15 files changed, 770 insertions, 0 deletions
diff --git a/debian/arm-trusted-firmware-tools.install b/debian/arm-trusted-firmware-tools.install
new file mode 100644
index 0000000..1e1bda5
--- /dev/null
+++ b/debian/arm-trusted-firmware-tools.install
@@ -0,0 +1,2 @@
+tools/fiptool/fiptool /usr/bin/
+tools/cert_create/cert_create /usr/bin/
diff --git a/debian/arm-trusted-firmware-tools.lintian-overrides b/debian/arm-trusted-firmware-tools.lintian-overrides
new file mode 100644
index 0000000..3622cfa
--- /dev/null
+++ b/debian/arm-trusted-firmware-tools.lintian-overrides
@@ -0,0 +1,2 @@
+# GPL code is dual-licensed under licenses compatible with openssl.
+arm-trusted-firmware-tools binary: possible-gpl-code-linked-with-openssl
diff --git a/debian/arm-trusted-firmware.docs b/debian/arm-trusted-firmware.docs
new file mode 100644
index 0000000..7239029
--- /dev/null
+++ b/debian/arm-trusted-firmware.docs
@@ -0,0 +1 @@
+readme.rst
diff --git a/debian/arm-trusted-firmware.install b/debian/arm-trusted-firmware.install
new file mode 100644
index 0000000..81ddcb8
--- /dev/null
+++ b/debian/arm-trusted-firmware.install
@@ -0,0 +1 @@
+build/renamed/*                         usr/lib/arm-trusted-firmware
diff --git a/debian/arm-trusted-firmware.lintian-overrides b/debian/arm-trusted-firmware.lintian-overrides
new file mode 100644
index 0000000..c64df76
--- /dev/null
+++ b/debian/arm-trusted-firmware.lintian-overrides
@@ -0,0 +1,5 @@
+# This is boot firmware that needs to be statically linked.
+arm-trusted-firmware binary: statically-linked-binary *usr/lib/arm-trusted-firmware/*/bl31.elf*
+
+# Intended for U-Boot, not linux.
+arm-trusted-firmware binary: wrong-section-according-to-package-name admin => kernel
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..fae2159
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,226 @@
+arm-trusted-firmware (2.8.0+dfsg-1) unstable; urgency=medium
+
+  * New upstream release.
+  * debian/control: Add openssl to Build-Depends.
+  * debian/rules: Move sun50i_a64 to platforms_nodebug.
+  * debian/patches: Refresh for 2.8.0.
+  * debian/copyright: Update for 2.8.0.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Thu, 24 Nov 2022 22:31:44 -0800
+
+arm-trusted-firmware (2.7.0+dfsg-2) unstable; urgency=medium
+
+  * debian/rules: Fix build failure by ignoring warnings for RWX segments.
+  * debian/rules: Work around gcc-12 bug by passing --param=min-pagesize=0
+    in CFLAGS.
+  * debian/patches: Use LDFLAGS with fiptool and cert_create.
+  * debian/rules: Enable hardening options.
+  * Update lintian override for statically-linked-binary.
+  * Update lintian override for wrong-section-according-to-package-name.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Fri, 05 Aug 2022 20:28:37 -0700
+
+arm-trusted-firmware (2.7.0+dfsg-1) experimental; urgency=medium
+
+  * New upstream release.
+
+  [ Vagrant Cascadian ]
+  * debian/rules: Add imx8mq platform.
+  * debian/copyright: Update for 2.7.0.
+  * debian/control: Update Standards Version to 4.6.1.
+
+  [ Ariel D'Alessandro ]
+  * d/rules: Enable imx8mn target
+  * d/rules: Unify build rule for both debug and release platforms
+  * d/rules: Add imx8mn_uart4 target subplatform
+
+  [ Jelmer Vernooĳ ]
+  * Set upstream Repository/Repository-Browse fields.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 08 Jun 2022 20:58:51 -0700
+
+arm-trusted-firmware (2.6+dfsg-1) unstable; urgency=medium
+
+  * New upstream release.
