Add Firmware Image Package (FIP) driver

The Firmware Image Package (FIP) driver allows for data to be loaded
from a FIP on platform storage. The FVP supports loading bootloader
images from a FIP located in NOR FLASH.

The implemented FVP policy states that bootloader images will be
loaded from a FIP in NOR FLASH if available and fall back to loading
individual images from semi-hosting.

NOTE:
- BL3-3(e.g. UEFI) is loaded into DRAM and needs to be configured
  to run from the BL33_BASE address. This is currently set to
  DRAM_BASE+128MB for the FVP.

Change-Id: I2e4821748e3376b5f9e467cf3ec09509e43579a0

12 files changed, 989 insertions, 41 deletions

diff --git a/bl2/bl2_main.c b/bl2/bl2_main.c
index 018a21f..4745881 100644
--- a/bl2/bl2_main.c
+++ b/bl2/bl2_main.c
@@ -37,6 +37,7 @@
 #include <semihosting.h>
 #include <bl_common.h>
 #include <bl2.h>
+#include "debug.h"
 
 /*******************************************************************************
  * The only thing to do in BL2 is to load further images and pass control to
@@ -48,8 +49,9 @@ void bl2_main(void)
 {
 	meminfo *bl2_tzram_layout;
 	meminfo *bl31_tzram_layout;
+	meminfo *bl33_ns_layout;
 	el_change_info *ns_image_info;
-	unsigned long bl31_base, el_status;
+	unsigned long bl31_base, bl33_base, el_status;
 	unsigned int bl2_load, bl31_load, mode;
 
 	/* Perform remaining generic architectural setup in S-El1 */
@@ -87,18 +89,23 @@ void bl2_main(void)
 	bl31_tzram_layout = (meminfo *) get_el_change_mem_ptr();
 	init_bl31_mem_layout(bl2_tzram_layout, bl31_tzram_layout, bl31_load);
 
+	/* Find out where the BL3-3 normal world firmware should go. */
+	bl33_ns_layout = bl2_get_ns_mem_layout();
+	bl33_base = load_image(bl33_ns_layout, BL33_IMAGE_NAME,
+			       BOT_LOAD, plat_get_ns_image_entrypoint());
+	/* Halt if failed to load normal world firmware. */
+	if (bl33_base == 0) {
+		ERROR("Failed to load BL3-3.\n");
+		panic();
+	}
+
 	/*
 	 * BL2 also needs to tell BL31 where the non-trusted software image
 	 * has been loaded. Place this info right after the BL31 memory layout
 	 */
 	ns_image_info = (el_change_info *) ((unsigned char *) bl31_tzram_layout
 					      + sizeof(meminfo));
-
-	/*
-	 * Assume that the non-secure bootloader has already been
-	 * loaded to its platform-specific location.
-	 */
-	ns_image_info->entrypoint = plat_get_ns_image_entrypoint();
+	ns_image_info->entrypoint = bl33_base;
 
