I was able to make some progress on this. It appears that the Tegra X2 SoC can boot from QSPI. By forcing the Jetson TX2 4GB SoM module pin G10/BOOT_SELECT0 (TP503) high at 1.8V during reset, the Tegra X2 SoC attempts to boot from QSPI. I was able to see activity on the QSPI signals coming from the SoM. It looks like the QSPI_SCK, QSPI_CS_N, and QSPI_IO0 signals were all being activated by the BootROM code in the Tegra X2, most likely trying to detect the presence of the QSPI device and read from it.
Additionally, after attempting a QSPI boot, with no actual QSPI NOR flash connected, I sent in a recovery over USB and got the following message out of the serial console:
[0076.647] I> Welcome to MB2(TBoot-BPMP) Recovery(version: 01.00.160913-t186-M-00.00-mobile-bc98f182)
[0076.656] I> bit @ 0xd480000
[0076.659] I> Boot-device: QSPI
[0081.662] E> Read-device-ID: register (0x9f) read fail (err:0x12120706)
[0081.669] E> Error opening qspi
[0081.672] E> Failed to initialize boot device
[0081.676] E> Top caller module: SPI, error module: SPI, reason: 0x06, aux_info: 0x07
[0081.683] C> Hang
Therefore, it looks like a BOOT_SELECT[2:0] = b001 will perform a QSPI boot, instead of eMMC.
My next question is:
What is the proper format for the image that is flashed on the QSPI that would allow the BootROM to properly boot off QSPI?