vexpress: Check TC2 firmware support before defaulting to nonsec booting

The firmware on TC2 needs to be configured appropriately before booting
in nonsec mode will work as expected, so test for this and fall back to
sec mode if required.

Signed-off-by: Jon Medhurst <tixy@linaro.org>
Reviewed-by: Ryan Harkin <ryan.harkin@linaro.org>
Tested-by: Ryan Harkin <ryan.harkin@linaro.org>
diff --git a/board/armltd/vexpress/Makefile b/board/armltd/vexpress/Makefile
index 1dd6780..95f4ec0 100644
--- a/board/armltd/vexpress/Makefile
+++ b/board/armltd/vexpress/Makefile
@@ -6,3 +6,4 @@
 #
 
 obj-y	:= vexpress_common.o
+obj-$(CONFIG_TARGET_VEXPRESS_CA15_TC2)	+= vexpress_tc2.o
diff --git a/board/armltd/vexpress/vexpress_tc2.c b/board/armltd/vexpress/vexpress_tc2.c
new file mode 100644
index 0000000..ebb41a8
--- /dev/null
+++ b/board/armltd/vexpress/vexpress_tc2.c
@@ -0,0 +1,33 @@
+/*
+ * (C) Copyright 2016 Linaro
+ * Jon Medhurst <tixy@linaro.org>
+ *
+ * TC2 specific code for Versatile Express.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <asm/io.h>
+
+#define SCC_BASE	0x7fff0000
+
+bool armv7_boot_nonsec_default(void)
+{
+#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT
+	return false
+#else
+	/*
+	 * The Serial Configuration Controller (SCC) register at address 0x700
+	 * contains flags for configuring the behaviour of the Boot Monitor
+	 * (which CPUs execute from reset). Two of these bits are of interest:
+	 *
+	 * bit 12 = Use per-cpu mailboxes for power management
+	 * bit 13 = Power down the non-boot cluster
+	 *
+	 * It is only when both of these are false that U-Boot's current
+	 * implementation of 'nonsec' mode can work as expected because we
+	 * rely on getting all CPUs to execute _nonsec_init, so let's check that.
+	 */
+	return (readl((u32 *)(SCC_BASE + 0x700)) & ((1 << 12) | (1 << 13))) == 0;
+#endif
+}