+  * debian/rules: Adjust installation of upstream changelog.
+  * Remove upstream signing key.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Fri, 26 Nov 2021 17:26:17 -0800
+
+arm-trusted-firmware (2.6~rc0+dfsg-1) experimental; urgency=medium
+
+  * New upstream release candidate.
+  * debian/control: Remove "native" qualifier from binutils-arm-none-eabi
+    in Build-Depends.
+  * debian/control: Remove "native" qualifier from gcc-arm-none-eabi in
+    Build-Depends.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 17 Nov 2021 10:31:10 -0800
+
+arm-trusted-firmware (2.5+dfsg-2) unstable; urgency=medium
+
+  * debian/control: Update Standards-Version to 4.6.0, no changes.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 08 Sep 2021 19:35:43 -0700
+
+arm-trusted-firmware (2.5+dfsg-1) experimental; urgency=medium
+
+  * New upstream release
+
+  [ Nicolas Boulenguez ]
+  * Make each command run by Make visible in the build log
+    (Closes: #979278)
+  * Read DEB_HOST_ARCH from /usr/share/architecture.mk instead of
+    environment (Closes: #986059)
+  * Fix cross build of tools by setting HOSTCC from CC (Closes: #986058)
+  * Fix dependencies allowing cross build of rk3399 (Closes: #986057)
+  * Lintian override for non-linux firmware (Closes: #986056)
+  * Drop unused shlibs:Depends debhelper variable from firmware package
+    (Closes: #986055)
+
+  [ Vagrant Cascadian ]
+  * debian/control: Drop explicit branch from Vcs-Git.
+  * debian/copyright: Update for 2.5.
+  * Build rpi3 and rpi4 platforms. (Closes: #989579)
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Tue, 08 Jun 2021 20:04:40 -0700
+
+arm-trusted-firmware (2.4+dfsg-2) unstable; urgency=medium
+
+  * Upload to unstable.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Sat, 16 Jan 2021 17:29:49 -0800
+
+arm-trusted-firmware (2.4+dfsg-1) experimental; urgency=medium
+
+  [ Vagrant Cascadian ]
+  * debian/targets: Enable g12a target (Closes: #973255).
+  * Enable Build-Profile pkg.arm-trusted-firmware.notools to disable
+    building of arm-trusted-firmware-tools.
+  * debian/targets: Enable sun50i_h6 target (Closes: #979179).
+
+  [ Nicolas Boulenguez ]
+  * Update debian/watch (Closes: #977803).
+  * Delegate changelog renaming to debhelper (Closes: #977803).
+  * Let dh_auto_build call sub-Makes (Closes: #977803).
+
+  [ Vagrant Cascadian ]
+  * arm-trusted-firmware: Update lintian overrides to use a glob. Thanks
+    to Nicolas Boulenguez.  (Closes: #977803)
+  * debian/control: Update Standards-Version to 4.5.1.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Mon, 04 Jan 2021 13:40:33 -0800
+
+arm-trusted-firmware (2.3+dfsg-3) unstable; urgency=medium
+
+  * Only build firmware on arm64.
+  * Pass empty CFLAGS and LDFLAGS to firmware build
+  * Pass CFLAGS and CPPFLAGS to fiptool and cert_create.
+  * Drop hardening options that no longer cause issues for the firmware
+    build.
+  * Drop --debug flag from make invocation.
+  * Use -ffile-prefix-map in TF_CFLAGS for reproducible builds.
+  * Drop -fno-pie from TF_CFLAGS as it is handled upstream.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Sat, 17 Oct 2020 22:17:48 -0700
+
+arm-trusted-firmware (2.3+dfsg-2) experimental; urgency=medium
+
+  * debian/control: arm-trusted-firmware: Remove description comparing to
+    Intel ME. Thanks to Pali Rohár.
