FWU: Add Generic Firmware Update framework support in BL1

Firmware update(a.k.a FWU) feature is part of the TBB architecture.
BL1 is responsible for carrying out the FWU process if platform
specific code detects that it is needed.

This patch adds support for FWU feature support in BL1 which is
included by enabling `TRUSTED_BOARD_BOOT` compile time flag.

This patch adds bl1_fwu.c which contains all the core operations
of FWU, which are; SMC handler, image copy, authentication, execution
and resumption. It also adds bl1.h introducing #defines for all
BL1 SMCs.

Following platform porting functions are introduced:

int bl1_plat_mem_check(uintptr_t mem_base, unsigned int mem_size,
unsigned int flags);
	This function can be used to add platform specific memory checks
	for the provided base/size for the given security state.
	The weak definition will invoke `assert()` and return -ENOMEM.

__dead2 void bl1_plat_fwu_done(void *cookie, void *reserved);
	This function can be used to initiate platform specific procedure
	to mark completion of the FWU process.
	The weak definition waits forever calling `wfi()`.

plat_bl1_common.c contains weak definitions for above functions.

FWU process starts when platform detects it and return the image_id
other than BL2_IMAGE_ID by using `bl1_plat_get_next_image_id()` in
`bl1_main()`.

NOTE: User MUST provide platform specific real definition for
bl1_plat_mem_check() in order to use it for Firmware update.

Change-Id: Ice189a0885d9722d9e1dd03f76cac1aceb0e25ed

7 files changed, 743 insertions, 12 deletions

diff --git a/bl1/aarch64/bl1_exceptions.S b/bl1/aarch64/bl1_exceptions.S
index 8802301e..9ff6a57b 100644
--- a/bl1/aarch64/bl1_exceptions.S
+++ b/bl1/aarch64/bl1_exceptions.S
@@ -31,6 +31,7 @@
 #include <arch.h>
 #include <asm_macros.S>
 #include <bl_common.h>
+#include <bl1.h>
 #include <context.h>
 
 	.globl	bl1_exceptions
@@ -181,8 +182,26 @@ SErrorA32:
 
 
 func smc_handler64
+
 	/* ----------------------------------------------
-	 * Switch back to SP_EL0 for the C runtime stack.
+	 * Detect if this is a RUN_IMAGE or other SMC.
+	 * ----------------------------------------------
+	 */
+	mov	x30, #BL1_SMC_RUN_IMAGE
+	cmp	x30, x0
+	b.ne	smc_handler
+
+	/* ------------------------------------------------
+	 * Make sure only Secure world reaches here.
+	 * ------------------------------------------------
+	 */
+	mrs	x30, scr_el3
+	tst	x30, #SCR_NS_BIT
+	b.ne	unexpected_sync_exception
+
+	/* ----------------------------------------------
+	 * Handling RUN_IMAGE SMC. First switch back to
+	 * SP_EL0 for the C runtime stack.
 	 * ----------------------------------------------
 	 */
 	ldr	x30, [sp, #CTX_EL3STATE_OFFSET + CTX_RUNTIME_SP]
@@ -190,20 +209,13 @@ func smc_handler64
 	mov	sp, x30
 
 	/* ---------------------------------------------------------------------
-	 * Only a single SMC exception from BL2 to ask BL1 to pass EL3 control
-	 * to BL31 is expected here. It expects:
-	 *   - X0 with RUN_IMAGE SMC function ID;
-	 *   - X1 with the address of a entry_point_info_t structure describing
-	 *     the BL31 entrypoint.
+	 * Pass EL3 control to BL31.
+	 * Here it expects X1 with the address of a entry_point_info_t
+	 * structure describing the BL31 entrypoint.
 	 * ---------------------------------------------------------------------
 	 */
-	mov	x19, x0
 	mov	x20, x1
 
-	mov	x0, #RUN_IMAGE
-	cmp	x19, x0
-	b.ne	unexpected_sync_exception
-
 	mov	x0, x20
 	bl	bl1_print_bl31_ep_info
 
