trusted-firmware-a: fix build error when using ccache

When ccache is enabled trusted-firmware-a recipe fails with this
error message:

    make: *** No rule to make target 'aarch64-poky-linux-gcc'. Stop.

ccache prefix CC variable with 'ccache' word before compiler. Because
there are no quotes assigned to CC, only 'ccache' is assigned. The
compiler becomes a make target, producing the build error.

Add single quotes to LD is a good measure to prevent this kind of error.

Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>

.gitlab-ci.yml

@@ -1,4 +1,12 @@
-image: ghcr.io/siemens/kas/kas:latest-release
+image: ghcr.io/siemens/kas/kas:3.2
+
+variables:
+  CPU_REQUEST: ""
+  DEFAULT_TAG: ""
+  # These are needed as the k8s executor doesn't respect the container entrypoint
+  # by default
+  FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: 0
+  FF_KUBERNETES_HONOR_ENTRYPOINT: 1
 
 stages:
   - prep
@@ -6,6 +14,8 @@ stages:
 
 # Common job fragment to get a worker ready
 .setup:
+  tags:
+    - $DEFAULT_TAG
   stage: build
   interruptible: true
   variables:
@@ -25,11 +35,14 @@ stages:
     - mkdir --verbose --parents $KAS_WORK_DIR $KAS_REPO_REF_DIR $SSTATE_DIR $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
     # Must do this here, as it's the only way to make sure the toolchain is installed on the same builder
     - ./ci/get-binary-toolchains $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
-    - sudo apt-get update && sudo apt-get install --yes telnet python3-subunit
+    # This can be removed with Kas 3.2
+    - sudo apt-get update && sudo apt-get install --yes python3-subunit
 
 # Generalised fragment to do a Kas build
 .build:
   extends: .setup
+  variables:
+    KUBERNETES_CPU_REQUEST: $CPU_REQUEST
   script:
     - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME")
     - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
@@ -41,6 +54,17 @@ stages:
     paths:
       - $CI_PROJECT_DIR/work/build/tmp/work*/**/temp/log.do_*.*
 
+# Workaround for Zephyr not currectly handling TESTIMAGE_AUTO
+.build_and_test:
+  extends: .setup
+  script:
+    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME")
+    - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
+    - kas build $KASFILES
+    - kas build $KASFILES -c testimage
+    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
+
+
 #
 # Prep stage, update repositories once
 #
@@ -56,7 +80,6 @@ update-repos:
 # Available options for building are
 #  TOOLCHAINS: [gcc, clang, armgcc, external-gccarm]
 #  TCLIBC: [glibc, musl]
-#  FIRMWARE: [uboot, edk2]
 #  VIRT: [none, xen]
 #  TESTING: testimage
 
@@ -124,7 +147,13 @@ juno:
   parallel:
     matrix:
       - TOOLCHAINS: [gcc, clang]
-        FIRMWARE: [uboot, edk2]
+        FIRMWARE: [none, edk2]
+
+microbit-v1:
+  extends: .build_and_test
+  parallel:
+    matrix:
+      - TESTING: testimage-zephyr
 
 musca-b1:
   extends: .build
@@ -138,6 +167,18 @@ n1sdp:
     matrix:
       - TOOLCHAINS: [gcc, armgcc]
 
+qemu-cortex-a53:
+  extends: .build
+
+qemu-cortex-m3:
+  extends: .build_and_test
+  parallel:
+    matrix:
+      - TESTING: testimage-zephyr
+
+qemu-cortex-r5:
+  extends: .build
+
 qemu-generic-arm64:
   extends: .build
   parallel:
@@ -151,31 +192,19 @@ qemuarm64-secureboot:
     matrix:
       - TOOLCHAINS: [gcc, clang]
         TCLIBC: [glibc, musl]
-        TS: [none, trusted-services]
         TESTING: testimage
 
 qemuarm64:
   extends: .build
   parallel:
     matrix:
-      - TOOLCHAINS: [gcc, clang]
-        EFI: [uboot, edk2]
-        TESTING: testimage
       - VIRT: xen
 
-qemuarm-secureboot:
-  extends: .build
-  parallel:
-    matrix:
-      - TOOLCHAINS: [gcc, clang]
-        TESTING: testimage
-
 qemuarm:
   extends: .build
   parallel:
     matrix:
       - TOOLCHAINS: [gcc, clang]
-        EFI: [uboot, edk2]
         TESTING: testimage
       - VIRT: xen
 
@@ -188,6 +217,11 @@ qemuarmv5:
 sgi575:
   extends: .build
 
+tc0:
+  extends: .build
+  tags:
+    - x86_64
+
 tc1:
   extends: .build
   tags:
@@ -228,8 +262,7 @@ pending-updates:
 
 # What percentage of machines in the layer do we build
 machine-coverage:
-  stage: build
-  interruptible: true
+  extends: .setup
   script:
     - ./ci/check-machine-coverage
   coverage: '/Coverage: \d+/'
@@ -242,18 +275,3 @@ metrics:
   script:
     - kas shell --update --force-checkout ci/base.yml --command \
       "$CI_PROJECT_DIR/ci/patchreview $CI_PROJECT_DIR/meta-* --verbose --metrics $CI_PROJECT_DIR/metrics.txt"
-
-documentation:
-  extends: .setup
-  script:
-    - |
-      sudo pip3 install -r meta-arm-bsp/documentation/requirements.txt
-      for CONF in meta-*/documentation/*/conf.py ; do
-        SOURCE_DIR=$(dirname $CONF)
-        MACHINE=$(basename $SOURCE_DIR)
-        sphinx-build -vW $SOURCE_DIR build-docs/$MACHINE
-      done
-      test -d build-docs/
-  artifacts:
-    paths:
-      - build-docs/

ci/armgcc.yml

@@ -3,4 +3,4 @@ header:
 
 local_conf_header:
   cc: |
-    GCCVERSION = "arm-11.3"
+    GCCVERSION = "arm-11.2"

ci/base.yml

@@ -5,7 +5,7 @@ distro: poky
 
 defaults:
   repos:
-    refspec: langdale
+    refspec: kirkstone
 
 repos:
   meta-arm:
@@ -30,9 +30,6 @@ local_conf_header:
     CONF_VERSION = "2"
     BB_NUMBER_THREADS = "16"
     PARALLEL_MAKE = "-j16"
-    XZ_MEMLIMIT = "25%"
-    XZ_THREADS = "16"
-    ZSTD_THREADS = "16"
     LICENSE_FLAGS_ACCEPTED += "Arm-FVP-EULA"
   setup: |
     PACKAGE_CLASSES = "package_ipk"
@@ -41,10 +38,13 @@ local_conf_header:
     PACKAGECONFIG:append:pn-perf = " coresight"
     INHERIT += "rm_work"
     DISTRO_FEATURES:remove = "ptest"
+  kvm: |
+    QEMU_USE_KVM = ""
   perf: |
     CORE_IMAGE_EXTRA_INSTALL += "perf"
-
+  sshkeys: |
+    CORE_IMAGE_EXTRA_INSTALL += "ssh-pregen-hostkeys"
 machine: unset
 
 target:
-  - core-image-sato
+  - core-image-base

ci/clang.yml

@@ -4,7 +4,6 @@ header:
 repos:
   meta-clang:
     url: https://github.com/kraj/meta-clang
-    refspec: master
 
 local_conf_header:
   clang: |

ci/corstone1000-common.yml

@@ -3,13 +3,11 @@ header:
   includes:
     - ci/base.yml
     - ci/meta-openembedded.yml
-
 local_conf_header:
     perf: |
-    # Intentionally blank to prevent perf from being added to the image in base.yml
 
 distro: poky-tiny
 
 target:
-  - corstone1000-image
   - perf
+  - corstone1000-image

ci/corstone500.yml

@@ -8,7 +8,6 @@ local_conf_header:
     INHERIT += "fvpboot"
     IMAGE_FEATURES:remove = " ssh-server-dropbear"
   perf: |
-    # Intentionally blank to prevent perf from being added to the image in base.yml
 
 machine: corstone500
 

ci/edk2.yml

@@ -7,11 +7,3 @@ local_conf_header:
     MACHINE_FEATURES += "efi"
     TFA_UBOOT = "0"
     TFA_UEFI = "1"
-
-    EXTRA_IMAGEDEPENDS += "edk2-firmware"
-    EFI_PROVIDER ?= "grub-efi"
-
-    QB_DEFAULT_BIOS = "QEMU_EFI.fd"
-    WKS_FILE ?= "efi-disk.wks.in"
-  failing_tests: |
-    TEST_SUITES:remove = "xorg"

ci/fvp-base-arm32.yml

@@ -14,5 +14,3 @@ local_conf_header:
     # Tell testimage to connect to localhost:8122, and forward that to SSH in the FVP.
     TEST_TARGET_IP = "127.0.0.1:8122"
     FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] = "8122=22"
-  failing_tests: |
-    TEST_SUITES:remove = "xorg"

ci/fvp-base.yml

@@ -14,5 +14,3 @@ local_conf_header:
     # Tell testimage to connect to localhost:8022, and forward that to SSH in the FVP.
     TEST_TARGET_IP = "localhost:8022"
     FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
-  failing_tests: |
-    TEST_SUITES:remove = "xorg"

ci/fvps.yml

@@ -17,3 +17,4 @@ target:
   - nativesdk-fvp-sgi575
   - nativesdk-fvp-corstone500
   - nativesdk-fvp-corstone1000
+  - nativesdk-fvp-tc0

ci/get-binary-toolchains

@@ -1,8 +1,9 @@
 #!/bin/bash
-set -u
+set -u -e
 
-HOST_ARCH=$(uname -m)
-VER="11.3.rel1"
+BASENAME=gcc-arm
+VER=${VER:-10.3-2021.07}
+HOST_ARCH=${HOST_ARCH:-$(uname -m)}
 
 DOWNLOAD_DIR=$1
 TOOLCHAIN_DIR=$2
@@ -11,36 +12,39 @@ TOOLCHAIN_LINK_DIR=$3
 # These should be already created by .gitlab-ci.yml, but do here if run outside of that env
 mkdir -p $DOWNLOAD_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
 
+download() {
+	TRIPLE=$1
+	URL=https://developer.arm.com/-/media/Files/downloads/gnu-a/$VER/binrel/$BASENAME-$VER-$HOST_ARCH-$TRIPLE.tar.xz
+	wget -P $DOWNLOAD_DIR -nc $URL
+}
+
 if [ $HOST_ARCH = "aarch64" ]; then
-	#AArch64 Linux hosted cross compilers
+	# AArch64 Linux hosted cross compilers
 
-	#AArch32 target with hard float (arm-none-linux-gnueabihf)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-arm-none-linux-gnueabihf.tar.xz
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf
 elif [ $HOST_ARCH = "x86_64" ]; then
-	#x86_64 Linux hosted cross compilers
+	# x86_64 Linux hosted cross compilers
 
-	#AArch32 target with hard float (arm-linux-none-gnueabihf)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-arm-none-linux-gnueabihf.tar.xz
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf
 
-	#AArch64 GNU/Linux target (aarch64-none-linux-gnu)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-aarch64-none-linux-gnu.tar.xz
-
-	#AArch64 GNU/Linux target (aarch64_be-none-linux-gnu)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-aarch64_be-none-linux-gnu.tar.xz
+	# AArch64 GNU/Linux target
+	download aarch64-none-linux-gnu
 else
 	echo "ERROR - Unknown build arch of $HOST_ARCH"
 	exit 1
 fi
 
-for i in arm aarch64 aarch64_be; do
-	if [ ! -d $TOOLCHAIN_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
-		if [ ! -f $DOWNLOAD_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
+for i in arm aarch64; do
+	if [ ! -d $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
+		if [ ! -f $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
 			continue
 		fi
 
-		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
+		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
 	fi
 
 	# Setup a link for the toolchain to use local to the building machine (e.g., not in a shared location)
-	ln -s $TOOLCHAIN_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
+	ln -s $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
 done

ci/jobs-to-kas

@@ -18,7 +18,7 @@ for i in $(echo $1 | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
 	# defaults, we can simply ignore those parameters.  They are necessary
 	# to pass in so that matrix can correctly setup all of the permutations
 	# of each individual run.
-	if [[ $i == 'none' || $i == 'gcc' || $i == 'glibc' || $i == 'uboot' ]]; then
+	if [[ $i == 'none' || $i == 'gcc' || $i == 'glibc' ]]; then
 		continue
 	fi
 	FILES+=":ci/$i.yml"

ci/meta-openembedded.yml

@@ -4,7 +4,6 @@ header:
 repos:
   meta-openembedded:
     url: https://git.openembedded.org/meta-openembedded
-    refspec: master
     layers:
       meta-filesystems:
       meta-networking:

ci/meta-zephyr.yml

@@ -0,0 +1,13 @@
+header:
+  version: 11
+  includes:
+    - ci/meta-openembedded.yml
+
+repos:
+  meta-zephyr:
+    url: https://git.yoctoproject.org/git/meta-zephyr
+    layers:
+      meta-zephyr-core:
+
+target:
+  - zephyr-kernel-test-all

ci/microbit-v1.yml

@@ -0,0 +1,7 @@
+header:
+  version: 11
+  includes:
+    - ci/base.yml
+    - ci/meta-zephyr.yml
+
+machine: microbit-v1

ci/musca-b1.yml

@@ -2,9 +2,14 @@ header:
   version: 11
   includes:
     - ci/base.yml
-    - ci/meta-openembedded.yml
+    - ci/meta-zephyr.yml
+
+local_conf_header:
+  nonbuilding_tests: |
+    ZEPHYRTESTS:remove = "common sleep poll device queue"
 
 machine: musca-b1
 
 target:
   - trusted-firmware-m
+  - zephyr-kernel-test-all

ci/musca-s1.yml

@@ -2,9 +2,14 @@ header:
   version: 11
   includes:
     - ci/base.yml
-    - ci/meta-openembedded.yml
+    - ci/meta-zephyr.yml
+
+local_conf_header:
+  nonbuilding_tests: |
+    ZEPHYRTESTS:remove = "common sleep poll device queue"
 
 machine: musca-s1
 
 target:
   - trusted-firmware-m
+  - zephyr-kernel-test-all

ci/qemu-cortex-a53.yml

@@ -0,0 +1,9 @@
+header:
+  version: 11
+  includes:
+    - ci/base.yml
+    - ci/meta-zephyr.yml
+
+# FIXME - testimage fails all tests currently, but all the tests build
+
+machine: qemu-cortex-a53

ci/qemu-cortex-m3.yml

@@ -0,0 +1,20 @@
+header:
+  version: 11
+  includes:
+    - ci/base.yml
+    - ci/meta-zephyr.yml
+
+repos:
+  meta-zephyr:
+    layers:
+      meta-zephyr-bsp:
+
+local_conf_header:
+  tclibc: |
+    TCLIBC = "newlib"
+  nonbuilding_tests: |
+    ZEPHYRTESTS:remove = "context pending poll sleep"
+  qemu_opts: |
+    QB_OPT_APPEND = "-icount shift=3,align=off,sleep=on -rtc clock=vm"
+
+machine: qemu-cortex-m3

ci/qemu-cortex-r5.yml

@@ -0,0 +1,11 @@
+header:
+  version: 11
+  includes:
+    - ci/base.yml
+    - ci/meta-zephyr.yml
+
+local_conf_header:
+  nonbuilding_tests: |
+    ZEPHYRTESTS:remove = "common poll sleep queue device"
+
+machine: qemu-cortex-r5

ci/qemu-generic-arm64.yml

@@ -10,5 +10,5 @@ local_conf_header:
 machine: qemu-generic-arm64
 
 target:
-  - core-image-sato
+  - core-image-base
   - sbsa-acs

ci/qemuarm-secureboot.yml

@@ -1,12 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-
-machine: qemuarm-secureboot
-
-target:
-  - core-image-base
-  - optee-examples
-  - optee-test
-  - optee-os-tadevkit

ci/qemuarm64-secureboot.yml

@@ -5,8 +5,14 @@ header:
 
 machine: qemuarm64-secureboot
 
+local_conf_header:
+  failing_tests: |
+    # software IO TLB: Cannot allocate buffer
+    DEFAULT_TEST_SUITES:remove = "parselogs"
+
 target:
   - core-image-base
   - optee-examples
   - optee-test
+  - optee-spdevkit
   - optee-os-tadevkit

ci/tc0.yml

@@ -0,0 +1,9 @@
+header:
+  version: 11
+  includes:
+    - ci/base.yml
+
+machine: tc0
+
+target:
+  - tc-artifacts-image

ci/testimage-zephyr.yml

@@ -0,0 +1,8 @@
+header:
+  version: 11
+
+local_conf_header:
+  testimage: |
+    IMAGE_CLASSES += "testimage"
+    TEST_TARGET = "QemuTargetZephyr"
+    TEST_SUITES = "zephyr"

