arm/trusted-services: Update TS to v1.0.0

- Update Trusted Services to v1.0.0.
- Update TS "external components" references to fetch the version
  dictated by the TS repo.
- Remove patches merged up-stream.
- Update the TS nanopb integration fix (see 210a6ace83)
- Update TS test integration.

Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

documentation/trusted-services.md

@@ -22,7 +22,7 @@ features for each [Secure Partition][^2] you would like to include:
 | Protected Storage | ts-storage      |
 | se-proxy          | ts-se-proxy     |
 | smm-gateway       | ts-smm-gateway  |
-| spm-test[1-3]     | optee-spmc-test |
+| spm-test[1-4]     | optee-spmc-test |
 
 Other steps depend on your machine/platform definition:
 

meta-arm/lib/oeqa/runtime/cases/trusted_services.py

@@ -28,9 +28,7 @@ class TrustedServicesTest(OERuntimeTestCase):
     @OEHasPackage(['ts-psa-crypto-api-test'])
     @OETestDepends(['ssh.SSHTest.test_ssh'])
     def test_03_psa_crypto_api_test(self):
-        # There are a two expected PSA Crypto tests failures testing features
+        self.run_test_tool('psa-crypto-api-test')
-        # TS will not support.
-        self.run_test_tool('psa-crypto-api-test', expected_status=46)
 
     @OEHasPackage(['ts-psa-its-api-test'])
     @OETestDepends(['ssh.SSHTest.test_ssh'])
@@ -53,13 +51,12 @@ class TrustedServicesTest(OERuntimeTestCase):
     def test_09_ts_service_grp_check(self):
         # If this test fails, available test groups in ts-service-test have changed and all
         # tests using the test executable need to be double checked to ensure test group to
-        # TS SP mapping is still valid. 
+        # TS SP mapping is still valid.
         test_grp_list="FwuServiceTests PsServiceTests ItsServiceTests AttestationProvisioningTests"
         test_grp_list+=" AttestationServiceTests CryptoKeyDerivationServicePackedcTests"
         test_grp_list+=" CryptoMacServicePackedcTests CryptoCipherServicePackedcTests"
         test_grp_list+=" CryptoHashServicePackedcTests CryptoServicePackedcTests"
         test_grp_list+=" CryptoServiceProtobufTests CryptoServiceLimitTests"
-        test_grp_list+=" DiscoveryServiceTests"
         self.run_test_tool('ts-service-test -lg', expected_output=test_grp_list)
 
     @OEHasPackage(['optee-test'])
@@ -110,11 +107,3 @@ class TrustedServicesTest(OERuntimeTestCase):
                     "CryptoCipherServicePackedcTests", "CryptoHashServicePackedcTests", \
                     "CryptoServicePackedcTests", "CryptoServiceProtobufTests CryptoServiceLimitTests"]:
             self.run_test_tool('ts-service-test -g %s'%grp)
-
-    @OEHasPackage(['ts-service-test'])
-    @OETestDepends(['ssh.SSHTest.test_ssh'])
-    def test_16_discovery_service_test(self):
-        if 'ts-crypto' not in self.tc.td['MACHINE_FEATURES'] and \
-           'ts-se-proxy' not in self.tc.td['MACHINE_FEATURES']:
-            self.skipTest('Crypto SP is not included into OPTEE')
-        self.run_test_tool('ts-service-test -g DiscoveryServiceTests')

meta-arm/recipes-security/optee/optee-os-ts.inc

@@ -53,9 +53,14 @@ SP_PATHS:append = "${@bb.utils.contains('MACHINE_FEATURES', 'ts-smm-gateway', \
 
