17 files changed, 235 insertions, 1 deletions
diff --git a/sysutils/Makefile b/sysutils/Makefile
index 4c7ee468ff3..f8b0af1c334 100644
--- a/sysutils/Makefile
+++ b/sysutils/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.990 2022/02/05 03:14:19 ryoon Exp $
+# $NetBSD: Makefile,v 1.991 2022/02/09 01:57:57 mrg Exp $
 #
 
 COMMENT=	System utilities
@@ -706,6 +706,9 @@ SUBDIR+=	tphdisk
 SUBDIR+=	trash
 SUBDIR+=	tre-command
 SUBDIR+=	tree
+SUBDIR+=	trusted-firmware-a-fiptool
+SUBDIR+=	trusted-firmware-a-rk3328
+SUBDIR+=	trusted-firmware-a-rk3399
 SUBDIR+=	ts
 SUBDIR+=	tsm8
 SUBDIR+=	ttyplot
diff --git a/sysutils/trusted-firmware-a-fiptool/DESCR b/sysutils/trusted-firmware-a-fiptool/DESCR
new file mode 100644
index 00000000000..10aac436ede
--- /dev/null
+++ b/sysutils/trusted-firmware-a-fiptool/DESCR
@@ -0,0 +1,20 @@
+Trusted Firmware-A (TF-A) provides a reference implementation of secure
+world software for ARMv8-A, including a Secure Monitor executing at
+Exception Level 3 (EL3). It implements various ARM interface standards,
+such as:
+
+    The Power State Coordination Interface (PSCI)
+    Trusted Board Boot Requirements (TBBR, ARM DEN0006C-1)
+    SMC Calling Convention
+    System Control and Management Interface
+
+As far as possible the code is designed for reuse or porting to other
+ARMv8-A model and hardware platforms.
+
+ARM will continue development in collaboration with interested parties to
+provide a full reference implementation of Secure Monitor code and ARM
+standards to the benefit of all developers working with ARMv8-A TrustZone
+technology.
+
+This package provides "fiptool", used to wrap parts of trusted firmware
+with u-boot.
diff --git a/sysutils/trusted-firmware-a-fiptool/Makefile b/sysutils/trusted-firmware-a-fiptool/Makefile
new file mode 100644
index 00000000000..344102b8dec
--- /dev/null
+++ b/sysutils/trusted-firmware-a-fiptool/Makefile
@@ -0,0 +1,18 @@
+# $NetBSD: Makefile,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+# We override WRKSRC, so we provide our own patches (and thus distinfo)
+DISTINFO_FILE=	${.CURDIR}/distinfo
+PATCHDIR=	${.CURDIR}/patches
+
+.include "../../sysutils/trusted-firmware-a/trusted-firmware-a-dist.mk"
+
+PKGNAME=	${DISTNAME:S/arm-trusted-firmware/trusted-firmware-a-fiptool/}
+WRKSRC=		${WRKDIR}/${DISTNAME}/tools/fiptool
+
+INSTALLATION_DIRS=	bin
+
+do-install:
+	${INSTALL_PROGRAM} ${WRKSRC}/fiptool ${DESTDIR}${PREFIX}/bin
+
+.include "../../security/openssl/buildlink3.mk"
+.include "../../mk/bsd.pkg.mk"
diff --git a/sysutils/trusted-firmware-a-fiptool/PLIST b/sysutils/trusted-firmware-a-fiptool/PLIST
new file mode 100644
index 00000000000..59d5e032ba9
--- /dev/null
+++ b/sysutils/trusted-firmware-a-fiptool/PLIST
@@ -0,0 +1,2 @@
+@comment $NetBSD: PLIST,v 1.1 2022/02/09 01:57:57 mrg Exp $
+bin/fiptool
diff --git a/sysutils/trusted-firmware-a-fiptool/distinfo b/sysutils/trusted-firmware-a-fiptool/distinfo
new file mode 100644
index 00000000000..43bb22c7934
--- /dev/null
+++ b/sysutils/trusted-firmware-a-fiptool/distinfo
@@ -0,0 +1,6 @@
+$NetBSD: distinfo,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+BLAKE2s (arm-trusted-firmware-2.6.zip) = 00bfe714f77eb95a3fbbbe1a89667aa9ce70f55bcde4e8f0a8c36ac36d78ece1
+SHA512 (arm-trusted-firmware-2.6.zip) = 3d5ef0f39017aad6bc469ba367604941e0aa7f5ce69f1709492e282aaff8188ff18ee7a224271c3d6c0479cac98954feb6faf9355c83a7351d8693ae61beac03
+Size (arm-trusted-firmware-2.6.zip) = 8010252 bytes
+SHA1 (patch-Makefile) = 90cedf2c6c04fbf00bd8b2782add95b46c2ebcc0
diff --git a/sysutils/trusted-firmware-a-fiptool/patches/patch-Makefile b/sysutils/trusted-firmware-a-fiptool/patches/patch-Makefile
new file mode 100644
index 00000000000..71f3b353564
--- /dev/null
+++ b/sysutils/trusted-firmware-a-fiptool/patches/patch-Makefile
@@ -0,0 +1,15 @@
+$NetBSD: patch-Makefile,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+Honor LDFLAGS.