ci/testimage.yml

@@ -5,15 +5,9 @@ local_conf_header:
   testimage: |
     IMAGE_CLASSES += "testimage"
     TESTIMAGE_AUTO = "1"
-  kvm: |
-    QEMU_USE_KVM = ""
   slirp: |
     TEST_RUNQEMUPARAMS = "slirp"
     TEST_SERVER_IP = "127.0.0.1"
     QEMU_USE_SLIRP = "1"
   sshd: |
     IMAGE_FEATURES:append = " ssh-server-dropbear"
-  sshkeys: |
-    CORE_IMAGE_EXTRA_INSTALL += "ssh-pregen-hostkeys"
-  universally_failing_tests: |
-    TEST_SUITES:remove = "opkg"

ci/trusted-services.yml

@@ -1,14 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/meta-openembedded.yml
-
-local_conf_header:
-  trusted_services: |
-    TEST_SUITES:append = " trusted_services"
-    # Include TS Crypto, Storage, ITS, Attestation and SMM-Gateway SPs into optee-os image
-    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its ts-attestation ts-smm-gateway"
-    # Include TS demo/test tools into image
-    IMAGE_INSTALL:append = " packagegroup-ts-tests"
-    # Include TS PSA Arch tests into image
-    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"

ci/update-repos

@@ -22,6 +22,7 @@ repositories = (
     "https://git.yoctoproject.org/git/poky",
     "https://git.openembedded.org/meta-openembedded",
     "https://git.yoctoproject.org/git/meta-virtualization",
+    "https://git.yoctoproject.org/git/meta-zephyr",
     "https://github.com/kraj/meta-clang",
 )
 

documentation/trusted-services.md

@@ -1,53 +0,0 @@
-# The Trusted Services: framework for developing root-of-trust services
-
-  meta-arm layer includes recipes for [Trusted Services][1] Secure Partitions and Normal World applications
-in `meta-arm/recipes-security/trusted-services`
-
-## Secure Partitions recipes
-
-We define dedicated recipes for all supported Trusted Services (TS) Secure Partitions.
-These recipes produce ELF and DTB files for SPs.
-These files are automatically included into optee-os image accordingly to defined MACHINE_FEATURES.
-
-### How to include TS SPs
-
-To include TS SPs into optee-os image you need to add into MACHINE_FEATURES
-features for each [Secure Partition][2] you would like to include:
-
-| Secure Partition  | MACHINE_FEATURE |
-| ----------------- | --------------- |
-| Attestation       | ts-attesation   |
-| Crypto            | ts-crypto       |
-| Internal Storage  | ts-its          |
-| Protected Storage | ts-storage      |
-| se-proxy          | ts-se-proxy     |
-| smm-gateway       | ts-smm-gateway  |
-
-Other steps depend on your machine/platform definition:
-
-1. For communications between Secure and Normal Words Linux kernel option `CONFIG_ARM_FFA_TRANSPORT=y`
-is required. If your platform doesn't include it already you can add `arm-ffa` into MACHINE_FEATURES.
-
-2. optee-os might require platform specific OP-TEE build parameters (for example what SEL the SPM Core is implemented at).
-You can find examples in `meta-arm/recipes-security/optee/optee-os_%.bbappend` for qemuarm64-secureboot machine
-and in `meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc` and `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc`
-for N1SDP and Corstone1000 platforms accordingly.
-
-3. trusted-firmware-a might require platform specific TF-A build parameters (SPD and SPMC details on the platform).
-See `meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend` for qemuarm64-secureboot machine
-and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-n1sdp.inc` and
-`meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for N1SDP and Corstone1000 platforms.
-
-## Normal World applications
-
-  Optionally for testing purposes you can add `packagegroup-ts-tests` and `packagegroup-ts-tests-psa` package groups into your image.
-They include [Trusted Services test and demo tools][3]
-
-## OEQA Trusted Services tests
-
-  meta-arm also includes Trusted Service OEQA tests which can be used for automated testing.
-See `ci/trusted-services.yml` for an example how to include them into an image.
-
-[1] https://trusted-services.readthedocs.io/en/integration/overview/introduction.html
-[2] https://trusted-services.readthedocs.io/en/integration/developer/deployments/secure-partitions.html
-[3] https://trusted-services.readthedocs.io/en/integration/developer/deployments/test-executables.html

kas/corstone1000-base.yml

@@ -5,7 +5,7 @@ distro: poky-tiny
 
 defaults:
   repos:
-    refspec: master
+    refspec: kirkstone
 
 repos:
   meta-arm:
@@ -16,7 +16,6 @@ repos:
 
   poky:
     url: https://git.yoctoproject.org/git/poky
-    refspec: master
     layers:
       meta:
       meta-poky:
@@ -24,7 +23,6 @@ repos:
 
   meta-openembedded:
     url: https://git.openembedded.org/meta-openembedded
-    refspec: master
     layers:
       meta-oe:
       meta-python:

meta-arm-autonomy/README.md

@@ -0,0 +1,23 @@
+meta-arm-autonomy Yocto Layer
+=============================
+
+The meta-arm-autonomy layer is being deprecated from master, with bug fixes
+only being applied to the following branches. Additionally, all support and
+maintenance of meta-arm-autonomy will stop as per the schedule below.
+
+    honister: End-of-life scheduled to June 2022
+    hardknot: End-of-life scheduled to December 2021
+    gatesgarth: End-of-life scheduled to October 2021
+    dunfell: End-of-life scheduled to October 2021
+    master: End-of-life scheduled to October 2021 and code removed
+
+
+Contributing
+------------
+This project has not put in place a process for contributions currently. If you
+would like to contribute, please contact the maintainers
+
+
+Maintainer(s)
+-------------
+* Diego Sueiro <diego.sueiro@arm.com>

meta-arm-bsp/conf/layer.conf

@@ -9,7 +9,7 @@ BBFILE_COLLECTIONS += "meta-arm-bsp"
 BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-arm-bsp = "5"
 
-LAYERSERIES_COMPAT_meta-arm-bsp = "langdale"
+LAYERSERIES_COMPAT_meta-arm-bsp = "kirkstone"
 
 LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
 # This won't be used by layerindex-fetch, but works everywhere else

meta-arm-bsp/conf/machine/corstone1000-fvp.conf

@@ -33,16 +33,9 @@ FVP_CONFIG[se.nvm.update_raw_image] ?= "0"
 # Boot image
 FVP_DATA ?= "board.flash0=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic.nopt@0x68100000"
 
-# External system (cortex-M3)
-FVP_CONFIG[extsys_harness0.extsys_flashloader.fname] ?= "${DEPLOY_DIR_IMAGE}/es_flashfw.bin"
-
 # FVP Terminals
 FVP_TERMINALS[host.host_terminal_0] ?= "Normal World Console"
 FVP_TERMINALS[host.host_terminal_1] ?= "Secure World Console"
 FVP_TERMINALS[se.secenc_terminal] ?= "Secure Enclave Console"
 FVP_TERMINALS[extsys0.extsys_terminal] ?= "Cortex M3"
 
-# MMC card configuration
-FVP_CONFIG[board.msd_mmc.card_type] ?= "SDHC"
-FVP_CONFIG[board.msd_mmc.p_fast_access] ?= "0"
-FVP_CONFIG[board.msd_mmc.diagnostics] ?= "2"

meta-arm-bsp/conf/machine/corstone500.conf

@@ -12,7 +12,7 @@ require conf/machine/include/arm/armv7a/tune-cortexa5.inc
 # apply.
 #
 PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.19%"
+PREFERRED_VERSION_linux-yocto ?= "5.15%"
 
 EXTRA_IMAGEDEPENDS += "trusted-firmware-a u-boot"
 
@@ -26,7 +26,7 @@ SERIAL_CONSOLES = "115200;ttyAMA0"
 UBOOT_MACHINE = "corstone500_defconfig"
 UBOOT_IMAGE_ENTRYPOINT = "0x84000000"
 UBOOT_IMAGE_LOADADDRESS = "0x84000000"
-PREFERRED_VERSION_u-boot ?= "2022.07"
+PREFERRED_VERSION_u-boot ?= "2022.01"
 
 # making sure EXTRA_IMAGEDEPENDS will be used while creating the image
 WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"

meta-arm-bsp/conf/machine/fvp-base-arm32.conf

@@ -4,11 +4,11 @@
 #@NAME: Armv7-A Base Platform FVP machine
 #@DESCRIPTION: Machine configuration for Armv7-A Base Platform FVP model
 
-require conf/machine/include/fvp-common.inc
+require conf/machine/fvp-common.inc
 require conf/machine/include/arm/arch-armv7a.inc
 
 # FVP u-boot configuration
-PREFERRED_VERSION_u-boot ?= "2022.04"
+PREFERRED_VERSION_u-boot ?= "2021.10"
 UBOOT_MACHINE = "vexpress_aemv8a_aarch32_defconfig"
 
 KERNEL_IMAGETYPE = "zImage"

meta-arm-bsp/conf/machine/fvp-base.conf

@@ -4,15 +4,11 @@
 #@NAME: Armv8-A Base Platform FVP machine
 #@DESCRIPTION: Machine configuration for Armv8-A Base Platform FVP model
 
-require conf/machine/include/fvp-common.inc
+require conf/machine/fvp-common.inc
 require conf/machine/include/arm/arch-armv8a.inc
 
 TUNE_FEATURES = "aarch64"
 
-PREFERRED_VERSION_u-boot ?= "2022.04"
-PREFERRED_VERSION_linux-yocto ?= "5.15%"
-PREFERRED_VERSION_linux-yocto-rt ?= "5.15%"
-
 # FVP u-boot configuration
 UBOOT_MACHINE = "vexpress_aemv8a_semi_defconfig"
 

meta-arm-bsp/conf/machine/fvp-baser-aemv8r64.conf

@@ -11,7 +11,6 @@ EXTRA_IMAGEDEPENDS += "boot-wrapper-aarch64"
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
 PREFERRED_VERSION_linux-yocto ?= "5.15%"
 PREFERRED_VERSION_linux-yocto-rt ?= "5.15%"
-PREFERRED_VERSION_u-boot ?= "2022.07"
 
 KERNEL_IMAGETYPE = "Image"
 KERNEL_DEVICETREE = "arm/fvp-baser-aemv8r64.dtb"

meta-arm-bsp/conf/machine/fvp-common.inc

@@ -40,7 +40,7 @@ FVP_CONFIG[cluster0.has_arm_v8-4] = "1"
 FVP_CONFIG[cluster1.has_arm_v8-4] = "1"
 FVP_CONSOLE ?= "terminal_0"
 FVP_DATA ?= "cluster0.cpu0=${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}@0x80080000 \
-             cluster0.cpu0=${DEPLOY_DIR_IMAGE}/fvp-base-revc.dtb@0x8fc00000"
+             cluster0.cpu0=${DEPLOY_DIR_IMAGE}/fvp-base-revc.dtb@0x83000000"
 FVP_TERMINALS[bp.terminal_0] ?= "Console"
 FVP_TERMINALS[bp.terminal_1] ?= ""
 FVP_TERMINALS[bp.terminal_2] ?= ""

meta-arm-bsp/conf/machine/include/corstone1000.inc

@@ -10,6 +10,8 @@ TFA_BL2_BINARY = "bl2-corstone1000.bin"
 TFA_FIP_BINARY = "fip-corstone1000.bin"
 
 # TF-M
+PREFERRED_VERSION_trusted-firmware-m ?= "1.5%"
+TFM_PLATFORM = "arm/corstone1000"
 EXTRA_IMAGEDEPENDS += "virtual/trusted-firmware-m"
 
 # TF-M settings for signing host images
@@ -18,11 +20,11 @@ TFA_BL2_RE_SIGN_BIN_SIZE = "0x2d000"
 TFA_FIP_RE_IMAGE_LOAD_ADDRESS = "0x68130000"
 TFA_FIP_RE_SIGN_BIN_SIZE = "0x00200000"
 RE_LAYOUT_WRAPPER_VERSION = "0.0.7"
-TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
+TFM_SIGN_PRIVATE_KEY = "${S}/bl2/ext/mcuboot/root-RSA-3072_1.pem"
 RE_IMAGE_OFFSET = "0x1000"
 
 # u-boot
-PREFERRED_VERSION_u-boot ?= "2022.07"
+PREFERRED_VERSION_u-boot ?= "2022.01"
 EXTRA_IMAGEDEPENDS += "u-boot"
 
 UBOOT_CONFIG ??= "EFI"
@@ -33,23 +35,19 @@ UBOOT_BOOTARGS = "earlycon=pl011,0x1a510000 console=ttyAMA0 loglevel=9"
 UBOOT_ARCH = "arm"
 UBOOT_EXTLINUX = "0"
 
-#optee
-PREFERRED_VERSION_optee-os ?= "3.18.%"
-PREFERRED_VERSION_optee-client ?= "3.18.%"
+# optee
+PREFERRED_VERSION_optee-os ?= "3.14%"
+PREFERRED_VERSION_optee-client ?= "3.14%"
 EXTRA_IMAGEDEPENDS += "optee-os"
 OPTEE_ARCH = "arm64"
 OPTEE_BINARY = "tee-pager_v2.bin"
 
-# Include smm-gateway and se-proxy SPs into optee-os binary
-MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
-TS_PLATFORM = "arm/corstone1000"
-
-# External System(Cortex-M3)
-EXTRA_IMAGEDEPENDS += "external-system"
+# Trusted Services(TS)
+EXTRA_IMAGEDEPENDS += "secure-partitions"
 
 # Linux kernel
 PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto = "5.19%"
+PREFERRED_VERSION_linux-yocto = "5.15%"
 KERNEL_IMAGETYPE = "Image.gz"
 
 INITRAMFS_IMAGE_BUNDLE ?= "1"
@@ -57,9 +55,6 @@ INITRAMFS_IMAGE_BUNDLE ?= "1"
 #telling the build system which image is responsible of the generation of the initramfs rootfs
 INITRAMFS_IMAGE = "corstone1000-initramfs-image"
 
-# add FF-A support in the kernel
-MACHINE_FEATURES += "arm-ffa"
-
 # prevent the kernel image from being included in the intramfs rootfs
 PACKAGE_EXCLUDE = "kernel-image-*"
 

meta-arm-bsp/conf/machine/include/tc.inc

@@ -6,7 +6,7 @@ MACHINEOVERRIDES =. "tc:"
 
 # Das U-boot
 UBOOT_MACHINE ?= "total_compute_defconfig"
-PREFERRED_VERSION_u-boot ?= "2022.04"
+PREFERRED_VERSION_u-boot ?= "2021.10"
 UBOOT_RD_LOADADDRESS = "0x88000000"
 UBOOT_RD_ENTRYPOINT = "0x88000000"
 UBOOT_LOADADDRESS = "0x80080000"
@@ -23,11 +23,7 @@ UBOOT_SIGN_KEYDIR = "${DEPLOY_DIR_IMAGE}/keys"
 FIT_GENERATE_KEYS = "1"
 
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-arm64-ack"
-
-# OP-TEE
-PREFERRED_VERSION_optee-os ?= "3.18%"
-PREFERRED_VERSION_optee-client ?= "3.18%"
-PREFERRED_VERSION_optee-test ?= "3.18%"
+PREFERRED_VERSION_linux-arm64-ack ?= "5.10"
 
 # Cannot use the default zImage on arm64
 KERNEL_IMAGETYPE = "Image"

meta-arm-bsp/conf/machine/juno.conf

@@ -10,18 +10,21 @@ require conf/machine/include/arm/arch-armv8a.inc
 
 MACHINE_FEATURES = "usbhost usbgadget alsa screen wifi bluetooth optee pci"
 
-KERNEL_IMAGETYPE = "Image"
+KERNEL_IMAGETYPE = "Image.gz"
 KERNEL_DEVICETREE = "arm/juno.dtb arm/juno-r1.dtb arm/juno-r2.dtb"
 
-IMAGE_FSTYPES += "tar.bz2 ext4"
+IMAGE_FSTYPES += "tar.bz2 ext4 cpio.gz"
 
 SERIAL_CONSOLES = "115200;ttyAMA0"
 
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_u-boot ?= "2022.04"
+PREFERRED_VERSION_u-boot ?= "2020.07"
 PREFERRED_PROVIDER_virtual/bootloader ?= "u-boot"
 
 EXTRA_IMAGEDEPENDS += "trusted-firmware-a virtual/bootloader firmware-image-juno"
 
 # Juno u-boot configuration
 UBOOT_MACHINE = "vexpress_aemv8a_juno_defconfig"
+
+INITRAMFS_IMAGE_BUNDLE ?= "1"
+INITRAMFS_IMAGE = "core-image-minimal"

meta-arm-bsp/conf/machine/musca-b1.conf

@@ -16,8 +16,13 @@ IMAGE_CLASSES += "qemuboot"
 QB_SYSTEM_NAME = "qemu-system-arm"
 QB_MACHINE = "-machine musca-b1"
 QB_CPU = "-cpu cortex-m33"
-QB_GRAPHICS = "-nographic -vga none"
+QB_OPT_APPEND = "-nographic -vga none"
 QB_MEM = "512k"
 QB_RNG = ""
 
