc = false;
+		break;
+	case BOOT_SOURCE_QSPI_NOR:
+		disable_ifc = true;
+		break;
+	default:
+		val = in_le32(dcfg_ccsr + DCFG_RCWSR15 / 4);
+		if (DCFG_RCWSR15_IFCGRPABASE_QSPI == (val & (u32)0x3))
+			disable_ifc = true;
+		break;
+	}
+
+	if (disable_ifc) {
+		offset = fdt_path_offset(fdt, "/soc/ifc");
+
+		if (offset < 0)
+			offset = fdt_path_offset(fdt, "/ifc");
+	} else {
+		offset = fdt_path_offset(fdt, "/soc/quadspi");
+
+		if (offset < 0)
+			offset = fdt_path_offset(fdt, "/quadspi");
+	}
+
+#else
 #ifdef CONFIG_FSL_QSPI
 	offset = fdt_path_offset(fdt, "/soc/ifc");
 
@@ -363,6 +398,8 @@ void fsl_fdt_fixup_flash(void *fdt)
 	if (offset < 0)
 		offset = fdt_path_offset(fdt, "/quadspi");
 #endif
+#endif
+
 	if (offset < 0)
 		return;
 
diff --git a/configs/ls2088ardb_tfa_SECURE_BOOT_defconfig b/configs/ls2088ardb_tfa_SECURE_BOOT_defconfig
new file mode 100644
index 0000000000..cb9490a867
--- /dev/null
+++ b/configs/ls2088ardb_tfa_SECURE_BOOT_defconfig
@@ -0,0 +1,74 @@
+CONFIG_ARM=y
+CONFIG_TARGET_LS2080ARDB=y
+CONFIG_SYS_TEXT_BASE=0x82000000
+CONFIG_TFABOOT=y
+CONFIG_SECURE_BOOT=y
+CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT=y
+CONFIG_QSPI_AHB_INIT=y
+CONFIG_SEC_FIRMWARE_ARMV8_PSCI=y
+CONFIG_NR_DRAM_BANKS=3
+# CONFIG_SYS_MALLOC_F is not set
+CONFIG_FIT_VERBOSE=y
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_OF_STDOUT_VIA_ALIAS=y
+CONFIG_BOOTDELAY=10
+CONFIG_USE_BOOTARGS=y
+CONFIG_BOOTARGS="console=ttyS1,115200 root=/dev/ram0 earlycon=uart8250,mmio,0x21c0600 ramdisk_size=0x2000000 default_hugepagesz=2m hugepagesz=2m hugepages=256"
+# CONFIG_USE_BOOTCOMMAND is not set
+CONFIG_MISC_INIT_R=y
+CONFIG_CMD_IMLS=y
+CONFIG_CMD_GREPENV=y
+CONFIG_CMD_EEPROM=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_NAND=y
+CONFIG_CMD_PCI=y
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_DATE=y
+CONFIG_MP=y
+CONFIG_OF_CONTROL=y
+CONFIG_DEFAULT_DEVICE_TREE="fsl-ls2080a-rdb"
+CONFIG_ENV_IS_NOWHERE=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_DM=y
+CONFIG_FSL_CAAM=y
+CONFIG_FSL_ESDHC=y
+CONFIG_MTD_NOR_FLASH=y
+CONFIG_FLASH_CFI_DRIVER=y
+CONFIG_SYS_FLASH_USE_BUFFER_WRITE=y
+CONFIG_SYS_FLASH_CFI=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH=y
+CONFIG_SPI_FLASH_SPANSION=y
+
+CONFIG_PHYLIB=y
+CONFIG_PHY_AQUANTIA=y
+CONFIG_E1000=y
+CONFIG_MII=y
+CONFIG_PCI=y
+CONFIG_DM_PCI=y
+CONFIG_DM_PCI_COMPAT=y
+CONFIG_PCIE_LAYERSCAPE=y
+CONFIG_CONS_INDEX=2
+CONFIG_SYS_NS16550=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_FSL_DSPI=y
+CONFIG_FSL_QSPI=y
+CONFIG_FSL_SPI_ALIGNED_TXFIFO=y
+
+CONFIG_USB=y
+CONFIG_DM_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_DWC3=y
