UPSTREAM-PEND: soc: ti: k3: Boot image generation

boards/arm/fvp_base_revc_2xaem/fvp_base_revc_2xaem_v8a_smp_ns_defconfig

@@ -20,6 +20,7 @@ CONFIG_UART_CONSOLE=y
 # Enable TFA
 CONFIG_ARMV8_A_NS=y
 CONFIG_BUILD_WITH_TFA=y
+CONFIG_TFA_BUILD_FIP=y
 
 # Enable SMP
 CONFIG_SMP=y

boards/arm/fvp_base_revc_2xaem/fvp_base_revc_2xaem_v9a_smp_ns_defconfig

@@ -20,6 +20,7 @@ CONFIG_UART_CONSOLE=y
 # Enable TFA
 CONFIG_ARMV8_A_NS=y
 CONFIG_BUILD_WITH_TFA=y
+CONFIG_TFA_BUILD_FIP=y
 
 # Enable SMP
 CONFIG_SMP=y

boards/ti/am62l_evm/Kconfig.defconfig

@@ -20,4 +20,14 @@ endif # FLASH_MSPI_NOR
 
 endif # FLASH
 
+if BUILD_WITH_TFA
+
+configdefault TFA_PLATFORM
+	default "k3low"
+
+configdefault TFA_TARGET_BOARD
+	default "am62lx-evm"
+
+endif # BUILD_WITH_TFA
+
 endif # BOARD_AM62L_EVM

boards/ti/am62l_evm/doc/index.rst

@@ -85,8 +85,179 @@ Serial Port
 This board configuration uses a single serial communication channel with the
 MAIN domain UART (main_uart0).
 