+
+--- Makefile.orig	2020-04-20 15:56:43.000000000 +0000
++++ Makefile	2020-06-22 01:21:57.959255753 +0000
+@@ -37,7 +37,7 @@ all: ${PROJECT}
+ 
+ ${PROJECT}: ${OBJECTS} Makefile
+ 	@echo "  HOSTLD  $@"
+-	${Q}${HOSTCC} ${OBJECTS} -o $@ ${LDLIBS}
++	${Q}${HOSTCC} ${OBJECTS} -o $@ ${LDFLAGS} ${LDLIBS}
+ 	@${ECHO_BLANK_LINE}
+ 	@echo "Built $@ successfully"
+ 	@${ECHO_BLANK_LINE}
diff --git a/sysutils/trusted-firmware-a-rk3328/DESCR b/sysutils/trusted-firmware-a-rk3328/DESCR
new file mode 100644
index 00000000000..8215e9f93eb
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3328/DESCR
@@ -0,0 +1,20 @@
+Trusted Firmware-A (TF-A) provides a reference implementation of secure
+world software for ARMv8-A, including a Secure Monitor executing at
+Exception Level 3 (EL3). It implements various ARM interface standards,
+such as:
+
+    The Power State Coordination Interface (PSCI)
+    Trusted Board Boot Requirements (TBBR, ARM DEN0006C-1)
+    SMC Calling Convention
+    System Control and Management Interface
+
+As far as possible the code is designed for reuse or porting to other
+ARMv8-A model and hardware platforms.
+
+ARM will continue development in collaboration with interested parties to
+provide a full reference implementation of Secure Monitor code and ARM
+standards to the benefit of all developers working with ARMv8-A TrustZone
+technology.
+
+This package provides mainline TF-A for the RockChip RK3328 platform,
+for example used by u-boot for the Pine64 Rock64.
diff --git a/sysutils/trusted-firmware-a-rk3328/Makefile b/sysutils/trusted-firmware-a-rk3328/Makefile
new file mode 100644
index 00000000000..25f6356b0c3
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3328/Makefile
@@ -0,0 +1,8 @@
+# $NetBSD: Makefile,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+PLATFORM=	rk3328
+COMMENT=	ARM Trusted Firmware for Rockchip RK3328 SoCs
+
+BL31_SUFFIX=	elf
+
+.include "../../sysutils/trusted-firmware-a/trusted-firmware-a.mk"
diff --git a/sysutils/trusted-firmware-a-rk3328/PLIST b/sysutils/trusted-firmware-a-rk3328/PLIST
new file mode 100644
index 00000000000..194b8ad34e0
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3328/PLIST
@@ -0,0 +1,2 @@
+@comment $NetBSD: PLIST,v 1.1 2022/02/09 01:57:57 mrg Exp $
+share/trusted-firmware-a/rk3328/bl31.elf
diff --git a/sysutils/trusted-firmware-a-rk3328/buildlink3.mk b/sysutils/trusted-firmware-a-rk3328/buildlink3.mk
new file mode 100644
index 00000000000..0aa21c682b7
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3328/buildlink3.mk
@@ -0,0 +1,15 @@
+# $NetBSD: buildlink3.mk,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+BUILDLINK_DEPMETHOD.trusted-firmware-a-rk3328?=	build
+
+BUILDLINK_TREE+=	trusted-firmware-a-rk3328
+
+.if !defined(TRUSTED_FIRMWARE_A_RK3328_BUILDLINK3_MK)
+TRUSTED_FIRMWARE_A_RK3328_BUILDLINK3_MK:=
+
+BUILDLINK_API_DEPENDS.trusted-firmware-a-rk3328+=	trusted-firmware-a-rk3328>=2.6
+BUILDLINK_PKGSRCDIR.trusted-firmware-a-rk3328?=	../../sysutils/trusted-firmware-a-rk3328
+.endif	# TRUSTED_FIRMWARE_A_RK3328_BUILDLINK3_MK
+
+BUILDLINK_TREE+=	-trusted-firmware-a-rk3328
+
diff --git a/sysutils/trusted-firmware-a-rk3399/DESCR b/sysutils/trusted-firmware-a-rk3399/DESCR
new file mode 100644
index 00000000000..ea1e895d4f4
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3399/DESCR
@@ -0,0 +1,20 @@
+Trusted Firmware-A (TF-A) provides a reference implementation of secure
+world software for ARMv8-A, including a Secure Monitor executing at
+Exception Level 3 (EL3). It implements various ARM interface standards,
+such as:
+
+    The Power State Coordination Interface (PSCI)
+    Trusted Board Boot Requirements (TBBR, ARM DEN0006C-1)
+    SMC Calling Convention
+    System Control and Management Interface
+
+As far as possible the code is designed for reuse or porting to other
+ARMv8-A model and hardware platforms.
