diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
index 2b086da..4e6a3cb 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
+++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
@@ -89,7 +89,7 @@
 config ARCH_LS1088A
 	bool
 	select ARMV8_SET_SMPEN
-	select ARM_ERRATA_855873
+	select ARM_ERRATA_855873 if !TFABOOT
 	select FSL_LSCH3
 	select SYS_FSL_SRDS_1
 	select SYS_HAS_SERDES
@@ -98,11 +98,11 @@
 	select SYS_FSL_DDR_VER_50
 	select SYS_FSL_EC1
 	select SYS_FSL_EC2
-	select SYS_FSL_ERRATUM_A009803
-	select SYS_FSL_ERRATUM_A009942
-	select SYS_FSL_ERRATUM_A010165
-	select SYS_FSL_ERRATUM_A008511
-	select SYS_FSL_ERRATUM_A008850
+	select SYS_FSL_ERRATUM_A009803 if !TFABOOT
+	select SYS_FSL_ERRATUM_A009942 if !TFABOOT
+	select SYS_FSL_ERRATUM_A010165 if !TFABOOT
+	select SYS_FSL_ERRATUM_A008511 if !TFABOOT
+	select SYS_FSL_ERRATUM_A008850 if !TFABOOT
 	select SYS_FSL_ERRATUM_A009007
 	select SYS_FSL_HAS_CCI400
 	select SYS_FSL_HAS_DDR4
diff --git a/board/freescale/ls1088a/MAINTAINERS b/board/freescale/ls1088a/MAINTAINERS
index 4d804d9..bca9969 100644
--- a/board/freescale/ls1088a/MAINTAINERS
+++ b/board/freescale/ls1088a/MAINTAINERS
@@ -1,15 +1,18 @@
 LS1088ARDB BOARD
 M:	Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
 M:	Ashish Kumar <Ashish.Kumar@nxp.com>
+M:	Rajesh Bhagat <rajesh.bhagat@nxp.com>
 S:	Maintained
 F:	board/freescale/ls1088a/
 F:	include/configs/ls1088ardb.h
 F:	configs/ls1088ardb_qspi_defconfig
 F:	configs/ls1088ardb_sdcard_qspi_defconfig
+F:	configs/ls1088ardb_tfa_defconfig
 
 LS1088AQDS BOARD
 M:	Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
 M:	Ashish Kumar <Ashish.Kumar@nxp.com>
+M:	Rajesh Bhagat <rajesh.bhagat@nxp.com>
 S:	Maintained
 F:	board/freescale/ls1088a/
 F:	include/configs/ls1088aqds.h
@@ -17,6 +20,7 @@
 F:	configs/ls1088aqds_sdcard_qspi_defconfig
 F:	configs/ls1088aqds_defconfig
 F:	configs/ls1088aqds_sdcard_ifc_defconfig
+F:	configs/ls1088aqds_tfa_defconfig
 
 LS1088AQDS_QSPI_SECURE_BOOT BOARD
 M:	Udit Agarwal <udit.agarwal@nxp.com>
diff --git a/board/freescale/ls1088a/ddr.c b/board/freescale/ls1088a/ddr.c
index 78d573a..c21a2ce 100644
--- a/board/freescale/ls1088a/ddr.c
+++ b/board/freescale/ls1088a/ddr.c
@@ -111,7 +111,17 @@
 			  DDR_CDR2_VREF_TRAIN_EN | DDR_CDR2_VREF_RANGE_2;
 }
 
+#ifdef CONFIG_TFABOOT
+int fsl_initdram(void)
+{
+	gd->ram_size = tfa_get_dram_size();
 