 # SPM test SPs
 DEPENDS:append  = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \
-                                        ' ts-sp-spm-test1 ts-sp-spm-test2 ts-sp-spm-test3', '' , d)}"
+                                        ' ts-sp-spm-test1 ts-sp-spm-test2 \
+                                          ts-sp-spm-test3 ts-sp-spm-test4', '' , d)}"
 SP_PATHS:append = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \
-                                        ' ${TS_BIN}/${SPM_TEST1_UUID}.stripped.elf ${TS_BIN}/${SPM_TEST2_UUID}.stripped.elf ${TS_BIN}/${SPM_TEST3_UUID}.stripped.elf', '', d)}"
+                            ' ${TS_BIN}/${SPM_TEST1_UUID}.stripped.elf \
+                              ${TS_BIN}/${SPM_TEST2_UUID}.stripped.elf \
+                              ${TS_BIN}/${SPM_TEST3_UUID}.stripped.elf \
+                              ${TS_BIN}/${SPM_TEST4_UUID}.stripped.elf', \
+                              '', d)}"
 EXTRA_OEMAKE:append = "${@bb.utils.contains('MACHINE_FEATURES', 'optee-spmc-test', \
                                         ' CFG_SPMC_TESTS=y', '' , d)}"
 
@@ -66,4 +71,6 @@ DEPENDS:append  = "${@bb.utils.contains('MACHINE_FEATURES', 'ts-block-storage',
 SP_PATHS:append = "${@bb.utils.contains('MACHINE_FEATURES', 'ts-block-storage', \
                                         ' ${TS_BIN}/${BLOCK_STORAGE_UUID}.stripped.elf', '', d)}"
 
-EXTRA_OEMAKE:append = "${@oe.utils.conditional('SP_PATHS', '', '', ' CFG_MAP_EXT_DT_SECURE=y CFG_SECURE_PARTITION=y SP_PATHS="${SP_PATHS}" ', d)}"
+EXTRA_OEMAKE:append = "${@oe.utils.conditional('SP_PATHS', '', '', \
+                        ' CFG_MAP_EXT_DT_SECURE=y CFG_SECURE_PARTITION=y \
+                         SP_PATHS="${SP_PATHS}" ', d)}"

meta-arm/recipes-security/trusted-services/files/0001-LazyFetch-allow-setting-the-cmake-generator.patch

@@ -1,46 +0,0 @@
-From e62709f8e6f586ace7975b58b8a1c726d120759f Mon Sep 17 00:00:00 2001
-From: Gyorgy Szing <Gyorgy.Szing@arm.com>
-Date: Thu, 31 Aug 2023 18:24:50 +0200
-Subject: [PATCH] LazyFetch: allow setting the cmake generator
-
-Allow configuring the CMake generator used for external components. By
-default use the generator the main project is using.
-For details see the documentation in tools/cmake/common/LazyFetch.cmake.
-
-Change-Id: Ie01ea1ae533cf7a40c1f09808de2ad2e83a09db3
-Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
-
-Upstream-Status: Backport
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- tools/cmake/common/LazyFetch.cmake | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/tools/cmake/common/LazyFetch.cmake b/tools/cmake/common/LazyFetch.cmake
-index 68e790e..7676201 100644
---- a/tools/cmake/common/LazyFetch.cmake
-+++ b/tools/cmake/common/LazyFetch.cmake
-@@ -87,11 +87,20 @@ function(LazyFetch_ConfigAndBuild)
- 							"component specific. Pleas refer to the upstream documentation for more information.")
- 	endif()
- 
-+	if(NOT DEFINED ${UC_DEP_NAME}_GENERATOR)
-+		if(DEFINED ENV{${UC_DEP_NAME}_GENERATOR})
-+			set(${UC_DEP_NAME}_GENERATOR ENV{${UC_DEP_NAME}_GENERATOR} CACHE STRING "CMake generator used for ${UC_DEP_NAME}.")
-+		else()
-+			set(${UC_DEP_NAME}_GENERATOR ${CMAKE_GENERATOR} CACHE STRING "CMake generator used for ${UC_DEP_NAME}.")
-+		endif()
-+	endif()
-+
- 	execute_process(COMMAND
- 		${CMAKE_COMMAND} -E env "CROSS_COMPILE=${CROSS_COMPILE}"
- 		${CMAKE_COMMAND}
- 			"-C${CONFIGURED_CACHE_FILE}"
- 			-DCMAKE_BUILD_TYPE=${${UC_DEP_NAME}_BUILD_TYPE}
-+			-G${${UC_DEP_NAME}_GENERATOR}
- 			-S ${BUILD_SRC_DIR}
- 			-B ${BUILD_BIN_DIR}
- 		RESULT_VARIABLE
--- 
-2.34.1
-