+  * debian/control: Update to debhelper-compat 13.
+  * debian/rules: Make builds verbose by default, respecting
+    DEB_BUILD_OPTIONS=terse.
+  * Add arm-trusted-firmware-tools (Closes: #931397). Thanks to Ying-Chun
+    Liu (PaulLiu).
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Sat, 10 Oct 2020 19:22:41 -0700
+
+arm-trusted-firmware (2.3+dfsg-1) unstable; urgency=medium
+
+  * Remove binary files with unknown licensing (Closes: #961697).
+  * Update debian/copyright.
+  * Update debian/watch.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 08 Jul 2020 08:26:49 -0700
+
+arm-trusted-firmware (2.3-1) unstable; urgency=medium
+
+  * New upstream release.
+  * debian/copyright: Update for new upstream version.
+  * debian/upstream: Add upstream signing key.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Sun, 26 Apr 2020 10:34:37 -0700
+
+arm-trusted-firmware (2.2-3) unstable; urgency=medium
+
+  [ Vagrant Cascadian ]
+  * debian/control:
+    - Add build-deps for rk3399.
+    - Update Standards-Version to 4.5.0, no changes.
+  * Enable rk3399 target.
+  * Add lintian override for rk3399.
+
+  [ Walter Lozano ]
+  * Fix build for rk3399 (Closes: #956298)
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Fri, 10 Apr 2020 08:34:34 -0700
+
+arm-trusted-firmware (2.2-2) unstable; urgency=medium
+
+  * Upload to unstable.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 08 Jan 2020 00:24:14 -0800
+
+arm-trusted-firmware (2.2-1) experimental; urgency=medium
+
+  * New upstream version.
+  * debian/copyright: Updates for v2.2.
+  * debian/control: Update Standards-Version to 4.4.1, no changes needed.
+  * debian/control: Add Breaks on u-boot-rockchip less than 2020.01~rc5.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 25 Dec 2019 18:46:10 -0800
+
+arm-trusted-firmware (2.1-3) unstable; urgency=medium
+
+  * Update URLs for move to trustedfirmware.org.
+  * debian/control: Update to Standards-Version 4.4.0.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Mon, 08 Jul 2019 10:25:12 -0700
+
+arm-trusted-firmware (2.1-2) experimental; urgency=medium
+
+  * Build rk3328 bl31.elf.
+  * Drop Recommends on u-boot-sunxi.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Mon, 13 May 2019 16:23:51 -0700
+
+arm-trusted-firmware (2.1-1) experimental; urgency=medium
+
+  * New upstream version.
+  * debian/control:
+    - Update Standards-Version to 4.3.0, no changes needed.
+    - Switch to debhelper-compat 12.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Wed, 10 Apr 2019 01:02:30 -0700
+
+arm-trusted-firmware (2.0+290.98aab974-2) unstable; urgency=medium
+
+  * Upload to unstable.
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Tue, 27 Nov 2018 15:33:29 -0800
+
+arm-trusted-firmware (2.0+290.98aab974-1) experimental; urgency=medium
+
+  * Upstream git snapshot from commit 98aab97484b27e40aa74a93e5d1c1ac037a7e0b8.
+    - Fixes for USB and Ethernet on allwinner platforms.
+  * Enable gxbb (tested on Odroid-C2).
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Mon, 26 Nov 2018 23:41:28 -0800
+
+arm-trusted-firmware (2.0+267~cabe0a31-1) experimental; urgency=medium
+
+  * Upstream git snapshot from commit cabe0a31801e99e7abb84d2114ded6bb56f3c71e.
+  * Initial upload to Debian (Closes: #881620).