+	if (!gd->ram_size)
+		gd->ram_size = fsl_ddr_sdram_size();
+
+	return 0;
+}
+#else
 int fsl_initdram(void)
 {
 	puts("Initializing DDR....using SPD\n");
@@ -123,3 +133,4 @@
 #endif
 	return 0;
 }
+#endif /* CONFIG_TFABOOT */
diff --git a/board/freescale/ls1088a/ls1088a.c b/board/freescale/ls1088a/ls1088a.c
index 1e2ad98..f3018aa 100644
--- a/board/freescale/ls1088a/ls1088a.c
+++ b/board/freescale/ls1088a/ls1088a.c
@@ -88,6 +88,9 @@
 #if !defined(CONFIG_SPL_BUILD)
 int checkboard(void)
 {
+#ifdef CONFIG_TFABOOT
+	enum boot_src src = get_boot_src();
+#endif
 	char buf[64];
 	u8 sw;
 	static const char *const freq[] = {"100", "125", "156.25",
@@ -117,9 +120,14 @@
 	sw = QIXIS_READ(brdcfg[0]);
 	sw = (sw & QIXIS_LBMAP_MASK) >> QIXIS_LBMAP_SHIFT;
 
+#ifdef CONFIG_TFABOOT
+	if (src == BOOT_SOURCE_SD_MMC)
+		puts("SD card\n");
+#else
 #ifdef CONFIG_SD_BOOT
 	puts("SD card\n");
 #endif
+#endif /* CONFIG_TFABOOT */
 	switch (sw) {
 #ifdef CONFIG_TARGET_LS1088AQDS
 	case 0:
@@ -546,6 +554,10 @@
 void fsl_fdt_fixup_flash(void *fdt)
 {
 	int offset;
+#ifdef CONFIG_TFABOOT
+	u32 __iomem *dcfg_ccsr = (u32 __iomem *)DCFG_BASE;
+	u32 val;
+#endif
 
 /*
  * IFC-NOR and QSPI are muxed on SoC.
@@ -553,6 +565,37 @@
  * disable QSPI node in dts in case QSPI is not enabled.
  */
 
+#ifdef CONFIG_TFABOOT
+	enum boot_src src = get_boot_src();
+	bool disable_ifc = false;
+
+	switch (src) {
+	case BOOT_SOURCE_IFC_NOR:
+		disable_ifc = false;
+		break;
+	case BOOT_SOURCE_QSPI_NOR:
+		disable_ifc = true;
+		break;
+	default:
+		val = in_le32(dcfg_ccsr + DCFG_RCWSR15 / 4);
+		if (DCFG_RCWSR15_IFCGRPABASE_QSPI == (val & (u32)0x3))
+			disable_ifc = true;
+		break;
+	}
+
+	if (disable_ifc) {
+		offset = fdt_path_offset(fdt, "/soc/ifc/nor");
+
+		if (offset < 0)
+			offset = fdt_path_offset(fdt, "/ifc/nor");
+	} else {
+		offset = fdt_path_offset(fdt, "/soc/quadspi");
+
+		if (offset < 0)
+			offset = fdt_path_offset(fdt, "/quadspi");
+	}
+
+#else
 #ifdef CONFIG_FSL_QSPI
 	offset = fdt_path_offset(fdt, "/soc/ifc/nor");
 
@@ -564,6 +607,7 @@
 	if (offset < 0)
 		offset = fdt_path_offset(fdt, "/quadspi");
 #endif
+#endif
 	if (offset < 0)
 		return;
 