@@ -238,3 +250,69 @@ unexpected_sync_exception:
 	bl	plat_report_exception
 	wfi
 	b	unexpected_sync_exception
+
+	/* -----------------------------------------------------
+	 * Save Secure/Normal world context and jump to
+	 * BL1 SMC handler.
+	 * -----------------------------------------------------
+	 */
+smc_handler:
+	/* -----------------------------------------------------
+	 * Save the GP registers x0-x29.
+	 * TODO: Revisit to store only SMCC specified registers.
+	 * -----------------------------------------------------
+	 */
+	bl	save_gp_registers
+
+	/* -----------------------------------------------------
+	 * Populate the parameters for the SMC handler. We
+	 * already have x0-x4 in place. x5 will point to a
+	 * cookie (not used now). x6 will point to the context
+	 * structure (SP_EL3) and x7 will contain flags we need
+	 * to pass to the handler.
+	 * -----------------------------------------------------
+	 */
+	mov	x5, xzr
+	mov	x6, sp
+
+	/* -----------------------------------------------------
+	 * Restore the saved C runtime stack value which will
+	 * become the new SP_EL0 i.e. EL3 runtime stack. It was
+	 * saved in the 'cpu_context' structure prior to the last
+	 * ERET from EL3.
+	 * -----------------------------------------------------
+	 */
+	ldr	x12, [x6, #CTX_EL3STATE_OFFSET + CTX_RUNTIME_SP]
+
+	/* ---------------------------------------------
+	 * Switch back to SP_EL0 for the C runtime stack.
+	 * ---------------------------------------------
+	 */
+	msr	spsel, #0
+	mov	sp, x12
+
+	/* -----------------------------------------------------
+	 * Save the SPSR_EL3, ELR_EL3, & SCR_EL3 in case there
+	 * is a world switch during SMC handling.
+	 * -----------------------------------------------------
+	 */
+	mrs	x16, spsr_el3
+	mrs	x17, elr_el3
+	mrs	x18, scr_el3
+	stp	x16, x17, [x6, #CTX_EL3STATE_OFFSET + CTX_SPSR_EL3]
+	str	x18, [x6, #CTX_EL3STATE_OFFSET + CTX_SCR_EL3]
+
+	/* Copy SCR_EL3.NS bit to the flag to indicate caller's security */
+	bfi	x7, x18, #0, #1
+
+	/* -----------------------------------------------------
+	 * Go to BL1 SMC handler.
+	 * -----------------------------------------------------
+	 */
+	bl	bl1_smc_handler
+
+	/* -----------------------------------------------------
+	 * Do the transition to next BL image.
+	 * -----------------------------------------------------
+	 */
+	b	el3_exit
diff --git a/bl1/bl1.mk b/bl1/bl1.mk
index a19a3307..21e87c79 100644
--- a/bl1/bl1.mk
+++ b/bl1/bl1.mk
@@ -38,5 +38,8 @@ BL1_SOURCES		+=	bl1/bl1_main.c				\
 				lib/cpus/aarch64/cpu_helpers.S		\
 				plat/common/plat_bl1_common.c
 
+ifeq (${TRUSTED_BOARD_BOOT},1)
+BL1_SOURCES		+=	bl1/bl1_fwu.c
+endif
 
 BL1_LINKERFILE		:=	bl1/bl1.ld.S
diff --git a/bl1/bl1_context_mgmt.c b/bl1/bl1_context_mgmt.c
index e9264cb7..6355190e 100644
--- a/bl1/bl1_context_mgmt.c
+++ b/bl1/bl1_context_mgmt.c
@@ -32,7 +32,6 @@
 #include <assert.h>
 #include <context.h>
 #include <context_mgmt.h>
-#include <debug.h>
 #include <platform.h>
 