+CONFIG_USB_STORAGE=y
+CONFIG_EFI_LOADER_BOUNCE_BUFFER=y
+CONFIG_BLK=y
+CONFIG_DM_MMC=y
+CONFIG_RSA=y
+CONFIG_SPL_RSA=y
+CONFIG_RSA_SOFTWARE_EXP=y
diff --git a/configs/ls2088ardb_tfa_defconfig b/configs/ls2088ardb_tfa_defconfig
new file mode 100644
index 0000000000..bb5e4f8bb5
--- /dev/null
+++ b/configs/ls2088ardb_tfa_defconfig
@@ -0,0 +1,72 @@
+CONFIG_ARM=y
+CONFIG_TARGET_LS2080ARDB=y
+CONFIG_SYS_TEXT_BASE=0x82000000
+CONFIG_TFABOOT=y
+CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT=y
+CONFIG_QSPI_AHB_INIT=y
+CONFIG_SEC_FIRMWARE_ARMV8_PSCI=y
+CONFIG_NR_DRAM_BANKS=3
+# CONFIG_SYS_MALLOC_F is not set
+CONFIG_FIT_VERBOSE=y
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_OF_STDOUT_VIA_ALIAS=y
+CONFIG_BOOTDELAY=10
+CONFIG_USE_BOOTARGS=y
+CONFIG_BOOTARGS="console=ttyS1,115200 root=/dev/ram0 earlycon=uart8250,mmio,0x21c0600 ramdisk_size=0x2000000 default_hugepagesz=2m hugepagesz=2m hugepages=256"
+# CONFIG_USE_BOOTCOMMAND is not set
+CONFIG_MISC_INIT_R=y
+CONFIG_CMD_IMLS=y
+CONFIG_CMD_GREPENV=y
+CONFIG_CMD_EEPROM=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_NAND=y
+CONFIG_CMD_PCI=y
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_DATE=y
+CONFIG_MP=y
+CONFIG_OF_CONTROL=y
+CONFIG_DEFAULT_DEVICE_TREE="fsl-ls2088a-rdb-qspi"
+CONFIG_ENV_IS_IN_FLASH=y
+CONFIG_ENV_IS_IN_SPI_FLASH=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_DM=y
+CONFIG_FSL_CAAM=y
+CONFIG_FSL_ESDHC=y
+CONFIG_MTD_NOR_FLASH=y
+CONFIG_FLASH_CFI_DRIVER=y
+CONFIG_SYS_FLASH_USE_BUFFER_WRITE=y
+CONFIG_SYS_FLASH_CFI=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH=y
+CONFIG_SPI_FLASH_SPANSION=y
+# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
+
+CONFIG_PHYLIB=y
+CONFIG_PHY_AQUANTIA=y
+CONFIG_E1000=y
+CONFIG_MII=y
+CONFIG_PCI=y
+CONFIG_DM_PCI=y
+CONFIG_DM_PCI_COMPAT=y
+CONFIG_PCIE_LAYERSCAPE=y
+CONFIG_CONS_INDEX=2
+CONFIG_SYS_NS16550=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_FSL_DSPI=y
+CONFIG_FSL_QSPI=y
+CONFIG_FSL_SPI_ALIGNED_TXFIFO=y
+
+CONFIG_USB=y
+CONFIG_DM_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_DWC3=y
+CONFIG_USB_STORAGE=y
+CONFIG_EFI_LOADER_BOUNCE_BUFFER=y
+CONFIG_BLK=y
+CONFIG_DM_MMC=y
diff --git a/include/configs/ls2080a_common.h b/include/configs/ls2080a_common.h
index 713e1d1d09..235a757f75 100644
--- a/include/configs/ls2080a_common.h
+++ b/include/configs/ls2080a_common.h
@@ -16,17 +16,23 @@
 #include <asm/arch/config.h>
 
 /* Link Definitions */
+#ifdef CONFIG_TFABOOT
+#define CONFIG_SYS_INIT_SP_ADDR		CONFIG_SYS_TEXT_BASE
+#else
 #define CONFIG_SYS_INIT_SP_ADDR		(CONFIG_SYS_FSL_OCRAM_BASE + 0xfff0)
+#endif
 