@@ -613,3 +657,37 @@
 }
 #endif
 #endif /* defined(CONFIG_SPL_BUILD) */
+
+#ifdef CONFIG_TFABOOT
+#ifdef CONFIG_MTD_NOR_FLASH
+int is_flash_available(void)
+{
+	char *env_hwconfig = env_get("hwconfig");
+	enum boot_src src = get_boot_src();
+	int is_nor_flash_available = 1;
+
+	switch (src) {
+	case BOOT_SOURCE_IFC_NOR:
+		is_nor_flash_available = 1;
+		break;
+	case BOOT_SOURCE_QSPI_NOR:
+		is_nor_flash_available = 0;
+		break;
+	/*
+	 * In Case of SD boot,if qspi is defined in env_hwconfig
+	 * disable nor flash probe.
+	 */
+	default:
+		if (hwconfig_f("qspi", env_hwconfig))
+			is_nor_flash_available = 0;
+		break;
+	}
+	return is_nor_flash_available;
+}
+#endif
+
+void *env_sf_get_env_addr(void)
+{
+	return (void *)(CONFIG_SYS_FSL_QSPI_BASE + CONFIG_ENV_OFFSET);
+}
+#endif
diff --git a/configs/ls1088ardb_tfa_SECURE_BOOT_defconfig b/configs/ls1088ardb_tfa_SECURE_BOOT_defconfig
new file mode 100644
index 0000000..ae177d3
--- /dev/null
+++ b/configs/ls1088ardb_tfa_SECURE_BOOT_defconfig
@@ -0,0 +1,64 @@
+CONFIG_ARM=y
+CONFIG_TARGET_LS1088ARDB=y
+CONFIG_SYS_TEXT_BASE=0x82000000
+CONFIG_TFABOOT=y
+CONFIG_SECURE_BOOT=y
+CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT=y
+CONFIG_SEC_FIRMWARE_ARMV8_PSCI=y
+CONFIG_QSPI_AHB_INIT=y
+CONFIG_DISTRO_DEFAULTS=y
+CONFIG_NR_DRAM_BANKS=2
+# CONFIG_SYS_MALLOC_F is not set
+CONFIG_FIT_VERBOSE=y
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_OF_STDOUT_VIA_ALIAS=y
+CONFIG_SYS_EXTRA_OPTIONS="SYS_FSL_DDR4"
+CONFIG_USE_BOOTARGS=y
+CONFIG_BOOTARGS="console=ttyS0,115200 root=/dev/ram0 earlycon=uart8250,mmio,0x21c0500 ramdisk_size=0x3000000 default_hugepagesz=2m hugepagesz=2m hugepages=256"
+# CONFIG_USE_BOOTCOMMAND is not set
+CONFIG_MISC_INIT_R=y
+# CONFIG_DISPLAY_BOARDINFO is not set
+CONFIG_DISPLAY_BOARDINFO_LATE=y
+CONFIG_CMD_GREPENV=y
+CONFIG_CMD_MEMTEST=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_MP=y
+CONFIG_OF_CONTROL=y
+CONFIG_DEFAULT_DEVICE_TREE="fsl-ls1088a-rdb"
+CONFIG_ENV_IS_NOWHERE=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_DM=y
+CONFIG_SCSI_AHCI=y
+CONFIG_FSL_ESDHC=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH=y
+CONFIG_SPI_FLASH_SPANSION=y
+# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
+CONFIG_E1000=y
+CONFIG_MII=y
+CONFIG_PCI=y
+CONFIG_DM_PCI=y
+CONFIG_DM_PCI_COMPAT=y
+CONFIG_PCIE_LAYERSCAPE=y
+CONFIG_SYS_NS16550=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_FSL_DSPI=y