 /*
diff --git a/bl1/bl1_fwu.c b/bl1/bl1_fwu.c
new file mode 100644
index 00000000..f8b414e3
--- /dev/null
+++ b/bl1/bl1_fwu.c
@@ -0,0 +1,503 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <arch_helpers.h>
+#include <auth_mod.h>
+#include <bl1.h>
+#include <bl_common.h>
+#include <context.h>
+#include <context_mgmt.h>
+#include <debug.h>
+#include <errno.h>
+#include <platform.h>
+#include <platform_def.h>
+#include <smcc_helpers.h>
+#include <string.h>
+#include "bl1_private.h"
+
+/*
+ * Function declarations.
+ */
+static int bl1_fwu_image_copy(unsigned int image_id,
+			uintptr_t image_addr,
+			unsigned int block_size,
+			unsigned int image_size,
+			unsigned int flags);
+static int bl1_fwu_image_auth(unsigned int image_id,
+			uintptr_t image_addr,
+			unsigned int image_size,
+			unsigned int flags);
+static int bl1_fwu_image_execute(unsigned int image_id,
+			void **handle,
+			unsigned int flags);
+static register_t bl1_fwu_image_resume(unsigned int image_id,
+			register_t image_param,
+			void **handle,
+			unsigned int flags);
+static int bl1_fwu_sec_image_done(void **handle,
+			unsigned int flags);
+__dead2 static void bl1_fwu_done(void *cookie, void *reserved);
+
+/*
+ * This keeps track of last executed secure image id.
+ */
+static unsigned int sec_exec_image_id = INVALID_IMAGE_ID;
+
+/*******************************************************************************
+ * Top level handler for servicing FWU SMCs.
+ ******************************************************************************/
+register_t bl1_fwu_smc_handler(unsigned int smc_fid,
+			register_t x1,
+			register_t x2,
+			register_t x3,
+			register_t x4,
+			void *cookie,
+			void *handle,
+			unsigned int flags)
+{
+
+	switch (smc_fid) {
+	case FWU_SMC_IMAGE_COPY:
+		SMC_RET1(handle, bl1_fwu_image_copy(x1, x2, x3, x4, flags));
+
+	case FWU_SMC_IMAGE_AUTH:
+		SMC_RET1(handle, bl1_fwu_image_auth(x1, x2, x3, flags));
+
+	case FWU_SMC_IMAGE_EXECUTE:
+		SMC_RET1(handle, bl1_fwu_image_execute(x1, &handle, flags));
+
+	case FWU_SMC_IMAGE_RESUME:
+		SMC_RET1(handle, bl1_fwu_image_resume(x1, x2, &handle, flags));
+
+	case FWU_SMC_SEC_IMAGE_DONE:
+		SMC_RET1(handle, bl1_fwu_sec_image_done(&handle, flags));
+
+	case FWU_SMC_UPDATE_DONE:
+		bl1_fwu_done(cookie, NULL);
+		/* We should never return from bl1_fwu_done() */
+
+	default:
+		assert(0);
+		break;
+	}
+
+	SMC_RET0(handle);
+}
+
+/*******************************************************************************
+ * This function is responsible for copying secure images in AP Secure RAM.
+ ******************************************************************************/
+static int bl1_fwu_image_copy(unsigned int image_id,
+			uintptr_t image_src,
+			unsigned int block_size,
+			unsigned int image_size,
+			unsigned int flags)
+{
+	uintptr_t base_addr;
+	meminfo_t *mem_layout;
+
+	/* Get the image descriptor. */
+	image_desc_t *image_desc = bl1_plat_get_image_desc(image_id);
+
+	/* Check if we are in correct state. */
+	if ((!image_desc) ||
+		((image_desc->state != IMAGE_STATE_RESET) &&
+		 (image_desc->state != IMAGE_STATE_COPYING))) {
+		WARN("BL1-FWU: Copy not allowed due to invalid state\n");
+		return -EPERM;
+	}
+
+	/* Only Normal world is allowed to copy a Secure image. */
+	if ((GET_SEC_STATE(flags) == SECURE) ||
+		(GET_SEC_STATE(image_desc->ep_info.h.attr) == NON_SECURE)) {
+		WARN("BL1-FWU: Copy not allowed for Non-Secure "
+			 "image from Secure-world\n");
+		return -EPERM;
+	}
+
+	if ((!image_src) || (!block_size)) {
+		WARN("BL1-FWU: Copy not allowed due to invalid image source"
+			" or block size\n");
+		return -ENOMEM;
+	}
+
+	/* Get the image base address. */
+	base_addr = image_desc->image_info.image_base;
+
+	if (image_desc->state == IMAGE_STATE_COPYING) {
+		/*
+		 * If last block is more than expected then