+# Zephyr RTOS settings
+ZEPHYR_BOARD = "v2m_musca_b1"
+ZEPHYR_INHERIT_CLASSES += "zephyr-qemuboot"
+ARCH:musca-b1 = "arm"
+
 TFM_PLATFORM = "arm/musca_b1/sse_200"

meta-arm-bsp/conf/machine/musca-s1.conf

@@ -15,8 +15,13 @@ IMAGE_CLASSES += "qemuboot"
 QB_SYSTEM_NAME = "qemu-system-arm"
 QB_MACHINE = "-machine musca-s1"
 QB_CPU = "-cpu cortex-m33"
-QB_GRAPHICS = "-nographic -vga none"
+QB_OPT_APPEND = "-nographic -vga none"
 QB_MEM = "512k"
 QB_RNG = ""
 
+# Zephyr RTOS settings
+ZEPHYR_BOARD = "v2m_musca_s1"
+ZEPHYR_INHERIT_CLASSES += "zephyr-qemuboot"
+ARCH:musca-s1 = "arm"
+
 TFM_PLATFORM = "arm/musca_s1"

meta-arm-bsp/conf/machine/n1sdp.conf

@@ -19,20 +19,19 @@ WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
 
 # Use kernel provided by yocto
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.19%"
+PREFERRED_VERSION_linux-yocto ?= "5.15%"
 
 # RTL8168E Gigabit Ethernet Controller is attached to the PCIe interface
 MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "linux-firmware-rtl8168"
 
 EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+PREFERRED_VERSION_trusted-firmware-a ?= "2.7%"
+
 EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"
 
 #UEFI EDK2 firmware
 EXTRA_IMAGEDEPENDS += "edk2-firmware"
 
-#optee
-PREFERRED_VERSION_optee-os ?= "3.18.%"
-
 #grub-efi
 EFI_PROVIDER ?= "grub-efi"
 MACHINE_FEATURES += "efi"

meta-arm-bsp/conf/machine/qemu-cortex-r5.conf

@@ -0,0 +1,22 @@
+#@TYPE: Machine
+#@NAME: qemu_cortex_r5
+#@DESCRIPTION: Machine for Zephyr BOARD qemu_cortex_r5
+
+require conf/machine/include/qemu.inc
+require conf/machine/include/arm/armv7r/tune-cortexr5.inc
+
+# GLIBC will not work with Cortex-R.
+TCLIBC = "newlib"
+
+# For runqemu
+QB_SYSTEM_NAME = "qemu-system-aarch64"
+QB_MACHINE = "-machine xlnx-zcu102"
+QB_CPU = "-cpu cortex-r5"
+QB_MEM = "-m 64k"
+QB_OPT_APPEND = "-nographic -vga none"
+QB_RNG = ""
+
+# Zephyr RTOS settings
+ZEPHYR_BOARD = "qemu_cortex_r5"
+ZEPHYR_INHERIT_CLASSES += "zephyr-qemuboot"
+ARCH:qemu-cortex-r5 = "arm"

meta-arm-bsp/conf/machine/tc0.conf

@@ -0,0 +1,7 @@
+# Configuration for TC0
+
+#@TYPE: Machine
+#@NAME: TC0
+#@DESCRIPTION: Machine configuration for TC0
+
+require conf/machine/include/tc.inc

meta-arm-bsp/documentation/corstone1000/change-log.rst

@@ -1,98 +0,0 @@
-..
- # Copyright (c) 2022, Arm Limited.
- #
- # SPDX-License-Identifier: MIT
-
-##########
-Change Log
-##########
-
-This document contains a summary of the new features, changes and
-fixes in each release of corstone1000 software stack.
-
-******************
-Version 2022.04.04
-******************
-
-Changes
-=======
-- Linux distro openSUSE, raw image installation and boot in the FVP.
-- SCT test support in FVP.
-- Manual capsule update support in FVP.
-
-******************
-Version 2022.02.25
-******************
-
-Changes
-=======
-- Building and running psa-arch-tests on corstone1000 FVP
-- Enabled smm-gateway partition in Trusted Service on corstone1000 FVP
-- Enabled MHU driver in Trusted Service on corstone1000 FVP
-- Enabled OpenAMP support in SE proxy SP on corstone1000 FVP
-
-******************
-Version 2022.02.21
-******************
-
-Changes
-=======
-- psa-arch-tests: recipe is dropped and merged into the secure-partitons recipe.
-- psa-arch-tests: The tests are align with latest tfm version for psa-crypto-api suite.
-
-******************
-Version 2022.01.18
-******************
-
-Changes
-=======
-- psa-arch-tests: change master to main for psa-arch-tests
-- U-Boot: fix null pointer exception for get_image_info
-- TF-M: fix capsule instability issue for corstone1000
-
-******************
-Version 2022.01.07
-******************
-
-Changes
-=======
-- corstone1000: fix SystemReady-IR ACS test (SCT, FWTS) failures.
-- U-Boot: send bootcomplete event to secure enclave.
-- U-Boot: support populating corstone1000 image_info to ESRT table.
-- U-Boot: add ethernet device and enable configs to support bootfromnetwork SCT.
-
-******************
-Version 2021.12.15
-******************
-
-Changes
-=======
-- Enabling corstone1000 FPGA support on:
-  - Linux 5.10
-  - OP-TEE 3.14
-  - Trusted Firmware-A 2.5
-  - Trusted Firmware-M 1.5
-- Building and running psa-arch-tests
-- Adding openamp support in SE proxy SP
-- OP-TEE: adding smm-gateway partition
-- U-Boot: introducing Arm FF-A and MM support
-
-******************
-Version 2021.10.29
-******************
-
-Changes
-=======
-- Enabling corstone1000 FVP support on:
-  - Linux 5.10
-  - OP-TEE 3.14
-  - Trusted Firmware-A 2.5
-  - Trusted Firmware-M 1.4
-- Linux kernel: enabling EFI, adding FF-A debugfs driver, integrating ARM_FFA_TRANSPORT.
-- U-Boot: Extending EFI support
-- python3-imgtool: adding recipe for Trusted-firmware-m
-- python3-imgtool: adding the Yocto recipe used in signing host images (based on MCUBOOT format)
-
---------------
-
-*Copyright (c) 2021, Arm Limited. All rights reserved.*

meta-arm-bsp/documentation/corstone1000/conf.py

@@ -1,52 +0,0 @@
-# Configuration file for the Sphinx documentation builder.
-#
-# This file only contains a selection of the most common options. For a full
-# list see the documentation:
-# https://www.sphinx-doc.org/en/master/usage/configuration.html
-
-# -- Path setup --------------------------------------------------------------
-
-# If extensions (or modules to document with autodoc) are in another directory,
-# add these directories to sys.path here. If the directory is relative to the
-# documentation root, use os.path.abspath to make it absolute, like shown here.
-#
-# import os
-# import sys
-# sys.path.insert(0, os.path.abspath('.'))
-
-
-# -- Project information -----------------------------------------------------
-
-project = 'corstone1000'
-copyright = '2020-2022, Arm Limited'
-author = 'Arm Limited'
-
-
-# -- General configuration ---------------------------------------------------
-
-# Add any Sphinx extension module names here, as strings. They can be
-# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
-# ones.
-extensions = [
-]
-
-# Add any paths that contain templates here, relative to this directory.
-templates_path = ['_templates']
-
-# List of patterns, relative to source directory, that match files and
-# directories to ignore when looking for source files.
-# This pattern also affects html_static_path and html_extra_path.
-exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store', 'docs/infra']
-
-
-# -- Options for HTML output -------------------------------------------------
-
-# The theme to use for HTML and HTML Help pages.  See the documentation for
-# a list of builtin themes.
-#
-html_theme = 'sphinx_rtd_theme'
-
-# Add any paths that contain custom static files (such as style sheets) here,
-# relative to this directory. They are copied after the builtin static files,
-# so a file named "default.css" will overwrite the builtin "default.css".
-#html_static_path = ['_static']

meta-arm-bsp/documentation/corstone1000/index.rst

@@ -1,16 +0,0 @@
-..
- # Copyright (c) 2022, Arm Limited.
- #
- # SPDX-License-Identifier: MIT
-
-################
-ARM Corstone1000
-################
-
-.. toctree::
-   :maxdepth: 1
-
-   software-architecture
-   user-guide
-   release-notes
-   change-log

meta-arm-bsp/documentation/corstone1000/release-notes.rst

@@ -1,137 +0,0 @@
-..
- # Copyright (c) 2022, Arm Limited.
- #
- # SPDX-License-Identifier: MIT
-
-#############
-Release notes
-#############
-
-**************************
-Release notes - 2022.04.04
-**************************
-
-Known Issues or Limitations
----------------------------
- - FGPA support Linux distro install and boot through installer. However,
-   FVP only support openSUSE raw image installation and boot.
- - Due to the performance uplimit of MPS3 FPGA and FVP, some Linux distros like Fedora Rawhide
-   cannot boot on corstone1000 (i.e. user may experience timeouts or boot hang).
- - Below SCT FAILURE is a known issues in the FVP:
-   UEFI Compliant - Boot from network protocols must be implemented -- FAILURE
-
-Platform Support
------------------
- - This software release is tested on corstone1000 FPGA version AN550_v1
- - This software release is tested on corstone1000 Fast Model platform (FVP) version 11.17_23
-   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
-
-**************************
-Release notes - 2022.02.25
-**************************
-
-Known Issues or Limitations
----------------------------
- - The following tests only work on corstone1000 FPGA: ACS tests (SCT, FWTS,
-   BSA), manual capsule update test, Linux distro install and boot.
-
-Platform Support
-----------------
- - This software release is tested on corstone1000 FPGA version AN550_v1
- - This software release is tested on corstone1000 Fast Model platform (FVP) version 11.17_23
-   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
-
-Release notes - 2022.02.21
---------------------------
-
-Known Issues or Limitations
----------------------------
- - The following tests only work on corstone1000 FPGA: ACS tests (SCT, FWTS,
-   BSA), manual capsule update test, Linux distro install and boot, psa-arch-test.
-
-Platform Support
-----------------
- - This software release is tested on corstone1000 FPGA version AN550_v1
- - This software release is tested on corstone1000 Fast Model platform (FVP) version 11.16.21
-   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
-
-Release notes - 2022.01.18
---------------------------
-
-Known Issues or Limitations
----------------------------
-
- - Before running each SystemReady-IR tests: ACS tests (SCT, FWTS, BSA), manual
-   capsule update test, Linux distro install and boot, etc., the SecureEnclave
-   flash must be cleaned. See user-guide "Clean Secure Flash Before Testing"
-   section.
-
-Release notes - 2021.12.15
---------------------------
-
-Software Features
-------------------
-The following components are present in the release:
-
- - Yocto version Honister
- - Linux kernel version 5.10
- - U-Boot 2021.07
- - OP-TEE version 3.14
- - Trusted Firmware-A 2.5
- - Trusted Firmware-M 1.5
- - OpenAMP 347397decaa43372fc4d00f965640ebde042966d
- - Trusted Services a365a04f937b9b76ebb2e0eeade226f208cbc0d2
-
-
-Platform Support
-----------------
- - This software release is tested on corstone1000 FPGA version AN550_v1
- - This software release is tested on corstone1000 Fast Model platform (FVP) version 11.16.21
-   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
-
-Known Issues or Limitations
----------------------------
- - The following tests only work on corstone1000 FPGA: ACS tests (SCT, FWTS,
-   BSA), manual capsule update test, Linux distro install and boot, and
-   psa-arch-tests.
- - Only the manual capsule update from UEFI shell is supported on FPGA.
- - Due to flash size limitation and to support A/B banks,the wic image provided
-   by the user should be smaller than 15MB.
- - The failures in PSA Arch Crypto Test are known limitations with crypto
-   library. It requires further investigation. The user can refer to `PSA Arch Crypto Test Failure Analysis In TF-M V1.5 Release <https://developer.trustedfirmware.org/w/tf_m/release/psa_arch_crypto_test_failure_analysis_in_tf-m_v1.5_release/>`__
-   for the reason for each failing test.
-
-
-Release notes - 2021.10.29
---------------------------
-
-Software Features
------------------
-This initial release of corstone1000 supports booting Linux on the Cortex-A35
-and TF-M/MCUBOOT in the Secure Enclave. The following components are present in
-the release:
-
- - Linux kernel version 5.10
- - U-Boot 2021.07
- - OP-TEE version 3.14
- - Trusted Firmware-A 2.5
- - Trusted Firmware-M 1.4
-
-Platform Support
-----------------
- - This Software release is tested on corstone1000 Fast Model platform (FVP) version 11.16.21
-   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
-
-Known Issues or Limitations
----------------------------
- - No software support for external system(Cortex M3)
- - No communication established between A35 and M0+
- - Very basic functionality of booting Secure Enclave, Trusted Firmware-A , OP-TEE , u-boot and Linux are performed
-
-Support
--------
-For support email: support-subsystem-iot@arm.com
-
---------------
-
-*Copyright (c) 2021, Arm Limited. All rights reserved.*