meta-arm/recipes-security/trusted-services/files/0001-Limit-nanopb-build-to-single-process.patch

@@ -1,41 +0,0 @@
-From aca9f9ae26235e9da2bc9adef49f9f5578f3e1e7 Mon Sep 17 00:00:00 2001
-From: Gyorgy Szing <Gyorgy.Szing@arm.com>
-Date: Tue, 25 Apr 2023 15:03:46 +0000
-Subject: [PATCH 1/1] Limit nanopb build to single process
-
-Sometimes in yocto the nanopb build step fails. The reason seems
-to be a race condition. This fix disables parallel build as
-a workaround.
-
-Upstream-Status: Inappropriate [yocto specific]
-
-Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
----
- external/nanopb/nanopb.cmake | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/external/nanopb/nanopb.cmake b/external/nanopb/nanopb.cmake
-index 36465f61..94f8048c 100644
---- a/external/nanopb/nanopb.cmake
-+++ b/external/nanopb/nanopb.cmake
-@@ -65,6 +65,8 @@ if(TARGET stdlib::c)
- 	unset_saved_properties(LIBC)
- endif()
- 
-+set(_PROCESSOR_COUNT ${PROCESSOR_COUNT})
-+set(PROCESSOR_COUNT 1)
- include(${TS_ROOT}/tools/cmake/common/LazyFetch.cmake REQUIRED)
- LazyFetch_MakeAvailable(DEP_NAME nanopb
- 	FETCH_OPTIONS ${GIT_OPTIONS}
-@@ -73,6 +75,8 @@ LazyFetch_MakeAvailable(DEP_NAME nanopb
- 	CACHE_FILE "${TS_ROOT}/external/nanopb/nanopb-init-cache.cmake.in"
- 	SOURCE_DIR "${NANOPB_SOURCE_DIR}"
-   )
-+set(PROCESSOR_COUNT ${_PROCESSOR_COUNT})
-+
- unset(_cmake_fragment)
- 
- if(TARGET stdlib::c)
--- 
-2.34.1
-

meta-arm/recipes-security/trusted-services/files/0001-Upgrade-nanopb-to-v0.4.7.patch

@@ -1,26 +1,33 @@
-From 35d16cdfd51aeca5df70732accc89e250af86b69 Mon Sep 17 00:00:00 2001
+From f3ba58b00ec967970d22dfbd71c406ccb5b2ac78 Mon Sep 17 00:00:00 2001
 From: Ross Burton <ross.burton@arm.com>
 Date: Fri, 29 Sep 2023 16:21:26 +0100
-Subject: [PATCH] Upgrade nanopb
+Subject: [PATCH 1/1] Upgrade nanopb to v4.7.0
 
-Upgrade the nanopb checkout to 0.4.7 plus some important build fixes, and
+Upgrade the nanopb to 0.4.7 and add the following fixes:
-change the build/install process to be more reliable.
+  - remove the nanopb patch as it has become obsolete.
-
+  - stop using the nanopb protoc wrapper when building the generator as
-This should be upstreamed, but some pieces of this are not upstreamable in their
+    this seems to cause build issues.
-current state.
+  - use the new nanopb_PYTHON_INSTDIR_OVERRIDE variable to set the
+    install location for the generator. Modify TS cmake script to search
+    the generator in the install content instead of the nanopb source.
+  - pass discovered python settings to nanopb build using the initial
+    cache. This speeds up the build and allows easier control of python
+    discovery for integration systems.
 
