Model: TC: Update model & RSS firmware in step

As it happens, there was inverted logic in TF-M's rss
that would check that a particular KMU interrupt has not fired.
After correcting this logic, I found that the firmware no longer
booted, perpetually waiting for the KMU interrupt that the model
did not provide.

This update resolves the issue with the model.

New RSS Firmware has a slightly different flash map, so this includes
the modifications needed to correct image offsets.

Further, Update RSS firmware allowing rollback

In particular, this introduces a subdirectory within the TC prebuilt dir
that corresponds to the short hash of the TF-M revision used to build
the rss images. This allows a commit to the CI in the future to change
both the model version and the rss version in step, without replacing
the old revision. This should allow the CI to test any single commit
without worrying about changing the model version without also changing
the rss version and vice versa.

Change-Id: I0c0f0e7036741f0a9a8cabed605ed21984a691fb
Signed-off-by: Jimmy Brisson <jimmy.brisson@arm.com>
diff --git a/model/tc2.sh b/model/tc2.sh
index 588d36c..97ce774 100644
--- a/model/tc2.sh
+++ b/model/tc2.sh
@@ -5,7 +5,7 @@
 # SPDX-License-Identifier: BSD-3-Clause
 #
 
-set_model_path "$warehouse/SysGen/SubSystemModels/11.18/28/models/$model_flavour/FVP_TC2"
+set_model_path "$warehouse/SysGen/SubSystemModels/11.20/24/models/$model_flavour/FVP_TC2"
 
 cat <<EOF >"$model_param_file"
 -C css.terminal_uart_ap.start_port=5000
diff --git a/run_config/fvp-linux.tc b/run_config/fvp-linux.tc
index c4109c4..ba469fb 100644
--- a/run_config/fvp-linux.tc
+++ b/run_config/fvp-linux.tc
@@ -84,14 +84,15 @@
 
             inject_bl1() {
                 # Get pre-built rss rom
+                local prebuild_prefix=$tc_prebuilts/tc$plat_variant/$rss_revision
                 if [ ! -f "$archive/rss_rom.bin" ]; then
-                    url="$tc_prebuilts/tc$plat_variant/rss_rom.bin" fetch_file
+                    url="$prebuild_prefix/rss_rom.bin" fetch_file
 		    archive_file "rss_rom.bin"
 		fi
 
 		# Get pre-built rss flash
 		if [ ! -f "$archive/rss_flash.bin" ]; then
-		    url="$tc_prebuilts/tc$plat_variant/rss_flash.bin" fetch_file
+		    url="$prebuild_prefix/rss_flash.bin" fetch_file
 		    archive_file "rss_flash.bin"
 		fi
 
diff --git a/tc_utils.sh b/tc_utils.sh
index b5bbe6c..36194a6 100644
--- a/tc_utils.sh
+++ b/tc_utils.sh
@@ -25,9 +25,10 @@
 rvbaddr_lw=0x1000
 rvbaddr_up=0x0000
 
-# AP bl1 0x00 is mapped to 0x70010000 in RSS memory map
-ap_bl1_flash_load_addr=0x70010000
+# AP bl1 0x00 is mapped to 0x70000000 in RSS memory map
+ap_bl1_flash_load_addr=0x70000000
 ap_bl1_flash_size=0x20000
+rss_revision="199e090f8"
 
 # Hafnium build repo containing Secure hafnium binaries
 spm_secure_out_dir=secure_tc_clang