[bug#74849] [PATCH 0/6] Update ARM Trusted Firmware.

[bug#74849] [PATCH 0/6] Update ARM Trusted Firmware.

[Herman Rimm via Guix-patches via]

Hello,

I updated and moved [PATCH v2 3/8] of #70131 to this patch series.

I assume the change to GCC 14 caused arm-trusted-firmware-imx8mq to
fail.  The last patch makes it build again, with a commit (patch) from
https://github.com/nxp-imx/imx-atf.git.

I think we should verify that boards using arm-trusted-firmware-imx8mq
would still boot, but there aren't any U-Boot packages that use it.

Cheers,
Herman

Herman Rimm (6):
  gnu: arm-trusted-firmware-rk3399: Reformat.
  gnu: arm-trusted-firmware: Reformat.
  import: utils: Move guix-name to (guix utils).
  gnu: make-arm-trusted-firmware: Use guix-name.
  gnu: make-arm-trusted-firmware: Update to 2.12.
  gnu: arm-trusted-firmware-imx8mq: Fix build.

 gnu/local.mk                                  |   2 +
 gnu/packages/firmware.scm                     | 159 ++++++++----------
 .../patches/8mq-enable-imx_hab_handler.patch  |  36 ++++
 .../patches/8mq-move-stack-to-ocram_s.patch   |  88 ++++++++++
 guix/import/elpa.scm                          |   1 +
 guix/import/texlive.scm                       |  10 +-
 guix/import/utils.scm                         |  10 --
 guix/utils.scm                                |   9 +
 8 files changed, 205 insertions(+), 110 deletions(-)
 create mode 100644 gnu/packages/patches/8mq-enable-imx_hab_handler.patch
 create mode 100644 gnu/packages/patches/8mq-move-stack-to-ocram_s.patch


base-commit: 98aca7a2b6250e7f6a2ff3a93b29d0dea896ad21
-- 
2.45.2

[bug#74849] [PATCH 1/6] gnu: arm-trusted-firmware-rk3399: Reformat.

[Herman Rimm via Guix-patches via]

* gnu/packages/firmware.scm (arm-trusted-firmware-rk3399)[name]: Remove.
[native-inputs]: Reformat.

Change-Id: Ib44246f0c3929fcf8c6f625df53e3a307fc87595
---
 gnu/packages/firmware.scm | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/gnu/packages/firmware.scm b/gnu/packages/firmware.scm
index 868be8488c..2750bab66d 100644
--- a/gnu/packages/firmware.scm
+++ b/gnu/packages/firmware.scm
@@ -1175,12 +1175,9 @@ (define-public arm-trusted-firmware-rk3399
   (let ((base (make-arm-trusted-firmware "rk3399")))
     (package
       (inherit base)
-      (name "arm-trusted-firmware-rk3399")
-      (native-inputs
-       (modify-inputs (package-native-inputs base)
-         (prepend
-             (cross-gcc "arm-none-eabi")
-             (cross-binutils "arm-none-eabi")))))))
+      (native-inputs (modify-inputs (package-native-inputs base)
+                       (prepend (cross-gcc "arm-none-eabi")
+                                (cross-binutils "arm-none-eabi")))))))
 
 (define-public arm-trusted-firmware-imx8mq
   (let ((base (make-arm-trusted-firmware "imx8mq")))
-- 
2.45.2

[bug#74849] [PATCH 2/6] gnu: arm-trusted-firmware: Reformat.

[Herman Rimm via Guix-patches via]

* gnu/packages/firmware.scm (arm-trusted-firmware)[source]: Use modules.
[synopsis]: Mention supported architectures.
[description]: Fix "ARMv7A" typo.  Remove newline.

Change-Id: I52d1a02f27e1c8ebbe5b48ea9a69e4c008ff5b9c
---
 gnu/packages/firmware.scm | 104 ++++++++++++++++++--------------------
 1 file changed, 49 insertions(+), 55 deletions(-)

diff --git a/gnu/packages/firmware.scm b/gnu/packages/firmware.scm
index 2750bab66d..ff083a2c6f 100644
--- a/gnu/packages/firmware.scm
+++ b/gnu/packages/firmware.scm
@@ -1099,68 +1099,62 @@ (define-public ovmf
 