+		 * clip the block to the required image size.
+		 */
+		if (image_desc->image_info.copied_size + block_size >
+			 image_desc->image_info.image_size) {
+			block_size = image_desc->image_info.image_size -
+				image_desc->image_info.copied_size;
+			WARN("BL1-FWU: Copy argument block_size > remaining image size."
+				" Clipping block_size\n");
+		}
+
+		/* Make sure the image src/size is mapped. */
+		if (bl1_plat_mem_check(image_src, block_size, flags)) {
+			WARN("BL1-FWU: Copy arguments source/size not mapped\n");
+			return -ENOMEM;
+		}
+
+		INFO("BL1-FWU: Continuing image copy in blocks\n");
+
+		/* Copy image for given block size. */
+		base_addr += image_desc->image_info.copied_size;
+		image_desc->image_info.copied_size += block_size;
+		memcpy((void *)base_addr, (const void *)image_src, block_size);
+		flush_dcache_range(base_addr, block_size);
+
+		/* Update the state if last block. */
+		if (image_desc->image_info.copied_size ==
+				image_desc->image_info.image_size) {
+			image_desc->state = IMAGE_STATE_COPIED;
+			INFO("BL1-FWU: Image copy in blocks completed\n");
+		}
+	} else {
+		/* This means image is in RESET state and ready to be copied. */
+		INFO("BL1-FWU: Fresh call to copy an image\n");
+
+		if (!image_size) {
+			WARN("BL1-FWU: Copy not allowed due to invalid image size\n");
+			return -ENOMEM;
+		}
+
+		/*
+		 * If block size is more than total size then
+		 * assume block size as the total image size.
+		 */
+		if (block_size > image_size) {
+			block_size = image_size;
+			WARN("BL1-FWU: Copy argument block_size > image size."
+				" Clipping block_size\n");
+		}
+
+		/* Make sure the image src/size is mapped. */
+		if (bl1_plat_mem_check(image_src, block_size, flags)) {
+			WARN("BL1-FWU: Copy arguments source/size not mapped\n");
+			return -ENOMEM;
+		}
+
+		/* Find out how much free trusted ram remains after BL1 load */
+		mem_layout = bl1_plat_sec_mem_layout();
+		if ((image_desc->image_info.image_base < mem_layout->free_base) ||
+			 (image_desc->image_info.image_base + image_size >
+			  mem_layout->free_base + mem_layout->free_size)) {
+			WARN("BL1-FWU: Memory not available to copy\n");
+			return -ENOMEM;
+		}
+
+		/* Update the image size. */
+		image_desc->image_info.image_size = image_size;
+
+		/* Copy image for given size. */
+		memcpy((void *)base_addr, (const void *)image_src, block_size);
+		flush_dcache_range(base_addr, block_size);
+
+		/* Update the state. */
+		if (block_size == image_size) {
+			image_desc->state = IMAGE_STATE_COPIED;
+			INFO("BL1-FWU: Image is copied successfully\n");
+		} else {
+			image_desc->state = IMAGE_STATE_COPYING;
+			INFO("BL1-FWU: Started image copy in blocks\n");
+		}
+
+		image_desc->image_info.copied_size = block_size;
+	}
+
+	return 0;
+}
+
+/*******************************************************************************
+ * This function is responsible for authenticating Normal/Secure images.
+ ******************************************************************************/
+static int bl1_fwu_image_auth(unsigned int image_id,
+			uintptr_t image_src,
+			unsigned int image_size,
+			unsigned int flags)
+{
+	int result;
+	uintptr_t base_addr;
+	unsigned int total_size;
+
+	/* Get the image descriptor. */
+	image_desc_t *image_desc = bl1_plat_get_image_desc(image_id);
+	if (!image_desc)
+		return -EPERM;
+
+	if (GET_SEC_STATE(flags) == SECURE) {
+		if (image_desc->state != IMAGE_STATE_RESET) {
+			WARN("BL1-FWU: Authentication from secure world "
+				"while in invalid state\n");
+			return -EPERM;
+		}
+	} else {
+		if (GET_SEC_STATE(image_desc->ep_info.h.attr) == SECURE) {
+			if (image_desc->state != IMAGE_STATE_COPIED) {
+				WARN("BL1-FWU: Authentication of secure image "
+					"from non-secure world while not in copied state\n");
+				return -EPERM;
+			}