-SD Card
-*******
+Building and Booting
+*********************
+
+Dual-Stage Boot Architecture
+=============================
+
+The AM62L SoC uses a dual-stage boot architecture:
+
+**Stage 1: tiboot3.bin**
+   - Loaded by boot ROM from boot media (SD/eMMC/OSPI)
+   - Contains BL1 (first-stage bootloader) from TF-A
+   - Contains TIFS (TI Foundation Security firmware)
+   - Contains board configuration (security, power, resource management)
+   - Initializes SRAM, validates TIFS, loads Stage 2 into DDR
+
+**Stage 2: tispl.bin**
+   - Loaded by ROM into DDR memory
+   - Contains TF-A BL31 (ARM Trusted Firmware - secure monitor)
+   - Contains Zephyr application binary
+
+Building Boot Images
+====================
+
+Boot image generation (``tispl.bin``, ``tiboot3.bin``) is **not enabled by default**.
+The TF-A revision bundled with Zephyr does not include AM62Lx board support. AM62Lx
+board support is available in upstream TF-A, which must be configured separately in
+``west.yml``.
+
+A standard build without any extra flags produces only the Zephyr application binary:
+
+.. zephyr-app-commands::
+   :tool: west
+   :app: samples/hello_world
+   :board: am62l_evm/am62l3/a53
+   :goals: build
+   :compact:
+
+Prerequisites
+-------------
+
+Boot image generation requires ARM Trusted Firmware-A with AM62Lx support. Update
+``west.yml`` to use upstream TF-A before enabling boot image generation, then run
+``west update``:
+
+.. code-block:: yaml
+
+   - name: trusted-firmware-a
+     url: https://review.trustedfirmware.org/TF-A/trusted-firmware-a
+     revision: master
+     path: modules/tee/tf-a/trusted-firmware-a
+     groups:
+       - tee
+
+Building
+--------
+
+**Generating tiboot3.bin (Stage 1)**
+
+Enable :kconfig:option:`CONFIG_BUILD_WITH_TFA` and
+:kconfig:option:`CONFIG_SOC_FAMILY_TI_K3_BUILD_TIBOOT3`
+to generate the ``tiboot3.bin`` Stage 1 bootloader (BL1 + TIFS + board configs):
+
+.. zephyr-app-commands::
+   :tool: west
+   :app: samples/hello_world
+   :board: am62l_evm/am62l3/a53
+   :goals: build
+   :gen-args: -DCONFIG_BUILD_WITH_TFA=y -DCONFIG_SOC_FAMILY_TI_K3_BUILD_TIBOOT3=y
+   :compact:
+
+**Generating tispl.bin (Stage 2)**
+
+Enable :kconfig:option:`CONFIG_BUILD_WITH_TFA` and
+:kconfig:option:`CONFIG_SOC_FAMILY_TI_K3_BUILD_TISPL`
+to generate the ``tispl.bin`` boot image (TF-A BL31 + Zephyr):
+
+.. zephyr-app-commands::
+   :tool: west
+   :app: samples/hello_world
+   :board: am62l_evm/am62l3/a53
+   :goals: build
+   :gen-args: -DCONFIG_BUILD_WITH_TFA=y -DCONFIG_SOC_FAMILY_TI_K3_BUILD_TISPL=y
+   :compact:
+
+To generate both boot images in a single build:
+
+.. zephyr-app-commands::
+   :tool: west
+   :app: samples/hello_world
+   :board: am62l_evm/am62l3/a53
+   :goals: build
+   :gen-args: -DCONFIG_BUILD_WITH_TFA=y -DCONFIG_SOC_FAMILY_TI_K3_BUILD_TISPL=y -DCONFIG_SOC_FAMILY_TI_K3_BUILD_TIBOOT3=y
+   :compact:
+
+When boot image generation is enabled, the build system will automatically:
+
+1. Build ARM Trusted Firmware-A (BL31, and BL1 if generating tiboot3.bin)
+2. Generate board configuration blobs
+3. Create ``tiboot3.bin`` (Stage 1 bootloader) - **if CONFIG_SOC_FAMILY_TI_K3_BUILD_TIBOOT3=y**
+4. Create ``tispl.bin`` (Stage 2 with TF-A BL31 + Zephyr app) - **if CONFIG_SOC_FAMILY_TI_K3_BUILD_TISPL=y**
+
+Generated Boot Files
+====================
+
+A default build (no boot image flags) generates:
+
+.. code-block:: console
+
+   build/zephyr/zephyr.bin     # Zephyr application binary
+
+With :kconfig:option:`CONFIG_SOC_FAMILY_TI_K3_BUILD_TISPL` enabled:
+
+.. code-block:: console
+
+   build/zephyr/zephyr.bin     # Zephyr application binary
+   build/zephyr/tispl.bin      # Stage 2 boot image (TF-A BL31 + Zephyr)
+   build/zephyr/bl31.bin       # TF-A BL31 binary (intermediate)
+
+With :kconfig:option:`CONFIG_SOC_FAMILY_TI_K3_BUILD_TIBOOT3` also enabled:
+
+.. code-block:: console
+
+   build/zephyr/tiboot3.bin    # Stage 1 bootloader (BL1 + TIFS + board configs)
+   build/zephyr/bl1.bin        # TF-A BL1 binary (intermediate)
+
+Booting from SD Card
+********************
+
+The AM62L EVM supports two boot methods: direct boot (no U-Boot) and U-Boot-based boot.
+
+Option 1: Direct Boot (No U-Boot)
+==================================
+
+This method boots Zephyr directly using only the generated boot images.
+
+**Build Requirements:**
+
+To use direct boot, both ``tiboot3.bin`` and ``tispl.bin`` are required. Enable both
+boot image configurations explicitly:
+
+.. code-block:: console
+
+   west build -b am62l_evm/am62l3/a53 samples/hello_world -- \
+     -DCONFIG_BUILD_WITH_TFA=y \
+     -DCONFIG_SOC_FAMILY_TI_K3_BUILD_TISPL=y \
+     -DCONFIG_SOC_FAMILY_TI_K3_BUILD_TIBOOT3=y
+
+**Preparation:**
+
+1. Prepare an SD card with a FAT32 boot partition
+2. Copy the generated boot images to the SD card:
+
+   .. code-block:: console
+
+      cp build/zephyr/tiboot3.bin /media/boot/
+      cp build/zephyr/tispl.bin /media/boot/
+
+3. Insert the SD card and power on the board
+
+**Boot Sequence:**
+
+.. code-block:: text
+
+   Boot ROM → tiboot3.bin (BL1 + TIFS) → tispl.bin (TF-A + Zephyr)
+                                                           ↓
+                                                    Zephyr Running
+
+The boot ROM loads ``tiboot3.bin``, which initializes the hardware and loads
+``tispl.bin`` into DDR. The TF-A BL31 then starts the Zephyr application at
+0x82000000. No U-Boot is involved.
+
+Option 2: U-Boot-Based Boot
+============================
 
 Download TI's official `WIC`_ and flash the WIC file with an etching software
 onto an SD-card.
@@ -99,10 +270,11 @@ Use U-Boot to load and start zephyr.bin:
 
 .. code-block:: console
 
-    fatload mmc 1:1 0x82000000 zephyr.bin; dcache flush; icache flush; dcache off; icache off; go 0x82000000
+   fatload mmc 1:1 0x82000000 zephyr.bin; dcache flush; icache flush; dcache off; icache off; go 0x82000000
 
 The Zephyr application should start running on the A53 core.
 