 (define* (make-arm-trusted-firmware platform
                                     #:key (triplet "aarch64-linux-gnu"))
-  (let ((native-build? (lambda ()
-                         ;; Note: %current-system is a *triplet*, unlike its
-                         ;; name would suggest.
-                         (or (not triplet) ;disable cross-compilation
-                             (string=? (%current-system)
-                                       (gnu-triplet->nix-system triplet))))))
-    (package
-      (name (string-append "arm-trusted-firmware-" platform))
-      (version "2.9")
-      (source
-       (origin
-         (method git-fetch)
-         (uri (git-reference
-               ;; There are only GitHub generated release snapshots.
-               (url "https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/")
-               (commit (string-append "v" version))))
-         (file-name (git-file-name "arm-trusted-firmware" version))
-         (sha256
-          (base32
-           "16fjbn1zck0d8b554h8lk1svqqn0zlawvrlkjxry9l71s9h4vd0p"))
-         (snippet
-          #~(begin
-              (use-modules (guix build utils))
-              ;; Remove binary blobs which do not contain source or proper
-              ;; license.
+  (define (native-build?)
+    "Return #t if the host and target platforms differ."
+    (or (not triplet)
+        ;;%current-system is a *triplet*, unlike its name would suggest.
+        (string=? (%current-system) (gnu-triplet->nix-system triplet))))
+  (package
+    (name (string-append "arm-trusted-firmware-" platform))
+    (version "2.9")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url (string-append "https://git.trustedfirmware.org"
+                                  "/TF-A/trusted-firmware-a.git/"))
+              (commit (string-append "v" version))))
+       (file-name (git-file-name "arm-trusted-firmware" version))
+       (sha256
+        (base32 "16fjbn1zck0d8b554h8lk1svqqn0zlawvrlkjxry9l71s9h4vd0p"))
+       (modules '((guix build utils)))
+       ;; Remove binary blobs: they don't reference a source or license.
+       (snippet #~(for-each delete-file (find-files "." "\\.bin$")))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:target (and (not (native-build?)) triplet)
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)         ;no configure script
+          (replace 'install
+            (lambda _
               (for-each (lambda (file)
-                          (delete-file file))
-                        (find-files "." "\\.bin$"))))))
-      (build-system gnu-build-system)
-      (arguments
-       (list
-        #:target (and (not (native-build?)) triplet)
-        #:phases
-        #~(modify-phases %standard-phases
-            (delete 'configure)         ;no configure script
-            (replace 'install
-              (lambda _
-                (for-each (lambda (file)
-                            (install-file file #$output))
-                          (find-files "." "\\.(bin|elf)$")))))
-        #:make-flags #~(list (string-append "PLAT=" #$platform)
-                             #$@(if (not (native-build?))
-                                    (list (string-append "CROSS_COMPILE=" triplet "-"))
-                                    '())
-                             "DEBUG=1")
-        #:tests? #f))                   ;no test suite
-      (home-page "https://www.trustedfirmware.org/")
-      (synopsis "Implementation of \"secure world software\"")
-      (description
-       "ARM Trusted Firmware provides a reference implementation of secure world
-software for ARMv7A and ARMv8-A, including a Secure Monitor executing at
-@dfn{Exception Level 3} (EL3).  It implements various ARM interface standards,
-such as:
+                          (install-file file #$output))
+                        (find-files "." "\\.(bin|elf)$")))))
+      #:make-flags
+      #~(list (string-append "PLAT=" #$platform)
+              #$@(if (not (native-build?))
+                     (list (string-append "CROSS_COMPILE=" triplet "-"))
+                     '())
+              "DEBUG=1")
+      #:tests? #f))                   ;no test suite
+    (home-page "https://www.trustedfirmware.org/")
+    (synopsis "Secure world software for ARMv7-A and ARMv8-A")
+    (description
+     "ARM Trusted Firmware provides a reference implementation of secure
+world software for ARMv7-A and ARMv8-A, including a Secure Monitor
+executing at @dfn{Exception Level 3} (EL3).  It implements various ARM
+interface standards, such as:
 @enumerate
 @item The Power State Coordination Interface (PSCI)
 @item Trusted Board Boot Requirements (TBBR, ARM DEN0006C-1)
 @item SMC Calling Convention
 @item System Control and Management Interface
 @item Software Delegated Exception Interface (SDEI)
-@end enumerate\n")
-      (license (list license:bsd-3
-                     license:bsd-2))))) ; libfdt
+@end enumerate")
+    (license (list license:bsd-3
+                   license:bsd-2)))) ; libfdt
 
 (define-public arm-trusted-firmware-sun50i-a64
   (let ((base (make-arm-trusted-firmware "sun50i_a64")))
-- 
2.45.2

[bug#74849] [PATCH 3/6] import: utils: Move guix-name to (guix utils).