+		} else {
+			if (image_desc->state != IMAGE_STATE_RESET) {
+				WARN("BL1-FWU: Authentication of non-secure image "
+					"from non-secure world while in invalid state\n");
+				return -EPERM;
+			}
+		}
+	}
+
+	if (image_desc->state == IMAGE_STATE_COPIED) {
+		/*
+		 * Image is in COPIED state.
+		 * Use the stored address and size.
+		 */
+		base_addr = image_desc->image_info.image_base;
+		total_size = image_desc->image_info.image_size;
+	} else {
+		if ((!image_src) || (!image_size)) {
+			WARN("BL1-FWU: Auth not allowed due to invalid"
+				" image source/size\n");
+			return -ENOMEM;
+		}
+
+		/*
+		 * Image is in RESET state.
+		 * Check the parameters and authenticate the source image in place.
+		 */
+		if (bl1_plat_mem_check(image_src, image_size, flags)) {
+			WARN("BL1-FWU: Authentication arguments source/size not mapped\n");
+			return -ENOMEM;
+		}
+
+		base_addr = image_src;
+		total_size = image_size;
+
+		/* Update the image size in the descriptor. */
+		image_desc->image_info.image_size = total_size;
+	}
+
+	/*
+	 * Authenticate the image.
+	 */
+	INFO("BL1-FWU: Authenticating image_id:%d\n", image_id);
+	result = auth_mod_verify_img(image_id, (void *)base_addr, total_size);
+	if (result != 0) {
+		WARN("BL1-FWU: Authentication Failed err=%d\n", result);
+
+		/*
+		 * Authentication has failed.
+		 * Clear the memory if the image was copied.
+		 * This is to prevent an attack where this contains
+		 * some malicious code that can somehow be executed later.
+		 */
+		if (image_desc->state == IMAGE_STATE_COPIED) {
+			/* Clear the memory.*/
+			memset((void *)base_addr, 0, total_size);
+			flush_dcache_range(base_addr, total_size);
+
+			/* Indicate that image can be copied again*/
+			image_desc->state = IMAGE_STATE_RESET;
+		}
+		return -EAUTH;
+	}
+
+	/* Indicate that image is in authenticated state. */
+	image_desc->state = IMAGE_STATE_AUTHENTICATED;
+
+	/*
+	 * Flush image_info to memory so that other
+	 * secure world images can see changes.
+	 */
+	flush_dcache_range((unsigned long)&image_desc->image_info,
+		sizeof(image_info_t));
+
+	INFO("BL1-FWU: Authentication was successful\n");
+
+	return 0;
+}
+
+/*******************************************************************************
+ * This function is responsible for executing Secure images.
+ ******************************************************************************/
+static int bl1_fwu_image_execute(unsigned int image_id,
+			void **handle,
+			unsigned int flags)
+{
+	/* Get the image descriptor. */
+	image_desc_t *image_desc = bl1_plat_get_image_desc(image_id);
+
+	/*
+	 * Execution is NOT allowed if:
+	 * Caller is from Secure world OR
+	 * Image is Non-Secure OR
+	 * Image is Non-Executable OR
+	 * Image is NOT in AUTHENTICATED state.
+	 */
+	if ((!image_desc) ||
+		(GET_SEC_STATE(flags) == SECURE) ||
+		(GET_SEC_STATE(image_desc->ep_info.h.attr) == NON_SECURE) ||
+		(GET_EXEC_STATE(image_desc->image_info.h.attr) == NON_EXECUTABLE) ||
+		(image_desc->state != IMAGE_STATE_AUTHENTICATED)) {
+		WARN("BL1-FWU: Execution not allowed due to invalid state/args\n");
+		return -EPERM;
+	}
+
+	INFO("BL1-FWU: Executing Secure image\n");
+
+	/* Save NS-EL1 system registers. */
+	cm_el1_sysregs_context_save(NON_SECURE);
+
+	/* Prepare the image for execution. */
+	bl1_prepare_next_image(image_id);
+
+	/* Update the secure image id. */
+	sec_exec_image_id = image_id;
+
+	*handle = cm_get_context(SECURE);
+	return 0;
+}
+
+/*******************************************************************************
+ * This function is responsible for resuming Secure/Non-Secure images.
+ ******************************************************************************/
+static register_t bl1_fwu_image_resume(unsigned int image_id,
+			register_t image_param,
+			void **handle,
+			unsigned int flags)