+
+ARM will continue development in collaboration with interested parties to
+provide a full reference implementation of Secure Monitor code and ARM
+standards to the benefit of all developers working with ARMv8-A TrustZone
+technology.
+
+This package provides mainline TF-A for the RockChip RK3399 platform,
+for example used by u-boot for the Pinebook Pro.
diff --git a/sysutils/trusted-firmware-a-rk3399/Makefile b/sysutils/trusted-firmware-a-rk3399/Makefile
new file mode 100644
index 00000000000..3c636490621
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3399/Makefile
@@ -0,0 +1,11 @@
+# $NetBSD: Makefile,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+PLATFORM=	rk3399
+COMMENT=	ARM Trusted Firmware for Rockchip RK3399 SoCs
+
+BL31_SUFFIX=	elf
+
+# This package builds for Cortex-M0 *and* Cortex-A53/A72.
+ATF_CORTEX_M0=	yes
+
+.include "../../sysutils/trusted-firmware-a/trusted-firmware-a.mk"
diff --git a/sysutils/trusted-firmware-a-rk3399/PLIST b/sysutils/trusted-firmware-a-rk3399/PLIST
new file mode 100644
index 00000000000..5b097b09512
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3399/PLIST
@@ -0,0 +1,2 @@
+@comment $NetBSD: PLIST,v 1.1 2022/02/09 01:57:57 mrg Exp $
+share/trusted-firmware-a/rk3399/bl31.elf
diff --git a/sysutils/trusted-firmware-a-rk3399/buildlink3.mk b/sysutils/trusted-firmware-a-rk3399/buildlink3.mk
new file mode 100644
index 00000000000..9746555fdbf
--- /dev/null
+++ b/sysutils/trusted-firmware-a-rk3399/buildlink3.mk
@@ -0,0 +1,15 @@
+# $NetBSD: buildlink3.mk,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+BUILDLINK_DEPMETHOD.trusted-firmware-a-rk3399?=	build
+
+BUILDLINK_TREE+=	trusted-firmware-a-rk3399
+
+.if !defined(TRUSTED_FIRMWARE_A_RK3399_BUILDLINK3_MK)
+TRUSTED_FIRMWARE_A_RK3399_BUILDLINK3_MK:=
+
+BUILDLINK_API_DEPENDS.trusted-firmware-a-rk3399+=	trusted-firmware-a-rk3399>=2.6
+BUILDLINK_PKGSRCDIR.trusted-firmware-a-rk3399?=	../../sysutils/trusted-firmware-a-rk3399
+.endif	# TRUSTED_FIRMWARE_A_RK3399_BUILDLINK3_MK
+
+BUILDLINK_TREE+=	-trusted-firmware-a-rk3399
+
diff --git a/sysutils/trusted-firmware-a/distinfo b/sysutils/trusted-firmware-a/distinfo
new file mode 100644
index 00000000000..ec72e0a7c88
--- /dev/null
+++ b/sysutils/trusted-firmware-a/distinfo
@@ -0,0 +1,5 @@
+$NetBSD: distinfo,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+BLAKE2s (arm-trusted-firmware-2.6.zip) = 00bfe714f77eb95a3fbbbe1a89667aa9ce70f55bcde4e8f0a8c36ac36d78ece1
+SHA512 (arm-trusted-firmware-2.6.zip) = 3d5ef0f39017aad6bc469ba367604941e0aa7f5ce69f1709492e282aaff8188ff18ee7a224271c3d6c0479cac98954feb6faf9355c83a7351d8693ae61beac03
+Size (arm-trusted-firmware-2.6.zip) = 8010252 bytes
diff --git a/sysutils/trusted-firmware-a/trusted-firmware-a-dist.mk b/sysutils/trusted-firmware-a/trusted-firmware-a-dist.mk
new file mode 100644
index 00000000000..fd0d9bc57d9
--- /dev/null
+++ b/sysutils/trusted-firmware-a/trusted-firmware-a-dist.mk
@@ -0,0 +1,20 @@
+# $NetBSD: trusted-firmware-a-dist.mk,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+# When updating, don't forget to also update trusted-firmware-a-fiptool.