meta-arm-bsp/documentation/corstone1000/software-architecture.rst

@@ -1,239 +0,0 @@
-..
- # Copyright (c) 2022, Arm Limited.
- #
- # SPDX-License-Identifier: MIT
-
-######################
-Software architecture
-######################
-
-
-*****************
-ARM corstone1000
-*****************
-
-ARM corstone1000 is a reference solution for IoT devices. It is part of
-Total Solution for IoT which consists of hardware and software reference
-implementation.
-
-Corstone1000 software plus hardware reference solution is PSA Level-2 ready
-certified (`PSA L2 Ready`_) as well as System Ready IR certified(`SRIR cert`_).
-More information on the corstone1000 subsystem product and design can be
-found at:
-`Arm corstone1000 Software`_ and `Arm corstone1000 Technical Overview`_.
-
-This readme explicitly focuses on the software part of the solution and
-provides internal details on the software components. The reference
-software package of the platform can be retrieved following instructions
-present in the user-guide document.
-
-***************
-Design Overview
-***************
-
-The software architecture of corstone1000 platform is a reference
-implementation of Platform Security Architecture (`PSA`_) which provides
-framework to build secure IoT devices.
-
-The base system architecture of the platform is created from three
-different tyes of systems: Secure Enclave, Host and External System.
-Each subsystem provides different functionality to overall SoC.
-
-
-.. image:: images/CorstoneSubsystems.png
-   :width: 720
-   :alt: CorstoneSubsystems
-
-
-The Secure Enclave System, provides PSA Root of Trust (RoT) and
-cryptographic functions. It is based on an Cortex-M0+ processor,
-CC312 Cryptographic Accelerator and peripherals, such as watchdog and
-secure flash. Software running on the Secure Enclave is isolated via
-hardware for enhanced security. Communication with the Secure Encalve
-is achieved using Message Hnadling Units (MHUs) and shared memory.
-On system power on, the Secure Enclaves boots first. Its software
-comprises of two boot loading stages, both based on mcuboot, and
-TrustedFirmware-M(`TF-M`_) as runtime software. The software design on 
-Secure Enclave follows Firmware Framework for M class
-processor (`FF-M`_) specification.
-
-The Host System is based on ARM Cotex-A35 processor with standardized
-peripherals to allow for the booting of a Linux OS. The Cortex-A35 has
-the TrustZone technology that allows secure and non-secure security
-states in the processor. The software design in the Host System follows
-Firmware Framework for A class procseeor (`FF-A`_) specification.
-The boot process follows Trusted Boot Base Requirement (`TBBR`_).
-The Host Subsystem is taken out of reset by the Secure Enclave system
-during its final stages of the initialization. The Host subsystem runs
-FF-A Secure Partitions(based on `Trusted Services`_) and OPTEE-OS
-(`OPTEE-OS`_) in the secure world, and u-boot(`u-boot repo`_) and
-linux (`linux repo`_) in the non-secure world. The communication between
-non-secure and the secure world is performed via FF-A messages.
-
-An external system is intended to implement use-case specific
-functionality. The system is based on Cortex-M3 and run RTX RTOS.
-Communictaion between external system and Host(cortex-A35) is performed
-using MHU as transport mechanism and rpmsg messaging system.
-
-Overall, the corstone1000 architecture is designed to cover a range
-of Power, Performance, and Area (PPA) applications, and enable extension
-for use-case specific applications, for example, sensors, cloud
-connectivitiy, and edge computing.
-
-*****************
-Secure Boot Chain
-*****************
-
-For the security of a device, it is essential that only authorized
-software should run on the device. The corstone1000 boot uses a
-Secure Boot Chain process where an already authenticated image verifies
-and loads the following software in the chain. For the boot chain
-process to work, the start of the chain should be trusted, forming the
-Root of Trust (RoT) of the device. The RoT of the device is immutable in
-nature and encoded into the device by the device owner before it
-is deployed into the field. In Corstone1000, the BL1 image of the secure
-enclave and content of the CC312 OTP (One Time Programmable) memory
-forms the RoT. The BL1 image exists in ROM (Read Only Memory).
-
-.. image:: images/SecureBootChain.png
-   :width: 870
-   :alt: SecureBootChain
-
-It is a lengthy chain to boot the software on corstone1000. On power on,
-the secure enclave starts executing BL1 code from the ROM which is the RoT
-of the device. Authentication of an image involves the steps listed below:
-
-- Load image from flash to dynamic RAM.
-- The public key present in the image header is validated by comparing with the hash. Depending on the image, the hash of the public key is either stored in the OTP or part of the software which is being already verfied in the previous stages.
-- The image is validated using the public key.
-
-In the secure enclave, BL1 authenticates the BL2 and passes the execution
-control. BL2 authenticates the initial boot loader of the host (Host BL2)
-and TF-M. The execution control is now passed to TF-M. TF-M being the run
-time executable of secure enclaves initializes itself and, in the end,
-brings the host CPU out of rest. The host follows the boot standard defined
-in the `TBBR`_ to authenticate the secure and non-secure software.
-
-***************
-Secure Services
-***************
-
-corstone1000 is unique in providing a secure environment to run a secure
-workload. The platform has Trustzone technology in the Host subsystem but
-it also has hardware isolated secure enclave environment to run such secure
-workloads. In corstone1000, known Secure Services such as Crypto, Protected
-Storage, Internal Trusted Storage and Attestation are available via PSA
-Functional APIs in TF-M. There is no difference for a user communicating to
-these services which are running on a secure enclave instead of the
-secure world of the host subsystem. The below diagram presents the data
-flow path for such calls.
-
-
-.. image:: images/SecureServices.png
-   :width: 930
-   :alt: SecureServices
-
-
-The SE Proxy SP (Secure Enclave Proxy Secure Partition) is a proxy partition
-managed by OPTEE which forwards such calls to the secure enclave. The
-solution relies on OpenAMP which uses shared memory and MHU interrupts as
-a doorbell for communication between two cores. corstone1000 implements
-isolation level 2. Cortex-M0+ MPU (Memory Protection Unit) is used to implement
-isolation level 2.
-
-For a user to define its own secure service, both the options of the host
-secure world or secure encalve are available. It's a trade-off between
-lower latency vs higher security. Services running on a secure enclave are
-secure by real hardware isolation but have a higher latency path. In the
-second scenario, the services running on the secure world of the host
-subsystem have lower latency but virtual hardware isolation created by
-Trustzone technology.
-
-
-**********************
-Secure Firmware Update
-**********************
-
-Apart from always booting the authorized images, it is also essential that
-the device only accepts the authorized images in the firmware update
-process. corstone1000 supports OTA (Over the Air) firmware updates and
-follows Platform Security Firmware Update sepcification (`FWU`_).
-
-As standardized into `FWU`_, the external flash is divided into two
-banks of which one bank has currently running images and the other bank is
-used for staging new images.  There are four updatable units, i.e. Secure
-Enclave's BL2 and TF-M, and Host's FIP (Firmware Image Package) and Kernel
-Image. The new images are accepted in the form of a UEFI capsule.
-
-
-.. image:: images/ExternalFlash.png
-   :width: 690
-   :alt: ExternalFlash
-
-
-The Metadata Block in the flash has the below firmware update state machine.
-TF-M runs an OTA service that is responsible for accepting and updating the
-images in the flash. The communication between the UEFI Capsule update
-subsystem and the OTA service follows the same data path explained above.
-The OTA service writes the new images to the passive bank after successful
-capsule verification. It changes the state of the system to trial state and
-triggers the reset. Boot loaders in Secure Enclave and Host read the Metadata
-block to get the information on the boot bank. In the successful trial stage,
-the acknowledgment from the host moves the state of the system from trial to
-regular. Any failure in the trial stage or system hangs leads to a system
-reset. This is made sure by the use of watchdog hardware. The Secure Enclave's
-BL1 has the logic to identify multiple resets and eventually switch back to the
-previous good bank. The ability to revert to the previous bank is crucial to
-guarantee the availability of the device.
-
-
-.. image:: images/SecureFirmwareUpdate.png
-   :width: 430
-   :alt: SecureFirmwareUpdate
-
-
-
-******************************
-UEFI Runtime Support in u-boot
-******************************
-
-Implementation of UEFI boottime and runtime APIs require variable storage.
-In corstone1000, these UEFI variables are stored in the Protected Storage
-service. The below diagram presents the data flow to store UEFI variables.
-The u-boot implementation of the UEFI subsystem uses the FF-A driver to
-communicate with the SMM Service in the secure world. The backend of the
-SMM service uses the proxy PS from the SE Proxy SP. From there on, the PS
-calls are forwarded to the secure enclave as explained above.
-
-
-.. image:: images/UEFISupport.png
-   :width: 590
-   :alt: UEFISupport
-
-
-***************
-References
-***************
-`ARM corstone1000 Search`_
-`Arm security features`_
-
---------------
-
-*Copyright (c) 2022, Arm Limited. All rights reserved.*
-
-.. _Arm corstone1000 Technical Overview: https://developer.arm.com/documentation/102360/0000
-.. _Arm corstone1000 Software: https://developer.arm.com/Tools%20and%20Software/Corstone-1000%20Software
-.. _Arm corstone1000 Search: https://developer.arm.com/search#q=corstone-1000
-.. _Arm security features: https://www.arm.com/architecture/security-features/platform-security
-.. _linux repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
-.. _FF-A: https://developer.arm.com/documentation/den0077/latest
-.. _FF-M: https://developer.arm.com/-/media/Files/pdf/PlatformSecurityArchitecture/Architect/DEN0063-PSA_Firmware_Framework-1.0.0-2.pdf?revision=2d1429fa-4b5b-461a-a60e-4ef3d8f7f4b4&hash=3BFD6F3E687F324672F18E5BE9F08EDC48087C93
-.. _FWU: https://developer.arm.com/documentation/den0118/a/
-.. _OPTEE-OS: https://github.com/OP-TEE/optee_os
-.. _PSA: https://www.psacertified.org/
-.. _PSA L2 Ready: https://www.psacertified.org/products/corstone-1000/
-.. _SRIR cert: https://armkeil.blob.core.windows.net/developer/Files/pdf/certificate-list/arm-systemready-ir-certification-arm-corstone-1000.pdf
-.. _TBBR: https://developer.arm.com/documentation/den0006/latest
-.. _TF-M: https://www.trustedfirmware.org/projects/tf-m/
-.. _Trusted Services: https://www.trustedfirmware.org/projects/trusted-services/
-.. _u-boot repo: https://github.com/u-boot/u-boot.git

