Corstone-1000 performs PSA ADAC authentication while the device is
in CM. TF-M runtime provisioning then changes the lifecycle state and
resets the platform, which loses the authenticated debug permissions.
Add a Secure Debug build option that skips TF-M runtime provisioning.
This keeps the device in CM and avoids the provisioning reset until a
reset-safe design can preserve DCU_EN across reset and apply it from
BL2.
Update the Secure Debug guide to use Arm Development Studio's built-in
PSA-ADAC manager and obtain test credentials without building the
external SDM library. Document the connection setup and verify that
the system boots after authentication.
Signed-off-by: Ahmed Gomaa <ahmed.gomaa@arm.com>
Select TF-M and its native scripts at version 2.3 for both
Corstone-1000 and Corstone-1000-A320.
Remove 45 obsolete TF-M patches and two obsolete PSA-ADAC patches,
47 in total. Refresh three retained TF-M patches and renumber the
remaining series: 15 TF-M patches and two PSA-ADAC patches.
Drop the Corstone-specific PSA-ADAC revision override to use the
revision pinned by the generic TF-M 2.3 recipe, which includes the
required Corstone-1000 Secure Debug fixes.
Configure Corstone-1000 image signing with the TF-M default non-secure
PSA key ID required by TF-M 2.3 image verification. Without this
metadata, BL2 cannot select the expected built-in verification key.
Update the user guide recipe references to TF-M 2.3.0.
Signed-off-by: Ahmed Gomaa <ahmed.gomaa@arm.com>
TF-M 2.3 packages its image-signing wrapper as the
mcuboot_imagesign_wrapper console command. Add the required native
Python runtime dependencies and install the bundled MCUboot PEM
signing keys in the native sysroot.
Install TF-M's patched MCUboot imgtool package, including its
imgtool.keys Python modules for loading and handling cryptographic
keys. These modules are part of the signing tool implementation,
separate from the PEM signing-key files installed above.
Prefer this patched package through PYTHONPATH because it supports
PSA key IDs and writes them into signed image metadata.
Update tfm_sign_image.bbclass to invoke the console command when
available, retaining wrapper.py as a fallback for older TF-M versions.
Add optional PSA key ID arguments so platforms can provide the
identifier expected by BL2 during image verification.
Signed-off-by: Ahmed Gomaa <ahmed.gomaa@arm.com>
The upcoming 6.1 release is codenamed blacksail, so set that as the
layer compatibility. We can't also claim to be compatible with wrynose
as apart from potential dependency issues, the LICENSE changes mean this
layer will not parse successfully.
Signed-off-by: Ross Burton <ross.burton@arm.com>
The latest kernel produces the following ACPI message on rdn2 and
rdv2:
ACPI: PNP0A08:03: _OSC: platform retains control of PCIe features (AE_ERROR)
This message is benign, but causes the parselogs test in testimage to
fail. Add it to the list of ignored errors for both platforms.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Recent changes to the arm64 kernel defconfig changed CONFIG_E1000E from
built-in to a module. This breaks testimage networking on the SBSA
Reference platform.
testimage provides the target network configuration through the kernel
“ip=” command-line option. The kernel needs the network driver to be
built-in in order to configure the interface from this option during
boot. With e1000e built as a module, the interface is not available at
that point and testimage is unable to establish an SSH connection to the
target.
Set CONFIG_E1000E=y in the sbsa-ref kernel configuration to make the
driver built-in again and restore testimage SSH testing.
Signed-off-by: Jon Mason <jon.mason@arm.com>
GenerateCapsule expects a PEM that contains both the private key and the
matching certificate. The current capsule flow appends the certificate
to PAYLOAD_PRIVATE_KEY_PATH in place, which mutates the deployed key
file and adds another certificate block every time do_image_uefi_capsule
runs.
Prepare per-component signing PEMs under WORKDIR instead and pass those
files to the capsule JSON generator. This keeps the configured private
key unchanged, makes repeated capsule builds idempotent, and provides
GenerateCapsule with the combined key and certificate input it requires.
Rename the helper's primary signing input from --private_keys to
--signing_pems to reflect the actual input format, while keeping
--private_keys as a compatibility alias.
Generating the signing PEMs per component also allows each capsule
payload to use its own private key and matching certificate instead of
relying on a single mutated key file.
Use expr for the signing PEM counter because the BitBake shell parser
does not support arithmetic expansion.
Signed-off-by: Gianluca Andreotti <gianluca.andreotti@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update Corstone-1000 to OP-TEE 4.10.0.
Removed the local 4.9.0 recipes and patches that are included
upstream in 4.10.0.
Tested on the Corstone-1000 Cortex-A35 and Cortex-A320 FVPs.