+
+ -- Vagrant Cascadian <vagrant@debian.org>  Mon, 19 Nov 2018 14:25:59 -0800
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..3ddb4ab
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,40 @@
+Source: arm-trusted-firmware
+Section: admin
+Priority: optional
+Maintainer: Vagrant Cascadian <vagrant@debian.org>
+Standards-Version: 4.6.1
+Build-Depends: debhelper-compat (= 13),
+ gcc-arm-none-eabi [arm64],
+ binutils-arm-none-eabi [arm64],
+ libssl-dev <!pkg.arm-trusted-firmware.notools>,
+ openssl,
+Rules-Requires-Root: no
+Homepage: https://www.trustedfirmware.org/
+Vcs-Browser: https://salsa.debian.org/debian/arm-trusted-firmware
+Vcs-Git: https://salsa.debian.org/debian/arm-trusted-firmware.git
+
+Package: arm-trusted-firmware
+Architecture: arm64
+Depends: ${misc:Depends}
+Breaks: u-boot-rockchip (<< 2020.01~rc5)
+Description: "secure world" software for ARM SoCs - firmware
+ The "secure world" on arm64 machines is a special level of CPU
+ privilege that is hidden from the normal OS, and has complete
+ control over the system.  It provides both initialization during
+ early boot stages (before u-boot or EFI) and system monitor
+ functionality once the machine is booted up.
+ .
+ This package includes the firmware binaries.
+
+Package: arm-trusted-firmware-tools
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Build-Profiles: <!pkg.arm-trusted-firmware.notools>
+Description: "secure world" software for ARM SoCs - tools
+ The "secure world" on arm64 machines is a special level of CPU
+ privilege that is hidden from the normal OS, and has complete
+ control over the system.  It provides both initialization during
+ early boot stages (before u-boot or EFI) and system monitor
+ functionality once the machine is booted up.
+ .
+ This package includes helper tools.
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..ba66239
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,377 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: arm-trusted-firmware
+Source: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/
+Files-Excluded:
+ plat/rockchip/rk3368/drivers/ddr/rk3368_ddr_reg_resume_V1.05.bin
+ plat/rockchip/rk3399/drivers/dp/hdcp.bin
+ plat/arm/board/common/protpk/arm_protpk_rsa_sha256.bin
+ plat/arm/board/common/rotpk/arm_rotpk_rsa_sha256.bin
+ plat/arm/board/common/rotpk/arm_rotpk_ecdsa_sha256.bin
+
+Files: *
+Copyright:
+ 2013-2022, Arm Limited and Contributors.
+License: BSD-3-clause
+
+Files: debian/*
+Copyright: 2018 Adam Borowski <kilobyte@angband.pl>
+ 2018-2020 Vagrant Cascadian <vagrant@debian.org>
+License: BSD-3-clause
+
+Files: drivers/brcm/*
+Copyright:
+ 2016-2021, Broadcom
+License: BSD-3-clause
+
+Files: drivers/imx/uart/*
+Copyright:
+  Linaro 2018 Limited and Contributors.
+License: BSD-3-clause
+
+Files: drivers/marvell/*
+Copyright:
+ 2016-2021 Marvell International Ltd.
+License: BSD-3-clause
+
+Files: drivers/renesas/*
+Copyright:
+ 2015-2021, Renesas Electronics Corporation.
+License: BSD-3-clause
+
+Files:
+ drivers/st/*
+Copyright:
+ 2016-2022, STMicroelectronics
+ 2018-2022, ARM Limited and Contributors.
+License: BSD-3-clause
+
+Files:
+ drivers/st/clk/stm32mp1_clk.c
+ drivers/st/ddr/stm32mp1_ddr.c
+ drivers/st/ddr/stm32mp1_ram.c
+ drivers/st/fmc/stm32_fmc2_nand.c
+ drivers/st/spi/stm32_qspi.c
+Copyright: 2018-2022, STMicroelectronics
+License: GPL-2+ or BSD-3-clause
+
+Files: fdts/stm32*
+Copyright:
+ 2017-2022, STMicroelectronics
+ 2019, Arrow Electronics
+ 2019, Linaro Ltd
+ 2020 Ahmad Fatoum, Pengutronix
+ 2021, Grzegorz Szymaszek.