+CONFIG_FSL_QSPI=y
+CONFIG_USB=y
+CONFIG_DM_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_DWC3=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_GADGET=y
+CONFIG_EFI_LOADER_BOUNCE_BUFFER=y
+CONFIG_BLK=y
+CONFIG_DM_MMC=y
+CONFIG_RSA=y
+CONFIG_SPL_RSA=y
+CONFIG_RSA_SOFTWARE_EXP=y
diff --git a/configs/ls1088ardb_tfa_defconfig b/configs/ls1088ardb_tfa_defconfig
new file mode 100644
index 0000000..3328af4
--- /dev/null
+++ b/configs/ls1088ardb_tfa_defconfig
@@ -0,0 +1,61 @@
+CONFIG_ARM=y
+CONFIG_TARGET_LS1088ARDB=y
+CONFIG_SYS_TEXT_BASE=0x82000000
+CONFIG_TFABOOT=y
+CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT=y
+CONFIG_SEC_FIRMWARE_ARMV8_PSCI=y
+CONFIG_QSPI_AHB_INIT=y
+CONFIG_DISTRO_DEFAULTS=y
+CONFIG_NR_DRAM_BANKS=2
+# CONFIG_SYS_MALLOC_F is not set
+CONFIG_FIT_VERBOSE=y
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_OF_STDOUT_VIA_ALIAS=y
+CONFIG_SYS_EXTRA_OPTIONS="SYS_FSL_DDR4"
+CONFIG_USE_BOOTARGS=y
+CONFIG_BOOTARGS="console=ttyS0,115200 root=/dev/ram0 earlycon=uart8250,mmio,0x21c0500 ramdisk_size=0x3000000 default_hugepagesz=2m hugepagesz=2m hugepages=256"
+# CONFIG_USE_BOOTCOMMAND is not set
+CONFIG_MISC_INIT_R=y
+# CONFIG_DISPLAY_BOARDINFO is not set
+CONFIG_DISPLAY_BOARDINFO_LATE=y
+CONFIG_CMD_GREPENV=y
+CONFIG_CMD_MEMTEST=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+# CONFIG_CMD_SETEXPR is not set
+CONFIG_MP=y
+CONFIG_OF_CONTROL=y
+CONFIG_DEFAULT_DEVICE_TREE="fsl-ls1088a-rdb"
+CONFIG_ENV_IS_IN_SPI_FLASH=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_DM=y
+CONFIG_SCSI_AHCI=y
+CONFIG_FSL_ESDHC=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH=y
+CONFIG_SPI_FLASH_SPANSION=y
+CONFIG_FSL_SPI_ALIGNED_TXFIFO=y
+# CONFIG_SPI_FLASH_USE_4K_SECTORS is not set
+CONFIG_E1000=y
+CONFIG_MII=y
+CONFIG_PCI=y
+CONFIG_DM_PCI=y
+CONFIG_DM_PCI_COMPAT=y
+CONFIG_PCIE_LAYERSCAPE=y
+CONFIG_SYS_NS16550=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_FSL_DSPI=y
+CONFIG_FSL_QSPI=y
+CONFIG_USB=y
+CONFIG_DM_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_DWC3=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_GADGET=y
+CONFIG_EFI_LOADER_BOUNCE_BUFFER=y
+CONFIG_BLK=y
+CONFIG_DM_MMC=y
diff --git a/include/configs/ls1088a_common.h b/include/configs/ls1088a_common.h
index 743d0cf..95e6786 100644
--- a/include/configs/ls1088a_common.h
+++ b/include/configs/ls1088a_common.h
@@ -29,16 +29,23 @@
 