 /* We need architecture specific misc initializations */
 
 /* Link Definitions */
+#ifndef CONFIG_TFABOOT
 #ifndef CONFIG_QSPI_BOOT
 #else
 #define CONFIG_ENV_SIZE			0x2000          /* 8KB */
 #define CONFIG_ENV_OFFSET		0x300000        /* 3MB */
 #define CONFIG_ENV_SECT_SIZE		0x40000
 #endif
+#endif
 
 #define CONFIG_SKIP_LOWLEVEL_INIT
 
@@ -185,6 +191,7 @@ unsigned long long get_qixis_addr(void);
 	"mcinitcmd=fsl_mc start mc 0x580a00000"	\
 	" 0x580e00000 \0"
 
+#ifndef CONFIG_TFABOOT
 #ifdef CONFIG_SD_BOOT
 #define CONFIG_BOOTCOMMAND	"mmc read 0x80200000 0x6800 0x800;"\
 				" fsl_mc apply dpl 0x80200000 &&" \
@@ -195,6 +202,7 @@ unsigned long long get_qixis_addr(void);
 				" cp.b $kernel_start $kernel_load" \
 				" $kernel_size && bootm $kernel_load"
 #endif
+#endif
 
 /* Monitor Command Prompt */
 #define CONFIG_SYS_CBSIZE		512	/* Console I/O Buffer Size */
diff --git a/include/configs/ls2080ardb.h b/include/configs/ls2080ardb.h
index 295b824aa0..ef0f4ff48e 100644
--- a/include/configs/ls2080ardb.h
+++ b/include/configs/ls2080ardb.h
@@ -69,8 +69,17 @@ unsigned long get_board_sys_clk(void);
 #define CONFIG_SYS_SCSI_MAX_LUN			1
 #define CONFIG_SYS_SCSI_MAX_DEVICE		(CONFIG_SYS_SCSI_MAX_SCSI_ID * \
 						CONFIG_SYS_SCSI_MAX_LUN)
+#ifdef CONFIG_TFABOOT
+#define CONFIG_SYS_MMC_ENV_DEV         0
 
-#ifndef CONFIG_FSL_QSPI
+#define CONFIG_ENV_SIZE			0x2000
+#define CONFIG_ENV_OFFSET		0x500000	/* 5MB */
+#define CONFIG_ENV_ADDR			(CONFIG_SYS_FLASH_BASE + \
+					 CONFIG_ENV_OFFSET)
+#define CONFIG_ENV_SECT_SIZE		0x40000
+#endif
+
+#if !defined(CONFIG_FSL_QSPI) || defined(CONFIG_TFABOOT)
 /* undefined CONFIG_FSL_DDR_SYNC_REFRESH for simulator */
 
 #define CONFIG_SYS_NOR0_CSPR_EXT	(0x0)
@@ -212,9 +221,11 @@ unsigned long get_board_sys_clk(void);
 #define CONFIG_SYS_CS0_FTIM2		CONFIG_SYS_NAND_FTIM2
 #define CONFIG_SYS_CS0_FTIM3		CONFIG_SYS_NAND_FTIM3
 
+#ifndef CONFIG_TFABOOT
 #define CONFIG_ENV_OFFSET		(2048 * 1024)
 #define CONFIG_ENV_SECT_SIZE		0x20000
 #define CONFIG_ENV_SIZE			0x2000
+#endif
 #define CONFIG_SPL_PAD_TO		0x80000
 #define CONFIG_SYS_NAND_U_BOOT_OFFS	(1024 * 1024)
 #define CONFIG_SYS_NAND_U_BOOT_SIZE	(512 * 1024)
@@ -237,10 +248,12 @@ unsigned long get_board_sys_clk(void);
 #define CONFIG_SYS_CS2_FTIM2		CONFIG_SYS_NAND_FTIM2
 #define CONFIG_SYS_CS2_FTIM3		CONFIG_SYS_NAND_FTIM3
 
+#ifndef CONFIG_TFABOOT
 #define CONFIG_ENV_ADDR			(CONFIG_SYS_FLASH_BASE + 0x300000)
 #define CONFIG_ENV_SECT_SIZE		0x20000
 #define CONFIG_ENV_SIZE			0x2000
 #endif
+#endif
 