 Upstream-Status: Pending
+
 Signed-off-by: Ross Burton <ross.burton@arm.com>
+Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
 ---
  external/nanopb/fix-pyhon-name.patch       | 41 ----------------------
- external/nanopb/nanopb-init-cache.cmake.in |  6 +++-
+ external/nanopb/nanopb-init-cache.cmake.in |  9 ++++-
- external/nanopb/nanopb.cmake               |  7 ++--
+ external/nanopb/nanopb.cmake               | 34 +++++++++---------
- 3 files changed, 8 insertions(+), 46 deletions(-)
+ 3 files changed, 24 insertions(+), 60 deletions(-)
  delete mode 100644 external/nanopb/fix-pyhon-name.patch
 
 diff --git a/external/nanopb/fix-pyhon-name.patch b/external/nanopb/fix-pyhon-name.patch
 deleted file mode 100644
-index ab0e84c550f4..000000000000
+index ab0e84c5..00000000
 --- a/external/nanopb/fix-pyhon-name.patch
 +++ /dev/null
 @@ -1,41 +0,0 @@
@@ -66,15 +73,16 @@ index ab0e84c550f4..000000000000
 -     endforeach()
 - endif()
 diff --git a/external/nanopb/nanopb-init-cache.cmake.in b/external/nanopb/nanopb-init-cache.cmake.in
-index fb8104d64b26..8df41ddcb5eb 100644
+index fb8104d6..c53b6e5b 100644
 --- a/external/nanopb/nanopb-init-cache.cmake.in
 +++ b/external/nanopb/nanopb-init-cache.cmake.in
-@@ -12,11 +12,15 @@ set(BUILD_STATIC_LIBS On CACHE BOOL "")
+@@ -12,11 +12,18 @@ set(BUILD_STATIC_LIBS On CACHE BOOL "")
  set(nanopb_BUILD_RUNTIME On CACHE BOOL "")
  set(nanopb_BUILD_GENERATOR On CACHE BOOL "")
  set(nanopb_MSVC_STATIC_RUNTIME Off BOOL "")
 -set(nanopb_PROTOC_PATH ${CMAKE_SOURCE_DIR}/generator/protoc CACHE STRING "")
 +
++# Specify location of python binary and avoid discovery.
 +set(Python_EXECUTABLE "@Python_EXECUTABLE@" CACHE PATH "Location of python3 executable")
  
  string(TOUPPER @CMAKE_CROSSCOMPILING@ CMAKE_CROSSCOMPILING) # CMake expects TRUE
@@ -82,15 +90,42 @@ index fb8104d64b26..8df41ddcb5eb 100644
  	set(CMAKE_TRY_COMPILE_TARGET_TYPE STATIC_LIBRARY CACHE STRING "")
  endif()
  
++# Override the install directory of the generator. TS will first look at
++# NEWLIB_INSTALL_DIR (aka. BUILD_INSTALL_DIR), then let cmake do system specific
++# search.
 +set(nanopb_PYTHON_INSTDIR_OVERRIDE "@BUILD_INSTALL_DIR@/lib/python" CACHE PATH "")
-+set(NANOPB_GENERATOR_DIR "@BUILD_INSTALL_DIR@/lib/python" CACHE PATH "")
 +
  @_cmake_fragment@
 diff --git a/external/nanopb/nanopb.cmake b/external/nanopb/nanopb.cmake
-index 36465f612d5d..57cf3d697fdd 100644
+index 36465f61..fa35d971 100644
 --- a/external/nanopb/nanopb.cmake
 +++ b/external/nanopb/nanopb.cmake
-@@ -28,7 +28,7 @@ running this module.
+@@ -10,17 +10,14 @@ NanoPB integration for cmake
+ ----------------------------
+ 
+ This module will:
+-	- download nanopb if not available locally
+-	- build the runtime static library and the generator
+-	- import the static library to the build
+-	- define a function to provide access to the generator
++	- use LazyFetch to download nanopb and build the static library and the generator.
++	  Usual LazyFetch configuration to use prefetched source or prebuilt binaries apply.
++	- run find_module() to import the static library
++	- run find_executable() import the generator to the build (extend PYTHONPATH) and
++	  define a cmake function to provide access to the generator to build nanopb files.
+ 
+-Note: the python module created by the generator build will be installed under
+-Python_SITELIB ("Third-party platform independent installation directory.")
+-This means the build may alter the state of your system. Please use virtualenv.
+-
+-Note: see requirements.txt for dependencies which need to be installed before
+-running this module.
++Note: see requirements.txt for dependencies which need to be installed in the build
++environment to use this module.
+ 
+ #]===]
+ 
+@@ -28,7 +25,7 @@ running this module.
  
