diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
index 0b8d30004c332ec1fda8678038250cedf5dd220c..ba411e2af85296bd3e54fc7c479bd2fd9936d6c5 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
+++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
@@ -102,13 +102,37 @@ menu "Layerscape PPA"
 config FSL_LS_PPA
 	bool "FSL Layerscape PPA firmware support"
 	depends on !ARMV8_PSCI
-	depends on ARCH_LS1043A || ARCH_LS1046A
+	select ARMV8_SEC_FIRMWARE_SUPPORT
 	select SEC_FIRMWARE_ARMV8_PSCI
+	select ARMV8_SEC_FIRMWARE_ERET_ADDR_REVERT if FSL_LSCH2
 	help
 	  The FSL Primary Protected Application (PPA) is a software component
 	  which is loaded during boot stage, and then remains resident in RAM
 	  and runs in the TrustZone after boot.
 	  Say y to enable it.
+choice
+	prompt "FSL Layerscape PPA firmware loading-media select"
+	depends on FSL_LS_PPA
+	default SYS_LS_PPA_FW_IN_XIP
+
+config SYS_LS_PPA_FW_IN_XIP
+	bool "XIP"
+	help
+	  Say Y here if the PPA firmware locate at XIP flash, such
+	  as NOR or QSPI flash.
+
+endchoice
+
+config SYS_LS_PPA_FW_ADDR
+	hex "Address of PPA firmware loading from"
+	depends on FSL_LS_PPA
+	default 0x40500000 if SYS_LS_PPA_FW_IN_XIP && QSPI_BOOT
+	default 0x60500000 if SYS_LS_PPA_FW_IN_XIP
+	help
+	  If the PPA firmware locate at XIP flash, such as NOR or
+	  QSPI flash, this address is a directly memory-mapped.
+	  If it is in a serial accessed flash, such as NAND and SD
+	  card, it is a byte offset.
 endmenu
 
 config SYS_FSL_ERRATUM_A010315
diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Makefile b/arch/arm/cpu/armv8/fsl-layerscape/Makefile
index 423b4b39a8a6a36140172d00845076f10c6321f3..c9ab93e3d7cd2a1885b710e488bac5fd95a241a3 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/Makefile
+++ b/arch/arm/cpu/armv8/fsl-layerscape/Makefile
@@ -10,7 +10,7 @@ obj-y += soc.o
 obj-$(CONFIG_MP) += mp.o
 obj-$(CONFIG_OF_LIBFDT) += fdt.o
 obj-$(CONFIG_SPL) += spl.o
-obj-$(CONFIG_FSL_LS_PPA) += ppa.o
+obj-$(CONFIG_$(SPL_)FSL_LS_PPA) += ppa.o
 
 ifneq ($(CONFIG_FSL_LSCH3),)
 obj-y += fsl_lsch3_speed.o
diff --git a/include/configs/ls1043ardb.h b/include/configs/ls1043ardb.h
index 3657f21dfbead6ba1bd87f403f6688aea15f8cb1..0054d1643eaa886b363b470543184ae578771e6f 100644
--- a/include/configs/ls1043ardb.h
+++ b/include/configs/ls1043ardb.h
@@ -9,13 +9,6 @@
 
 #include "ls1043a_common.h"
 
-#if defined(CONFIG_FSL_LS_PPA)
-#define CONFIG_SYS_LS_PPA_FW_IN_XIP
-#ifdef CONFIG_SYS_LS_PPA_FW_IN_XIP
-#define	CONFIG_SYS_LS_PPA_FW_ADDR	0x60500000
-#endif
-#endif
-
 #if defined(CONFIG_NAND_BOOT) || defined(CONFIG_SD_BOOT)
 #define CONFIG_SYS_TEXT_BASE		0x82000000
 #else
diff --git a/include/configs/ls1046ardb.h b/include/configs/ls1046ardb.h
index 08c5441807bd7fbd676ea85e0a9aa7637c741c08..24843dc9ba78a4026a711aa96aaf54d4ecce4779 100644
--- a/include/configs/ls1046ardb.h
+++ b/include/configs/ls1046ardb.h
@@ -9,13 +9,6 @@
 
 #include "ls1046a_common.h"
 
-#if defined(CONFIG_FSL_LS_PPA)
-#define CONFIG_SYS_LS_PPA_FW_IN_XIP
-#ifdef CONFIG_SYS_LS_PPA_FW_IN_XIP
-#define	CONFIG_SYS_LS_PPA_FW_ADDR	0x40500000
-#endif
-#endif
-
 #ifdef CONFIG_SD_BOOT
 #define CONFIG_SYS_TEXT_BASE		0x82000000
 #else