[Herman Rimm via Guix-patches via]

* guix/import/elpa.scm: Import (guix utils).
* guix/import/texlive.scm (guix-name): Remove.
* guix/import/utils.scm (guix-name): Move to ...
* guix/utils.scm (guix-name): ... here.

Change-Id: If56a452f64ed06c8bb06a96a283a5067cb54d602
---
 guix/import/elpa.scm    |  1 +
 guix/import/texlive.scm | 10 +---------
 guix/import/utils.scm   | 10 ----------
 guix/utils.scm          |  9 +++++++++
 4 files changed, 11 insertions(+), 19 deletions(-)

diff --git a/guix/import/elpa.scm b/guix/import/elpa.scm
index 46b6dc98a2..11559097b5 100644
--- a/guix/import/elpa.scm
+++ b/guix/import/elpa.scm
@@ -44,6 +44,7 @@ (define-module (guix import elpa)
   #:use-module (guix git)
   #:use-module (guix hash)
   #:use-module (guix store)
+  #:use-module ((guix utils) #:select (guix-name))
   #:use-module (guix base32)
   #:use-module (guix upstream)
   #:use-module (guix packages)
diff --git a/guix/import/texlive.scm b/guix/import/texlive.scm
index 6d04cc25ee..b2e99c40f2 100644
--- a/guix/import/texlive.scm
+++ b/guix/import/texlive.scm
@@ -35,6 +35,7 @@ (define-module (guix import texlive)
   #:use-module (guix store)
   #:use-module (guix svn-download)
   #:use-module (guix upstream)
+  #:use-module ((guix utils) #:select (guix-name))
   #:use-module (ice-9 ftw)
   #:use-module (ice-9 match)
   #:use-module (ice-9 popen)
@@ -334,15 +335,6 @@ (define string->license
     ((lst ...) `(list ,@(map string->license lst)))
     (x `(error unknown-license ,x))))
 
-(define (guix-name name)
-  "Return a Guix package name for a given Texlive package NAME."
-  (string-append "texlive-"
-                 (string-map (match-lambda
-                               (#\_ #\-)
-                               (#\. #\-)
-                               (chr (char-downcase chr)))
-                             name)))
-
 (define* (filter-depends depends #:optional texlive-only)
   "Filter upstream package names DEPENDS to include only their equivalent Guix
 package names, without \"texlive-\" prefix.  When TEXLIVE-ONLY is true, ignore
diff --git a/guix/import/utils.scm b/guix/import/utils.scm
index ccf18a7bf9..610fe9970e 100644
--- a/guix/import/utils.scm
+++ b/guix/import/utils.scm
@@ -82,8 +82,6 @@ (define-module (guix import utils)
             read-lines
             chunk-lines
 
-            guix-name
-
             recursive-import))
 
 (define (factorize-uri uri version)
@@ -609,14 +607,6 @@ (define* (chunk-lines lines #:optional (pred string-null?))
             (reverse res)
             (loop (cdr after) res))))))
 
-(define (guix-name prefix name)
-  "Return a Guix package name for a given package name."
-  (string-append prefix (string-map (match-lambda
-                                      (#\_ #\-)
-                                      (#\. #\-)
-                                      (chr (char-downcase chr)))
-                                    name)))
-
 (define (topological-sort nodes
                           node-dependencies
                           node-name)
diff --git a/guix/utils.scm b/guix/utils.scm
index 537d0490e0..dfa8f0f19b 100644
--- a/guix/utils.scm
+++ b/guix/utils.scm
@@ -91,6 +91,7 @@ (define-module (guix utils)
             %current-system
             %current-target-system
             package-name->name+version
+            guix-name
             target-linux?
             target-hurd?
             system-hurd?
@@ -706,6 +707,14 @@ (define* (package-name->name+version spec
     (idx (values (substring spec 0 idx)
                  (substring spec (1+ idx))))))
 
+(define (guix-name prefix name)
+  "Return a Guix package name for a given package name."
+  (string-append prefix (string-map (match-lambda
+                                      (#\_ #\-)
+                                      (#\. #\-)
+                                      (chr (char-downcase chr)))
+                                    name)))
+
 (define* (target-linux? #:optional (target (or (%current-target-system)
                                                (%current-system))))
   "Does the operating system of TARGET use the Linux kernel?"
-- 
2.45.2

[bug#74849] [PATCH 4/6] gnu: make-arm-trusted-firmware: Use guix-name.