  set(NANOPB_URL "https://github.com/nanopb/nanopb.git"
  		CACHE STRING "nanopb repository URL")
@@ -99,16 +134,34 @@ index 36465f612d5d..57cf3d697fdd 100644
  		CACHE STRING "nanopb git refspec")
  set(NANOPB_SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/nanopb-src"
  		CACHE PATH "nanopb source-code")
-@@ -85,7 +85,7 @@ find_package(Python3 REQUIRED COMPONENTS Interpreter)
+@@ -65,6 +62,11 @@ if(TARGET stdlib::c)
+ 	unset_saved_properties(LIBC)
+ endif()
  
- find_file(NANOPB_GENERATOR_PATH
++# Nanopb build depends on python. Discover python here and pass the result to
++# nanopb build trough the initial cache file.
++find_package(Python3 REQUIRED COMPONENTS Interpreter)
++
++# Use LazyFetch to manage the external dependency.
+ include(${TS_ROOT}/tools/cmake/common/LazyFetch.cmake REQUIRED)
+ LazyFetch_MakeAvailable(DEP_NAME nanopb
+ 	FETCH_OPTIONS ${GIT_OPTIONS}
+@@ -80,12 +82,9 @@ if(TARGET stdlib::c)
+ endif()
+ 
+ #### Build access to the protobuf compiler
+-#TODO: verify protoc dependencies: python3-protobuf
+-find_package(Python3 REQUIRED COMPONENTS Interpreter)
+-
+-find_file(NANOPB_GENERATOR_PATH
++find_program(NANOPB_GENERATOR_PATH
  			NAMES nanopb_generator.py
 -			PATHS ${nanopb_SOURCE_DIR}/generator
-+			PATHS ${NANOPB_INSTALL_DIR}/bin
++			HINTS ${NANOPB_INSTALL_DIR}/bin ${NANOPB_INSTALL_DIR}/sbin
  			DOC "nanopb protobuf compiler"
  			NO_DEFAULT_PATH
  		)
-@@ -186,11 +186,10 @@ function(protobuf_generate)
+@@ -186,11 +185,10 @@ function(protobuf_generate)
  		target_include_directories(${PARAMS_TGT} PRIVATE ${_OUT_DIR_BASE})
  	endif()
  
@@ -121,3 +174,6 @@ index 36465f612d5d..57cf3d697fdd 100644
  					   ${Python3_EXECUTABLE} ${NANOPB_GENERATOR_PATH}
  						  -I ${PARAMS_BASE_DIR}
  						  -D ${_OUT_DIR_BASE}
+-- 
+2.34.1
+

meta-arm/recipes-security/trusted-services/trusted-services-src.inc

@@ -8,13 +8,12 @@ SRC_URI = "git://git.trustedfirmware.org/TS/trusted-services.git;protocol=https;
 FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
 