meta-arm-bsp/documentation/corstone1000/user-guide.rst

@@ -1,685 +0,0 @@
-..
- # Copyright (c) 2022, Arm Limited.
- #
- # SPDX-License-Identifier: MIT
-
-##########
-User Guide
-##########
-
-Notice
-------
-The corstone1000 software stack uses the `Yocto Project <https://www.yoctoproject.org/>`__ to build
-a tiny Linux distribution suitable for the corstone1000 platform. The Yocto Project relies on the
-`Bitbake <https://docs.yoctoproject.org/bitbake.html#bitbake-documentation>`__
-tool as its build tool. Please see `Yocto Project documentation <https://docs.yoctoproject.org/>`__
-for more information.
-
-
-Prerequisites
--------------
-These instructions assume your host PC is running Ubuntu Linux 18.04 or 20.04 LTS, with
-at least 32GB of free disk space and 16GB of RAM as minimum requirement. The
-following instructions expect that you are using a bash shell.
-
-The following prerequisites must be available on the host system. To resolve these dependencies, run:
-
-::
-
-    sudo apt-get update
-    sudo apt-get install gawk wget git-core diffstat unzip texinfo gcc-multilib \
-     build-essential chrpath socat cpio python3 python3-pip python3-pexpect \
-     xz-utils debianutils iputils-ping python3-git libegl1-mesa libsdl1.2-dev \
-     xterm zstd liblz4-tool picocom
-    sudo apt-get upgrade libstdc++6
-
-Provided components
--------------------
-Within the Yocto Project, each component included in the corstone1000 software stack is specified as
-a `bitbake recipe <https://www.yoctoproject.org/docs/1.6/bitbake-user-manual/bitbake-user-manual.html#recipes>`__.
-The recipes specific to the corstone1000 BSP are located at:
-``<_workspace>/meta-arm/meta-arm-bsp/``.
-
-The Yocto machine config files for the corstone1000 FVP and FPGA are:
-
- - ``<_workspace>/meta-arm/meta-arm-bsp/conf/machine/include/corstone1000.inc``
- - ``<_workspace>/meta-arm/meta-arm-bsp/conf/machine/corstone1000-fvp.conf``
- - ``<_workspace>/meta-arm/meta-arm-bsp/conf/machine/corstone1000-mps3.conf``
-
-*****************
-Software for Host
-*****************
-
-Trusted Firmware-A
-==================
-Based on `Trusted Firmware-A <https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git>`__
-
-+----------+---------------------------------------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bbappend |
-+----------+---------------------------------------------------------------------------------------------------+
-| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bb           |
-+----------+---------------------------------------------------------------------------------------------------+
-
-OP-TEE
-======
-Based on `OP-TEE <https://git.trustedfirmware.org/OP-TEE/optee_os.git>`__
-
-+----------+------------------------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bbappend |
-+----------+------------------------------------------------------------------------------------+
-| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-security/optee/optee-os_3.18.0.bb           |
-+----------+------------------------------------------------------------------------------------+
-
-U-Boot
-=======
-Based on `U-Boot <https://gitlab.com/u-boot>`__
-
-+----------+---------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend |
-+----------+---------------------------------------------------------------------+
-| Recipe   | <_workspace>/poky/meta/recipes-bsp/u-boot/u-boot_2022.07.bb         |
-+----------+---------------------------------------------------------------------+
-
-Linux
-=====
-The distro is based on the `poky-tiny <https://wiki.yoctoproject.org/wiki/Poky-Tiny>`__
-distribution which is a Linux distribution stripped down to a minimal configuration.
-
-The provided distribution is based on busybox and built using muslibc. The
-recipe responsible for building a tiny version of linux is listed below.
-
-+-----------+----------------------------------------------------------------------------------------------+
-| bbappend  | <_workspace>/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-yocto_%.bbappend               |
-+-----------+----------------------------------------------------------------------------------------------+
-| Recipe    | <_workspace>/poky/meta/recipes-kernel/linux/linux-yocto_5.19.bb                              |
-+-----------+----------------------------------------------------------------------------------------------+
-| defconfig | <_workspace>/meta-arm/meta-arm-bsp/recipes-kernel/linux/files/corstone1000/defconfig         |
-+-----------+----------------------------------------------------------------------------------------------+
-
-**************************************************
-Software for Boot Processor (a.k.a Secure Enclave)
-**************************************************
-Based on `Trusted Firmware-M <https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git>`__
-
-+----------+-------------------------------------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m_%.bbappend |
-+----------+-------------------------------------------------------------------------------------------------+
-| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.6.0.bb       |
-+----------+-------------------------------------------------------------------------------------------------+
-
-Building the software stack
----------------------------
-Create a new folder that will be your workspace and will henceforth be referred
-to as ``<_workspace>`` in these instructions. To create the folder, run:
-
-::
-
-    mkdir <_workspace>
-    cd <_workspace>
-
-corstone1000 is a Bitbake based Yocto Project which uses kas and bitbake
-commands to build the stack. To install kas tool, run:
-
-::
-
-    pip3 install kas
-
-In the top directory of the workspace ``<_workspace>``, run:
-
-::
-
-    git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2022.04.07
-
-To build corstone1000 image for MPS3 FPGA, run:
-
-::
-
-    kas build meta-arm/kas/corstone1000-mps3.yml
-
-Alternatively, to build corstone1000 image for FVP, run:
-
-::
-
-    kas build meta-arm/kas/corstone1000-fvp.yml
-
-The initial clean build will be lengthy, given that all host utilities are to
-be built as well as the target images. This includes host executables (python,
-cmake, etc.) and the required toolchain(s).
-
-Once the build is successful, all output binaries will be placed in the following folders:
- - ``<_workspace>/build/tmp/deploy/images/corstone1000-fvp/`` folder for FVP build;
- - ``<_workspace>/build/tmp/deploy/images/corstone1000-mps3/`` folder for FPGA build.
-
-Everything apart from the ROM firmware is bundled into a single binary, the
-``corstone1000-image-corstone1000-{mps3,fvp}.wic.nopt`` file. The ROM firmware is the
-``bl1.bin`` file.
-
-The output binaries used by FVP are the following:
- - The ROM firmware: ``<_workspace>/build/tmp/deploy/images/corstone1000-fvp/bl1.bin``
- - The flash image: ``<_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.wic.nopt``
-
-The output binaries used by FPGA are the following:
- - The ROM firmware: ``<_workspace>/build/tmp/deploy/images/corstone1000-mps3/bl1.bin``
- - The flash image: ``<_workspace>/build/tmp/deploy/images/corstone1000-mps3/corstone1000-image-corstone1000-mps3.wic.nopt``
-
-Flash the firmware image on FPGA
---------------------------------
-
-The user should download the FPGA bit file image from `this link <https://developer.arm.com/tools-and-software/development-boards/fpga-prototyping-boards/download-fpga-images>`__
-and under the section ``Arm® Corstone™-1000 for MPS3``.
-
-The directory structure of the FPGA bundle is shown below.
-
-::
-
-    Boardfiles
-    ├── MB
-    │   ├── BRD_LOG.TXT
-    │   ├── HBI0309B
-    │   │   ├── AN550
-    │   │   │   ├── AN550_v1.bit
-    │   │   │   ├── an550_v1.txt
-    │   │   │   └── images.txt
-    │   │   ├── board.txt
-    │   │   └── mbb_v210.ebf
-    │   └── HBI0309C
-    │       ├── AN550
-    │       │   ├── AN550_v1.bit
-    │       │   ├── an550_v1.txt
-    │       │   └── images.txt
-    │       ├── board.txt
-    │       └── mbb_v210.ebf
-    ├── SOFTWARE
-    │   ├── ES0.bin
-    │   ├── SE.bin
-    │   └── an550_st.axf
-    └── config.txt
-
-Depending upon the MPS3 board version (printed on the MPS3 board) you should update the images.txt file
-(in corresponding HBI0309x folder) so that the file points to the images under SOFTWARE directory.
-
-Here is an example
-
-::
-
-  ;************************************************
-  ;       Preload port mapping                    *
-  ;************************************************
-  ;  PORT 0 & ADDRESS: 0x00_0000_0000 QSPI Flash (XNVM) (32MB)
-  ;  PORT 0 & ADDRESS: 0x00_8000_0000 OCVM (DDR4 2GB)
-  ;  PORT 1        Secure Enclave (M0+) ROM (64KB)
-  ;  PORT 2        External System 0 (M3) Code RAM (256KB)
-  ;  PORT 3        Secure Enclave OTP memory (8KB)
-  ;  PORT 4        CVM (4MB)
-  ;************************************************
-
-  [IMAGES]
-  TOTALIMAGES: 2      ;Number of Images (Max: 32)
-
-  IMAGE0PORT: 1
-  IMAGE0ADDRESS: 0x00_0000_0000
-  IMAGE0UPDATE: RAM
-  IMAGE0FILE: \SOFTWARE\bl1.bin
-
-  IMAGE1PORT: 0
-  IMAGE1ADDRESS: 0x00_00010_0000
-  IMAGE1UPDATE: AUTOQSPI
-  IMAGE1FILE: \SOFTWARE\cs1000.bin
-
-OUTPUT_DIR = ``<_workspace>/build/tmp/deploy/images/corstone1000-mps3``
-
-1. Copy ``bl1.bin`` from OUTPUT_DIR directory to SOFTWARE directory of the FPGA bundle.
-2. Copy ``corstone1000-image-corstone1000-mps3.wic.nopt`` from OUTPUT_DIR directory to SOFTWARE
-   directory of the FPGA bundle and rename the wic image to ``cs1000.bin``.
-
-**NOTE:** Renaming of the images are required because MCC firmware has
-limitation of 8 characters before .(dot) and 3 characters after .(dot).
-
-Now, copy the entire folder to board's SDCard and reboot the board.
-
-Running the software on FPGA
-----------------------------
-
-On the host machine, open 3 minicom sessions. In case of Linux machine it will
-be ttyUSB0, ttyUSB1, ttyUSB2 and it might be different on Window machine.
-
-  - ttyUSB0 for MCC, OP-TEE and Secure Partition
-  - ttyUSB1 for Boot Processor (Cortex-M0+)
-  - ttyUSB2 for Host Processor (Cortex-A35)
-
-Run following commands to open minicom sessions on Linux:
-
-::
-
-  sudo picocom -b 115200 /dev/ttyUSB0  # in one terminal
-  sudo picocom -b 115200 /dev/ttyUSB1  # in another terminal
-  sudo picocom -b 115200 /dev/ttyUSB2  # in another terminal.
-
-Once the system boot is completed, you should see console
-logs on the minicom sessions. Once the HOST(Cortex-A35) is
-booted completely, user can login to the shell using
-**"root"** login.
-
-Running the software on FVP
----------------------------
-An FVP (Fixed Virtual Platform) of the corstone1000 platform must be available to execute the
-included run script.
-
-The Fixed Virtual Platform (FVP) version 11.17_23 can be downloaded from the
-`Arm Ecosystem FVPs`_ page. On this page, navigate to "Corstone IoT FVPs"
-section to download the Corstone1000 platform FVP installer.  Follow the
-instructions of the installer and setup the FVP.
-
-<_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf
-
-When the script is executed, three terminal instances will be launched, one for the boot processor
-(aka Secure Enclave) processing element and two for the Host processing element. Once the FVP is
-executing, the Boot Processor will start to boot, wherein the relevant memory contents of the .wic
-file are copied to their respective memory locations within the model, enforce firewall policies
-on memories and peripherals and then, bring the host out of reset.
-
-The host will boot trusted-firmware-a, OP-TEE, U-Boot and then Linux, and present a login prompt
-(FVP host_terminal_0):
-
-::
-    corstone1000-fvp login:
-
-Login using the username root.
-
-Running test applications
--------------------------
-
-**NOTE**: Running the SystemReady-IR tests described below requires the user to
-work with USB sticks. In our testing, not all USB stick models work well with
-MPS3 FPGA. Here are the USB sticks models that are stable in our test
-environment.
-
- - HP V165W 8 GB USB Flash Drive
- - SanDisk Ultra 32GB Dual USB Flash Drive USB M3.0
- - SanDisk Ultra 16GB Dual USB Flash Drive USB M3.0
-
-**NOTE**:
-Before running each of the tests in this chapter, the user should follow the
-steps described in following section "Clean Secure Flash Before Testing" to
-erase the SecureEnclave flash cleanly and prepare a clean board environment for
-the testing.
-
-Clean Secure Flash Before Testing (applicable to FPGA only)
------------------------------------------------------------
-To prepare a clean board environment with clean secure flash for the testing,
-the user should prepare an image that erases the secure flash cleanly during
-boot. Run following commands to build such image.
-
-::
-
-  cd <_workspace>
-  git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2022.02.18
-  git clone https://git.gitlab.arm.com/arm-reference-solutions/systemready-patch.git
-  cp -f systemready-patch/embedded-a/corstone1000/erase_flash/0001-arm-bsp-trusted-firmware-m-corstone1000-Clean-Secure.patch meta-arm
-  cd meta-arm
-  git apply 0001-arm-bsp-trusted-firmware-m-corstone1000-Clean-Secure.patch
-  cd ..
-  kas build meta-arm/kas/corstone1000-mps3.yml
-
-Replace the bl1.bin and cs1000.bin files on the SD card with following files:
-  - The ROM firmware: <_workspace>/build/tmp/deploy/images/corstone1000-mps3/bl1.bin
-  - The flash image: <_workspace>/build/tmp/deploy/images/corstone1000-mps3/corstone1000-image-corstone1000-mps3.wic.nopt
-
-Now reboot the board. This step erases the Corstone1000 SecureEnclave flash
-completely, the user should expect following message from TF-M log:
-
-::
-
-  !!!SECURE FLASH HAS BEEN CLEANED!!!
-  NOW YOU CAN FLASH THE ACTUAL CORSTONE1000 IMAGE
-  PLEASE REMOVE THE LATEST ERASE SECURE FLASH PATCH AND BUILD THE IMAGE AGAIN
-
-Then the user should follow "Building the software stack" to build a clean
-software stack and flash the FPGA as normal. And continue the testing.
-
-Run SystemReady-IR ACS tests
------------------------------
-
-ACS image contains two partitions. BOOT partition and RESULTS partition.
-Following packages are under BOOT partition
-
- * SCT
- * FWTS
- * BSA uefi
- * BSA linux
- * grub
- * uefi manual capsule application
-
-RESULTS partition is used to store the test results.
-PLEASE MAKE SURE THAT THE RESULTS PARTITION IS EMPTY BEFORE YOU START THE TESTING. OTHERWISE THE TEST RESULTS
-WILL NOT BE CONSISTENT
-
-FPGA instructions for ACS image
--------------------------------
-
-This section describes how the user can build and run Architecture Compliance
-Suite (ACS) tests on Corstone1000.
-
-First, the user should download the `Arm SystemReady ACS repository <https://github.com/ARM-software/arm-systemready/>`__.
-This repository contains the infrastructure to build the Architecture
-Compliance Suite (ACS) and the bootable prebuilt images to be used for the
-certifications of SystemReady-IR. To download the repository, run command:
-
-::
-
-  cd <_workspace>
-  git clone https://github.com/ARM-software/arm-systemready.git -b v21.09_REL1.0
-
-Once the repository is successfully downloaded, the prebuilt ACS live image can be found in:
- - ``<_workspace>/arm-systemready/IR/prebuilt_images/v21.07_0.9_BETA/ir_acs_live_image.img.xz``
-
-**NOTE**: This prebuilt ACS image includes v5.13 kernel, which doesn't provide
-USB driver support for Corstone1000. The ACS image with newer kernel version
-and with full USB support for Corstone1000 will be available in the next
-SystemReady release in this repository.
-
-Then, the user should prepare a USB stick with ACS image. In the given example here,
-we assume the USB device is ``/dev/sdb`` (the user should use ``lsblk`` command to
-confirm). Be cautious here and don't confuse your host PC's own hard drive with the
-USB drive. Run the following commands to prepare the ACS image in USB stick:
-
-::
-
-  cd <_workspace>/arm-systemready/IR/scripts/output/
-  unxz ir_acs_live_image.img.xz
-  sudo dd if=ir_acs_live_image.img of=/dev/sdb iflag=direct oflag=direct bs=1M status=progress; sync
-
-Once the USB stick with ACS image is prepared, the user should make sure that
-ensure that only the USB stick with the ACS image is connected to the board,
-and then boot the board.
-
-FVP instructions for ACS image and run
----------------------------------------
-
-Download acs image from:
- - ``https://gitlab.arm.com/systemready/acs/arm-systemready/-/tree/linux-5.17-rc7/IR/prebuilt_images/v22.04_1.0-Linux-v5.17-rc7``
-
-Use the below command to run the FVP with acs image support in the
-SD card.
-
-::
-
-  unxz ${<path-to-img>/ir_acs_live_image.img.xz}
-
-<_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C board.msd_mmc.p_mmc_file="${<path-to-img>/ir_acs_live_image.img}" 
-
-The test results can be fetched using following commands:
-
-::
-
-  sudo mkdir /mnt/test
-  sudo mount -o rw,offset=<offset_2nd_partition> <path-to-img>/ir_acs_live_image.img /mnt/test/
-  fdisk -lu <path-to-img>/ir_acs_live_image.img
-  ->  Device                                                     Start     End Sectors  Size Type
-      /home/emeara01/Downloads/ir_acs_live_image_modified.img1    2048 1050622 1048575  512M Microsoft basic data
-      /home/emeara01/Downloads/ir_acs_live_image_modified.img2 1050624 1153022  102399   50M Microsoft basic data
-
-  ->   <offset_2nd_partition> = 1050624 * 512 (sector size) = 537919488
-
-The FVP will reset multiple times during the test, and it might take up to 1 day to finish
-the test. At the end of test, the FVP host terminal will halt showing a shell prompt.
-Once test is finished, the FVP can be stoped, and result can be copied following above
-instructions.
-
-Common to FVP and FPGA
------------------------
-
-U-Boot should be able to boot the grub bootloader from
-the 1st partition and if grub is not interrupted, tests are executed
-automatically in the following sequence:
-
- - SCT
- - UEFI BSA
- - FWTS
- - BSA Linux
-
-The results can be fetched from the ``acs_results`` partition of the USB stick (FPGA) / SD Card (FVP).
-
-Manual capsule update test
---------------------------
-
-The following steps describe running manual capsule update with the ``direct``
-method.
-
-Check the "Run SystemReady-IR ACS tests" section above to download and unpack the acs image file
- - ``ir_acs_live_image.img.xz``
-
-Download edk2 and generate capsule file:
-
-::
-
-  git clone https://github.com/tianocore/edk2.git
-  edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \
-    cs1k_cap --fw-version 1 --lsv 0 --guid \
-    e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
-    0 --verbose <binary_file>
-
-The <binary_file> here should be a corstone1000-image-corstone1000-fvp.wic.nopt image for FVP and
-corstone1000-image-corstone1000-mps3.wic.nopt for FPGA. And this input binary file
-(capsule) should be less than 15 MB.
-
-Based on the user's requirement, the user can change the firmware version
-number given to ``--fw-version`` option (the version number needs to be >= 1).
-
-Capsule Copy instructions for FPGA
------------------------------------
-
-The user should prepare a USB stick as explained in ACS image section (see above).
-Place the generated ``cs1k_cap`` file in the root directory of the boot partition
-in the USB stick. Note: As we are running the direct method, the ``cs1k_cap`` file
-should not be under the EFI/UpdateCapsule directory as this may or may not trigger
-the on disk method.
-
-Capsule Copy instructions for FVP
----------------------------------
-
-Run below commands to copy capsule into the
-image file and run FVP software.
-
-::
-
-  sudo mkdir /mnt/test
-  sudo mount -o rw,offset=<offset_1st_partition> <path-to-img>/ir_acs_live_image.img /mnt/test/
-  sudo cp cs1k_cap /mnt/test/
-  sudo umount /mnt/test
-  exit
-
-<_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C "board.msd_mmc.p_mmc_file ${<path-to-img>/ir_acs_live_image.img}" 
-
-Size of first partition in the image file is calculated in the following way. The data is
-just an example and might vary with different ir_acs_live_image.img files.
-
-::
-
-  fdisk -lu <path-to-img>/ir_acs_live_image.img
-  ->  Device                                                     Start     End Sectors  Size Type
-      /home/emeara01/Downloads/ir_acs_live_image_modified.img1    2048 1050622 1048575  512M Microsoft basic data
-      /home/emeara01/Downloads/ir_acs_live_image_modified.img2 1050624 1153022  102399   50M Microsoft basic data
-
-  ->  <offset_1st_partition> = 2048 * 512 (sector size) = 1048576
-
-Common to FVP and FPGA
------------------------
-Reach u-boot then interrupt shell to reach EFI shell. Use below command at EFI shell.
-
-::
-
-  FS0:
-  EFI/BOOT/app/CapsuleApp.efi cs1k_cap
-
-For this test, the user can provide two capsules for testing: a positive test
-case capsule which boots the board correctly, and a negative test case with an
-incorrect capsule which fails to boot the host software.
-
-In the positive case scenario, the user should see following log in TF-M log,
-indicating the new capsule image is successfully applied, and the board boots
-correctly.
-
-::
-
-  ...
-  SysTick_Handler: counted = 10, expiring on = 360
-  SysTick_Handler: counted = 20, expiring on = 360
-  SysTick_Handler: counted = 30, expiring on = 360
-  ...
-  metadata_write: success: active = 1, previous = 0
-  accept_full_capsule: exit: fwu state is changed to regular
-  ...
-
-
-In the negative case scenario, the user should see appropriate logs in
-the secure enclave terminal. If capsule pass initial verification, but fails
-verifications performed during boot time, secure enclave will try new images
-predetermined number of times (defined in the code), before reverting back to
-the previous good bank.
-
-::
-
-  ...
-  metadata_write: success: active = 0, previous = 1
-  fwu_select_previous: in regular state by choosing previous active bank
-  ...
-
-*******************************************************
-Linux distro install and boot (applicable to FPGA only)
-*******************************************************
-
-To test Linux distro install and boot, the user should prepare two empty USB sticks.
-
-Download one of following Linux distro images:
- - Debian installer image: https://cdimage.debian.org/cdimage/weekly-builds/arm64/iso-dvd/
- - OpenSUSE Tumbleweed installer image: http://download.opensuse.org/ports/aarch64/tumbleweed/iso/
-   - The user should look for a DVD Snapshot like openSUSE-Tumbleweed-DVD-aarch64-Snapshot20211125-Media.iso
-
-Once the .iso file is downloaded, the .iso file needs to be flashed to your USB drive.
-
-In the given example here, we assume the USB device is ``/dev/sdb`` (the user
-should use `lsblk` command to confirm). Be cautious here and don't confuse your
-host PC's own hard drive with the USB drive. Then copy the contents of an iso
-file into the first USB stick, run:
-
-::
-
-  sudo dd if=</path/to/iso_file> of=/dev/sdb iflag=direct oflag=direct status=progress bs=1M; sync;
-
-Boot the MSP3 board with the first USB stick connected. Open following minicom sessions:
-
-::
-
-  sudo picocom -b 115200 /dev/ttyUSB0  # in one terminal
-  sudo picocom -b 115200 /dev/ttyUSB2  # in another terminal.
-
-Press <Ctrl+x>.
-
-Now plug in the second USB stick, the distro installation process will start.
-
-**NOTE:** Due to the performance limitation of Corstone1000 MPS3 FPGA, the
-distro installation process can take up to 24 hours to complete.
-
-Once installation is complete, unplug the first USB stick and reboot the board.
-After successfully installing and booting the Linux distro, the user should see
-a login prompt:
-
-::
-
-  debian login:
-
-Login with the username root.
-
-Run psa-arch-test (applicable to both FPGA and FVP)
----------------------------------------------------
-
-When running psa-arch-test on MPS3 FPGA, the user should make sure there is no
-USB stick connected to the board. Power on the board and boot the board to
-Linux. Then, the user should follow the steps below to run the psa_arch_tests.
-
-When running psa-arch-test on Corstone1000 FVP, the user should follow the
-instructions in `Running the software on FVP`_ section to boot Linux in FVP
-host_terminal_0, and login using the username ``root``.
-
-As a reference for the user's test results, the psa-arch-test report for `Corstone1000 software (CORSTONE1000-2022.02.18) <https://git.yoctoproject.org/meta-arm/tag/?h=CORSTONE1000-2022.02.18>`__
-can be found in `here <https://gitlab.arm.com/arm-reference-solutions/arm-reference-solutions-test-report/-/tree/master/embedded-a/corstone1000>`__.
-
-First, create a file containing SE_PROXY_SP UUID. Run:
-
-::
-
-  echo 46bb39d1-b4d9-45b5-88ff-040027dab249 > sp_uuid_list.txt
-
-Then, load FFA driver module into Linux kernel. Run:
-
-::
-
-  load_ffa_debugfs.sh .
-
-Then, check whether the FFA driver loaded correctly by using the following command:
-
-::
-
-  cat /proc/modules | grep arm_ffa_user
-
-The output should be:
-
-::
-
-  arm_ffa_user 16384 - - Live 0xffffffc0084b0000 (O)
-
-Now, run the PSA arch tests with following commands. The user should run the
-tests in following order:
-
-::
-
-  psa-iat-api-test
-  psa-crypto-api-test
-  psa-its-api-test
-  psa-ps-api-test
-
-********************************************************
-Linux distro: OpenSUSE Raw image installation (FVP Only)
-********************************************************
-
-Steps to download openSUSE Tumbleweed raw image:
-  - Go to: http://download.opensuse.org/ports/aarch64/tumbleweed/appliances/
-  - The user should look for a Tumbleweed-ARM-JeOS-efi.aarch64-* Snapshot, for example, ``openSUSE-Tumbleweed-ARM-JeOS-efi.aarch64-2022.03.18-Snapshot20220331.raw.xz``
-
-Once the .raw.xz file is downloaded, the raw image file needs to be extracted:
-
-::
-
-       unxz <file-name.raw.xz>
-
-
-The above command will generate a file ending with extension .raw image. Now, use the following command
-to run FVP with raw image installation process.
-
-::
-
-<_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C board.msd_mmc.p_mmc_file="${openSUSE raw image file path}" 
-
-After successfully installing and booting the Linux distro, the user should see
-a openSUSE login prompt.
-
-::
-
-      localhost login:
-
-Login with the username 'root' and password 'linux'.
-
-**************************************
-Running the software on FVP on Windows
-**************************************
-If the user needs to run the Corstone1000 software on FVP on Windows. The user
-should follow the build instructions in this document to build on Linux host
-PC, and copy the output binaries to the Windows PC where the FVP is located,
-and launch the FVP binary.
-
---------------
-
-*Copyright (c) 2021, Arm Limited. All rights reserved.*
-
-.. _Arm Ecosystem FVPs: https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps

meta-arm-bsp/documentation/fvp-baser-aemv8r64.md

@@ -29,7 +29,7 @@ and run:
 
  - FVP_Base_AEMv8R: v11.19.14
  - boot-wrapper-aarch64: provides PSCI support
- - U-Boot: v2022.04 - provides UEFI services
+ - U-Boot: v2022.01 - provides UEFI services
  - Linux kernel: linux-yocto-5.15
  - Linux kernel with PREEMPT\_RT support: linux-yocto-rt-5.15
 

meta-arm-bsp/documentation/musca-b1.md

@@ -4,6 +4,9 @@
 For a description of the hardware, go to
 https://developer.arm.com/tools-and-software/development-boards/iot-test-chips-and-boards/musca-b-test-chip-board
 
+For current supported hardware by Zephyr, go to
+https://docs.zephyrproject.org/2.3.0/boards/arm/v2m_musca/doc/index.html
+
 For emulated hardware, go to
 https://www.qemu.org/docs/master/system/arm/musca.html
 
@@ -11,5 +14,13 @@ https://www.qemu.org/docs/master/system/arm/musca.html
 In the local.conf file, MACHINE should be set as follows:
 MACHINE ?= "musca-b1"
 