 #define LS1088ARDB_PB_BOARD            0x4A
 /* Link Definitions */
+#ifdef CONFIG_TFABOOT
+#define CONFIG_SYS_INIT_SP_ADDR		CONFIG_SYS_TEXT_BASE
+#else
 #define CONFIG_SYS_INIT_SP_ADDR		(CONFIG_SYS_FSL_OCRAM_BASE + 0xfff0)
+#endif
 
 /* Link Definitions */
-
+#ifdef CONFIG_TFABOOT
+#define CONFIG_SYS_FSL_QSPI_BASE	0x20000000
+#else
 #ifdef CONFIG_QSPI_BOOT
 #define CONFIG_SYS_FSL_QSPI_BASE	0x20000000
 #define CONFIG_ENV_OFFSET		0x300000        /* 3MB */
 #define CONFIG_ENV_ADDR			(CONFIG_SYS_FSL_QSPI_BASE + \
 						CONFIG_ENV_OFFSET)
 #endif
+#endif
 
 #define CONFIG_SKIP_LOWLEVEL_INIT
 
@@ -192,6 +199,7 @@
 	"mcinitcmd=fsl_mc start mc 0x580a00000"	\
 	" 0x580e00000 \0"
 
+#ifndef CONFIG_TFABOOT
 #if defined(CONFIG_QSPI_BOOT)
 #define CONFIG_BOOTCOMMAND	"sf probe 0:0;" \
 				"sf read 0x80001000 0xd00000 0x100000;"\
@@ -208,6 +216,7 @@
 				" cp.b $kernel_start $kernel_load" \
 				" $kernel_size && bootm $kernel_load"
 #endif
+#endif /* CONFIG_TFABOOT  */
 #endif
 
 /* Monitor Command Prompt */
diff --git a/include/configs/ls1088ardb.h b/include/configs/ls1088ardb.h
index 5269bcd..f52ea4d 100644
--- a/include/configs/ls1088ardb.h
+++ b/include/configs/ls1088ardb.h
@@ -8,6 +8,15 @@
 
 #include "ls1088a_common.h"
 
+#ifdef CONFIG_TFABOOT
+#define CONFIG_SYS_MMC_ENV_DEV		0
+
+#define CONFIG_ENV_SIZE			0x2000          /* 8KB */
+#define CONFIG_ENV_OFFSET		0x500000
+#define CONFIG_ENV_ADDR			(CONFIG_SYS_FLASH_BASE + \
+					 CONFIG_ENV_OFFSET)
+#define CONFIG_ENV_SECT_SIZE		0x40000
+#else
 #if defined(CONFIG_QSPI_BOOT)
 #define CONFIG_ENV_SIZE			0x2000          /* 8KB */
 #define CONFIG_ENV_SECT_SIZE		0x40000
@@ -21,8 +30,10 @@
 #define CONFIG_ENV_SECT_SIZE		0x20000
 #define CONFIG_ENV_SIZE			0x20000
 #endif
+#endif /* CONFIG_TFABOOT */
 
-#if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
+#if defined(CONFIG_TFABOOT) || \
+	defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
 #ifndef CONFIG_SPL_BUILD
 #define CONFIG_QIXIS_I2C_ACCESS
 #endif
@@ -185,7 +196,8 @@
 					FTIM2_GPCM_TWP(0x3E))
 #define SYS_FPGA_CS_FTIM3	0x0
 
-#if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
+#if defined(CONFIG_TFABOOT) || \
+	defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
 #define CONFIG_SYS_CSPR0_EXT		CONFIG_SYS_NAND_CSPR_EXT
 #define CONFIG_SYS_CSPR0		CONFIG_SYS_NAND_CSPR
 #define CONFIG_SYS_AMASK0		CONFIG_SYS_NAND_AMASK
@@ -215,7 +227,6 @@
 #define CONFIG_SYS_CS0_FTIM3		CONFIG_SYS_NOR_FTIM3
 #endif
 
-
 #define CONFIG_SYS_LS_MC_BOOT_TIMEOUT_MS 5000
 
 #define I2C_MUX_CH_VOL_MONITOR          0xA
@@ -274,7 +285,8 @@
 
 #ifndef SPL_NO_QSPI
 /* QSPI device */
-#if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
+#if defined(CONFIG_TFABOOT) || \
+	defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
 #define FSL_QSPI_FLASH_SIZE		(1 << 26)
 #define FSL_QSPI_FLASH_NUM		2
 #endif
@@ -294,6 +306,26 @@
 