 	/* Figure out what mode we enter the non-secure world in */
 	el_status = read_id_aa64pfr0_el1() >> ID_AA64PFR0_EL2_SHIFT;
diff --git a/drivers/io/io_fip.c b/drivers/io/io_fip.c
new file mode 100644
index 0000000..6a7f123
--- /dev/null
+++ b/drivers/io/io_fip.c
@@ -0,0 +1,409 @@
+/*
+ * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <uuid.h>
+#include <errno.h>
+#include <string.h>
+#include <assert.h>
+#include "platform.h"
+#include "firmware_image_package.h"
+#include "io_storage.h"
+#include "io_driver.h"
+#include "io_fip.h"
+#include "debug.h"
+
+/* Useful for printing UUIDs when debugging.*/
+#define PRINT_UUID2(x)								\
+	"%08x-%04hx-%04hx-%02hhx%02hhx-%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx",	\
+		x.time_low, x.time_mid, x.time_hi_and_version,			\
+		x.clock_seq_hi_and_reserved, x.clock_seq_low,			\
+		x.node[0], x.node[1], x.node[2], x.node[3],			\
+		x.node[4], x.node[5]
+
+typedef struct {
+	const char	*name;
+	const uuid_t	 uuid;
+} plat_fip_name_uuid;
+
+typedef struct {
+	/* Put file_pos above the struct to allow {0} on static init.
+	 * It is a workaround for a known bug in GCC
+	 * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53119
+	 */
+	unsigned int file_pos;
+	fip_toc_entry entry;
+} file_state;
+
+static plat_fip_name_uuid name_uuid[] = {
+	{BL2_IMAGE_NAME, UUID_TRUSTED_BOOT_FIRMWARE_BL2},
+	{BL31_IMAGE_NAME, UUID_EL3_RUNTIME_FIRMWARE_BL31},
+	{BL32_IMAGE_NAME, UUID_SECURE_PAYLOAD_BL32},
+	{BL33_IMAGE_NAME, UUID_NON_TRUSTED_FIRMWARE_BL33},
+	{NULL, {0} }
+};
+
+static const uuid_t uuid_null = {0};
+static file_state current_file = {0};
+static io_dev_handle backend_dev_handle;
+static void *backend_image_spec;
+
+
+/* Firmware Image Package driver functions */
+static int fip_dev_open(void *spec, struct io_dev_info **dev_info);
+static int fip_file_open(struct io_dev_info *dev_info, const void *spec,
+			  struct io_entity *entity);
+static int fip_file_len(struct io_entity *entity, size_t *length);
+static int fip_file_read(struct io_entity *entity, void *buffer, size_t length,
+			  size_t *length_read);
+static int fip_file_close(struct io_entity *entity);
+static int fip_dev_init(struct io_dev_info *dev_info, const void *init_params);
+static int fip_dev_close(struct io_dev_info *dev_info);
+
+
+static inline int copy_uuid(uuid_t *dst, const uuid_t *src)
+{
+	memcpy(dst, src, sizeof(uuid_t));
+	return 0;
+}
+
+
+/* Return 0 for equal uuids. */
+static inline int compare_uuids(const uuid_t *uuid1, const uuid_t *uuid2)
+{
+	return memcmp(uuid1, uuid2, sizeof(uuid_t));
+}
+
+
+/* TODO: We could check version numbers or do a package checksum? */
+static inline int is_valid_header(fip_toc_header *header)
+{
+	if ((header->name == TOC_HEADER_NAME) && (header->serial_number != 0)) {
+		return 1;
+	} else {
+		return 0;
+	}
+}
+
+
+static int file_to_uuid(const char *filename, uuid_t *uuid)
+{
+	int i;
+	int status = -EINVAL;
+
+	for (i = 0; i < (sizeof(name_uuid)/sizeof(plat_fip_name_uuid)); i++) {
+		if (strcmp(filename, name_uuid[i].name) == 0) {
+			copy_uuid(uuid, &name_uuid[i].uuid);
+			status = 0;
+			break;
+		}
+	}
+	return status;
+}
+
+
+/* Identify the device type as a virtual driver */
+io_type device_type_fip(void)
+{
+	return IO_TYPE_FIRMWARE_IMAGE_PACKAGE;
+}
+
+
+static struct io_dev_connector fip_dev_connector = {
+	.dev_open = fip_dev_open
+};
+
+
+static struct io_dev_funcs fip_dev_funcs = {
+	.type = device_type_fip,
+	.open = fip_file_open,
+	.seek = NULL,
+	.size = fip_file_len,
+	.read = fip_file_read,
+	.write = NULL,
+	.close = fip_file_close,
+	.dev_init = fip_dev_init,
+	.dev_close = fip_dev_close,
+};
+
+
+static struct io_dev_info fip_dev_info = {
+	.funcs = &fip_dev_funcs,
+	.info = (uintptr_t)NULL
+};
+
+
+/* Open a connection to the FIP device */
+static int fip_dev_open(void *spec __attribute__((unused)),
+			 struct io_dev_info **dev_info)
+{
+	assert(dev_info != NULL);
+	*dev_info = &fip_dev_info;
+
+	return IO_SUCCESS;
+}
+
+
+/* Do some basic package checks. */
+static int fip_dev_init(struct io_dev_info *dev_info, const void *init_params)
+{
+	int result = IO_FAIL;
+	char *image_name = (char *)init_params;
+	io_handle backend_handle;
+	fip_toc_header header;
+	size_t bytes_read;
+
+	/* Obtain a reference to the image by querying the platform layer */
+	result = plat_get_image_source(image_name, &backend_dev_handle,
+				       &backend_image_spec);
+	if (result != IO_SUCCESS) {
+		ERROR("Failed to obtain reference to image '%s' (%i)\n",
+			image_name, result);
+		result = IO_FAIL;
+		goto fip_dev_init_exit;
+	}
+
+	/* Attempt to access the FIP image */
+	result = io_open(backend_dev_handle, backend_image_spec,
+			 &backend_handle);
+	if (result != IO_SUCCESS) {
+		ERROR("Failed to access image '%s' (%i)\n", image_name, result);
+		result = IO_FAIL;
+		goto fip_dev_init_exit;
+	}
+
+	result = io_read(backend_handle, &header, sizeof(header), &bytes_read);
+	if (result == IO_SUCCESS) {
+		if (!is_valid_header(&header)) {
+			ERROR("Firmware Image Package header check failed.\n");
+			result = IO_FAIL;
+		} else {
+			INFO("FIP header looks OK.\n");
+		}
+	}
+
+	io_close(backend_handle);
+
+ fip_dev_init_exit:
+	return result;
+}
+
+/* Close a connection to the FIP device */
+static int fip_dev_close(struct io_dev_info *dev_info)
+{
+	/* TODO: Consider tracking open files and cleaning them up here */
+
+	/* Clear the backend. */
+	backend_dev_handle = NULL;
+	backend_image_spec = NULL;
+
+	return IO_SUCCESS;
+}
+
+
+/* Open a file for access from package. */
+static int fip_file_open(struct io_dev_info *dev_info, const void *spec,
+			 struct io_entity *entity)
+{
+	int result = IO_FAIL;
+	io_handle backend_handle;