+
 Debugging
 *********
 
@@ -118,11 +290,82 @@ The board is equipped with an XDS110 JTAG debugger. To debug a binary, utilize t
    To utilize this feature, you'll need OpenOCD version 0.12 or higher. Due to the possibility of
    older versions being available in package feeds, it's advisable to `build OpenOCD from source`_.
 
+
+Custom Board Configuration
+***************************
+
+Board configurations are defined in YAML files under ``boards/ti/am62l_evm/support/``:
+
+- ``board-cfg.yaml`` - General board configuration
+- ``sec-cfg.yaml`` - Security configuration
+- ``pm-cfg.yaml`` - Power management (not required for AM62L)
+- ``rm-cfg.yaml`` - Resource management (not required for AM62L)
+
+To customize, edit these files and rebuild. The build system will automatically
+regenerate the board configuration binary blob.
+
+Custom Signing Keys
+===================
+
+For production, replace the development signing key:
+
+.. code-block:: kconfig
+
+   CONFIG_SOC_FAMILY_TI_K3_CERT_KEY_PATH="path/to/production_key.pem"
+
+The path is relative to the Zephyr base directory. The key must be RSA 2048-bit in PEM format.
+
+TF-A Build Configuration
+=========================
+
+The following Kconfig option controls the TF-A build target board:
+
+**CONFIG_TFA_TARGET_BOARD**
+  TF-A TARGET_BOARD parameter (string, default: "am62lx-evm" for AM62L)
+
+  This specifies the board name passed to TF-A's build system via the TARGET_BOARD parameter.
+  TF-A artifacts are always placed under a board-specific subdirectory:
+  ``build/tfa/${PLATFORM}/${TARGET_BOARD}/${BUILD_TYPE}/``
+  (e.g., ``build/tfa/k3/am62lx-evm/release/``)
+
+Boot Image Structure
+=====================
+
+**tiboot3.bin structure:**
+
+.. code-block:: text
+
+   +------------------+
+   | X.509 Certificate|  (Signed with RSA key)
+   +------------------+
+   | BL1 Binary       |  (TF-A first stage)
+   +------------------+
+   | TIFS Firmware    |  (System firmware)
+   +------------------+
+   | TIFS Inner Cert  |  (Firmware certificate)
+   +------------------+
+   | Board Config     |  (Combined YAML configs)
+   +------------------+
+
+**tispl.bin structure:**
+
+.. code-block:: text
+
+   +------------------+
+   | X.509 Certificate|  (Signed with RSA key)
+   +------------------+
+   | TF-A BL31        |  (ARM Trusted Firmware)
+   +------------------+
+   | TIFS Firmware    |  (System firmware)
+   +------------------+
+   | Board Config     |  (Combined YAML configs)
+   +------------------+
+   | Zephyr Binary    |  (Application code)
+   +------------------+
+
 References
 **********
 
-https://www.ti.com/tool/TMDS62LEVM
-
 .. _AM62L EVM TRM:
    https://www.ti.com/lit/pdf/sprujb4
 

boards/ti/am62l_evm/support/board-cfg.yaml

@@ -0,0 +1,31 @@
+# Copyright (c) 2026 Texas Instruments Incorporated
+# SPDX-License-Identifier: Apache-2.0
+#
+# Board configuration for the AM62Lx SoC
+#
+board-cfg:
+  rev:
+    boardcfg_abi_maj: 0x0
+    boardcfg_abi_min: 0x1
+
+  control:
+    subhdr:
+      magic: 0xC1D3
+      size: 7
+    main_isolation_enable: 0x5A
+    main_isolation_hostid: 0x2
+
+  bm_writer_cfg:
+    subhdr:
+      magic: 0x7D8A
+      size: 5
+    allowed_host: 10
+
+  reserved: [0, 0, 0, 0, 0, 0, 0]
+
+  debug_cfg:
+    subhdr:
+      magic: 0x020C
+      size: 8
+    trace_dst_enables: 0x00
+    trace_src_enables: 0x00