[Herman Rimm via Guix-patches via]

* gnu/packages/firmware.scm (make-arm-trusted-firmware): Use guix-name.
(arm-trusted-firmware-sun50i-a64): Return base package directly.

Change-Id: I23f05ac5e8e897037cd8d8afc4e747b05e56e32d
---
 gnu/packages/firmware.scm | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/gnu/packages/firmware.scm b/gnu/packages/firmware.scm
index ff083a2c6f..438b347dfb 100644
--- a/gnu/packages/firmware.scm
+++ b/gnu/packages/firmware.scm
@@ -1105,7 +1105,7 @@ (define* (make-arm-trusted-firmware platform
         ;;%current-system is a *triplet*, unlike its name would suggest.
         (string=? (%current-system) (gnu-triplet->nix-system triplet))))
   (package
-    (name (string-append "arm-trusted-firmware-" platform))
+    (name (guix-name "arm-trusted-firmware-" platform))
     (version "2.9")
     (source
      (origin
@@ -1157,10 +1157,7 @@ (define* (make-arm-trusted-firmware platform
                    license:bsd-2)))) ; libfdt
 
 (define-public arm-trusted-firmware-sun50i-a64
-  (let ((base (make-arm-trusted-firmware "sun50i_a64")))
-    (package
-      (inherit base)
-      (name "arm-trusted-firmware-sun50i-a64"))))
+  (make-arm-trusted-firmware "sun50i_a64"))
 
 (define-public arm-trusted-firmware-rk3328
   (make-arm-trusted-firmware "rk3328"))
-- 
2.45.2

[bug#74849] [PATCH 5/6] gnu: make-arm-trusted-firmware: Update to 2.12.

[Herman Rimm via Guix-patches via]

* gnu/packages/firmware.scm (make-arm-trusted-firmware): Update to 2.12.
[arguments]: Select correct objcopy and objdump variants.
[native-inputs]: Add python to avoid warnings.

Change-Id: Iccff10b16090913fe5c99491d8335f8ede09038c
---
 gnu/packages/firmware.scm | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/firmware.scm b/gnu/packages/firmware.scm
index 438b347dfb..2e170fcc1d 100644
--- a/gnu/packages/firmware.scm
+++ b/gnu/packages/firmware.scm
@@ -1106,7 +1106,7 @@ (define* (make-arm-trusted-firmware platform
         (string=? (%current-system) (gnu-triplet->nix-system triplet))))
   (package
     (name (guix-name "arm-trusted-firmware-" platform))
-    (version "2.9")
+    (version "2.12")
     (source
      (origin
        (method git-fetch)
@@ -1116,7 +1116,7 @@ (define* (make-arm-trusted-firmware platform
               (commit (string-append "v" version))))
        (file-name (git-file-name "arm-trusted-firmware" version))
        (sha256
-        (base32 "16fjbn1zck0d8b554h8lk1svqqn0zlawvrlkjxry9l71s9h4vd0p"))
+        (base32 "18rzhygvq0afcylirq9yis3kaa1nli14k2jrm64ih85gz4nhl99w"))
        (modules '((guix build utils)))
        ;; Remove binary blobs: they don't reference a source or license.
        (snippet #~(for-each delete-file (find-files "." "\\.bin$")))))
@@ -1126,7 +1126,14 @@ (define* (make-arm-trusted-firmware platform
       #:target (and (not (native-build?)) triplet)
       #:phases
       #~(modify-phases %standard-phases
-          (delete 'configure)         ;no configure script
+          (replace 'configure          ;no configure script
+            ;; Fix ATF commit ffb7742125def3e0acca4c7e4d3215af5ce25a31
+            (lambda _
+              (substitute* "plat/rockchip/rk3399/drivers/m0/Makefile"
+                (("-oc") "-oc-default"))
+              (substitute* "make_helpers/build_macros.mk"
+                (("-oc") "-oc-default")
+                (("-od") "-od-default"))))
           (replace 'install
             (lambda _
               (for-each (lambda (file)
@@ -1139,6 +1146,7 @@ (define* (make-arm-trusted-firmware platform
                      '())
               "DEBUG=1")
       #:tests? #f))                   ;no test suite
+    (native-inputs (list python))
     (home-page "https://www.trustedfirmware.org/")
     (synopsis "Secure world software for ARMv7-A and ARMv8-A")
     (description
-- 
2.45.2

[bug#74849] [PATCH 6/6] gnu: arm-trusted-firmware-imx8mq: Fix build.