+	uuid_t file_uuid;
+	const io_file_spec *file_spec = (io_file_spec *)spec;
+	size_t bytes_read;
+	int found_file = 0;
+
+	assert(file_spec != NULL);
+	assert(entity != NULL);
+
+	/* Can only have one file open at a time for the moment. We need to
+	 * track state like file cursor position. We know the header lives at
+	 * offset zero, so this entry should never be zero for an active file.
+	 * When the system supports dynamic memory allocation we can allow more
+	 * than one open file at a time if needed.
+	 */
+	if (current_file.entry.offset_address != 0) {
+		ERROR("fip_file_open : Only one open file at a time.\n");
+		return IO_RESOURCES_EXHAUSTED;
+	}
+
+	/* Attempt to access the FIP image */
+	result = io_open(backend_dev_handle, backend_image_spec,
+			 &backend_handle);
+	if (result != IO_SUCCESS) {
+		ERROR("Failed to open Firmware Image Package (%i)\n", result);
+		result = IO_FAIL;
+		goto fip_file_open_exit;
+	}
+
+	/* Seek past the FIP header into the Table of Contents */
+	result = io_seek(backend_handle, IO_SEEK_SET, sizeof(fip_toc_header));
+	if (result != IO_SUCCESS) {
+		ERROR("fip_file_open: failed to seek\n");
+		result = IO_FAIL;
+		goto fip_file_open_close;
+	}
+
+	file_to_uuid(file_spec->path, &file_uuid);
+
+	found_file = 0;
+	do {
+		result = io_read(backend_handle, &current_file.entry,
+				 sizeof(current_file.entry),
+				 &bytes_read);
+		if (result == IO_SUCCESS) {
+			if (compare_uuids(&current_file.entry.uuid,
+					  &file_uuid) == 0) {
+				found_file = 1;
+				break;
+			}
+		} else {
+			ERROR("Failed to read FIP (%i)\n", result);
+			goto fip_file_open_close;
+		}
+	} while (compare_uuids(&current_file.entry.uuid, &uuid_null) != 0);
+
+	if (found_file == 1) {
+		/* All fine. Update entity info with file state and return. Set
+		 * the file position to 0. The 'current_file.entry' holds the
+		 * base and size of the file.
+		 */
+		current_file.file_pos = 0;
+		entity->info = (uintptr_t)&current_file;
+	} else {
+		/* Did not find the file in the FIP. */
+		result = IO_FAIL;
+	}
+
+ fip_file_open_close:
+	io_close(backend_handle);
+
+ fip_file_open_exit:
+	return result;
+}
+
+
+/* Return the size of a file in package */
+static int fip_file_len(struct io_entity *entity, size_t *length)
+{
+	assert(entity != NULL);
+	assert(length != NULL);
+
+	*length =  ((file_state *)entity->info)->entry.size;
+
+	return IO_SUCCESS;
+}
+
+
+/* Read data from a file in package */
+static int fip_file_read(struct io_entity *entity, void *buffer, size_t length,
+			  size_t *length_read)
+{
+	int result = IO_FAIL;
+	file_state *fp;
+	size_t file_offset;
+	size_t bytes_read;
+	io_handle backend_handle;
+
+	assert(entity != NULL);
+	assert(buffer != NULL);
+	assert(length_read != NULL);
+	assert((void *)entity->info != NULL);
+
+	/* Open the backend, attempt to access the blob image */
+	result = io_open(backend_dev_handle, backend_image_spec,
+			 &backend_handle);
+	if (result != IO_SUCCESS) {
+		ERROR("Failed to open FIP (%i)\n", result);
+		result = IO_FAIL;
+		goto fip_file_read_exit;
+	}
+
+	fp = (file_state *)entity->info;
+
+	/* Seek to the position in the FIP where the payload lives */
+	file_offset = fp->entry.offset_address + fp->file_pos;
+	result = io_seek(backend_handle, IO_SEEK_SET, file_offset);
+	if (result != IO_SUCCESS) {
+		ERROR("fip_file_read: failed to seek\n");
+		result = IO_FAIL;
+		goto fip_file_read_close;
+	}
+
+	result = io_read(backend_handle, buffer, length, &bytes_read);
+	if (result != IO_SUCCESS) {
+		/* We cannot read our data. Fail. */
+		ERROR("Failed to read payload (%i)\n", result);
+		result = IO_FAIL;
+		goto fip_file_read_close;
+	} else {
+		/* Set caller length and new file position. */
+		*length_read = bytes_read;
+		fp->file_pos += bytes_read;
+	}
+
+/* Close the backend. */
+ fip_file_read_close:
+	io_close(backend_handle);
+
+ fip_file_read_exit:
+	return result;
+}
+
+
+/* Close a file in package */
+static int fip_file_close(struct io_entity *entity)
+{
+	/* Clear our current file pointer.
+	 * If we had malloc() we would free() here.
+	 */
+	if (current_file.entry.offset_address != 0) {
+		memset(&current_file, 0, sizeof(current_file));
+	}
+
+	/* Clear the Entity info. */
+	entity->info = 0;
+
+	return IO_SUCCESS;
+}
+
+/* Exported functions */
+
+/* Register the Firmware Image Package driver with the IO abstraction */
+int register_io_dev_fip(struct io_dev_connector **dev_con)
+{
+	int result = IO_FAIL;
+	assert(dev_con != NULL);
+
+	result = io_register_device(&fip_dev_info);
+	if (result == IO_SUCCESS)
+		*dev_con = &fip_dev_connector;
+
+	return result;
+}
diff --git a/drivers/io/io_fip.h b/drivers/io/io_fip.h
new file mode 100644
index 0000000..56dd1e0
--- /dev/null
+++ b/drivers/io/io_fip.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2014 ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __IO_FIP_H__
+#define __IO_FIP_H__
+
+int register_io_dev_fip(struct io_dev_connector **dev_con);
+
+#endif /* __IO_FIP_H__ */
diff --git a/drivers/io/io_memmap.c b/drivers/io/io_memmap.c
new file mode 100644
index 0000000..0809973
--- /dev/null
+++ b/drivers/io/io_memmap.c
@@ -0,0 +1,240 @@
+/*
+ * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <string.h>
+#include "io_storage.h"
+#include "io_driver.h"
+#include "debug.h"
+
+/* As we need to be able to keep state for seek, only one file can be open
+ * at a time. Make this a structure and point to the entity->info. When we
+ * can malloc memory we can change this to support more open files.
+ */
+typedef struct {
+	/* Use the 'in_use' flag as any value for base and file_pos could be
+	 * valid.
+	 */
+	int	in_use;
+	size_t	base;
+	size_t  file_pos;