+ 2019-2020 Marek Vasut <marex@denx.de>
+ 2022-2022 DH electronics GmbH
+License: GPL-2+ or BSD-3-clause
+
+File: fdts/stm32mp1-cot-descriptors.dtsi
+Copyright:
+ 2020-2022, ARM Limited. All rights reserved.
+License: BSD-3-Clause
+
+Files: include/dt-bindings/*
+Copyright:
+ 2017-2022, STMicroelectronics
+License: GPL-2+ or BSD-3-clause
+
+Files:
+ include/dt-bindings/reset/stm32mp13-resets.h
+ include/dt-bindings/reset/stm32mp15-resets.h
+Copyright:
+ 2018-2022 STMicroelectronics
+License: GPL-2 or BSD-3-clause
+
+Files:
+ include/dt-bindings/interrupt-controller/arm-gic.h
+ include/dt-bindings/interrupt-controller/irq.h
+Copyright:
+ 2019-2021, ARM Limited and Contributors.
+License: MIT
+
+Files: include/drivers/marvell/*
+Copyright:
+  2016-2020 Marvell International Ltd.
+License: BSD-3-clause
+
+Files: include/drivers/mentor/mi2cv.h
+Copyright:
+ 2018 Marvell International Ltd.
+ 2018 Icenowy Zheng <icenowy@aosc.io>
+License: BSD-3-Clause
+
+Files: include/drivers/st/*
+Copyright:
+ 2015-2018, ARM Limited and Contributors
+ 2015-2022, STMicroelectronics
+License: BSD-3-clause
+
+Files:
+ include/drivers/st/stm32_fmc2_nand.h
+ include/drivers/st/stm32_qspi.h
+ include/drivers/st/stm32mp1_ddr.h
+ include/drivers/st/stm32mp1_ddr_regs.h
+ include/drivers/st/stm32mp_ddr.h
+ include/drivers/st/stm32mp_ddrctrl_regs.h
+Copyright:
+ 2017-2022, STMicroelectronics
+License: GPL-2+ or BSD-3-clause
+
+Files:
+ lib/libc/str*
+Copyright:
+ 1988-1993 The Regents of the University of California.
+ 2011 The FreeBSD Foundation
+ 1998 Softweyr LLC
+ 2018, ARM Limited and Contributors
+License: BSD-3-clause
+
+Files: lib/libc/strlcpy.c
+ lib/libc/strlcat.c
+Copyright:
+ 1998, 2015 Todd C. Miller <Todd.Miller@courtesan.com>
+License: ISC
+
+Files: lib/libc/strnlen.c
+Copyright:
+ 2009 David Schultz <das@FreeBSD.org>
+License: BSD-2-clause
+
+Files: lib/zlib/*
+Copyright:
+ 1995-2022 Mark Adler
+ 1995-2017 Jean-loup Gailly
+License: Zlib
+
+Files: lib/zlib/tf_gunzip.c
+ lib/zlib/zlib.mk
+Copyright:
+ 2018-2021, ARM Limited and Contributors.
+License: BSD-3-clause
+
+Files: plat/allwinner/*
+Copyright:
+ 2017-2022, ARM Limited and Contributors.
+ 2018, Andre Przywara <osp@andrep.de>
+ 2018, Icenowy Zheng <icenowy@aosc.io>
+ 2021 Sipeed
+License: BSD-3-clause
+
+Files: plat/marvell/*
+ include/plat/marvell/*
+Copyright:
+ 2016-2021 Marvell International Ltd.
+ 2016-2020, ARM Limited and Contributors.
+ 2019 Repk repk@triplefau.lt
+ 2020-2021 Marek Behun, CZ.NIC
+ 2020-2021 Sartura Ltd.
+ 2021 Globalscale technologies, Inc.