-To build the trusted firmware-m:
+To build for Zephyr:
+```bash$ bitbake-layers layerindex-fetch meta-zephyr```
+```bash$ bitbake zephyr-philosophers```
+
+To build the trusted firmware-m (and not Zephyr):
 ```bash$ bitbake trusted-firmware-m```
+
+## Running
+To run Zephyr on the QEMU based machine, execute the following command
+```bash$ runqemu qemu-musca-b1```

meta-arm-bsp/documentation/requirements.txt

@@ -1,12 +0,0 @@
-# Copyright (c) 2022, Arm Limited.
-#
-# SPDX-License-Identifier: MIT
-
-# Read The Docs specific
-jinja2==3.1.1
-
-# Required to build the documentation
-sphinx==4.5.0
-sphinx_rtd_theme==1.0.0
-sphinx-copybutton==0.5.0
-docutils==0.17.1

meta-arm-bsp/documentation/tc0.md

@@ -0,0 +1,32 @@
+# TC0 Platform Support in meta-arm-bsp
+
+## Overview
+The Total Compute platform provides an envelope for all of Arm's latest IP and
+software solutions, optimised to work together. Further information can be
+found on the Total Compute community page:
+https://community.arm.com/developer/tools-software/oss-platforms/w/docs/606/total-compute
+
+The user guide for TC0 platform with detailed instructions for
+syncing and building the source code and running on TC0 Fixed Virtual Platform
+for poky and android distributions is available at:
+https://git.linaro.org/landing-teams/working/arm/arm-reference-platforms.git/tree/docs/tc0/user-guide.rst
+
+## Building
+In the local.conf file, MACHINE should be set as follows:
+MACHINE = "tc0"
+
+To build the required binaries for tc0, run the commmand:
+```bash$ bitbake tc-artifacts-image```
+
+Trusted-firmware-a is the final component to be built with the rest of the
+components dependent of it, therefore building tc-artifacts-image which depends
+on trusted-firmware-a will build all the required binaries.
+
+## Running
+To run the produced binaries in a TC0 Fixed Virtual Platform please get
+the run scripts at:
+https://git.linaro.org/landing-teams/working/arm/model-scripts.git/
+
+and follow the instructions in the user-guide.rst available in:
+https://git.linaro.org/landing-teams/working/arm/arm-reference-platforms.git/tree/docs/tc0/user-guide.rst
+

meta-arm-bsp/recipes-bsp/external-system/external-system_0.1.0.bb

@@ -1,47 +0,0 @@
-SUMMARY = "External system Cortex-M3 Firmware"
-DESCRIPTION = "Firmware to be loaded and run in External System Harness in\
-               support to the main application CPU."
-HOMEPAGE = "https://git.linaro.org/landing-teams/working/arm/external-system.git"
-DEPENDS = "gcc-arm-none-eabi-native"
-INHIBIT_DEFAULT_DEPS="1"
-LICENSE = "BSD-3-Clause & Apache-2.0"
-LIC_FILES_CHKSUM = "file://license.md;md5=e44b2531cd6ffe9dece394dbe988d9a0 \
-                    file://cmsis/LICENSE.txt;md5=e3fc50a88d0a364313df4b21ef20c29e"
-
-SRC_URI = "gitsm://git.gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx.git;protocol=https;branch=master"
-SRCREV = "8c9dca74b104ff6c9722fb0738ba93dd3719c080"
-PV .= "+git${SRCPV}"
-
-COMPATIBLE_MACHINE = "(corstone1000)"
-
-# PRODUCT is passed to the Makefile to specify the platform to be used.
-PRODUCT = "corstone-1000"
-
-S = "${WORKDIR}/git"
-B = "${WORKDIR}/build"
-
-LDFLAGS[unexport] = "1"
-
-do_compile() {
-    oe_runmake -C ${S} V=y \
-        BUILD_PATH=${B} \
-	PRODUCT=${PRODUCT} \
-	CROSS_COMPILE=arm-none-eabi- \
-        all
-}
-
-do_compile[cleandirs] = "${B}"
-
-do_install() {
-    install -D -p -m 0644 ${B}/product/${PRODUCT}/firmware/release/bin/firmware.bin ${D}/firmware/es_flashfw.bin
-}
-
-FILES:${PN} = "/firmware"
-SYSROOT_DIRS += "/firmware"
-
-inherit deploy
-
-do_deploy() {
-    cp -rf ${D}/firmware/* ${DEPLOYDIR}/
-}
-addtask deploy after do_install

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0001-feat-emulate-cntp-timer-register-accesses-using-cnth.patch

@@ -1,252 +0,0 @@
-From c8bd941579fb062359b683b184b851eea2ddb761 Mon Sep 17 00:00:00 2001
-From: Ben Horgan <ben.horgan@arm.com>
-Date: Fri, 4 Mar 2022 16:48:14 +0000
-Subject: [PATCH 1/5] feat: emulate cntp timer register accesses using cnthps
-
-Upstream-Status: Inappropriate [Experimental feature]
-Signed-off-by: Ben Horgan <ben.horgan@arm.com>
-Change-Id: I67508203273baf3bd8e6be2d99717028db945715
----
- Makefile                                |   3 +-
- src/arch/aarch64/hypervisor/BUILD.gn    |   1 +
- src/arch/aarch64/hypervisor/cpu.c       |  11 ++-
- src/arch/aarch64/hypervisor/handler.c   |   6 ++
- src/arch/aarch64/hypervisor/timer_el1.c | 104 ++++++++++++++++++++++++
- src/arch/aarch64/hypervisor/timer_el1.h |  20 +++++
- src/arch/aarch64/msr.h                  |   8 ++
- 7 files changed, 150 insertions(+), 3 deletions(-)
- create mode 100644 src/arch/aarch64/hypervisor/timer_el1.c
- create mode 100644 src/arch/aarch64/hypervisor/timer_el1.h
-
-diff --git a/Makefile b/Makefile
-index c9fb16f..6371a8a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -59,7 +59,8 @@ CHECKPATCH := $(CURDIR)/third_party/linux/scripts/checkpatch.pl \
- # debug_el1.c : uses XMACROS, which checkpatch doesn't understand.
- # perfmon.c : uses XMACROS, which checkpatch doesn't understand.
- # feature_id.c : uses XMACROS, which checkpatch doesn't understand.
--CHECKPATCH_IGNORE := "src/arch/aarch64/hypervisor/debug_el1.c\|src/arch/aarch64/hypervisor/perfmon.c\|src/arch/aarch64/hypervisor/feature_id.c"
-+# timer_el1.c : uses XMACROS, which checkpatch doesn't understand.
-+CHECKPATCH_IGNORE := "src/arch/aarch64/hypervisor/debug_el1.c\|src/arch/aarch64/hypervisor/perfmon.c\|src/arch/aarch64/hypervisor/feature_id.c\|src/arch/aarch64/hypervisor/timer_el1.c"
- 
- OUT ?= out/$(PROJECT)
- OUT_DIR = out/$(PROJECT)
-diff --git a/src/arch/aarch64/hypervisor/BUILD.gn b/src/arch/aarch64/hypervisor/BUILD.gn
-index 6068d1e..de1a414 100644
---- a/src/arch/aarch64/hypervisor/BUILD.gn
-+++ b/src/arch/aarch64/hypervisor/BUILD.gn
-@@ -45,6 +45,7 @@ source_set("hypervisor") {
-     "handler.c",
-     "perfmon.c",
-     "psci_handler.c",
-+    "timer_el1.c",
-     "vm.c",
-   ]
- 
-diff --git a/src/arch/aarch64/hypervisor/cpu.c b/src/arch/aarch64/hypervisor/cpu.c
-index c6cebdd..cb41e6e 100644
---- a/src/arch/aarch64/hypervisor/cpu.c
-+++ b/src/arch/aarch64/hypervisor/cpu.c
-@@ -91,13 +91,20 @@ void arch_regs_reset(struct vcpu *vcpu)
- 	if (is_primary) {
- 		/*
- 		 * cnthctl_el2 is redefined when VHE is enabled.
--		 * EL1PCTEN, don't trap phys cnt access.
--		 * EL1PCEN, don't trap phys timer access.
-+		 * EL1PCTEN, don't trap phys cnt access. Except when in
-+		 * secure world without vhe.
-+		 * EL1PCEN, don't trap phys timer access. Except when in
-+		 * secure world without vhe.
- 		 */
- 		if (has_vhe_support()) {
- 			cnthctl |= (1U << 10) | (1U << 11);
- 		} else {
-+#if SECURE_WORLD == 1
-+			cnthctl &= ~(1U << 0);
-+			cnthctl &= ~(1U << 1);
-+#else
- 			cnthctl |= (1U << 0) | (1U << 1);
-+#endif
- 		}
- 	}
- 
-diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
-index cd64d68..c9068c5 100644
---- a/src/arch/aarch64/hypervisor/handler.c
-+++ b/src/arch/aarch64/hypervisor/handler.c
-@@ -34,6 +34,7 @@
- #include "psci_handler.h"
- #include "smc.h"
- #include "sysregs.h"
-+#include "timer_el1.h"
- 
- /**
-  * Hypervisor Fault Address Register Non-Secure.
-@@ -1276,6 +1277,11 @@ void handle_system_register_access(uintreg_t esr_el2)
- 			inject_el1_unknown_exception(vcpu, esr_el2);
- 			return;
- 		}
-+	} else if (timer_el1_is_register_access(esr_el2)) {
-+		if (!timer_el1_process_access(vcpu, vm_id, esr_el2)) {
-+			inject_el1_unknown_exception(vcpu, esr_el2);
-+			return;
-+		}
- 	} else {
- 		inject_el1_unknown_exception(vcpu, esr_el2);
- 		return;
-diff --git a/src/arch/aarch64/hypervisor/timer_el1.c b/src/arch/aarch64/hypervisor/timer_el1.c
-new file mode 100644
-index 0000000..c30e554
---- /dev/null
-+++ b/src/arch/aarch64/hypervisor/timer_el1.c
-@@ -0,0 +1,104 @@
-+/*
-+ * Copyright 2022 The Hafnium Authors.
-+ *
-+ * Use of this source code is governed by a BSD-style
-+ * license that can be found in the LICENSE file or at
-+ * https://opensource.org/licenses/BSD-3-Clause.
-+ */
-+
-+#include "timer_el1.h"
-+
-+#include "hf/dlog.h"
-+
-+#include "msr.h"
-+#include "sysregs.h"
-+
-+/*
-+ * Physical timer (CNTP) register encodings as defined in
-+ * table D13-8 of the ARMv8 ARM (DDI0487F).
-+ * TYPE, op0, op1, crn, crm, op2
-+ * The register names are the concatenation of
-+ * "CNTP_", TYPE and "_EL2".
-+ */
-+#define CNTP_REGISTERS          \
-+	X(CTL,  3, 3, 14, 2, 1) \
-+	X(CVAL, 3, 3, 14, 2, 2) \
-+	X(TVAL, 3, 3, 14, 2, 0) \
-+
-+bool timer_el1_is_register_access(uintreg_t esr)
-+{
-+	uintreg_t sys_register = GET_ISS_SYSREG(esr);
-+	bool is_timer_access;
-+	switch (sys_register) {
-+#define X(type, op0, op1, crn, crm, op2)                  \
-+	case (GET_ISS_ENCODING(op0, op1, crn, crm, op2)): \
-+		is_timer_access = true;                   \
-+		break;
-+			CNTP_REGISTERS
-+#undef X
-+	case (GET_ISS_ENCODING(3, 3, 14, 0, 1)):
-+		is_timer_access = true;
-+		break;
-+	default:
-+		is_timer_access = false;
-+	}
-+
-+	return is_timer_access;
-+}
-+
-+/* Accesses to CNTP timer emulated with CNTHPS */
-+bool timer_el1_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
-+			      uintreg_t esr)
-+{
-+	uintreg_t sys_register = GET_ISS_SYSREG(esr);
-+	uintreg_t rt_register = GET_ISS_RT(esr);
-+	uintreg_t value;
-+
-+	if (ISS_IS_READ(esr)) {
-+		switch (sys_register) {
-+#define X(type, op0, op1, crn, crm, op2)                           \
-+		case (GET_ISS_ENCODING(op0, op1, crn, crm, op2)):  \
-+			value = read_msr(MSR_CNTHPS_##type##_EL2); \
-+			vcpu->regs.r[rt_register] = value;         \
-+			break;
-+				CNTP_REGISTERS
-+#undef X
-+		case (GET_ISS_ENCODING(3, 3, 14, 0, 1)):
-+			value = read_msr(cntpct_el0);
-+			vcpu->regs.r[rt_register] = value;
-+			break;
-+		default:
-+			dlog_notice(
-+				"Unsupported timer register "
-+				"read: "
-+				"op0=%d, op1=%d, crn=%d, crm=%d, op2=%d, "
-+				"rt=%d.\n",
-+				GET_ISS_OP0(esr), GET_ISS_OP1(esr),
-+				GET_ISS_CRN(esr), GET_ISS_CRM(esr),
-+				GET_ISS_OP2(esr), GET_ISS_RT(esr));
-+			break;
-+		}
-+	} else {
-+		value = vcpu->regs.r[rt_register];
-+		switch (sys_register) {
-+#define X(type, op0, op1, crn, crm, op2)                           \
-+		case (GET_ISS_ENCODING(op0, op1, crn, crm, op2)):  \
-+			write_msr(MSR_CNTHPS_##type##_EL2, value); \
-+			break;
-+				CNTP_REGISTERS
-+#undef X
-+		default:
-+			dlog_notice(
-+				"Unsupported timer register "
-+				"write: "
-+				"op0=%d, op1=%d, crn=%d, crm=%d, op2=%d, "
-+				"rt=%d, value=%d.\n",
-+				GET_ISS_OP0(esr), GET_ISS_OP1(esr),
-+				GET_ISS_CRN(esr), GET_ISS_CRM(esr),
-+				GET_ISS_OP2(esr), GET_ISS_RT(esr), value);
-+			break;
-+		}
-+	}
-+
-+	return true;
-+}
-diff --git a/src/arch/aarch64/hypervisor/timer_el1.h b/src/arch/aarch64/hypervisor/timer_el1.h
-new file mode 100644
-index 0000000..04a43b6
---- /dev/null
-+++ b/src/arch/aarch64/hypervisor/timer_el1.h
-@@ -0,0 +1,20 @@
-+/*
-+ * Copyright 2022 The Hafnium Authors.
-+ *
-+ * Use of this source code is governed by a BSD-style
-+ * license that can be found in the LICENSE file or at
-+ * https://opensource.org/licenses/BSD-3-Clause.
-+ */
-+
-+#pragma once
-+
-+#include "hf/arch/types.h"
-+
-+#include "hf/cpu.h"
-+
-+#include "vmapi/hf/ffa.h"
-+
-+bool timer_el1_is_register_access(uintreg_t esr);
-+
-+bool timer_el1_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
-+			      uintreg_t esr);
-diff --git a/src/arch/aarch64/msr.h b/src/arch/aarch64/msr.h
-index cd6778b..55e7833 100644
---- a/src/arch/aarch64/msr.h
-+++ b/src/arch/aarch64/msr.h
-@@ -126,3 +126,11 @@
- #define MSR_ELR_EL12 S3_5_C4_C0_1
- 
- #endif
-+
-+/*
-+ * Secure EL2 Physical timer (CNTHPS) register encodings as defined in
-+ * table D13-8 of the ARMv8 ARM (DDI0487F).
-+ */
-+#define MSR_CNTHPS_CTL_EL2 S3_4_C14_C5_1
-+#define MSR_CNTHPS_CVAL_EL2 S3_4_C14_C5_2
-+#define MSR_CNTHPS_TVAL_EL2 S3_4_C14_C5_0
--- 
-2.17.1
-

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0001-fix-fail-mapping-if-start-address-exceeds-page-table.patch

@@ -0,0 +1,36 @@
+From dace8802ae6332eb4ca29faf288b96c83fadb2ae Mon Sep 17 00:00:00 2001
+From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Date: Tue, 28 Sep 2021 11:22:27 +0100
+Subject: [PATCH 1/2] fix: fail mapping if start address exceeds page table
+ mapping limit
+
+Currently the end address is capped to stay within bounds of page
+table range. If in case the start address is beyond bounds of
+page table then no mapping is made but the mm_map_root incorrectly
+returns success.
+
+Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Change-Id: I858ac653aafff62e9a2cf5771a32dc38690cd899