[Herman Rimm via Guix-patches via]

* gnu/local.mk (dist_patch_DATA): Register patches.
* gnu/packages/firmware.scm (make-arm-trusted-firmware): Add make-flags
argument.  [source]: Use patches.
(arm-trusted-firmware-imx8mq): Refactor.
* gnu/packages/patches/8mq-enable-imx_hab_handler.patch: Add file.
* gnu/packages/patches/8mq-move-stack-to-ocram_s.patch: Add file.

Change-Id: I8a72c1ceb5e00e113ae91a7c2f5b733d981185d6
---
 gnu/local.mk                                  |  2 +
 gnu/packages/firmware.scm                     | 35 ++------
 .../patches/8mq-enable-imx_hab_handler.patch  | 36 ++++++++
 .../patches/8mq-move-stack-to-ocram_s.patch   | 88 +++++++++++++++++++
 4 files changed, 134 insertions(+), 27 deletions(-)
 create mode 100644 gnu/packages/patches/8mq-enable-imx_hab_handler.patch
 create mode 100644 gnu/packages/patches/8mq-move-stack-to-ocram_s.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index 39b142af5a..9b3a557dc4 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -931,6 +931,8 @@ MODULES_NOT_COMPILED +=				\
 
 patchdir = $(guilemoduledir)/%D%/packages/patches
 dist_patch_DATA =						\
+  %D%/packages/patches/8mq-enable-imx_hab_handler.patch		\
+  %D%/packages/patches/8mq-move-stack-to-ocram_s.patch		\
   %D%/packages/patches/abcl-fix-build-xml.patch	\
   %D%/packages/patches/ableton-link-system-libraries-debian.patch	\
   %D%/packages/patches/abiword-explictly-cast-bools.patch	\
diff --git a/gnu/packages/firmware.scm b/gnu/packages/firmware.scm
index 2e170fcc1d..df7ad30590 100644
--- a/gnu/packages/firmware.scm
+++ b/gnu/packages/firmware.scm
@@ -1097,8 +1097,9 @@ (define-public ovmf-riscv64
 (define-public ovmf
   (deprecated-package "ovmf" ovmf-x86-64))
 
-(define* (make-arm-trusted-firmware platform
-                                    #:key (triplet "aarch64-linux-gnu"))
+(define* (make-arm-trusted-firmware platform #:key
+                                    (triplet "aarch64-linux-gnu")
+                                    (make-flags '("DEBUG=1")))
   (define (native-build?)
     "Return #t if the host and target platforms differ."
     (or (not triplet)
@@ -1117,6 +1118,8 @@ (define* (make-arm-trusted-firmware platform
        (file-name (git-file-name "arm-trusted-firmware" version))
        (sha256
         (base32 "18rzhygvq0afcylirq9yis3kaa1nli14k2jrm64ih85gz4nhl99w"))
+       (patches (search-patches "8mq-enable-imx_hab_handler.patch"
+                                "8mq-move-stack-to-ocram_s.patch"))
        (modules '((guix build utils)))
        ;; Remove binary blobs: they don't reference a source or license.
        (snippet #~(for-each delete-file (find-files "." "\\.bin$")))))
@@ -1144,7 +1147,7 @@ (define* (make-arm-trusted-firmware platform
               #$@(if (not (native-build?))
                      (list (string-append "CROSS_COMPILE=" triplet "-"))
                      '())
-              "DEBUG=1")
+              #$@make-flags)
       #:tests? #f))                   ;no test suite
     (native-inputs (list python))
     (home-page "https://www.trustedfirmware.org/")
@@ -1179,30 +1182,8 @@ (define-public arm-trusted-firmware-rk3399
                                 (cross-binutils "arm-none-eabi")))))))
 