 #ifndef SPL_NO_ENV
 /* Initial environment variables */
+#ifdef CONFIG_TFABOOT
+#define QSPI_MC_INIT_CMD				\
+	"sf probe 0:0;sf read 0x80000000 0xA00000 0x100000;"	\
+	"sf read 0x80100000 0xE00000 0x100000;"				\
+	"env exists secureboot && "			\
+	"sf read 0x80700000 0x700000 0x40000 && "	\
+	"sf read 0x80740000 0x740000 0x40000 && "	\
+	"esbc_validate 0x80700000 && "			\
+	"esbc_validate 0x80740000 ;"			\
+	"fsl_mc start mc 0x80000000 0x80100000\0"
+#define SD_MC_INIT_CMD				\
+	"mmcinfo;mmc read 0x80000000 0x5000 0x800;"		\
+	"mmc read 0x80100000 0x7000 0x800;"				\
+	"env exists secureboot && "			\
+	"mmc read 0x80700000 0x3800 0x10 && "		\
+	"mmc read 0x80740000 0x3A00 0x10 && "		\
+	"esbc_validate 0x80700000 && "			\
+	"esbc_validate 0x80740000 ;"			\
+	"fsl_mc start mc 0x80000000 0x80100000\0"
+#else
 #if defined(CONFIG_QSPI_BOOT)
 #define MC_INIT_CMD				\
 	"mcinitcmd=sf probe 0:0;sf read 0x80000000 0xA00000 0x100000;"	\
@@ -317,8 +349,84 @@
 	"fsl_mc start mc 0x80000000 0x80100000\0"	\
 	"mcmemsize=0x70000000\0"
 #endif
+#endif /* CONFIG_TFABOOT */
 
 #undef CONFIG_EXTRA_ENV_SETTINGS
+#ifdef CONFIG_TFABOOT
+#define CONFIG_EXTRA_ENV_SETTINGS		\
+	"BOARD=ls1088ardb\0"			\
+	"hwconfig=fsl_ddr:bank_intlv=auto\0"	\
+	"ramdisk_addr=0x800000\0"		\
+	"ramdisk_size=0x2000000\0"		\
+	"fdt_high=0xa0000000\0"			\
+	"initrd_high=0xffffffffffffffff\0"	\
+	"fdt_addr=0x64f00000\0"			\
+	"kernel_addr=0x1000000\0"		\
+	"kernel_addr_sd=0x8000\0"		\
+	"kernelhdr_addr_sd=0x4000\0"		\
+	"kernel_start=0x580100000\0"		\
+	"kernelheader_start=0x580800000\0"	\
+	"scriptaddr=0x80000000\0"		\
+	"scripthdraddr=0x80080000\0"		\
+	"fdtheader_addr_r=0x80100000\0"		\
+	"kernelheader_addr=0x800000\0"		\
+	"kernelheader_addr_r=0x80200000\0"	\
+	"kernel_addr_r=0x81000000\0"		\
+	"kernelheader_size=0x40000\0"		\
+	"fdt_addr_r=0x90000000\0"		\
+	"load_addr=0xa0000000\0"		\
+	"kernel_size=0x2800000\0"		\
+	"kernel_size_sd=0x14000\0"		\
+	"kernelhdr_size_sd=0x10\0"		\
+	QSPI_MC_INIT_CMD			\
+	"mcmemsize=0x70000000\0"		\
+	BOOTENV					\
+	"boot_scripts=ls1088ardb_boot.scr\0"	\
+	"boot_script_hdr=hdr_ls1088ardb_bs.out\0"	\
+	"scan_dev_for_boot_part="		\
+		"part list ${devtype} ${devnum} devplist; "	\
+		"env exists devplist || setenv devplist 1; "	\
+		"for distro_bootpart in ${devplist}; do "	\
+			"if fstype ${devtype} "			\
+				"${devnum}:${distro_bootpart} "	\
+				"bootfstype; then "		\
+				"run scan_dev_for_boot; "	\
+			"fi; "					\
+		"done\0"					\
+	"scan_dev_for_boot="					\
+		"echo Scanning ${devtype} "			\
+		"${devnum}:${distro_bootpart}...; "		\
+		"for prefix in ${boot_prefixes}; do "		\
+			"run scan_dev_for_scripts; "		\
+		"done;\0"					\
+	"boot_a_script="					\
+		"load ${devtype} ${devnum}:${distro_bootpart} " \
+		"${scriptaddr} ${prefix}${script}; "		\
+	"env exists secureboot && load ${devtype} "		\
+		"${devnum}:${distro_bootpart} "			\
+		"${scripthdraddr} ${prefix}${boot_script_hdr} " \
+		"&& esbc_validate ${scripthdraddr};"		\
+		"source ${scriptaddr}\0"			\
+	"installer=load mmc 0:2 $load_addr "			\
+		"/flex_installer_arm64.itb; "			\
+		"env exists mcinitcmd && run mcinitcmd && "	\
+		"mmc read 0x80001000 0x6800 0x800;"		\
+		"fsl_mc lazyapply dpl 0x80001000;"			\
+		"bootm $load_addr#ls1088ardb\0"			\
+	"qspi_bootcmd=echo Trying load from qspi..;"		\
+		"sf probe && sf read $load_addr "		\
+		"$kernel_addr $kernel_size ; env exists secureboot "	\
+		"&& sf read $kernelheader_addr_r $kernelheader_addr "	\
+		"$kernelheader_size && esbc_validate ${kernelheader_addr_r}; "\
+		"bootm $load_addr#$BOARD\0"			\
+		"sd_bootcmd=echo Trying load from sd card..;"		\
+		"mmcinfo; mmc read $load_addr "			\
+		"$kernel_addr_sd $kernel_size_sd ;"		\
+		"env exists secureboot && mmc read $kernelheader_addr_r "\
+		"$kernelhdr_addr_sd $kernelhdr_size_sd "	\
+		" && esbc_validate ${kernelheader_addr_r};"	\
+		"bootm $load_addr#$BOARD\0"
+#else
 #define CONFIG_EXTRA_ENV_SETTINGS		\
 	"BOARD=ls1088ardb\0"			\
 	"hwconfig=fsl_ddr:bank_intlv=auto\0"	\
@@ -391,8 +499,28 @@
 		"$kernelhdr_addr_sd $kernelhdr_size_sd "	\
 		" && esbc_validate ${kernelheader_addr_r};"	\
 		"bootm $load_addr#$BOARD\0"
+#endif /* CONFIG_TFABOOT */
 