+ 2021 Semihalf.
+License: BSD-3-clause
+
+Files: plat/ti/*
+Copyright:
+ 2018-2022 Texas Instruments Incorporated
+ 2017-2022, ARM Limited and Contributors.
+License: BSD-3-clause
+
+Files: plat/renesas/*
+Copyright:
+ 2013-2020, ARM Limited and Contributors.
+ 2015-2022, Renesas Electronics Corporation.
+License: BSD-3-clause
+
+Files: plat/st/*
+Copyright:
+ 2015-2022, ARM Limited and Contributors.
+ 2014-2022, STMicroelectronics
+ 2021, Linaro Limited
+License: BSD-3-clause
+
+Files: plat/imx/*
+Copyright:
+ 2018-2019 Linaro Limited and Contributors.
+ 2016 Freescale Semiconductor, Inc.
+ 2015-2022 ARM Limited and Contributors.
+ 2017-2022 NXP
+ 2021 Arm
+ 2022 Linaro
+ 2022 Leica Geosystems AG
+License: BSD-3-clause
+
+Files: services/spd/*
+Copyright:
+ 2013-2022, ARM Limited and Contributors.
+ 2020, NVIDIA Corporation.
+ 2014, Linaro Limited.
+ 2021-2022, ProvenRun S.A.S. All rights reserved.
+License: BSD-3-clause
+
+Files: tools/marvell/*
+Copyright:
+ 2018 Marvell International Ltd.
+License: BSD-3-clause
+
+Files: tools/renesas/*
+Copyright:
+ 2015-2021, Renesas Electronics Corporation.
+License: BSD-3-clause
+
+Files: tools/stm32image/*
+Copyright:
+ 2017-2018, ARM Limited and Contributors.
+ 2017-2022, STMicroelectronics
+License: BSD-3-clause
+
+Files:
+ lib/libfdt/*
+ include/lib/libfdt/*
+Copyright:
+ 2006-2012 David Gibson, IBM Corporation.
+ 2012 Kim Phillips, Freescale Semiconductor.
+ 2014 David Gibson <david@gibson.dropbear.id.au>
+ 2016 Free Electrons
+ 2016 NextThing Co.
+ 2018 embedded brains GmbH
+License: BSD-2-clause or GPL-2+
+
+Files: lib/libfdt/libfdt.mk
+Copyright: 2016, ARM Limited and Contributors.
+License: BSD-3-clause
+
+Files: include/lib/libc/*
+Copyright:
+ 1982-1993 The Regents of the University of California.
+ UNIX System Laboratories, Inc.
+ 2001 David E. O'Brien
+ 2012-2021 Roberto E. Vargas Caballero
+ 2018-2020, ARM Limited and Contributors.
+ 2021 ARM Limited
+ 2020 Broadcom
+License: BSD-3-clause
+
+Files: include/lib/libc/endian.h
+Copyright: 2002 Thomas Moestl <tmm@FreeBSD.org>
+License: BSD-2-clause
+
+Files:
+ include/tools_share/uuid.h
+Copyright:
+ 2002 Marcel Moolenaar
+License: BSD-2-clause
+
+License: BSD-3-clause
+ Redistribution and use in source and binary forms, with or without modification,
+ are permitted provided that the following conditions are met:
+ .
+ -  Redistributions of source code must retain the above copyright notice, this
+    list of conditions and the following disclaimer.
+ .
+ -  Redistributions in binary form must reproduce the above copyright notice, this
+    list of conditions and the following disclaimer in the documentation and/or
+    other materials provided with the distribution.
+ .
+ -  Neither the name of Arm nor the names of its contributors may be used to
+    endorse or promote products derived from this software without specific prior
+    written permission.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+License: BSD-2-clause
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ .
+ 1. Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+ 2. Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+ .
+ THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+License: GPL-2+
+ This library is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or (at
+ your option) any later version.