 (define-public arm-trusted-firmware-imx8mq
-  (let ((base (make-arm-trusted-firmware "imx8mq")))
-    (package
-      (inherit base)
-      ;; Newer versions do not build and are essentially not supported
-      ;; upstream.
-      ;; XXX: explore using NXP maintained branch
-      ;; https://github.com/nxp-imx/imx-atf
-      (version "2.8")
-      (source
-       (origin
-         (method git-fetch)
-         (uri (git-reference
-               ;; There are only GitHub generated release snapshots.
-               (url "https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/")
-               (commit (string-append "v" version))))
-         (file-name (git-file-name "arm-trusted-firmware" version))
-         (sha256
-          (base32
-           "0grq3fgxi9xhcljnhwlxjvdghyz15gaq50raw41xy4lm8rkmnzp3"))))
-      (arguments
-       (substitute-keyword-arguments (package-arguments base)
-         ((#:make-flags flags ''())
-          ;; Adding debug symbols causes the size to exceed limits.
-          #~(delete "DEBUG=1" #$flags)))))))
+  ;; Remove debug symbols because of limited OCRAM.
+  (make-arm-trusted-firmware "imx8mq" #:make-flags '()))
 
 (define make-crust-firmware
   (mlambda (platform)
diff --git a/gnu/packages/patches/8mq-enable-imx_hab_handler.patch b/gnu/packages/patches/8mq-enable-imx_hab_handler.patch
new file mode 100644
index 0000000000..0ead773e4e
--- /dev/null
+++ b/gnu/packages/patches/8mq-enable-imx_hab_handler.patch
@@ -0,0 +1,36 @@
+From: Herman Rimm <herman@rimm.ee>
+Date: Sun, 8 Dec 2024 01:13:59 +0100
+Subject: [PATCH] fix(imx8m): 8mq: enable imx_hab_handler
+
+This completes af799814e2639a03b3453744f06a73e77cb66e86.
+
+Signed-off-by: Herman Rimm <herman@rimm.ee>
+---
+To submit to review.trustedfirmware.org, sign in with a GitHub account.
+
+diff --git a/plat/imx/common/include/imx_sip_svc.h b/plat/imx/common/include/imx_sip_svc.h
+index 404a82959..1948bc2eb 100644
+--- a/plat/imx/common/include/imx_sip_svc.h
++++ b/plat/imx/common/include/imx_sip_svc.h
+@@ -88,7 +88,8 @@ int imx_src_handler(uint32_t smc_fid, u_register_t x1,
+ 		    u_register_t x2, u_register_t x3, void *handle);
+ #endif
+ 
+-#if defined(PLAT_imx8mm) || defined(PLAT_imx8mn) || defined(PLAT_imx8mp)
++#if defined(PLAT_imx8mm) || defined(PLAT_imx8mn) || defined(PLAT_imx8mp) || \
++	defined(PLAT_imx8mq)
+ int imx_hab_handler(uint32_t smc_fid, u_register_t x1,
+ 		    u_register_t x2, u_register_t x3, u_register_t x4);
+ #endif
+diff --git a/plat/imx/imx8m/imx8mq/platform.mk b/plat/imx/imx8m/imx8mq/platform.mk
+index 73179dd0c..b1b954f1d 100644
+--- a/plat/imx/imx8m/imx8mq/platform.mk
++++ b/plat/imx/imx8m/imx8mq/platform.mk
+@@ -30,6 +30,7 @@ BL31_SOURCES		+=	plat/imx/common/imx8_helpers.S			\
+ 				plat/imx/imx8m/imx8mq/imx8mq_psci.c		\
+ 				plat/imx/imx8m/gpc_common.c			\
+ 				plat/imx/imx8m/imx_aipstz.c			\
++				plat/imx/imx8m/imx_hab.c			\
+ 				plat/imx/imx8m/imx8m_caam.c			\
+ 				plat/imx/imx8m/imx8m_ccm.c			\
+ 				plat/imx/imx8m/imx8m_psci_common.c		\
diff --git a/gnu/packages/patches/8mq-move-stack-to-ocram_s.patch b/gnu/packages/patches/8mq-move-stack-to-ocram_s.patch