+VERSION=	2.6
+
+GITHUB_PROJECT=	arm-trusted-firmware
+GITHUB_TAG=	v${VERSION}
+
+DISTNAME=	${GITHUB_PROJECT}-${VERSION}
+DISTINFO_FILE?=	${.CURDIR}/../../sysutils/trusted-firmware-a/distinfo
+CATEGORIES=	sysutils
+MASTER_SITES=	${MASTER_SITE_GITHUB:=ARM-software/}
+EXTRACT_SUFX=	.zip
+PATCHDIR?=	${.CURDIR}/../../sysutils/trusted-firmware-a/patches
+
+MAINTAINER=	port-arm@NetBSD.org
+HOMEPAGE=	https://github.com/ARM-software/arm-trusted-firmware/
+LICENSE=	modified-bsd
+
+USE_TOOLS+=	gmake
diff --git a/sysutils/trusted-firmware-a/trusted-firmware-a.mk b/sysutils/trusted-firmware-a/trusted-firmware-a.mk
new file mode 100644
index 00000000000..d4ffbacbc32
--- /dev/null
+++ b/sysutils/trusted-firmware-a/trusted-firmware-a.mk
@@ -0,0 +1,52 @@
+# $NetBSD: trusted-firmware-a.mk,v 1.1 2022/02/09 01:57:57 mrg Exp $
+
+.include "../../sysutils/trusted-firmware-a/trusted-firmware-a-dist.mk"
+
+PKGNAME?=	trusted-firmware-a-${PLATFORM}-${VERSION}
+
+RELRO_SUPPORTED=	no
+MAKE_FLAGS+=	CROSS_COMPILE=${PREFIX}/cross-aarch64-none-elf/bin/aarch64-none-elf-
+.if !empty(ATF_CORTEX_M0:Myes)
+MAKE_FLAGS+=	M0_CROSS_COMPILE=${PREFIX}/cross-arm-none-eabi/bin/arm-none-eabi-
+.endif
+MAKE_FLAGS+=	PLAT=${PLATFORM}
+MAKE_FLAGS+=	CFLAGS='-gdwarf-2'
+#MAKE_FLAGS+=	DEBUG=1
+#MAKE_FLAGS+=	LOG_LEVEL=50
+#MAKE_FLAGS+=	V=1
+MAKE_FLAGS+=	BUILD_STRING=${GITHUB_TAG}
+BUILD_TARGET=	bl31
+
+BUILD_DEPENDS+=	cross-aarch64-none-elf-gcc-[0-9]*:../../cross/aarch64-none-elf-gcc
+.if !empty(ATF_CORTEX_M0:Myes)
+BUILD_DEPENDS+=	cross-arm-none-eabi-gcc-[0-9]*:../../cross/arm-none-eabi-gcc
+.endif
+
+.if empty(MAKE_FLAGS:MDEBUG=1)
+BL31_DIR=release
+.else
+BL31_DIR=debug
+.endif
+
+BL31_SUFFIX?=	bin
+
+.if !target(do-install)
+do-install:
+	${INSTALL_DATA_DIR} \
+	     ${DESTDIR}${PREFIX}/share/trusted-firmware-a/${PLATFORM}
+.if ${BL31_SUFFIX} == "bin"
+	${INSTALL_DATA} \
+	    ${WRKSRC}/build/${PLATFORM}/${BL31_DIR}/bl31.${BL31_SUFFIX} \
+	    ${DESTDIR}${PREFIX}/share/trusted-firmware-a/${PLATFORM}/
+.else
+	${INSTALL_DATA} \
+	    ${WRKSRC}/build/${PLATFORM}/${BL31_DIR}/bl31/bl31.${BL31_SUFFIX} \
+	    ${DESTDIR}${PREFIX}/share/trusted-firmware-a/${PLATFORM}/
+.endif
+.endif
+
+# XXX kludge. pkgsrc passes down run path flags in LDFLAGS assuming
+# gcc is used for linking, but here we call the linker directly.
+COMPILER_RPATH_FLAG=	-R
+
+.include "../../mk/bsd.pkg.mk"