Signed-off-by: Oscar Belshaw <Oscar.Belshaw@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If anything else in the BSP also wants or needs to add an early TA to
optee, that will conflict with this .bbappend adding its own
EARLY_TA_PATHS="..." argument to EXTRA_OEMAKE.
Instead, add the path to the ftpm TA to the newly introduced
EARLY_TA_PATHS bitbake variable, which the main recipe will use to
produce the make argument.
Passing CFG_EARLY_TA=y explicitly is not needed, as optee-os' build
system sets that automatically if the EARLY_TA_PATHS list is
non-empty.
CFG_CORE_HEAP_SIZE is somewhat harder to make play along nicely with
other .bbappends that might have an opinion on its proper (minimum)
value. For now, keep adding it explicitly to EXTRA_OEMAKE.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If two different .bbappends both try to add an "early TA" by appending
an EARLY_TA_PATHS="..." to EXTRA_OEMAKE, only one of them will
actually take effect.
For example, meta-arm itself has a .bbappend in optee-ftpm which adds
the ftpm TA if optee-ftpm is in MACHINE_FEATURES. If the BSP developer
wants to add another early TA, he has to take that into account and
very carefully ensure to create an EARLY_TA_PATHS="..." argument which
contains both the ftpm value as well as his desired extra TA.
Instead, let the main recipe define a variable which can simply be
appended to in the normal way, and which is used for deriving the
single EARLY_TA_PATHS="" argument in the make command line.
Handle the in-tree TAs similarly.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Makefiles in TF-A have changed since this recipe was last altered,
and our BUILD_LDFLAGS are no longer being respected. This means the built
objects don't have the correct RPATH, so they fail to run if the host
doesn't have libcrypto.so.4 (from OpenSSL 4) installed.
Pass all of our BUILD_* flags via HOSTCC*, and delete the now redundant
sed operations.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The cert_create tool uses the OpenSSL engine API, which has been removed
from OpenSSL 4. Enable the engine stubs to fix the build until this is
resolved upstream.
Also shoe-horn BUILD_CFLAGS into cert_create/Makefile, so the define is
passed to the build.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
u-boot/lib/rsa/rsa-sign.c uses the OpenSSL engine API, but this has been
removed from OpenSSL 4. Patches are being worked on upstream and the
recipe in oe-core has those patches, but for ease we can simply enable
the stub API to fix the build until this old recipe is removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
gen-sbkeys creates and installs the secure boot signing keys, certificates,
and database used by U-Boot and systemd-boot. Both recipes require these
files during do_compile, but there was no dependency ensuring that
gen-sbkeys:do_install completed first.
Add an explicit do_compile dependency on gen-sbkeys:do_install for both
U-Boot and systemd-boot to prevent the race, which was causing intermittent
CI failures.
The uki.bbclass also requires the secure boot keys and certificates, but
depends on systemd-boot:do_deploy, which ensures the keys are available before
they are needed.
Issues being tracked in meta-secure-core
https://github.com/Wind-River/meta-secure-core/issues/145https://github.com/Wind-River/meta-secure-core/issues/146
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make the COMPATIBLE_HOST in fvp-common.inc be both x86 and arm64, since
that is the large majority of the FVPs available.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the fvp-base model recipe to version 11.32.19.
The new release changes the package layout and installation process,
requiring updates to the license checksums, source checksums, install
procedure, and FVP binary linking.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Replace the incomplete Arm Development Studio steps with the configuration database and hardware connection flow.
Initialize the required submodules and document that the Secure Debug Manager library must be built before importing the configuration.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Replace manual partial and rollback capsule generation with a kas
shell command
- Remove incorrect MPS3 capsule transfer instructions
- Fix broken MPS3 section header
- Update incorrect capsule amount in instructions
Shortens documentation and improves clarity in capsule generation,
making it easier to see how the partial and rollback capsules differ.
Also correct the capsule count in the test setup instructions.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Juno firmware recipe currently depends on the
juno-latest-oe-uboot.zip archive hosted on Linaro. That archive is no
longer available, making the recipe impossible to build from scratch.
Replace the archive dependency with the individual firmware files
required to recreate the original directory layout. The recipe now
assembles the firmware tree during do_install(), generating the small
board-specific differences where appropriate.
The original archive contained duplicate copies of mbb_v151.ebf,
io_b118.bit, and tapid.arm under the HBI0262B/C/D directories. The only
meaningful differences between those directories are the PMS firmware
filename and references to it, so the recipe generates the board-specific
files with sed rather than storing duplicate copies.