+} file_state;
+
+static file_state current_file = {0};
+
+/* Identify the device type as memmap */
+io_type device_type_memmap(void)
+{
+	return IO_TYPE_MEMMAP;
+}
+
+/* Memmap device functions */
+static int memmap_dev_open(void *spec, struct io_dev_info **dev_info);
+static int memmap_block_open(struct io_dev_info *dev_info, const void *spec,
+			     struct io_entity *entity);
+static int memmap_block_seek(struct io_entity *entity, int mode,
+			     ssize_t offset);
+static int memmap_block_read(struct io_entity *entity, void *buffer,
+			     size_t length, size_t *length_read);
+static int memmap_block_write(struct io_entity *entity, const void *buffer,
+			      size_t length, size_t *length_written);
+static int memmap_block_close(struct io_entity *entity);
+static int memmap_dev_close(struct io_dev_info *dev_info);
+
+
+static struct io_dev_connector memmap_dev_connector = {
+	.dev_open = memmap_dev_open
+};
+
+
+static struct io_dev_funcs memmap_dev_funcs = {
+	.type = device_type_memmap,
+	.open = memmap_block_open,
+	.seek = memmap_block_seek,
+	.size = NULL,
+	.read = memmap_block_read,
+	.write = memmap_block_write,
+	.close = memmap_block_close,
+	.dev_init = NULL,
+	.dev_close = memmap_dev_close,
+};
+
+
+static struct io_dev_info memmap_dev_info = {
+	.funcs = &memmap_dev_funcs,
+	.info = (uintptr_t)NULL
+};
+
+
+/* Open a connection to the memmap device */
+static int memmap_dev_open(void *spec __attribute__((unused)),
+			   struct io_dev_info **dev_info)
+{
+	assert(dev_info != NULL);
+	*dev_info = &memmap_dev_info;
+
+	return IO_SUCCESS;
+}
+
+
+
+/* Close a connection to the memmap device */
+static int memmap_dev_close(struct io_dev_info *dev_info)
+{
+	/* NOP */
+	/* TODO: Consider tracking open files and cleaning them up here */
+	return IO_SUCCESS;
+}
+
+
+/* Open a file on the memmap device */
+/* TODO: Can we do any sensible limit checks on requested memory */
+static int memmap_block_open(struct io_dev_info *dev_info, const void *spec,
+			     struct io_entity *entity)
+{
+	int result = IO_FAIL;
+	const io_block_spec *block_spec = (io_block_spec *)spec;
+
+	/* Since we need to track open state for seek() we only allow one open
+	 * spec at a time. When we have dynamic memory we can malloc and set
+	 * entity->info.
+	 */
+	if (current_file.in_use == 0) {
+		assert(block_spec != NULL);
+		assert(entity != NULL);
+
+		current_file.in_use = 1;
+		current_file.base = block_spec->offset;
+		/* File cursor offset for seek and incremental reads etc. */
+		current_file.file_pos = 0;
+		entity->info = (uintptr_t)&current_file;
+		result = IO_SUCCESS;
+	} else {
+		ERROR("A Memmap device is already active. Close first.\n");
+		result = IO_RESOURCES_EXHAUSTED;
+	}
+
+	return result;
+}
+
+
+/* Seek to a particular file offset on the memmap device */
+static int memmap_block_seek(struct io_entity *entity, int mode, ssize_t offset)
+{
+	int result = IO_FAIL;
+
+	/* We only support IO_SEEK_SET for the moment. */
+	if (mode == IO_SEEK_SET) {
+		assert(entity != NULL);
+
+		/* TODO: can we do some basic limit checks on seek? */
+		((file_state *)entity->info)->file_pos = offset;
+		result = IO_SUCCESS;
+	} else {
+		result = IO_FAIL;
+	}
+
+	return result;
+}
+
+
+/* Read data from a file on the memmap device */
+static int memmap_block_read(struct io_entity *entity, void *buffer,
+			     size_t length, size_t *length_read)
+{
+	file_state *fp;
+
+	assert(entity != NULL);
+	assert(buffer != NULL);
+	assert(length_read != NULL);
+
+	fp = (file_state *)entity->info;
+
+	memcpy(buffer, (void *)(fp->base + fp->file_pos), length);
+
+	*length_read = length;
+	/* advance the file 'cursor' for incremental reads */
+	fp->file_pos += length;
+
+	return IO_SUCCESS;
+}
+
+
+/* Write data to a file on the memmap device */
+static int memmap_block_write(struct io_entity *entity, const void *buffer,
+			      size_t length, size_t *length_written)
+{
+	file_state *fp;
+
+	assert(entity != NULL);
+	assert(buffer != NULL);
+	assert(length_written != NULL);
+
+	fp = (file_state *)entity->info;
+
+	memcpy((void *)(fp->base + fp->file_pos), buffer, length);
+
+	*length_written = length;
+
+	/* advance the file 'cursor' for incremental writes */
+	fp->file_pos += length;
+
+	return IO_SUCCESS;
+}
+
+
+/* Close a file on the memmap device */
+static int memmap_block_close(struct io_entity *entity)
+{
+	assert(entity != NULL);
+
+	entity->info = 0;
+
+	/* This would be a mem free() if we had malloc.*/
+	memset((void *)&current_file, 0, sizeof(current_file));
+
+	return IO_SUCCESS;
+}
+
+
+/* Exported functions */
+
+/* Register the memmap driver with the IO abstraction */
+int register_io_dev_memmap(struct io_dev_connector **dev_con)
+{
+	int result = IO_FAIL;
+	assert(dev_con != NULL);
+
+	result = io_register_device(&memmap_dev_info);
+	if (result == IO_SUCCESS)
+		*dev_con = &memmap_dev_connector;
+
+	return result;
+}
diff --git a/drivers/io/io_memmap.h b/drivers/io/io_memmap.h
new file mode 100644
index 0000000..5fa7bc9
--- /dev/null
+++ b/drivers/io/io_memmap.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2014, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __IO_MEMMAP_H__
+#define __IO_MEMMAP_H__
+
+int register_io_dev_memmap(struct io_dev_connector **dev_con);
+
+#endif /* __IO_MEMMAP_H__ */
diff --git a/include/bl2.h b/include/bl2.h
index b9a7b0f..2955a40 100644
--- a/include/bl2.h
+++ b/include/bl2.h
@@ -43,6 +43,6 @@ extern unsigned long long bl2_entrypoint;
  *****************************************/
 extern void bl2_platform_setup(void);
 extern meminfo *bl2_plat_sec_mem_layout(void);
-extern meminfo bl2_get_ns_mem_layout(void);
+extern meminfo *bl2_get_ns_mem_layout(void);
 
