How to Send a Patch to Trusted Firmware-A (TF-A) using Gerrit

TF-A does not take patches by email like the Linux kernel. You must use Gerrit at https://review.trustedfirmware.org. This guide shows every step, from making an account to pushing your first patch. I tested it by sending a real BL2 patch.

1. Make a trustedfirmware.org account

Open https://review.trustedfirmware.org/login.
Sign in with GitHub, Google, or GitLab. There is no password sign-up.
Pick your username at first login. It is hard to change later, so think before you choose.
After login, click your profile and go to Settings → Profile. Set your Full name. This name shows up as the owner of every Change you make.

2. Add your SSH key

You push to Gerrit over SSH. Make a key if you do not have one:

ssh-keygen -t ed25519 -C "your-email@example.com"
cat ~/.ssh/id_ed25519.pub

Copy the public key. In Gerrit, go to Settings → SSH Keys → Add new SSH key, paste it, and click Add.

3. Set up SSH (optional but easier)

Add this to ~/.ssh/config so you do not have to type the host and port every time:

Host review.trustedfirmware.org
    User <your-gerrit-username>
    Port 29418
    IdentityFile ~/.ssh/id_ed25519

Test it:

ssh -p 29418 review.trustedfirmware.org gerrit version
# Should print: gerrit version 3.12...

4. Clone the repo and add the Gerrit remote

git clone https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
cd trusted-firmware-a

git remote add gerrit ssh://review.trustedfirmware.org:29418/TF-A/trusted-firmware-a

5. Install the commit-msg hook

Gerrit uses a Change-Id line in each commit to track the same review across new versions. The hook adds it for you:

curl -Lo .git/hooks/commit-msg https://review.trustedfirmware.org/tools/hooks/commit-msg
chmod +x .git/hooks/commit-msg

To add a Change-Id to a commit you already made:

git commit --amend --no-edit

6. Make your branch and write your patch

git fetch gerrit integration
git checkout -b my-fix gerrit/integration

# edit code...

git add -p
git commit -s   # -s adds Signed-off-by, which is required

Write the commit message in this style (TF-A uses conventional commits):

fix(st): reset SoC instead of panic() on MMC init failure

Explain why you made the change. Wrap lines at 80 columns.

Signed-off-by: XXX <XXX@XXX.XXX>
Change-Id: I0123456789abcdef0123456789abcdef01234567

Common types: feat, fix, refactor, docs, build, ci, style, test, chore. The scope is the folder or module, like st, cpus, tc.

7. Push to Gerrit

You do not push to a normal branch. You push to a magic ref called refs/for/<branch>:

git push gerrit HEAD:refs/for/integration

You will see something like:

remote: SUCCESS
remote:   https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/<NNNNN> fix(st): ... [NEW]

Open that URL. That is your Change. You can read the diff and reply to comments there.

8. Add reviewers

Click ADD REVIEWER in the web UI, or do it from SSH:

ssh -p 29418 review.trustedfirmware.org gerrit set-reviewers \
  --add reviewer1@example.com \
  --add reviewer2@example.com \
  -- <change-number>

Watch out: the email a maintainer uses for git commits may not be the email they used to sign up for Gerrit. For example, one ST maintainer commits as @foss.st.com but is registered on Gerrit as @st.com. If you get “Account not found”, try other domain forms.

9. Send a new version (v2)

Keep the same Change-Id and the new patch will go into the same review as Patch Set 2:

# edit code...
git commit --amend     # the Change-Id stays
git push gerrit HEAD:refs/for/integration

The hook keeps the same Change-Id when you amend. A new Change is not made.

10. Things that often go wrong

“missing Change-Id” — push refused → You did not install the commit-msg hook. Run git commit --amend after you install it.
“prohibited by Gerrit: not permitted: create” → You pushed to a normal branch. You must use refs/for/integration.
checkpatch fails → TF-A runs a Linux-style checkpatch.pl in CI. Check first with ./scripts/checkpatch.py --no-tree -f <file> (or use the Linux kernel checkpatch.pl).
Permission denied (publickey) → The SSH key on Gerrit and your local key do not match. Run ssh -vT review.trustedfirmware.org -p 29418 to see which key is used.
A maintainer asks you to send the patch by email → That should not happen. TF-A does not take email patches. Reply with your Gerrit URL.

Links

I used these steps to push a real BL2 reset patch for an STM32MP-based board, from sending a mailing-list email, to moving to Gerrit, to adding reviewers — all in one flow.

happycpu notepad

2026-04-30