Similarly, the SITE1 images.txt files only differ in the referenced DTB,
so those are generated from a common template.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Extract the full list of licenses from third_party_licenses.txt.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Part of the GCC license is -only, not -or-later. Thanks to Denys
Dmytriyenko and Joshua Watt for their diligent review.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
openembedded-core now parses the LICENSE field as a SPDX license
expression[1], so convert the license statements.
This is mostly replacing "&" with "AND", but we can also use "WITH" in
the GCC recipes.
[1] oe-core e9d424738d6 ("classes/conf/lib: Parse LICENSE as SPDX Expression")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-ftpm tagged the 4.10 release, but had no functional changes (that
is, they tagged the same commit of 4.9.0 with 4.10.0). Update the
recipe name to match the latest version, and not have people think that
one package was held back.
Also, modify the version checking to be less incorrect
Signed-off-by: Jon Mason <jon.mason@arm.com>
The source tree is question is not tagged or branched with any version.
Update to the latest commit, change the recipe name to denote it is
'git' and not versioned, and fix the upgrade-status. Also, update the
git URL.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The source tree is question is not tagged or branched with any version.
Update to the latest commit, change the recipe name to denote it is
'git' and not versioned, and fix the upgrade-status. Also, update the
git URL.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the recipes to the newest release. Also, Arm Binary Toolchains
have moved to https://gitlab.arm.com/tooling/gnu-toolchains-for-arm
The new location has a new layout, which means the upstream version
check needs to change. Unfortunately, they are not using tags, but do
seem to use branch names like a tag. So, using that for the version
check.
Signed-off-by: Jon Mason <jon.mason@arm.com>
CI is seeing intermittent boot test timeout errors, where the FVP is
almost to shell but times out before getting there. To get around this,
lengthen the timeout to allow for more opportunity to complete
successfully.
By default, the timeout is 600 seconds. Increase this by 50% to 900.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 A320 FVP CI matrix to run testimage jobs.
This enables testimage coverage for both the firmware-only and no-firmware
entries.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 with Cortex-A320 FVP recipe to use the
11.31.cs1000_a320_2 release from Arm Developer.
Switch the source URL to the new package layout, add the architecture-specific
download tokens, and update the x86_64 and aarch64 SHA256 checksums.
The new package extracts directly into the FVP install directory, so update the
install step and license paths accordingly.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 with Cortex-A320 changelog, release notes,
user guide, tests documentation and metadata for the 2026.05 release.
Add the new 2026.05 changelog entry for the Corstone-1000 with
Cortex-A320 specific updates and align the component version tables and
Yocto distribution component versions with the current release content.
Refresh the user guide and tests documentation to align with the
2026.05 release state, including release tag references, recipe version
references, report links
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 changelog, release notes and user guide for
the 2026.05 wrynose release.
Add the new 2026.05 changelog entry and capture the main release work,
including the component upgrades, TF-M GPT and PSA FWU changes, and the
updated SSH-enabled build flow.
Refresh the component version tables and Yocto distribution component
versions in changelog for the new release.
Update the user guide to align with the 2026.05 release branch and
documentation state, including the Yocto release name, recipe version
references, release tag references, and related asset and report links.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
u-boot v2026.04 changed to kbuild 6.1, which broke how ubootefi.var is
used. Apply patch from u-boot mailing list to address the issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the recipes to 4.10.0 and update the git recipes to 4.10.0
Since corstone1000 is still using 4.9.0, move that to meta-arm-bsp
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update edk2-firmware to the latest release.
Of note, GCC5 make variable has been removed. Use the GCC make variable
instead. Also, these changes caused the need to modify the sbsa-acs
patches.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The policy in meta-arm is to only have the latest version and the
latest LTS version. Remove all of the older LTS versions to comply with
this policy.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for the newest release of TF-A.
mnedtls was made a git submodule, and moved location. Given that this
will be the location going forward, I thought it best to change inc file
to point by default to the new location, and have the LTS versions to
point to the old location in their recipes.
Also, seeing some weird behavior with CPUs not coming on line in
sbsa-ref and qemuarm-secureboot. So, pinning those back to the LTS
until they can be sorted out.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Place psa-arch-tests under ${S}/ts-external/psatest and update the
recipe paths to match.
This keeps the external source layout aligned with trusted-services,
updates the Corstone-1000 patch locations, and lets devtool modify work
against the same psa-arch-tests tree that CMake and
apply_local_src_patches use.
Signed-off-by: Arthur Cassegrain <arthur.cassegrain@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Ahmed Gomaa
Ross Burton
Harsimran Singh Tungal
Jon Mason
Gianluca Andreotti
Oscar Belshaw
Rasmus Villemoes
Jaipaul Cheernam
Alex Chapman
Arthur Cassegrain