 #endif /* __BL2_H__ */
diff --git a/include/io_storage.h b/include/io_storage.h
index f67e5d0..04e63c3 100644
--- a/include/io_storage.h
+++ b/include/io_storage.h
@@ -42,7 +42,8 @@
 typedef enum {
 	IO_TYPE_INVALID,
 	IO_TYPE_SEMIHOSTING,
-	IO_TYPE_BLOCK,
+	IO_TYPE_MEMMAP,
+	IO_TYPE_FIRMWARE_IMAGE_PACKAGE,
 	IO_TYPE_MAX
 } io_type;
 
diff --git a/plat/fvp/bl1_plat_setup.c b/plat/fvp/bl1_plat_setup.c
index 3daa480..7a61c66 100644
--- a/plat/fvp/bl1_plat_setup.c
+++ b/plat/fvp/bl1_plat_setup.c
@@ -28,7 +28,6 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <string.h>
 #include <assert.h>
 #include <arch_helpers.h>
 #include <platform.h>
diff --git a/plat/fvp/bl2_plat_setup.c b/plat/fvp/bl2_plat_setup.c
index 4efb436..f8c922e 100644
--- a/plat/fvp/bl2_plat_setup.c
+++ b/plat/fvp/bl2_plat_setup.c
@@ -28,7 +28,6 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <string.h>
 #include <assert.h>
 #include <arch_helpers.h>
 #include <platform.h>
@@ -71,12 +70,21 @@ extern unsigned char **bl2_el_change_mem_ptr;
 static meminfo bl2_tzram_layout
 __attribute__ ((aligned(PLATFORM_CACHE_LINE_SIZE),
 		section("tzfw_coherent_mem")));
+/* Data structure which holds the extents of the Non-Secure DRAM for BL33 */
+static meminfo bl33_dram_layout
+__attribute__ ((aligned(PLATFORM_CACHE_LINE_SIZE),
+		section("tzfw_coherent_mem")));
 