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ src/mm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/mm.c b/src/mm.c
+index 6f15748..c57e24e 100644
+--- a/src/mm.c
++++ b/src/mm.c
+@@ -472,6 +472,10 @@ static bool mm_ptable_identity_map(struct mm_ptable *t, paddr_t pa_begin,
+ 	 */
+ 	CHECK(root_level >= 2);
+ 
++	if (begin >= ptable_end) {
++		return false;
++	}
++
+ 	/* Cap end to stay within the bounds of the page table. */
+ 	if (end > ptable_end) {
+ 		end = ptable_end;
+-- 
+2.30.2
+

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0002-Extend-Stage-1-mapping-limit.patch

@@ -0,0 +1,197 @@
+From 45187e2f9c73ea96e69d1f46f0c24ff31d7f9298 Mon Sep 17 00:00:00 2001
+From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Date: Tue, 28 Sep 2021 11:25:25 +0100
+Subject: [PATCH 2/2] Extend Stage 1 mapping limit
+
+As Stage 1 mappings are limited to 512GB, registering FF-A RxTx buffers
+fails when the physical address of these buffers exceeds 512GB. This
+fix removes the limitation and allows Stage 1 mapping up to the
+supported PA range.
+
+Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Change-Id: I4cb8d68fc18e0edf4a7ee06ae636849d552d72a9
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ inc/hf/arch/mm.h      |  7 ++++++-
+ src/arch/aarch64/mm.c | 38 ++++++++++++++++++++++++++------------
+ src/arch/fake/mm.c    |  9 +++++++--
+ src/mm.c              |  8 +++++++-
+ 4 files changed, 46 insertions(+), 16 deletions(-)
+
+diff --git a/inc/hf/arch/mm.h b/inc/hf/arch/mm.h
+index ef64dd3..d277369 100644
+--- a/inc/hf/arch/mm.h
++++ b/inc/hf/arch/mm.h
+@@ -162,7 +162,12 @@ uint32_t arch_mm_stage1_attrs_to_mode(uint64_t attrs);
+ /**
+  * Initializes the arch specific memory management.
+  */
+-bool arch_mm_init(paddr_t table);
++bool arch_mm_init(void);
++
++/**
++ * Set ptable base address.
++ */
++void arch_mm_set_ptable(paddr_t table);
+ 
+ /**
+  * Return the arch specific mm mode for send/recv pages of given VM ID.
+diff --git a/src/arch/aarch64/mm.c b/src/arch/aarch64/mm.c
+index 7256c28..0ee0bb6 100644
+--- a/src/arch/aarch64/mm.c
++++ b/src/arch/aarch64/mm.c
+@@ -141,6 +141,7 @@ struct arch_mm_config {
+ 	uintreg_t hcr_el2;
+ } arch_mm_config;
+ 
++static uint8_t mm_s1_max_level;
+ static uint8_t mm_s2_max_level;
+ static uint8_t mm_s2_root_table_count;
+ 
+@@ -676,12 +677,7 @@ uint32_t arch_mm_stage2_attrs_to_mode(uint64_t attrs)
+ 
+ uint8_t arch_mm_stage1_max_level(void)
+ {
+-	/*
+-	 * For stage 1 we hard-code this to 2 for now so that we can
+-	 * save one page table level at the expense of limiting the
+-	 * physical memory to 512GB.
+-	 */
+-	return 2;
++	return mm_s1_max_level;
+ }
+ 
+ uint8_t arch_mm_stage2_max_level(void)
+@@ -735,10 +731,16 @@ uint64_t arch_mm_combine_table_entry_attrs(uint64_t table_attrs,
+ 	return block_attrs;
+ }
+ 
++void
++arch_mm_set_ptable(paddr_t table)
++{
++	arch_mm_config.ttbr0_el2 = pa_addr(table);
++}
++
+ /**
+  * This is called early in initialization without MMU or caches enabled.
+  */
+-bool arch_mm_init(paddr_t table)
++bool arch_mm_init(void)
+ {
+ 	static const int pa_bits_table[16] = {32, 36, 40, 42, 44, 48};
+ 	uint64_t features = read_msr(id_aa64mmfr0_el1);
+@@ -784,6 +786,13 @@ bool arch_mm_init(paddr_t table)
+ 		mm_s2_max_level = 1;
+ 	}
+ 
++	if (pa_bits >= 40) {
++		mm_s1_max_level = 3;
++	} else {
++		/* Setting to 2 covers physical memory upto 512GB */
++		mm_s1_max_level = 2;
++	}
++
+ 	/*
+ 	 * Since the shallowest possible tree is used, the maximum number of
+ 	 * concatenated tables must be used. This means if no more than 4 bits
+@@ -800,6 +809,10 @@ bool arch_mm_init(paddr_t table)
+ 		"Stage 2 has %d page table levels with %d pages at the root.\n",
+ 		mm_s2_max_level + 1, mm_s2_root_table_count);
+ 
++	dlog_info("Stage 1 has %d page table levels with %d pages at the "
++		  "root.\n", mm_s1_max_level + 1,
++		  arch_mm_stage1_root_table_count());
++
+ 	/*
+ 	 * If the PE implements S-EL2 then VTCR_EL2.NSA/NSW bits are significant
+ 	 * in secure state. In non-secure state, NSA/NSW behave as if set to
+@@ -818,8 +831,6 @@ bool arch_mm_init(paddr_t table)
+ 	}
+ 
+ 	arch_mm_config = (struct arch_mm_config){
+-		.ttbr0_el2 = pa_addr(table),
+-
+ 		.vtcr_el2 =
+ 			(1U << 31) |		   /* RES1. */
+ 			(nsa_nsw << 29) |	   /* NSA/NSW. */
+@@ -879,14 +890,16 @@ bool arch_mm_init(paddr_t table)
+ 			 << 24) | /* IRGN1, normal mem, WB RA WA Cacheable. */
+ 			(1UL << 23) | /* EPD1 - Disable TTBR1_EL2 translation */
+ 			(0UL << 22) | /* TTBR0_EL2.ASID defines ASID */
+-			(25UL << 16) | /* T1SZ, input address is 2^39 bytes. */
++			((64 - pa_bits) << 16) | /* T1SZ, input address is *
++						    2^pa_bits bytes. */
+ 			(0UL << 14) |  /* TG0, granule size, 4KB. */
+ 			(3UL << 12) |  /* SH0, inner shareable. */
+ 			(1UL
+ 			 << 10) | /* ORGN0, normal mem, WB RA WA Cacheable. */
+ 			(1UL
+ 			 << 8) | /* IRGN0, normal mem, WB RA WA Cacheable. */
+-			(25UL << 0) | /* T0SZ, input address is 2^39 bytes. */
++			((64 - pa_bits) << 0) | /* T0SZ, input address is *
++						   2^pa_bits bytes. */
+ 			0;
+ 	} else {
+ 		arch_mm_config.tcr_el2 =
+@@ -896,7 +909,8 @@ bool arch_mm_init(paddr_t table)
+ 			(3 << 12) |		   /* SH0, inner shareable. */
+ 			(1 << 10) | /* ORGN0, normal mem, WB RA WA Cacheable. */
+ 			(1 << 8) |  /* IRGN0, normal mem, WB RA WA Cacheable. */
+-			(25 << 0) | /* T0SZ, input address is 2^39 bytes. */
++			((64 - pa_bits) << 0) | /* T0SZ, input address is *
++						   2^pa_bits bytes. */
+ 			0;
+ 	}
+ 	return true;
+diff --git a/src/arch/fake/mm.c b/src/arch/fake/mm.c
+index e06a8b7..8ac63fa 100644
+--- a/src/arch/fake/mm.c
++++ b/src/arch/fake/mm.c
+@@ -161,13 +161,18 @@ uint32_t arch_mm_stage1_attrs_to_mode(uint64_t attrs)
+ 	return attrs >> PTE_ATTR_MODE_SHIFT;
+ }
+ 
+-bool arch_mm_init(paddr_t table)
++bool arch_mm_init(void)
+ {
+ 	/* No initialization required. */
+-	(void)table;
+ 	return true;
+ }
+ 
++void arch_mm_set_ptable(paddr_t table)
++{
++	/* No initialization required. */
++	(void)table;
++}
++
+ uint32_t arch_mm_extra_attributes_from_vm(ffa_vm_id_t id)
+ {
+ 	(void)id;
+diff --git a/src/mm.c b/src/mm.c
+index c57e24e..aa0c512 100644
+--- a/src/mm.c
++++ b/src/mm.c
+@@ -1114,6 +1114,10 @@ bool mm_init(struct mpool *ppool)
+ 	dlog_info("data: %#x - %#x\n", pa_addr(layout_data_begin()),
+ 		  pa_addr(layout_data_end()));
+ 
++	if (!arch_mm_init()) {
++		return false;
++	}
++
+ 	/* ASID 0 is reserved for use by the hypervisor. */
+ 	if (!mm_ptable_init(&ptable, 0, MM_FLAG_STAGE1, ppool)) {
+ 		dlog_error("Unable to allocate memory for page table.\n");
+@@ -1133,5 +1137,7 @@ bool mm_init(struct mpool *ppool)
+ 	mm_identity_map(stage1_locked, layout_data_begin(), layout_data_end(),
+ 			MM_MODE_R | MM_MODE_W, ppool);
+ 
+-	return arch_mm_init(ptable.root);
++	arch_mm_set_ptable(ptable.root);
++
++	return true;
+ }
+-- 
+2.30.2
+

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0002-feat-emulate-interrupt-controller-register-access.patch

@@ -1,159 +0,0 @@
-From 380f2cf944dd5db36c168a11d31a46ad14cdcb6d Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Tue, 26 Apr 2022 14:43:58 +0100
-Subject: [PATCH 4/5] feat: emulate interrupt controller register access
-
-This emulates ICC_SGI1R_EL1 and ICC_IGRPEN1_EL1 register
-
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Change-Id: I0c11f034f3676067597461a183a341c809adcaa4
-Upstream-Status: Inappropriate [Experimental feature]
----
- src/arch/aarch64/hypervisor/handler.c |  5 ++
- src/arch/aarch64/hypervisor/perfmon.c | 84 +++++++++++++++++++++++++++
- src/arch/aarch64/hypervisor/perfmon.h |  5 ++
- src/arch/aarch64/msr.h                |  3 +
- 4 files changed, 97 insertions(+)
-
-diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
-index c9068c5..b9aa5d8 100644
---- a/src/arch/aarch64/hypervisor/handler.c
-+++ b/src/arch/aarch64/hypervisor/handler.c
-@@ -1282,6 +1282,11 @@ void handle_system_register_access(uintreg_t esr_el2)
- 			inject_el1_unknown_exception(vcpu, esr_el2);
- 			return;
- 		}
-+	} else if (intr_ctrl_is_register_access(esr_el2)) {
-+		if (!intr_ctrl_el1_process_access(vcpu, vm_id, esr_el2)) {
-+			inject_el1_unknown_exception(vcpu, esr_el2);
-+			return;
-+		}
- 	} else {
- 		inject_el1_unknown_exception(vcpu, esr_el2);
- 		return;
-diff --git a/src/arch/aarch64/hypervisor/perfmon.c b/src/arch/aarch64/hypervisor/perfmon.c
-index f13b035..05e216c 100644
---- a/src/arch/aarch64/hypervisor/perfmon.c
-+++ b/src/arch/aarch64/hypervisor/perfmon.c
-@@ -116,6 +116,10 @@
- 	X(PMEVTYPER30_EL0   , 3, 3, 14, 15, 6) \
- 	X(PMCCFILTR_EL0     , 3, 3, 14, 15, 7)
- 
-+#define INTR_CTRL_REGISTERS                    \
-+	X(ICC_IGRPEN1_EL1   , 3, 0, 12, 12, 7) \
-+	X(ICC_SGI1R_EL1     , 3, 0, 12, 11, 5) \
-+
- /* clang-format on */
- 
- /**
-@@ -232,3 +236,83 @@ uintreg_t perfmon_get_pmccfiltr_el0_init_value(ffa_vm_id_t vm_id)
- 
- 	return 0;
- }
-+
-+bool intr_ctrl_is_register_access(uintreg_t esr)
-+{
-+	uintreg_t op0 = GET_ISS_OP0(esr);
-+	uintreg_t op1 = GET_ISS_OP1(esr);
-+	uintreg_t crn = GET_ISS_CRN(esr);
-+	uintreg_t crm = GET_ISS_CRM(esr);
-+
-+	if (op0 == 3 && op1 == 0 && crn == 12 && crm == 12) {
-+		return true;
-+	}
-+
-+	if (op0 == 3 && op1 == 0 && crn == 12 && crm == 11) {
-+		return true;
-+	}
-+
-+	return false;
-+}
-+
-+bool intr_ctrl_el1_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
-+				  uintreg_t esr)
-+{
-+	uintreg_t sys_register = GET_ISS_SYSREG(esr);
-+	uintreg_t rt_register = GET_ISS_RT(esr);
-+	uintreg_t value;
-+
-+	/* +1 because Rt can access register XZR */
-+	CHECK(rt_register < NUM_GP_REGS + 1);
-+
-+	if (ISS_IS_READ(esr)) {
-+		switch (sys_register) {
-+#define X(reg_name, op0, op1, crn, crm, op2)              \
-+	case (GET_ISS_ENCODING(op0, op1, crn, crm, op2)): \
-+		value = read_msr(reg_name);               \
-+		break;
-+			INTR_CTRL_REGISTERS
-+#undef X
-+		default:
-+			value = vcpu->regs.r[rt_register];
-+			dlog_notice(
-+				"Unsupported interrupt control register "
-+				"read: "
-+				"op0=%d, op1=%d, crn=%d, crm=%d, op2=%d, "
-+				"rt=%d.\n",
-+				GET_ISS_OP0(esr), GET_ISS_OP1(esr),
-+				GET_ISS_CRN(esr), GET_ISS_CRM(esr),
-+				GET_ISS_OP2(esr), GET_ISS_RT(esr));
-+			break;
-+		}
-+		if (rt_register != RT_REG_XZR) {
-+			vcpu->regs.r[rt_register] = value;
-+		}
-+	} else {
-+		if (rt_register != RT_REG_XZR) {
-+			value = vcpu->regs.r[rt_register];
-+		} else {
-+			value = 0;
-+		}
-+		switch (sys_register) {
-+#define X(reg_name, op0, op1, crn, crm, op2)              \
-+	case (GET_ISS_ENCODING(op0, op1, crn, crm, op2)): \
-+		write_msr(reg_name, value);               \
-+		break;
-+			INTR_CTRL_REGISTERS
-+#undef X
-+		default:
-+			dlog_notice(
-+				"Unsupported interrupt control register "
-+				"write: "
-+				"op0=%d, op1=%d, crn=%d, crm=%d, op2=%d, "
-+				"rt=%d.\n",
-+				GET_ISS_OP0(esr), GET_ISS_OP1(esr),
-+				GET_ISS_CRN(esr), GET_ISS_CRM(esr),
-+				GET_ISS_OP2(esr), GET_ISS_RT(esr));
-+			break;
-+		}
-+	}
-+
-+	return true;
-+}
-diff --git a/src/arch/aarch64/hypervisor/perfmon.h b/src/arch/aarch64/hypervisor/perfmon.h
-index 81669ba..c90d45b 100644
---- a/src/arch/aarch64/hypervisor/perfmon.h
-+++ b/src/arch/aarch64/hypervisor/perfmon.h
-@@ -70,3 +70,8 @@ bool perfmon_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
- 			    uintreg_t esr_el2);
- 
- uintreg_t perfmon_get_pmccfiltr_el0_init_value(ffa_vm_id_t vm_id);
-+
-+bool intr_ctrl_is_register_access(uintreg_t esr);
-+
-+bool intr_ctrl_el1_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
-+				  uintreg_t esr);
-diff --git a/src/arch/aarch64/msr.h b/src/arch/aarch64/msr.h
-index 55e7833..82aa884 100644
---- a/src/arch/aarch64/msr.h
-+++ b/src/arch/aarch64/msr.h
-@@ -134,3 +134,6 @@
- #define MSR_CNTHPS_CTL_EL2 S3_4_C14_C5_1
- #define MSR_CNTHPS_CVAL_EL2 S3_4_C14_C5_2
- #define MSR_CNTHPS_TVAL_EL2 S3_4_C14_C5_0
-+
-+#define ICC_IGRPEN1_EL1 S3_0_C12_C12_7
-+#define ICC_SGI1R_EL1 S3_0_C12_C11_5
--- 
-2.17.1
-

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0003-tc-increase-heap-pages.patch

@@ -1,27 +0,0 @@
-From e918cc5179241e1d35ba4b465b035b74b88e55d2 Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Fri, 29 Apr 2022 20:07:50 +0100
-Subject: [PATCH] tc: increase heap pages
-
-Upstream-Status: Pending
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
----
- /BUILD.gn | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a//BUILD.gn b//BUILD.gn
-index 5d84d13..4ea0890 100644
---- a//BUILD.gn
-+++ b//BUILD.gn
-@@ -233,7 +233,7 @@ aarch64_toolchains("secure_tc") {
-   gicd_base_address = "0x30000000"