 /* Debug Server firmware */
 #define CONFIG_SYS_DEBUG_SERVER_FW_IN_NOR
@@ -323,6 +336,27 @@ unsigned long get_board_sys_clk(void);
 	func(SCSI, scsi, 0)
 #include <config_distro_bootcmd.h>
 
+#ifdef CONFIG_TFABOOT
+#define QSPI_MC_INIT_CMD			\
+	"env exists secureboot && "		\
+	"esbc_validate 0x20700000 && "		\
+	"esbc_validate 0x20740000;"		\
+	"fsl_mc start mc 0x20a00000 0x20e00000 \0"
+#define SD_MC_INIT_CMD				\
+	"mmcinfo;mmc read 0x80000000 0x5000 0x800;" \
+	"mmc read 0x80100000 0x7000 0x800;"	\
+	"env exists secureboot && "		\
+	"mmc read 0x80700000 0x3800 0x10 && "	\
+	"mmc read 0x80740000 0x3A00 0x10 && "	\
+	"esbc_validate 0x80700000 && "		\
+	"esbc_validate 0x80740000 ;"		\
+	"fsl_mc start mc 0x80000000 0x80100000\0"
+#define IFC_MC_INIT_CMD				\
+	"env exists secureboot && "	\
+	"esbc_validate 0x580700000 && "		\
+	"esbc_validate 0x580740000; "		\
+	"fsl_mc start mc 0x580a00000 0x580e00000 \0"
+#else
 #ifdef CONFIG_QSPI_BOOT
 #define MC_INIT_CMD				\
 	"mcinitcmd=env exists secureboot && "	\
@@ -347,9 +381,80 @@ unsigned long get_board_sys_clk(void);
 	"esbc_validate 0x580740000; "		\
 	"fsl_mc start mc 0x580a00000 0x580e00000 \0"
 #endif
+#endif
 