 meminfo *bl2_plat_sec_mem_layout(void)
 {
 	return &bl2_tzram_layout;
 }
 
+meminfo *bl2_get_ns_mem_layout(void)
+{
+	return &bl33_dram_layout;
+}
+
 /*******************************************************************************
  * BL1 has passed the extents of the trusted SRAM that should be visible to BL2
  * in x0. This memory layout is sitting at the base of the free trusted SRAM.
@@ -93,6 +101,16 @@ void bl2_early_platform_setup(meminfo *mem_layout,
 	bl2_tzram_layout.attr = mem_layout->attr;
 	bl2_tzram_layout.next = 0;
 
+	/* Setup the BL3-3 memory layout.
+	 * Normal World Firmware loaded into main DRAM.
+	 */
+	bl33_dram_layout.total_base = DRAM_BASE;
+	bl33_dram_layout.total_size = DRAM_SIZE;
+	bl33_dram_layout.free_base = DRAM_BASE;
+	bl33_dram_layout.free_size = DRAM_SIZE;
+	bl33_dram_layout.attr = 0;
+	bl33_dram_layout.next = 0;
+
 	/* Initialize the platform config for future decision making */
 	platform_config_setup();
 
diff --git a/plat/fvp/plat_io_storage.c b/plat/fvp/plat_io_storage.c
index e476106..fd2d2b2 100644
--- a/plat/fvp/plat_io_storage.c
+++ b/plat/fvp/plat_io_storage.c
@@ -35,69 +35,259 @@
 #include "io_driver.h"
 #include "io_semihosting.h"
 #include "semihosting.h"	/* For FOPEN_MODE_... */
+#include "io_fip.h"
+#include "io_memmap.h"
 #include "debug.h"
 
 
+typedef struct {
+	char *image_name;
+	int (*image_policy)(io_dev_handle *dev_handle, void **image_spec);
+} plat_io_policy;
+
+
 /* IO devices */
 static struct io_plat_data io_data;
 static struct io_dev_connector *sh_dev_con;
 static void *const sh_dev_spec;
 static void *const sh_init_params;
 static io_dev_handle sh_dev_handle;
+static struct io_dev_connector *fip_dev_con;
+static void *const fip_dev_spec;
+static io_dev_handle fip_dev_handle;
+static struct io_dev_connector *memmap_dev_con;
+static void *const memmap_dev_spec;
+static void *const memmap_init_params;
+static io_dev_handle memmap_dev_handle;
+
+static int fvp_bl2_policy(io_dev_handle *dev_handle, void **image_spec);
+static int fvp_bl31_policy(io_dev_handle *dev_handle, void **image_spec);
+static int fvp_bl33_policy(io_dev_handle *dev_handle, void **image_spec);
+static int fvp_fip_policy(io_dev_handle *dev_handle, void **image_spec);
+
+
+static io_block_spec fip_block_spec = {
+	.offset = FLASH0_BASE,
+	.length = FLASH0_SIZE
+};
 
-static io_file_spec bl2_image_spec = {
+static io_file_spec bl2_file_spec = {
 	.path = BL2_IMAGE_NAME,
 	.mode = FOPEN_MODE_R
 };
 
-static io_file_spec bl31_image_spec = {
+static io_file_spec bl31_file_spec = {
 	.path = BL31_IMAGE_NAME,
 	.mode = FOPEN_MODE_R
 };
 