 #undef CONFIG_BOOTCOMMAND
+#ifdef CONFIG_TFABOOT
+#define QSPI_NOR_BOOTCOMMAND					\
+		"sf read 0x80001000 0xd00000 0x100000;"		\
+		"env exists mcinitcmd && env exists secureboot "	\
+		" && sf read 0x80780000 0x780000 0x100000 "	\
+		"&& esbc_validate 0x80780000;env exists mcinitcmd "	\
+		"&& fsl_mc lazyapply dpl 0x80001000;"		\
+		"run distro_bootcmd;run qspi_bootcmd;"		\
+		"env exists secureboot && esbc_halt;"
+#define SD_BOOTCOMMAND						\
+		"env exists mcinitcmd && mmcinfo; "		\
+		"mmc read 0x80001000 0x6800 0x800; "		\
+		"env exists mcinitcmd && env exists secureboot "	\
+		" && mmc read 0x80780000 0x3C00 0x10 "		\
+		"&& esbc_validate 0x80780000;env exists mcinitcmd "	\
+		"&& fsl_mc lazyapply dpl 0x80001000;"		\
+		"run distro_bootcmd;run sd_bootcmd;"		\
+		"env exists secureboot && esbc_halt;"
+#else
 #if defined(CONFIG_QSPI_BOOT)
 /* Try to boot an on-QSPI kernel first, then do normal distro boot */
 #define CONFIG_BOOTCOMMAND                                      \
@@ -416,6 +544,7 @@
 		"run distro_bootcmd;run sd_bootcmd;"		\
 		"env exists secureboot && esbc_halt;"
 #endif
+#endif /* CONFIG_TFABOOT */
 
 /* MAC/PHY configuration */
 #ifdef CONFIG_FSL_MC_ENET