diff --git a/Makefile b/Makefile
index d6bf367..eb5c4f3 100644
--- a/Makefile
+++ b/Makefile
@@ -84,7 +84,7 @@
 default: kvm-unit-tests linux
 
 .PHONY: clean
-clean: bl33_clean buildroot_clean kvm-unit-tests_clean linux_clean kselftest_clean
+clean: bl_clean bl33_clean buildroot_clean kvm-unit-tests_clean linux_clean kselftest_clean tfa_clean
 
 .PHONY: distclean
 distclean:
@@ -100,20 +100,24 @@
 	@echo 'Generic Targets:'
 	@echo '   default              - builds all generic targets except for buildroot'
 	@echo '   all                  - builds all generic targets'
+	@echo '   bl                   - builds U-Boot and TF-A and copies them to the bl output directory'
 	@echo '   bl33                 - U-Boot as BL33'
 	@echo '   buildroot            - the buildroot rootfs image as well as the host qemu'
 	@echo '   kvm-unit-tests       - the kvm-unit-tests'
 	@echo '   linux                - the Linux kernel'
 	@echo '   kselftest            - the Linux kernel selftests'
+	@echo '   tfa                  - Arm Trusted Firmware-A'
 	@echo ''
 	@echo 'Clean Targets:'
 	@echo '   clean                - cleans all, but keeps the prebuilts'
 	@echo '   distclean            - distclean for all targets'
+	@echo '   bl_clean             - TF-A, U-Boot and the bl output directory'
 	@echo '   bl33_clean           - the U-Boot BL33'
 	@echo '   buildroot_clean      - the buildroot rootfs image as well as the host qemu'
 	@echo '   kvm-unit-tests_clean - the kvm-unit-tests'
 	@echo '   linux_clean          - the Linux kernel'
 	@echo '   kselftest_clean      - the Linux kernel selftests'
+	@echo '   tfa_clean            - Arm Trusted Firmware-A'
 	@echo ''
 	@echo 'Test Targets:'
 	@echo '   test                 - runs all tests in qemu-aarch64 simulated environment'
@@ -159,13 +163,19 @@
 buildroot_clean:
 	+ $(BR_MAKE) clean
 
+# Bootloader stages come from TF-A, U-Boot, or just an empty file.
+BL_DIR := $(OUT_DIR)/bl
+BL1_BIN := $(BL_DIR)/bl1.bin
+BL2_BIN := $(BL_DIR)/bl2.bin
+BL31_BIN := $(BL_DIR)/bl31.bin
+BL32_BIN := $(BL_DIR)/bl32.bin
+BL33_BIN := $(BL_DIR)/bl33.bin
+
 ##
 ## U-Boot
 ##
 UBOOT_SRC := $(ROOT_DIR)/u-boot
 UBOOT_OUT := $(OUT_DIR)/u-boot
-BL_DIR := $(OUT_DIR)/bl
-BL33_BIN := $(BL_DIR)/bl33.bin
 UBOOT_DEFCONFIG ?= qemu_arm64_defconfig
 UBOOT_CONFIG := $(UBOOT_OUT)/.config
 UBOOT_TOOLCHAIN ?= gcc-9.2
@@ -180,7 +190,7 @@
 	O=$(UBOOT_OUT)
 
 .PHONY: bl33
-bl33: $(BL33_BIN)
+bl33: $(UBOOT_OUT)/u-boot.bin
 
 $(UBOOT_CONFIG): $(UBOOT_SRC)/configs/$(UBOOT_DEFCONFIG)
 	+ $(UBOOT_MAKE) $(UBOOT_DEFCONFIG)
@@ -191,14 +201,65 @@
 $(UBOOT_OUT)/u-boot.bin: $(UBOOT_CONFIG) FORCE
 	+ $(UBOOT_MAKE)
 
-$(BL33_BIN): $(UBOOT_OUT)/u-boot.bin
-	mkdir -p $(@D)
-	cp $< $@
-
 .PHONY: bl33_clean
 bl33_clean:
 	+ $(UBOOT_MAKE) distclean
-	rm -f $(BL33_BIN)
+
+##
+## TF-A
+##
+TFA_SRC := $(ROOT_DIR)/trusted-firmware-a
+TFA_OUT := $(OUT_DIR)/trusted-firmware-a
+TFA_TOOLCHAIN ?= gcc-9.2
+TFA_VERBOSE ?= $(VERBOSE)
+$(eval $(call define_toolchain,$(TFA_TOOLCHAIN),TFA_))
+TFA_MAKE := \
+	PATH=$(TFA_TOOLCHAIN_BIN):$(PATH) \
+	$(MAKE) \
+	CROSS_COMPILE="$(TFA_TARGET)-" \
+	PLAT=qemu \
+	ENABLE_SVE_FOR_NS=1 \
+	QEMU_USE_GIC_DRIVER=QEMU_GICV3 \
+	ARM_LINUX_KERNEL_AS_BL33=1 \
+	SPD=trusty \
+	TRUSTY_SPD_WITH_GENERIC_SERVICES=1 \
+	V=$(TFA_VERBOSE) \
+	-C $(TFA_SRC) \
+	BUILD_BASE=$(TFA_OUT)
+
+.PHONY: tfa
+tfa: $(TFA_OUT)/qemu/release/bl1.bin $(TFA_OUT)/qemu/release/bl2.bin $(TFA_OUT)/qemu/release/bl31.bin
+
+$(TFA_OUT)/qemu/release/bl1.bin $(TFA_OUT)/qemu/release/bl2.bin $(TFA_OUT)/qemu/release/bl31.bin &: FORCE
+	+ $(TFA_MAKE) all
+
+.PHONY: tfa_clean
+tfa_clean:
+	rm -rf $(TFA_OUT)
+
+##
+## Copy bootloader stages to BL_DIR
+##
+
+$(BL_DIR):
+	mkdir -p $@
+
+$(BL1_BIN) $(BL2_BIN) $(BL31_BIN): $(BL_DIR)/bl%.bin: $(TFA_OUT)/qemu/release/bl%.bin | $(BL_DIR)
+	cp $< $@
+
+# An empty BL32 is enough for us, it just needs to exist.
+$(BL32_BIN): | $(BL_DIR)
+	touch $@
+
+.PHONY: bl
+bl: $(BL1_BIN) $(BL2_BIN) $(BL31_BIN) $(BL32_BIN) $(BL33_BIN)
+
+$(BL33_BIN): $(UBOOT_OUT)/u-boot.bin | $(BL_DIR)
+	cp $< $@
+
+.PHONY: bl_clean
+bl_clean: tfa_clean bl33_clean
+	rm -rf $(BL_DIR)
 
 ##
 ## kvm-unit-tests