 SRC_URI:append = "\
-	file://0001-Limit-nanopb-build-to-single-process.patch \
+	file://0001-Upgrade-nanopb-to-v0.4.7.patch \
-	file://0001-LazyFetch-allow-setting-the-cmake-generator.patch \
+    file://0001-Add-boot-order-property-to-SP-manifests.patch \
-	file://nanopb-upgrade.patch \
 "
 
-#Latest on 2023 April 28
+# Trusted Services; Tag: v1.0.0
-SRCREV_trusted-services = "08b3d39471f4914186bd23793dc920e83b0e3197"
+SRCREV_trusted-services = "808904390eb89294d2371959a7d82dde3851ca6c"
 LIC_FILES_CHKSUM = "file://${S}/license.rst;md5=ea160bac7f690a069c608516b17997f4"
 
 S = "${WORKDIR}/git/trusted-services"
@@ -25,9 +24,9 @@ SRC_URI += "git://github.com/dgibson/dtc;name=dtc;protocol=https;branch=main;des
 SRCREV_dtc = "b6910bec11614980a21e46fbccc35934b671bd81"
 LIC_FILES_CHKSUM += "file://../dtc/README.license;md5=a1eb22e37f09df5b5511b8a278992d0e"
 
-# MbedTLS, tag "mbedtls-3.3.0"
+# MbedTLS, tag "mbedtls-3.4.0"
 SRC_URI += "git://github.com/ARMmbed/mbedtls.git;name=mbedtls;protocol=https;branch=master;destsuffix=git/mbedtls"
-SRCREV_mbedtls = "8c89224991adff88d53cd380f42a2baa36f91454"
+SRCREV_mbedtls = "1873d3bfc2da771672bd8e7e8f41f57e0af77f33"
 LIC_FILES_CHKSUM += "file://../mbedtls/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 # Nanopb, tag "nanopb-0.4.7" plus some further fixes
@@ -74,6 +73,11 @@ do_apply_local_src_patches() {
     apply_local_src_patches ${S}/external/nanopb ${WORKDIR}/git/nanopb
 }
 
+do_config:append:() {
+    # Fine tune MbedTLS configuration for crypto only operation.
+    sh -c "cd ${WORKDIR}/git/mbedtls; python3 scripts/config.py crypto"
+}
+
 # Paths to dependencies required by some TS SPs/tools
 EXTRA_OECMAKE += "-DDTC_SOURCE_DIR=${WORKDIR}/git/dtc \
                   -DCPPUTEST_SOURCE_DIR=${WORKDIR}/git/cpputest \

meta-arm/recipes-security/trusted-services/trusted-services.inc

@@ -32,7 +32,6 @@ OECMAKE_EXTRA_ROOT_PATH = "${WORKDIR}/git/ ${WORKDIR}/build/"
 
 EXTRA_OECMAKE += '-DLIBGCC_LOCATE_CFLAGS="--sysroot=${STAGING_DIR_HOST}" \
                   -DCROSS_COMPILE="${TARGET_PREFIX}" \
-                  -DSP_PACKAGING_METHOD="${SP_PACKAGING_METHOD}" \
                   -DTS_PLATFORM="${TS_PLATFORM}" \
                  '
 export CROSS_COMPILE="${TARGET_PREFIX}"
@@ -40,13 +39,18 @@ export CROSS_COMPILE="${TARGET_PREFIX}"
 # Default TS installation path
 TS_INSTALL = "/usr/${TS_ENV}"
 