+static io_file_spec bl33_file_spec = {
+	.path = BL33_IMAGE_NAME,
+	.mode = FOPEN_MODE_R
+};
+
+static plat_io_policy fvp_policy[] = {
+	{BL2_IMAGE_NAME,  fvp_bl2_policy},
+	{BL31_IMAGE_NAME, fvp_bl31_policy},
+	{BL33_IMAGE_NAME, fvp_bl33_policy},
+	{FIP_IMAGE_NAME,  fvp_fip_policy},
+	{NULL, NULL}
+};
+
+
+static int open_fip(void *spec)
+{
+	int result = IO_FAIL;
+
+	/* See if a Firmware Image Package is available */
+	result = io_dev_init(fip_dev_handle, (void *)FIP_IMAGE_NAME);
+	if (result == IO_SUCCESS) {
+		INFO("Using FIP\n");
+		/*TODO: Check image defined in spec is present in FIP. */
+	}
+	return result;
+}
+
+
+static int open_memmap(void *spec)
+{
+	int result = IO_FAIL;
+	io_handle local_image_handle;
+
+	result = io_dev_init(memmap_dev_handle, memmap_init_params);
+	if (result == IO_SUCCESS) {
+		result = io_open(memmap_dev_handle, spec, &local_image_handle);
+		if (result == IO_SUCCESS) {
+			/* INFO("Using Memmap IO\n"); */
+			io_close(local_image_handle);
+		}
+	}
+	return result;
+}
+
+
+static int open_semihosting(void *spec)
+{
+	int result = IO_FAIL;
+	io_handle local_image_handle;
+
+	/* See if the file exists on semi-hosting.*/
+	result = io_dev_init(sh_dev_handle, sh_init_params);
+	if (result == IO_SUCCESS) {
+		result = io_open(sh_dev_handle, spec, &local_image_handle);
+		if (result == IO_SUCCESS) {
+			INFO("Using Semi-hosting IO\n");
+			io_close(local_image_handle);
+		}
+	}
+	return result;
+}
+
+
+/* Try to load BL2 from Firmware Image Package in FLASH first. If there is no
+ * FIP in FLASH or it is broken, try to load the file from semi-hosting.
+ */
+static int fvp_bl2_policy(io_dev_handle *dev_handle, void **image_spec)
+{
+	int result = IO_FAIL;
+	void *local_image_spec = &bl2_file_spec;
+
+	INFO("Loading BL2\n");
+	/* FIP first then fall back to semi-hosting */
+	result = open_fip(local_image_spec);
+	if (result == IO_SUCCESS) {
+		*dev_handle = fip_dev_handle;
+		*(io_file_spec **)image_spec = local_image_spec;
+	} else {
+		result = open_semihosting(local_image_spec);
+		if (result == IO_SUCCESS) {
+			*dev_handle = sh_dev_handle;
+			*(io_file_spec **)image_spec = local_image_spec;
+		}
+	}
+	return result;
+}
+
+
+/* Try to load BL31 from Firmware Image Package in FLASH first. If there is no
+ * FIP in FLASH or it is broken, try to load the file from semi-hosting.
+ */
+static int fvp_bl31_policy(io_dev_handle *dev_handle, void **image_spec)
+{
+	int result = IO_FAIL;
+	void *local_image_spec = &bl31_file_spec;
+
+	INFO("Loading BL31\n");
+	/* FIP first then fall back to semi-hosting */
+	result = open_fip(local_image_spec);
+	if (result == IO_SUCCESS) {
+		*dev_handle = fip_dev_handle;
+		*(io_file_spec **)image_spec = local_image_spec;
+	} else {
+		result = open_semihosting(local_image_spec);
+		if (result == IO_SUCCESS) {
+			*dev_handle = sh_dev_handle;
+			*(io_file_spec **)image_spec = local_image_spec;
+		}
+	}
+	return result;
+}
+
+
+/* Try to load BL33 from Firmware Image Package in FLASH first. If there is no
+ * FIP in FLASH or it is broken, try to load the file from semi-hosting.
+ */
+static int fvp_bl33_policy(io_dev_handle *dev_handle, void **image_spec)
+{
+	int result = IO_FAIL;
+	void *local_image_spec = &bl33_file_spec;
+
+	INFO("Loading BL33 (UEFI)\n");
+	/* FIP first then fall back to semi-hosting */
+	result = open_fip(local_image_spec);
+	if (result == IO_SUCCESS) {
+		*dev_handle = fip_dev_handle;
+		*(io_file_spec **)image_spec = local_image_spec;
+	} else {
+		result = open_semihosting(local_image_spec);
+		if (result == IO_SUCCESS) {
+			*dev_handle = sh_dev_handle;
+			*(io_file_spec **)image_spec = local_image_spec;
+		}
+	}
+	return result;
+}
+
 
-/* Set up the IO devices present on this platform, ready for use */
-void io_setup(void)
+/* Try to find FIP on NOR FLASH */
+static int fvp_fip_policy(io_dev_handle *dev_handle, void **image_spec)
 {
+	int result = IO_FAIL;
+	void *local_image_spec = &fip_block_spec;
+
+	result = open_memmap(local_image_spec);
+	if (result == IO_SUCCESS) {
+		*dev_handle = memmap_dev_handle;
+		*(io_file_spec **)image_spec = local_image_spec;
+	}
+	return result;
+}
+
+
+void io_setup (void)
+{
+	int io_result = IO_FAIL;
+
 	/* Initialise the IO layer */
 	io_init(&io_data);
 
-	/* Register a semi-hosting device */
-	int io_result = register_io_dev_sh(&sh_dev_con);
+	/* Register the IO devices on this platform */
+	io_result = register_io_dev_sh(&sh_dev_con);
+	assert(io_result == IO_SUCCESS);
+
+	io_result = register_io_dev_fip(&fip_dev_con);
+	assert(io_result == IO_SUCCESS);
+
+	io_result = register_io_dev_memmap(&memmap_dev_con);
 	assert(io_result == IO_SUCCESS);
 