+{
+	image_desc_t *image_desc;
+	unsigned int resume_sec_state;
+
+	if (GET_SEC_STATE(flags) == SECURE) {
+		/* Get the image descriptor for last executed secure image id. */
+		image_desc = bl1_plat_get_image_desc(sec_exec_image_id);
+
+		if ((!image_desc) || (image_desc->state != IMAGE_STATE_EXECUTED)) {
+			WARN("BL1-FWU: Resume not allowed for secure image "
+				"due to invalid state\n");
+			return -EPERM;
+		}
+
+		/* Update the flags. */
+		image_desc->state = IMAGE_STATE_INTERRUPTED;
+		resume_sec_state = NON_SECURE;
+	} else {
+		/* Get the image descriptor for image id to be resumed. */
+		image_desc = bl1_plat_get_image_desc(image_id);
+
+		/* Make sure image is secure and was interrupted. */
+		if ((!image_desc) ||
+			(GET_SEC_STATE(image_desc->ep_info.h.attr) == NON_SECURE) ||
+			(image_desc->state != IMAGE_STATE_INTERRUPTED)) {
+			WARN("BL1-FWU: Resume not allowed for NS image/ invalid state\n");
+			return -EPERM;
+		}
+
+		/* Update the flags. */
+		image_desc->state = IMAGE_STATE_EXECUTED;
+		resume_sec_state = SECURE;
+	}
+
+	/* Save the EL1 system registers of calling world. */
+	cm_el1_sysregs_context_save(GET_SEC_STATE(flags));
+
+	/* Restore the EL1 system registers of resuming world. */
+	cm_el1_sysregs_context_restore(resume_sec_state);
+
+	/* Update the next context. */
+	cm_set_next_eret_context(resume_sec_state);
+
+	INFO("BL1-FWU: Resuming %s world context\n",
+		(resume_sec_state == SECURE) ? "Secure" : "Normal");
+
+	*handle = cm_get_context(resume_sec_state);
+	return image_param;
+}
+
+/*******************************************************************************
+ * This function is responsible for resuming normal world context.
+ ******************************************************************************/
+static int bl1_fwu_sec_image_done(void **handle, unsigned int flags)
+{
+
+	/* Get the image descriptor for last executed secure image id. */
+	image_desc_t *image_desc = bl1_plat_get_image_desc(sec_exec_image_id);
+
+	/*
+	 * Make sure caller is from secure world
+	 * and the image is in EXECUTED state.
+	 */
+	if ((!image_desc) ||
+		(GET_SEC_STATE(flags) == NON_SECURE) ||
+		(image_desc->state != IMAGE_STATE_EXECUTED)) {
+		WARN("BL1-FWU: Done not allowed for NS caller/ invalid state\n");
+		return -EPERM;
+	}
+
+	/* Update the flags. */
+	image_desc->state = IMAGE_STATE_RESET;
+	sec_exec_image_id = INVALID_IMAGE_ID;
+
+	/*
+	 * Secure world is done so no need to save the context.
+	 * Just restore the Non-Secure context.
+	 */
+	cm_el1_sysregs_context_restore(NON_SECURE);
+
+	/* Update the next context. */
+	cm_set_next_eret_context(NON_SECURE);
+
+	INFO("BL1-FWU: Resuming Normal world context\n");
+
+	*handle = cm_get_context(NON_SECURE);
+	return 0;
+}
+
+/*******************************************************************************
+ * This function provides the opportunity for users to perform any
+ * platform specific handling after the Firmware update is done.
+ ******************************************************************************/
+__dead2 static void bl1_fwu_done(void *cookie, void *reserved)
+{
+	NOTICE("BL1-FWU: *******FWU Process Completed*******\n");
+
+	/*
+	 * Call platform done function.
+	 */
+	bl1_plat_fwu_done(cookie, reserved);
+	assert(0);
+}
diff --git a/bl1/bl1_main.c b/bl1/bl1_main.c
index 54da735e..84d56110 100644
--- a/bl1/bl1_main.c
+++ b/bl1/bl1_main.c
@@ -32,11 +32,19 @@
 #include <arch_helpers.h>
 #include <assert.h>
 #include <auth_mod.h>
+#include <bl1.h>
 #include <bl_common.h>
 #include <debug.h>
 #include <platform.h>
 #include <platform_def.h>
+#include <smcc_helpers.h>
 #include "bl1_private.h"
+#include <uuid.h>
+
+/* BL1 Service UUID */
+DEFINE_SVC_UUID(bl1_svc_uid,
+	0xfd3967d4, 0x72cb, 0x4d9a, 0xb5, 0x75,
+	0x67, 0x15, 0xd6, 0xf4, 0xbb, 0x4a);
 