-# Use the Yocto cmake toolchain for arm-linux TS deployments and
+# Use the Yocto cmake toolchain for external components of the arm-linux TS deployments,
-# the TS opteesp toolchain for opteesp TS deployments
+# and the TS toolchain for opteesp and sp deployments
-EXTRA_OECMAKE += "${@oe.utils.conditional('TS_ENV', 'opteesp', \
+def get_ts_toolchain_option(d):
-                    '-DCMAKE_TOOLCHAIN_FILE=${S}/environments/${TS_ENV}/default_toolchain_file.cmake', \
+    ts_env=d.getVar('TS_ENV')
-                    '-DTS_EXTERNAL_LIB_TOOLCHAIN_FILE=${WORKDIR}/toolchain.cmake', \
+    if ts_env == 'opteesp' or ts_env == 'sp':
-                    d)} \
+        return '-DCMAKE_TOOLCHAIN_FILE=${S}/environments/'+ts_env+'/default_toolchain_file.cmake'
-                 "
+    if ts_env == 'arm-linux':
+        return '-DTS_EXTERNAL_LIB_TOOLCHAIN_FILE=${WORKDIR}/toolchain.cmake'
+    bb.error("Unkown value \"%s\" for TS_ENV." % (ts_env))
+    return ''
+
+EXTRA_OECMAKE += "${@get_ts_toolchain_option(d)}"
 
 # Paths to pre-built dependencies required by some TS SPs/tools
 EXTRA_OECMAKE += "-Dlibts_ROOT=${STAGING_DIR_HOST}${TS_INSTALL}/lib/cmake/libts/ \

meta-arm/recipes-security/trusted-services/ts-psa-api-test-common_git.inc

@@ -13,7 +13,7 @@ SRC_URI += "git://github.com/ARM-software/psa-arch-tests.git;name=psatest;protoc
             file://0001-Pass-Yocto-build-settings-to-psa-arch-tests-native.patch;patchdir=../psatest \
            "
 
-SRCREV_psatest = "38cb53a4d9e292435ddf7899960b15af62decfbe"
+SRCREV_psatest = "74dc6646ff594e131a726a5305aba77bac30eceb"
 LIC_FILES_CHKSUM += "file://../psatest/LICENSE.md;md5=2a944942e1496af1886903d274dedb13"
 
 EXTRA_OECMAKE += "-DPSA_ARCH_TESTS_SOURCE_DIR=${WORKDIR}/git/psatest"

meta-arm/recipes-security/trusted-services/ts-sp-common.inc

@@ -1,6 +1,6 @@
 # Common part of all Trusted Services SPs recipes
 
-TS_ENV = "opteesp"
+TS_ENV ?= "opteesp"
 
 require trusted-services.inc
 require ts-uuid.inc
@@ -30,3 +30,13 @@ INSANE_SKIP:${PN}-dev += "ldflags"
 
 # Trusted Services SPs do not compile with clang
 TOOLCHAIN = "gcc"
+
+# FORTIFY_SOURCE is a glibc feature. Disable it for all SPs as these do not use glibc.
+TARGET_CFLAGS:remove = "-D_FORTIFY_SOURCE=2"
+OECMAKE_C_FLAGS:remove = "-D_FORTIFY_SOURCE=2"
+OECMAKE_CXX_FLAGS:remove = "-D_FORTIFY_SOURCE=2"
+
+# Override yoctos default linux specific toolchain file. trusted-services.inc
+# will add a proper tooclhain option.
+OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"
+

meta-arm/recipes-security/trusted-services/ts-sp-spm-test4_git.bb

@@ -0,0 +1,6 @@
+DESCRIPTION = "Trusted Services SPMC test SP4"
+
+SP_INDEX="4"
+
+require ts-sp-spm-test-common.inc
+

meta-arm/recipes-security/trusted-services/ts-uuid.inc

@@ -10,4 +10,5 @@ STORAGE_UUID     = "751bf801-3dde-4768-a514-0f10aeed1790"
 SPM_TEST1_UUID   = "5c9edbc3-7b3a-4367-9f83-7c191ae86a37"
 SPM_TEST2_UUID   = "7817164c-c40c-4d1a-867a-9bb2278cf41a"
 SPM_TEST3_UUID   = "23eb0100-e32a-4497-9052-2f11e584afa6"
+SPM_TEST4_UUID   = "423762ed-7772-406f-99d8-0c27da0abbf8"
 BLOCK_STORAGE_UUID = "63646e80-eb52-462f-ac4f-8cdf3987519c"