+ .
+ This library is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ General Public License for more details.
+ .
+ On Debian systems, the full text of the GNU General Public License
+ version 2 can be found in the file `/usr/share/common-licenses/GPL-2'.
+
+License: GPL-2
+ This library is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; version 2 of the License.
+ .
+ This library is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ General Public License for more details.
+ .
+ On Debian systems, the full text of the GNU General Public License
+ version 2 can be found in the file `/usr/share/common-licenses/GPL-2'.
+
+License: ISC
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+License: Zlib
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+  .
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+  .
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+License: MIT
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..e935d9a
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+use-ldflags-with-fiptool-and-cert-create
diff --git a/debian/patches/use-ldflags-with-fiptool-and-cert-create b/debian/patches/use-ldflags-with-fiptool-and-cert-create
new file mode 100644
index 0000000..05c9723
--- /dev/null
+++ b/debian/patches/use-ldflags-with-fiptool-and-cert-create
@@ -0,0 +1,28 @@
+Use LDFLAGS when building fiptool and cert_create.
+
+diff --git a/tools/cert_create/Makefile b/tools/cert_create/Makefile
+index ca548b836..a823f0dcc 100644
+--- a/tools/cert_create/Makefile
++++ b/tools/cert_create/Makefile
+@@ -83,7 +83,7 @@ ${BINARY}: ${OBJECTS} Makefile
+ 	@echo 'const char build_msg[] = "Built : "__TIME__", "__DATE__; \
+                 const char platform_msg[] = "${PLAT_MSG}";' | \
+                 ${HOSTCC} -c ${HOSTCCFLAGS} -xc - -o src/build_msg.o
+-	${Q}${HOSTCC} src/build_msg.o ${OBJECTS} ${LIB_DIR} ${LIB} -o $@
++	${Q}${HOSTCC} src/build_msg.o ${OBJECTS} ${LIB_DIR} ${LIB} ${LDFLAGS} -o $@
+ 
+ %.o: %.c
+ 	@echo "  HOSTCC  $<"
+diff --git a/tools/fiptool/Makefile b/tools/fiptool/Makefile
+index e6aeba95b..68a5b2acb 100644
+--- a/tools/fiptool/Makefile
++++ b/tools/fiptool/Makefile
+@@ -57,7 +57,7 @@ all: ${PROJECT}
+ 
+ ${PROJECT}: --openssl ${OBJECTS} Makefile
+ 	@echo "  HOSTLD  $@"
+-	${Q}${HOSTCC} ${OBJECTS} -o $@ ${LDLIBS}
++	${Q}${HOSTCC} ${OBJECTS} -o $@ ${LDLIBS} ${LDFLAGS}
+ 	@${ECHO_BLANK_LINE}
+ 	@echo "Built $@ successfully"
+ 	@${ECHO_BLANK_LINE}
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..10bafab
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,65 @@
+#!/usr/bin/make -f
+
+include /usr/share/dpkg/architecture.mk
+include /usr/share/dpkg/buildtools.mk
+
+export DH_VERBOSE=1
+export TF_CFLAGS += -ffile-prefix-map=$(CURDIR)=.
+export DEB_BUILD_MAINT_OPTIONS=hardening=+all
+
+# Enable verbose build by default, disable when terse is specified.
+ifneq (,$(filter terse,$(DEB_BUILD_OPTIONS)))
+VERBOSE=0
+else
+VERBOSE=1
+endif
+
+platforms := g12a gxbb sun50i_h6 rk3328 rk3399 rpi3 rpi4 imx8mn
+platforms_nodebug := sun50i_a64 imx8mq
+
+# By default, iMX8MN uses UART2 console. However, other boards supported
+# upstream (e.g. Variscite VAR-SOM-MX8M-NANO board) uses UART4.
