diff --git a/0001-atf-2.8-fix-linking.patch b/0001-atf-2.8-fix-linking.patch
new file mode 100644
index 0000000000000000000000000000000000000000..09357a4f8ad642cfbbe261b0af0bb394a804ba93
--- /dev/null
+++ b/0001-atf-2.8-fix-linking.patch
@@ -0,0 +1,11 @@
+--- arm-trusted-firmware-2.8/Makefile.orig	2022-11-24 12:09:34.740595091 +0000
++++ arm-trusted-firmware-2.8/Makefile	2022-11-24 12:11:00.923109191 +0000
+@@ -442,7 +442,7 @@
+ 
+ # LD = gcc-ld (ld) or llvm-ld (ld.lld) or other
+ else
+-TF_LDFLAGS		+=	--fatal-warnings -O1
++TF_LDFLAGS		+=	--fatal-warnings -O1 --no-warn-rwx-segments
+ TF_LDFLAGS		+=	--gc-sections
+ # ld.lld doesn't recognize the errata flags,
+ # therefore don't add those in that case
diff --git a/arm-trusted-firmware.spec b/arm-trusted-firmware.spec
new file mode 100644
index 0000000000000000000000000000000000000000..e78797cdb3510fa7c468992b7b06b6a93ac354a2
--- /dev/null
+++ b/arm-trusted-firmware.spec
@@ -0,0 +1,103 @@
+%define anolis_release 1
+
+%global debug_package %{nil}
+
+Name:    arm-trusted-firmware
+Version: 2.8
+Release: %{anolis_release}%{dist}
+Summary: ARM Trusted Firmware
+License: BSD
+URL:     https://github.com/ARM-software/arm-trusted-firmware
+Source0: https://github.com/ARM-software/arm-trusted-firmware/archive/refs/tags/v%{version}.tar.gz
+
+Patch0001:  0001-atf-2.8-fix-linking.patch
+
+ExclusiveArch: aarch64
+BuildRequires: gcc dtc
+
+%description
+ARM Trusted firmware is a reference implementation of secure world software for
+ARMv8-A including Exception Level 3 (EL3) software. It provides a number of
+standard ARM interfaces like Power State Coordination (PSCI), Trusted Board
+Boot Requirements (TBBR) and Secure Monitor.
+
+Note: the contents of this package are generally just consumed by bootloaders
+such as u-boot. As such the binaries aren't of general interest to users.
+
+%ifarch aarch64
+%package     -n arm-trusted-firmware-armv8
+Summary:     ARM Trusted Firmware for ARMv8-A
+
+%description -n arm-trusted-firmware-armv8
+ARM Trusted Firmware binaries for various  ARMv8-A SoCs.
+
+Note: the contents of this package are generally just consumed by bootloaders
+such as u-boot. As such the binaries aren't of general interest to users.
+%endif
+
+%package -n arm-trusted-firmware-armv8-doc
+Summary:        Documentation files for %{name}
+Requires:       arm-trusted-firmware-armv8 = %{EVR}
+BuildArch:      noarch
+
+%description -n arm-trusted-firmware-armv8-doc
+The arm-trusted-firmware-armv8-doc package contains documentation files for arm-trusted-firmware-armv8.
+
+%prep
+%autosetup -n %{name}-%{version} -p1
+sed -i 's/arm-none-eabi-/arm-linux-gnu-/' plat/rockchip/rk3399/drivers/m0/Makefile
+
+%build
+%ifarch aarch64
+for soc in $(cat %{_arch}-bl31)
+do
+# At the moment we're only making the secure firmware (bl31)
+make HOSTCC="gcc $RPM_OPT_FLAGS" CROSS_COMPILE="" PLAT=$(echo $soc) bl31
+done
+%endif
+
+%install
+
+mkdir -p %{buildroot}%{_datadir}/%{name}
+
+%ifarch aarch64
+# At the moment we just support adding bl31.bin
+for soc in $(cat %{_arch}-bl31)
+do
+mkdir -p %{buildroot}%{_datadir}/%{name}/$(echo $soc)/
+ for file in bl31.bin
+ do
+  if [ -f build/$(echo $soc)/release/$(echo $file) ]; then
+    install -p -m 0644 build/$(echo $soc)/release/$(echo $file) /%{buildroot}%{_datadir}/%{name}/$(echo $soc)/
+  fi
+ done
+done
+
+# Rockchips wants the bl31.elf, plus rk3399 wants power management co-processor bits
+for soc in rk3399 rk3368 rk3328
+do
+mkdir -p %{buildroot}%{_datadir}/%{name}/$(echo $soc)/
+ for file in bl31/bl31.elf m0/rk3399m0.bin m0/rk3399m0.elf
+ do
+  if [ -f build/$(echo $soc)/release/$(echo $file) ]; then
+    install -p -m 0644 build/$(echo $soc)/release/$(echo $file) /%{buildroot}%{_datadir}/%{name}/$(echo $soc)/
+  fi
+ done
+done
+
+%endif
+
+%generate_compatibility_deps
+
+%ifarch aarch64
+%files -n arm-trusted-firmware-armv8
+%license license.rst
+%{_datadir}/%{name}
+%endif
+
+%files -n arm-trusted-firmware-armv8-doc
+%doc readme.rst
+
+%changelog
+* Sat Apr 15 2023 yuanhui <yuanhui@linux.alibaba.com> - 2.8-1
+- Init package from upstream
diff --git a/v2.8.tar.gz b/v2.8.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..191e6e2d3238cff2262d16f947a6e702d0c077f6
Binary files /dev/null and b/v2.8.tar.gz differ