-	/* Open a connection to the semi-hosting device and cache the handle */
+	/* Open connections to devices and cache the handles */
 	io_result = io_dev_open(sh_dev_con, sh_dev_spec, &sh_dev_handle);
 	assert(io_result == IO_SUCCESS);
 
+	io_result = io_dev_open(fip_dev_con, fip_dev_spec, &fip_dev_handle);
+	assert(io_result == IO_SUCCESS);
+
+	io_result = io_dev_open(memmap_dev_con, memmap_dev_spec,
+				&memmap_dev_handle);
+	assert(io_result == IO_SUCCESS);
+
 	/* Ignore improbable errors in release builds */
 	(void)io_result;
 }
 
 
 /* Return an IO device handle and specification which can be used to access
- * an image */
+ * an image. Use this to enforce platform load policy */
 int plat_get_image_source(const char *image_name, io_dev_handle *dev_handle,
-				void **image_spec)
+			  void **image_spec)
 {
 	int result = IO_FAIL;
-	assert((image_name != NULL) && (dev_handle != NULL) &&
-			(image_spec != NULL));
+	plat_io_policy *policy;
 
-	if (strcmp(BL2_IMAGE_NAME, image_name) == 0) {
-		result = io_dev_init(sh_dev_handle, sh_init_params);
-		if (result == IO_SUCCESS) {
-			*dev_handle = sh_dev_handle;
-			*(io_file_spec **)image_spec = &bl2_image_spec;
-		}
-	} else if (strcmp(BL31_IMAGE_NAME, image_name) == 0) {
-		result = io_dev_init(sh_dev_handle, sh_init_params);
-		if (result == IO_SUCCESS) {
-			*dev_handle = sh_dev_handle;
-			*(io_file_spec **)image_spec = &bl31_image_spec;
-		}
-	} else
-		assert(0);
+	assert(image_name != NULL);
+	assert(dev_handle != NULL);
+	assert(image_spec != NULL);
 
+	policy = fvp_policy;
+	while ((policy->image_name != NULL) &&
+	       (policy->image_policy != NULL)) {
+		result = strcmp(policy->image_name, image_name);
+		if (result == 0) {
+			result = policy->image_policy(dev_handle, image_spec);
+			break;
+		}
+		policy++;
+	}
 	return result;
 }
diff --git a/plat/fvp/platform.h b/plat/fvp/platform.h
index ece882f..a12a094 100644
--- a/plat/fvp/platform.h
+++ b/plat/fvp/platform.h
@@ -50,9 +50,19 @@
 #define PLATFORM_STACK_SIZE		0x800
 
 #define FIRMWARE_WELCOME_STR		"Booting trusted firmware boot loader stage 1\n\r"
+
+/* Trusted Boot Firmware BL2 */
 #define BL2_IMAGE_NAME			"bl2.bin"
-#define BL31_IMAGE_NAME			"bl31.bin"
-#define NS_IMAGE_OFFSET			FLASH0_BASE
+/* EL3 Runtime Firmware BL31 */
+#define BL31_IMAGE_NAME		"bl31.bin"
+/* Secure Payload BL32 (Trusted OS) */
+#define BL32_IMAGE_NAME		"bl32.bin"
+/* Non-Trusted Firmware BL33 and its load address */
+#define BL33_IMAGE_NAME		"bl33.bin" /* e.g. UEFI */
+#define NS_IMAGE_OFFSET		(DRAM_BASE + 0x8000000) /* DRAM + 128MB */
+/* Firmware Image Package */
+#define FIP_IMAGE_NAME			"fip.bin"
+
 
 #define PLATFORM_CACHE_LINE_SIZE	64
 #define PLATFORM_CLUSTER_COUNT		2ull
@@ -62,7 +72,7 @@
 						PLATFORM_CLUSTER0_CORE_COUNT)
 #define PLATFORM_MAX_CPUS_PER_CLUSTER	4
 #define PRIMARY_CPU			0x0
-#define MAX_IO_DEVICES			1
+#define MAX_IO_DEVICES			3
 #define MAX_IO_HANDLES			4
 
 /* Constants for accessing platform configuration */
@@ -215,7 +225,7 @@
 /*******************************************************************************
  * BL2 specific defines.
  ******************************************************************************/
-#define BL2_BASE			0x0402C000
+#define BL2_BASE			0x0402B000
 
 /*******************************************************************************
  * BL31 specific defines.
diff --git a/plat/fvp/platform.mk b/plat/fvp/platform.mk
index 2efc7bc..cd7faa5 100644
--- a/plat/fvp/platform.mk
+++ b/plat/fvp/platform.mk
@@ -63,7 +63,9 @@ PLAT_BL_COMMON_OBJS	:=	semihosting_call.o			\
 				semihosting.o				\
 				sysreg_helpers.o			\
 				plat_io_storage.o			\
-				io_semihosting.o
+				io_semihosting.o			\
+				io_fip.o				\
+				io_memmap.o
 
 BL1_OBJS		+=	bl1_plat_setup.o			\
 				bl1_plat_helpers.o			\