 
 static void bl1_load_bl2(void);
@@ -131,8 +139,14 @@ void bl1_main(void)
 	/* Get the image id of next image to load and run. */
 	image_id = bl1_plat_get_next_image_id();
 
+	/*
+	 * We currently interpret any image id other than
+	 * BL2_IMAGE_ID as the start of firmware update.
+	 */
 	if (image_id == BL2_IMAGE_ID)
 		bl1_load_bl2();
+	else
+		NOTICE("BL1-FWU: *******FWU Process Started*******\n");
 
 	bl1_prepare_next_image(image_id);
 }
@@ -213,3 +227,45 @@ void print_debug_loop_message(void)
 	NOTICE("BL1: Please connect the debugger to continue\n");
 }
 #endif
+
+/*******************************************************************************
+ * Top level handler for servicing BL1 SMCs.
+ ******************************************************************************/
+register_t bl1_smc_handler(unsigned int smc_fid,
+	register_t x1,
+	register_t x2,
+	register_t x3,
+	register_t x4,
+	void *cookie,
+	void *handle,
+	unsigned int flags)
+{
+
+#if TRUSTED_BOARD_BOOT
+	/*
+	 * Dispatch FWU calls to FWU SMC handler and return its return
+	 * value
+	 */
+	if (is_fwu_fid(smc_fid)) {
+		return bl1_fwu_smc_handler(smc_fid, x1, x2, x3, x4, cookie,
+			handle, flags);
+	}
+#endif
+
+	switch (smc_fid) {
+	case BL1_SMC_CALL_COUNT:
+		SMC_RET1(handle, BL1_NUM_SMC_CALLS);
+
+	case BL1_SMC_UID:
+		SMC_UUID_RET(handle, bl1_svc_uid);
+
+	case BL1_SMC_VERSION:
+		SMC_RET1(handle, BL1_SMC_MAJOR_VER | BL1_SMC_MINOR_VER);
+
+	default:
+		break;
+	}
+
+	WARN("Unimplemented BL1 SMC Call: 0x%x \n", smc_fid);
+	SMC_RET1(handle, SMC_UNK);
+}
diff --git a/bl1/bl1_private.h b/bl1/bl1_private.h
index 7d796f1d..283bbb97 100644
--- a/bl1/bl1_private.h
+++ b/bl1/bl1_private.h
@@ -31,6 +31,8 @@
 #ifndef __BL1_PRIVATE_H__
 #define __BL1_PRIVATE_H__
 