+# Add two subplatforms for imx8mn platform:
+#   * imx8mn: default configuration
+#   * imx8mn_uart4: console set to UART4
+imx8mn_subplatforms := imx8mn imx8mn_uart4
+imx8mn_uart4_assigns := IMX_BOOT_UART_BASE=0x30a60000
+
+# Always set CROSS_COMPILE, which also works for native builds.
+define build_platform
+	$(eval platform := $(1))
+	$(eval debug := $(2))
+	$(eval buildtype := $(3))
+	$(eval subplatforms := $(if $($(platform)_subplatforms), $($(platform)_subplatforms), $(platform)))
+	$(eval target := $(if $(filter rk3328 rk3399,$(platform)),bl31/bl31.elf,bl31.bin))
+	$(foreach subplatform, $(subplatforms), \
+		CROSS_COMPILE=aarch64-linux-gnu- CFLAGS=--param=min-pagesize=0 LDFLAGS= TF_LDFLAGS=--no-warn-rwx-segments dh_auto_build -- V=$(VERBOSE) DEBUG=$(debug) $($(subplatform)_assigns) PLAT=$(platform) bl31 ; \
+		install -m644 build/$(platform)/$(buildtype)/$(target) -Dt build/renamed/$(subplatform) ; \
+		# For each subplatform, make is called using the same PLAT variable. If
+		# the build is not cleaned between each call, objects will remain the
+		# same, without rebuilding them.
+		make DEBUG=$(debug) PLAT=$(platform) clean ; \
+	)
+endef
+
+%:
+	dh $@
+
+override_dh_auto_build:
+# Disable building of arm-trusted-firmware-tools
+ifeq ($(filter pkg.arm-trusted-firmware.notools,$(DEB_BUILD_PROFILES)),)
+	dh_auto_build --sourcedir=tools/fiptool     -- DEBUG=1 V=$(VERBOSE) HOSTCC=$(CC) HOSTCCFLAGS="$(CFLAGS) $(CPPFLAGS)"
+	dh_auto_build --sourcedir=tools/cert_create -- DEBUG=1 V=$(VERBOSE) HOSTCC=$(CC) HOSTCCFLAGS="$(CFLAGS) $(CPPFLAGS) -std=c99 -DUSE_TBBR_DEFS=1"
+endif
+# Only build firmware on arm64.
+ifeq ($(DEB_HOST_ARCH),arm64)
+  override_dh_auto_build: $(platforms) $(platforms_nodebug)
+  $(platforms):
+	$(call build_platform,$@,1,debug)
+  $(platforms_nodebug):
+	$(call build_platform,$@,0,release)
+endif
+
+override_dh_installchangelogs:
+	dh_installchangelogs -parm-trusted-firmware docs/change-log.md
+	dh_installchangelogs -parm-trusted-firmware-tools
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 0000000..5e62779
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,12 @@
+---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
+
+variables:
+  # no autopkgtest tests
+  SALSA_CI_DISABLE_AUTOPKGTEST: 1
+  # No arch:all packages
+  SALSA_CI_DISABLE_BUILD_PACKAGE_ALL: 1
+
+test-crossbuild-arm64:
+  allow_failure: false
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..163aaf8
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (quilt)
diff --git a/debian/upstream/metadata b/debian/upstream/metadata
new file mode 100644
index 0000000..1f204e7
--- /dev/null
+++ b/debian/upstream/metadata
@@ -0,0 +1,2 @@
+Repository-Browse: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
+Repository: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
diff --git a/debian/watch b/debian/watch
new file mode 100644
index 0000000..7296767
--- /dev/null
+++ b/debian/watch
@@ -0,0 +1,7 @@
+version=4
+
+opts=dversionmangle=auto,\
+     filenamemangle=s/.*trusted-firmware-a-(.*)/@PACKAGE@-$1/,\
+     repacksuffix=+dfsg,\
+     uversionmangle=s/-rc/~rc/ \
+  https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/ .*/trusted-firmware-a-@ANY_VERSION@.tar.gz