 /* Initial environment variables */
 #undef CONFIG_EXTRA_ENV_SETTINGS
+#ifdef CONFIG_TFABOOT
+#define CONFIG_EXTRA_ENV_SETTINGS		\
+	"hwconfig=fsl_ddr:bank_intlv=auto\0"	\
+	"ramdisk_addr=0x800000\0"		\
+	"ramdisk_size=0x2000000\0"		\
+	"fdt_high=0xa0000000\0"			\
+	"initrd_high=0xffffffffffffffff\0"	\
+	"fdt_addr=0x64f00000\0"			\
+	"kernel_addr=0x581000000\0"		\
+	"kernel_start=0x1000000\0"		\
+	"kernelheader_start=0x800000\0"		\
+	"scriptaddr=0x80000000\0"		\
+	"scripthdraddr=0x80080000\0"		\
+	"fdtheader_addr_r=0x80100000\0"		\
+	"kernelheader_addr_r=0x80200000\0"	\
+	"kernelheader_addr=0x580800000\0"	\
+	"kernel_addr_r=0x81000000\0"		\
+	"kernelheader_size=0x40000\0"		\
+	"fdt_addr_r=0x90000000\0"		\
+	"load_addr=0xa0000000\0"		\
+	"kernel_size=0x2800000\0"		\
+	"kernel_addr_sd=0x8000\0"		\
+	"kernel_size_sd=0x14000\0"              \
+	"console=ttyAMA0,38400n8\0"		\
+	"mcmemsize=0x70000000\0"		\
+	"sd_bootcmd=echo Trying load from SD ..;" \
+	"mmcinfo; mmc read $load_addr "		\
+	"$kernel_addr_sd $kernel_size_sd && "	\
+	"bootm $load_addr#$board\0"             \
+	QSPI_MC_INIT_CMD				\
+	BOOTENV					\
+	"boot_scripts=ls2088ardb_boot.scr\0"	\
+	"boot_script_hdr=hdr_ls2088ardb_bs.out\0"	\
+	"scan_dev_for_boot_part="		\
+		"part list ${devtype} ${devnum} devplist; "	\
+		"env exists devplist || setenv devplist 1; "	\
+		"for distro_bootpart in ${devplist}; do "	\
+			"if fstype ${devtype} "			\
+				"${devnum}:${distro_bootpart} "	\
+				"bootfstype; then "		\
+				"run scan_dev_for_boot; "	\
+			"fi; "					\
+		"done\0"					\
+	"scan_dev_for_boot="					\
+		"echo Scanning ${devtype} "			\
+			"${devnum}:${distro_bootpart}...; "	\
+		"for prefix in ${boot_prefixes}; do "		\
+			"run scan_dev_for_scripts; "		\
+		"done;\0"					\
+	"boot_a_script="					\
+		"load ${devtype} ${devnum}:${distro_bootpart} "	\
+			"${scriptaddr} ${prefix}${script}; "	\
+		"env exists secureboot && load ${devtype} "	\
+			"${devnum}:${distro_bootpart} "		\
+			"${scripthdraddr} ${prefix}${boot_script_hdr} "	\
+			"&& esbc_validate ${scripthdraddr};"	\
+		"source ${scriptaddr}\0"			\
+	"qspi_bootcmd=echo Trying load from qspi..;"		\
+		"sf probe && sf read $load_addr "		\
+		"$kernel_start $kernel_size ; env exists secureboot &&"	\
+		"sf read $kernelheader_addr_r $kernelheader_start "	\
+		"$kernelheader_size && esbc_validate ${kernelheader_addr_r}; "\
+		" bootm $load_addr#$board\0"			\
+	"nor_bootcmd=echo Trying load from nor..;"		\
+		"cp.b $kernel_addr $load_addr "			\
+		"$kernel_size ; env exists secureboot && "	\
+		"cp.b $kernelheader_addr $kernelheader_addr_r "	\
+		"$kernelheader_size && esbc_validate ${kernelheader_addr_r}; "\
+		"bootm $load_addr#$board\0"
+#else
 #define CONFIG_EXTRA_ENV_SETTINGS		\
 	"hwconfig=fsl_ddr:bank_intlv=auto\0"	\
 	"ramdisk_addr=0x800000\0"		\
@@ -418,7 +523,36 @@ unsigned long get_board_sys_clk(void);
 		"cp.b $kernelheader_addr $kernelheader_addr_r "	\
 		"$kernelheader_size && esbc_validate ${kernelheader_addr_r}; "\
 		"bootm $load_addr#$board\0"
+#endif
+
+#ifdef CONFIG_TFABOOT
+#define QSPI_NOR_BOOTCOMMAND						\
+			"env exists mcinitcmd && env exists secureboot "\
+			"&& esbc_validate 0x20780000; "			\
+			"env exists mcinitcmd && "			\
+			"fsl_mc lazyapply dpl 0x20d00000; "		\
+			"run distro_bootcmd;run qspi_bootcmd; "		\
+			"env exists secureboot && esbc_halt;"
+
+/* Try to boot an on-SD kernel first, then do normal distro boot */
+#define SD_BOOTCOMMAND						\
+			"env exists mcinitcmd && env exists secureboot "\
+			"&& mmcinfo && mmc read $load_addr 0x3c00 0x800 " \
+			"&& esbc_validate $load_addr; "			\
+			"env exists mcinitcmd && run mcinitcmd "	\
+			"&& mmc read 0x88000000 0x6800 0x800 "		\
+			"&& fsl_mc lazyapply dpl 0x88000000; "		\
+			"run distro_bootcmd;run sd_bootcmd; "		\
+			"env exists secureboot && esbc_halt;"
 
+/* Try to boot an on-NOR kernel first, then do normal distro boot */
+#define IFC_NOR_BOOTCOMMAND						\
+			"env exists mcinitcmd && env exists secureboot "\
+			"&& esbc_validate 0x580780000; env exists mcinitcmd "\
+			"&& fsl_mc lazyapply dpl 0x580d00000;"		\
+			"run distro_bootcmd;run nor_bootcmd; "		\
+			"env exists secureboot && esbc_halt;"
+#else
 #undef CONFIG_BOOTCOMMAND
 #ifdef CONFIG_QSPI_BOOT
 /* Try to boot an on-QSPI kernel first, then do normal distro boot */
@@ -449,6 +583,7 @@ unsigned long get_board_sys_clk(void);
 			"run distro_bootcmd;run nor_bootcmd; "		\
 			"env exists secureboot && esbc_halt;"
 #endif
+#endif
 
 /* MAC/PHY configuration */
 #ifdef CONFIG_FSL_MC_ENET