+#include <types.h>
+
 /*******************************************************************************
  * Declarations of linker defined symbols which will tell us where BL1 lives
  * in Trusted RAM
@@ -47,4 +49,13 @@ void bl1_arch_setup(void);
 void bl1_arch_next_el_setup(void);
 
 void bl1_prepare_next_image(unsigned int image_id);
+
+register_t bl1_fwu_smc_handler(unsigned int smc_fid,
+		register_t x1,
+		register_t x2,
+		register_t x3,
+		register_t x4,
+		void *cookie,
+		void *handle,
+		unsigned int flags);
 #endif /* __BL1_PRIVATE_H__ */
diff --git a/bl1/tbbr/tbbr_img_desc.c b/bl1/tbbr/tbbr_img_desc.c
new file mode 100644
index 00000000..42de8517
--- /dev/null
+++ b/bl1/tbbr/tbbr_img_desc.c
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <bl1.h>
+#include <bl_common.h>
+#include <platform_def.h>
+
+image_desc_t bl1_tbbr_image_descs[] = {
+    {
+	    .image_id = FWU_CERT_ID,
+	    .image_info.h.attr = SET_EXEC_STATE(NON_EXECUTABLE),
+	    .image_info.image_base = BL2_BASE,
+	    .ep_info.h.attr = SET_SEC_STATE(SECURE),
+    },
+#if NS_BL1U_BASE
+    {
+	    .image_id = NS_BL1U_IMAGE_ID,
+	    .image_info.h.attr = SET_EXEC_STATE(EXECUTABLE),
+	    .image_info.image_base = NS_BL1U_BASE,
+	    .ep_info.h.attr = SET_SEC_STATE(NON_SECURE),
+	    .ep_info.pc = NS_BL1U_BASE,
+    },
+#endif
+#if SCP_BL2U_BASE
+    {
+	    .image_id = SCP_BL2U_IMAGE_ID,
+	    .image_info.h.attr = SET_EXEC_STATE(NON_EXECUTABLE),
+	    .image_info.image_base = SCP_BL2U_BASE,
+	    .ep_info.h.attr = SET_SEC_STATE(SECURE),
+    },
+#endif
+#if BL2U_BASE
+    {
+	    .image_id = BL2U_IMAGE_ID,
+	    .image_info.h.attr = SET_EXEC_STATE(EXECUTABLE),
+	    .image_info.image_base = BL2U_BASE,
+	    .ep_info.h.attr = SET_SEC_STATE(SECURE),
+	    .ep_info.pc = BL2U_BASE,
+    },
+#endif
+#if NS_BL2U_BASE
+    {
+	    .image_id = NS_BL2U_IMAGE_ID,
+	    .image_info.h.attr = SET_EXEC_STATE(NON_EXECUTABLE),
+	    .image_info.image_base = NS_BL2U_BASE,
+	    .ep_info.h.attr = SET_SEC_STATE(NON_SECURE),
+    },
+#endif
+	    BL2_IMAGE_DESC,
+
+    {
+	    .image_id = INVALID_IMAGE_ID,
+    }
+};