new file mode 100644
index 0000000000..1174881181
--- /dev/null
+++ b/gnu/packages/patches/8mq-move-stack-to-ocram_s.patch
@@ -0,0 +1,88 @@
+From: Jacky Bai <ping.bai@nxp.com>
+Date: Tue, 7 Jan 2020 15:48:36 +0800
+Subject: [PATCH] plat: imx8mq: move the stack & xlat table into ocram_s
+
+Move the stack & xlat table into ocram_s due to the
+ocram is not enough.
+
+Signed-off-by: Jacky Bai <ping.bai@nxp.com>
+Change-Id: I40a8e6c91f707598a38e420ff9f4be0c0a5dbf6c
+---
+Commit ae90cc5773abf5656e0e49f2ce746aa54f712b7b of:
+https://github.com/nxp-imx/imx-atf.git
+
+diff --git a/bl31/bl31.ld.S b/bl31/bl31.ld.S
+index 867dedb99..8be52bc7c 100644
+--- a/bl31/bl31.ld.S
++++ b/bl31/bl31.ld.S
+@@ -25,6 +25,10 @@ MEMORY {
+ #else /* SEPARATE_RWDATA_REGION */
+ #define RAM_RW RAM
+ #endif /* SEPARATE_RWDATA_REGION */
++
++#if XLAT_TABLE_IN_OCRAM_S
++    RAM_S (rwx): ORIGIN = 0x180000, LENGTH = 0x8000
++#endif
+ }
+
+ #ifdef PLAT_EXTRA_LD_SCRIPT
+@@ -198,9 +202,13 @@ SECTIONS {
+     __NOBITS_START__ = .;
+ #endif /* SEPARATE_NOBITS_REGION */
+
++#if !STACK_IN_OCRAM_S
+     STACK_SECTION >NOBITS
++#endif
+     BSS_SECTION >NOBITS
++#if !XLAT_TABLE_IN_OCRAM_S
+     XLAT_TABLE_SECTION >NOBITS
++#endif
+
+ #if USE_COHERENT_MEM
+     /*
+@@ -253,4 +261,15 @@ SECTIONS {
+     /DISCARD/ : {
+         *(.dynsym .dynstr .hash .gnu.hash)
+     }
++
++#if XLAT_TABLE_IN_OCRAM_S
++    . = 0x180000;
++    XLAT_TABLE_SECTION >RAM_S
++
++#if STACK_IN_OCRAM_S
++    STACK_SECTION >RAM_S
++#endif
++
++ASSERT(. <= OCRAM_S_LIMIT, "OCRAM_S limit has been exceeded.")
++#endif
+ }
+diff --git a/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c b/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c
+index 70c2def7d..ddff0925c 100644
+--- a/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c
++++ b/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c
+@@ -48,6 +48,7 @@ static uint8_t mmio_read_8_ldrb(uintptr_t address)
+ static const mmap_region_t imx_mmap[] = {
+ 	MAP_REGION_FLAT(GPV_BASE, GPV_SIZE, MT_DEVICE | MT_RW), /* GPV map */
+ 	MAP_REGION_FLAT(IMX_ROM_BASE, IMX_ROM_SIZE, MT_MEMORY | MT_RO), /* ROM map */
++	MAP_REGION_FLAT(OCRAM_S_BASE, OCRAM_S_SIZE, MT_MEMORY | MT_RW), /* ROM map */
+ 	MAP_REGION_FLAT(IMX_AIPS_BASE, IMX_AIPS_SIZE, MT_DEVICE | MT_RW), /* AIPS map */
+ 	MAP_REGION_FLAT(IMX_GIC_BASE, IMX_GIC_SIZE, MT_DEVICE | MT_RW), /* GIC map */
+ 	MAP_REGION_FLAT(IMX_DDRPHY_BASE, IMX_DDR_IPS_SIZE, MT_DEVICE | MT_RW), /* DDRMIX map */
+diff --git a/plat/imx/imx8m/imx8mq/platform.mk b/plat/imx/imx8m/imx8mq/platform.mk
+index 73179dd0c..20a73d691 100644
+--- a/plat/imx/imx8m/imx8mq/platform.mk
++++ b/plat/imx/imx8m/imx8mq/platform.mk
+@@ -45,7 +45,12 @@ BL31_SOURCES		+=	plat/imx/common/imx8_helpers.S			\
+ 				${XLAT_TABLES_LIB_SRCS}				\
+ 				${IMX_GIC_SOURCES}
+
+-ENABLE_PIE		:=	1
++XLAT_TABLE_IN_OCRAM_S	:=	1
++STACK_IN_OCRAM_S       :=      1
++
++$(eval $(call add_define,XLAT_TABLE_IN_OCRAM_S))
++$(eval $(call add_define,STACK_IN_OCRAM_S))
++
+ USE_COHERENT_MEM	:=	1
+ RESET_TO_BL31		:=	1
+ A53_DISABLE_NON_TEMPORAL_HINT := 0
-- 
2.45.2