-   gicr_base_address = "0x30080000"
-   gicr_frames = 8
--  heap_pages = 60
-+  heap_pages = 120
-   max_cpus = 8
-   max_vms = 16
-   branch_protection = "standard"
--- 
-2.30.2
-

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0004-feat-disable-alignment-check-for-EL0-partitions.patch

@@ -1,320 +0,0 @@
-From 1e24b45a8ff34af45dda45c57f8403452d384f99 Mon Sep 17 00:00:00 2001
-From: Olivier Deprez <olivier.deprez@arm.com>
-Date: Mon, 8 Aug 2022 19:14:23 +0200
-Subject: [PATCH] feat: disable alignment check for EL0 partitions
-
-Relax hw alignment check specifically for (S-)EL0 partitions when
-Hafnium runs with VHE enabled. EL1 partitions have a specific control
-for EL1 and EL0 with respect to alignment check.
-Create a hyp_state structure (from already defined flying registers)
-within the vCPU context to hold the Hypervisor EL2 static configuration
-applied when a vCPU runs. This state is switched back and forth when
-running the Hypervisor or the VM.
-Add SCTLR_EL2 to this context. An EL0 partition context is initialized
-with SCTLR_EL2.A=0 such that alignment check is disabled when EL0 runs
-in the EL2&0 translation regime. SCTLR_EL2.A is set back when returning
-to the Hypervisor such that Hypervisor execution runs with aligment
-check enabled at EL2.
-Remove HCR_EL2 saving from vCPU exit path provided this register state
-is static and doesn't change while a vCPU runs.
-The rationale for such change is to permit running upstream SW stacks
-such as the EDKII/StandaloneMm [1] for which default build assumes
-unaligned accesses are permitted. Similar query exists for running
-Trusted Services on top of Hafnium [2].
-
-[1] https://github.com/tianocore/edk2/tree/master/StandaloneMmPkg
-[2] https://trusted-services.readthedocs.io/en/integration/
-
-Signed-off-by: Olivier Deprez <olivier.deprez@arm.com>
-Change-Id: I2906f4c712425fcfb31adbf89e2e3b9ca293f181
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/hafnium/hafnium/+/16195]
----
- src/arch/aarch64/hypervisor/cpu.c        |  9 ++++---
- src/arch/aarch64/hypervisor/exceptions.S | 32 ++++++++++++++++--------
- src/arch/aarch64/hypervisor/feature_id.c |  6 ++---
- src/arch/aarch64/hypervisor/handler.c    | 18 +++++++------
- src/arch/aarch64/inc/hf/arch/types.h     |  9 +++++--
- src/arch/aarch64/mm.c                    |  2 +-
- src/arch/aarch64/sysregs.c               | 11 ++++++--
- src/arch/aarch64/sysregs.h               |  2 +-
- 8 files changed, 59 insertions(+), 30 deletions(-)
-
-diff --git a/src/arch/aarch64/hypervisor/cpu.c b/src/arch/aarch64/hypervisor/cpu.c
-index d2df77d..a000159 100644
---- a/src/arch/aarch64/hypervisor/cpu.c
-+++ b/src/arch/aarch64/hypervisor/cpu.c
-@@ -115,7 +115,9 @@ void arch_regs_reset(struct vcpu *vcpu)
- 		}
- 	}
- 
--	r->hcr_el2 = get_hcr_el2_value(vm_id, vcpu->vm->el0_partition);
-+	r->hyp_state.hcr_el2 =
-+		get_hcr_el2_value(vm_id, vcpu->vm->el0_partition);
-+	r->hyp_state.sctlr_el2 = get_sctlr_el2_value(vcpu->vm->el0_partition);
- 	r->lazy.cnthctl_el2 = cnthctl;
- 	if (vcpu->vm->el0_partition) {
- 		CHECK(has_vhe_support());
-@@ -125,10 +127,11 @@ void arch_regs_reset(struct vcpu *vcpu)
- 		 * are ignored and treated as 0. There is no need to mask the
- 		 * VMID (used as asid) to only 8 bits.
- 		 */
--		r->ttbr0_el2 = pa_addr(table) | ((uint64_t)vm_id << 48);
-+		r->hyp_state.ttbr0_el2 =
-+			pa_addr(table) | ((uint64_t)vm_id << 48);
- 		r->spsr = PSR_PE_MODE_EL0T;
- 	} else {
--		r->ttbr0_el2 = read_msr(ttbr0_el2);
-+		r->hyp_state.ttbr0_el2 = read_msr(ttbr0_el2);
- 		r->lazy.vtcr_el2 = arch_mm_get_vtcr_el2();
- 		r->lazy.vttbr_el2 = pa_addr(table) | ((uint64_t)vm_id << 48);
- #if SECURE_WORLD == 1
-diff --git a/src/arch/aarch64/hypervisor/exceptions.S b/src/arch/aarch64/hypervisor/exceptions.S
-index 539e196..d3732f8 100644
---- a/src/arch/aarch64/hypervisor/exceptions.S
-+++ b/src/arch/aarch64/hypervisor/exceptions.S
-@@ -20,6 +20,9 @@
- #define ID_AA64PFR0_SVE_SHIFT (32)
- #define ID_AA64PFR0_SVE_LENGTH (4)
- 
-+#define SCTLR_EL2_A_SHIFT	(1)
-+#define HCR_EL2_TGE_SHIFT	(27)
-+
- /**
-  * Saves the volatile registers into the register buffer of the current vCPU.
-  */
-@@ -51,8 +54,6 @@
- 	mrs x1, elr_el2
- 	mrs x2, spsr_el2
- 	stp x1, x2, [x18, #VCPU_REGS + 8 * 31]
--	mrs x1, hcr_el2
--	str x1, [x18, #VCPU_REGS + 8 * 33]
- .endm
- 
- /**
-@@ -871,12 +872,13 @@ vcpu_restore_volatile_and_run:
- 	msr elr_el2, x1
- 	msr spsr_el2, x2
- 
--	ldr x1, [x0, #VCPU_REGS + 8 * 33]
-+	ldp x1, x2, [x0, #VCPU_REGS + 8 * 33]
- 	msr hcr_el2, x1
-+	msr ttbr0_el2, x2
- 	isb
- 
--	ldr x1, [x0, #VCPU_REGS + 8 * 34]
--	msr ttbr0_el2, x1
-+	ldr x1, [x0, #VCPU_REGS + 8 * 35]
-+	msr sctlr_el2, x1
- 	isb
- 
- 	/* Restore x0..x3, which we have used as scratch before. */
-@@ -886,15 +888,17 @@ vcpu_restore_volatile_and_run:
- 
- #if ENABLE_VHE
- enable_vhe_tge:
-+	mrs x0, id_aa64mmfr1_el1
-+	tst x0, #0xf00
-+	b.eq 1f
-+
- 	/**
- 	 * Switch to host mode ({E2H, TGE} = {1,1}) when VHE is enabled.
- 	 * Note that E2H is always set when VHE is enabled.
- 	 */
--	mrs x0, id_aa64mmfr1_el1
--	tst x0, #0xf00
--	b.eq 1f
--	orr x1, x1, #(1 << 27)
--	msr hcr_el2, x1
-+	mrs x0, hcr_el2
-+	orr x0, x0, #(1 << HCR_EL2_TGE_SHIFT)
-+	msr hcr_el2, x0
- 	isb
- 
- 	/**
-@@ -905,6 +909,14 @@ enable_vhe_tge:
- 	ldr x0, [x0]
- 	msr ttbr0_el2, x0
- 	isb
-+
-+	/**
-+	 * Enable alignment check while Hypervisor runs.
-+	 */
-+	mrs x0, sctlr_el2
-+	orr x0, x0, #(1 << SCTLR_EL2_A_SHIFT)
-+	msr sctlr_el2, x0
-+	isb
- 1:
- 	ret
- #endif
-diff --git a/src/arch/aarch64/hypervisor/feature_id.c b/src/arch/aarch64/hypervisor/feature_id.c
-index ed3bf8f..57f3262 100644
---- a/src/arch/aarch64/hypervisor/feature_id.c
-+++ b/src/arch/aarch64/hypervisor/feature_id.c
-@@ -175,7 +175,7 @@ void feature_set_traps(struct vm *vm, struct arch_regs *regs)
- 		~(ID_AA64MMFR1_EL1_VH_MASK << ID_AA64MMFR1_EL1_VH_SHIFT);
- 
- 	if (features & HF_FEATURE_RAS) {
--		regs->hcr_el2 |= HCR_EL2_TERR;
-+		regs->hyp_state.hcr_el2 |= HCR_EL2_TERR;
- 		vm->arch.tid3_masks.id_aa64mmfr1_el1 &=
- 			~ID_AA64MMFR1_EL1_SPEC_SEI;
- 		vm->arch.tid3_masks.id_aa64pfr0_el1 &= ~ID_AA64PFR0_EL1_RAS;
-@@ -221,14 +221,14 @@ void feature_set_traps(struct vm *vm, struct arch_regs *regs)
- 	}
- 
- 	if (features & HF_FEATURE_LOR) {
--		regs->hcr_el2 |= HCR_EL2_TLOR;
-+		regs->hyp_state.hcr_el2 |= HCR_EL2_TLOR;
- 
- 		vm->arch.tid3_masks.id_aa64mmfr1_el1 &= ~ID_AA64MMFR1_EL1_LO;
- 	}
- 
- 	if (features & HF_FEATURE_PAUTH) {
- 		/* APK and API bits *enable* trapping when cleared. */
--		regs->hcr_el2 &= ~(HCR_EL2_APK | HCR_EL2_API);
-+		regs->hyp_state.hcr_el2 &= ~(HCR_EL2_APK | HCR_EL2_API);
- 
- 		vm->arch.tid3_masks.id_aa64isar1_el1 &= ~ID_AA64ISAR1_EL1_GPI;
- 		vm->arch.tid3_masks.id_aa64isar1_el1 &= ~ID_AA64ISAR1_EL1_GPA;
-diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
-index cd5146b..8a3d628 100644
---- a/src/arch/aarch64/hypervisor/handler.c
-+++ b/src/arch/aarch64/hypervisor/handler.c
-@@ -272,9 +272,9 @@ noreturn void sync_current_exception_noreturn(uintreg_t elr, uintreg_t spsr)
- static void set_virtual_irq(struct arch_regs *r, bool enable)
- {
- 	if (enable) {
--		r->hcr_el2 |= HCR_EL2_VI;
-+		r->hyp_state.hcr_el2 |= HCR_EL2_VI;
- 	} else {
--		r->hcr_el2 &= ~HCR_EL2_VI;
-+		r->hyp_state.hcr_el2 &= ~HCR_EL2_VI;
- 	}
- }
- 
-@@ -283,14 +283,15 @@ static void set_virtual_irq(struct arch_regs *r, bool enable)
-  */
- static void set_virtual_irq_current(bool enable)
- {
--	uintreg_t hcr_el2 = current()->regs.hcr_el2;
-+	struct vcpu *vcpu = current();
-+	uintreg_t hcr_el2 = vcpu->regs.hyp_state.hcr_el2;
- 
- 	if (enable) {
- 		hcr_el2 |= HCR_EL2_VI;
- 	} else {
- 		hcr_el2 &= ~HCR_EL2_VI;
- 	}
--	current()->regs.hcr_el2 = hcr_el2;
-+	vcpu->regs.hyp_state.hcr_el2 = hcr_el2;
- }
- 
- /**
-@@ -300,9 +301,9 @@ static void set_virtual_irq_current(bool enable)
- static void set_virtual_fiq(struct arch_regs *r, bool enable)
- {
- 	if (enable) {
--		r->hcr_el2 |= HCR_EL2_VF;
-+		r->hyp_state.hcr_el2 |= HCR_EL2_VF;
- 	} else {
--		r->hcr_el2 &= ~HCR_EL2_VF;
-+		r->hyp_state.hcr_el2 &= ~HCR_EL2_VF;
- 	}
- }
- 
-@@ -311,14 +312,15 @@ static void set_virtual_fiq(struct arch_regs *r, bool enable)
-  */
- static void set_virtual_fiq_current(bool enable)
- {
--	uintreg_t hcr_el2 = current()->regs.hcr_el2;
-+	struct vcpu *vcpu = current();
-+	uintreg_t hcr_el2 = vcpu->regs.hyp_state.hcr_el2;
- 
- 	if (enable) {
- 		hcr_el2 |= HCR_EL2_VF;
- 	} else {
- 		hcr_el2 &= ~HCR_EL2_VF;
- 	}
--	current()->regs.hcr_el2 = hcr_el2;
-+	vcpu->regs.hyp_state.hcr_el2 = hcr_el2;
- }
- 
- #if SECURE_WORLD == 1
-diff --git a/src/arch/aarch64/inc/hf/arch/types.h b/src/arch/aarch64/inc/hf/arch/types.h
-index 6379d73..6b8b24f 100644
---- a/src/arch/aarch64/inc/hf/arch/types.h
-+++ b/src/arch/aarch64/inc/hf/arch/types.h
-@@ -79,8 +79,13 @@ struct arch_regs {
- 	uintreg_t r[NUM_GP_REGS];
- 	uintreg_t pc;
- 	uintreg_t spsr;
--	uintreg_t hcr_el2;
--	uintreg_t ttbr0_el2;
-+
-+	/* Hypervisor configuration while a vCPU runs. */
-+	struct {
-+		uintreg_t hcr_el2;
-+		uintreg_t ttbr0_el2;
-+		uintreg_t sctlr_el2;
-+	} hyp_state;
- 
- 	/*
- 	 * System registers.
-diff --git a/src/arch/aarch64/mm.c b/src/arch/aarch64/mm.c
-index 8ee65ca..487ae35 100644
---- a/src/arch/aarch64/mm.c
-+++ b/src/arch/aarch64/mm.c
-@@ -886,7 +886,7 @@ bool arch_mm_init(paddr_t table)
- #endif
- 				    (0xff << (8 * STAGE1_NORMALINDX)),
- 
--		.sctlr_el2 = get_sctlr_el2_value(),
-+		.sctlr_el2 = get_sctlr_el2_value(false),
- 		.vstcr_el2 = (1U << 31) |	    /* RES1. */
- 			     (0 << 30) |	    /* SA. */
- 			     (0 << 29) |	    /* SW. */
-diff --git a/src/arch/aarch64/sysregs.c b/src/arch/aarch64/sysregs.c
-index e8c154b..087ba4e 100644
---- a/src/arch/aarch64/sysregs.c
-+++ b/src/arch/aarch64/sysregs.c
-@@ -159,7 +159,7 @@ uintreg_t get_cptr_el2_value(void)
- /**
-  * Returns the value for SCTLR_EL2 for the CPU.
-  */
--uintreg_t get_sctlr_el2_value(void)
-+uintreg_t get_sctlr_el2_value(bool is_el0_partition)
- {
- 	uintreg_t sctlr_el2_value = 0;
- 
-@@ -173,7 +173,14 @@ uintreg_t get_sctlr_el2_value(void)
- 
- 	/* MMU-related bits. */
- 	sctlr_el2_value |= SCTLR_EL2_M;
--	sctlr_el2_value |= SCTLR_EL2_A;
-+
-+	/*
-+	 * Alignment check enabled, but in the case of an EL0 partition
-+	 * with VHE enabled.
-+	 */
-+	if (!(has_vhe_support() && is_el0_partition)) {
-+		sctlr_el2_value |= SCTLR_EL2_A;
-+	}
- 	sctlr_el2_value |= SCTLR_EL2_C;
- 	sctlr_el2_value |= SCTLR_EL2_SA;
- 	sctlr_el2_value |= SCTLR_EL2_I;
-diff --git a/src/arch/aarch64/sysregs.h b/src/arch/aarch64/sysregs.h
-index babd237..6fdab58 100644
---- a/src/arch/aarch64/sysregs.h
-+++ b/src/arch/aarch64/sysregs.h
-@@ -668,7 +668,7 @@ uintreg_t get_mdcr_el2_value(void);
- 
- uintreg_t get_cptr_el2_value(void);
- 
--uintreg_t get_sctlr_el2_value(void);
-+uintreg_t get_sctlr_el2_value(bool is_el0_partition);
- 
- /**
-  * Branch Target Identification mechanism support in AArch64 state.
--- 
-2.34.1
-

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0005-feat-vhe-set-STAGE1_NS-while-mapping-memory-from-NWd.patch

@@ -1,44 +0,0 @@
-From 02c8afc4f7315b4e12098ffeb8bd5e64e4891e78 Mon Sep 17 00:00:00 2001
-From: Davidson K <davidson.kumaresan@arm.com>
-Date: Thu, 7 Oct 2021 12:20:08 +0530
-Subject: [PATCH] feat(vhe): set STAGE1_NS while mapping memory from NWd to SWd
-
-If the memory is shared by a VM executing in non secure world, attribute
-MM_MODE_NS had to be set while mapping that in a S-EL0 SP executing in
-secure world. It will not be needed for a S-EL1 SP since the NS bit is
-available only for the stage 1 translations and the stage 1 translations
-for a S-EL1 SP will be handled by a trusted OS running in S-EL1.
-
-Signed-off-by: Davidson K <davidson.kumaresan@arm.com>
-Change-Id: I074e2d5a50a659bd3c097d797c4901f08d210b1b
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- src/ffa_memory.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/src/ffa_memory.c b/src/ffa_memory.c
-index 048cca9..8910cc7 100644
---- a/src/ffa_memory.c
-+++ b/src/ffa_memory.c
-@@ -2483,6 +2483,18 @@ struct ffa_value ffa_memory_retrieve(struct vm_locked to_locked,
- 
- 	memory_to_attributes = ffa_memory_permissions_to_mode(
- 		permissions, share_state->sender_orig_mode);
-+
-+	if (to_locked.vm->el0_partition) {
-+		/*
-+		 * Get extra mapping attributes for the given VM ID.
-+		 * If the memory is shared by a VM executing in non secure
-+		 * world, attribute MM_MODE_NS had to be set while mapping
-+		 * that in a SP executing in secure world.
-+		 */
-+		memory_to_attributes |= arch_mm_extra_attributes_from_vm(
-+						retrieve_request->sender);
-+	}
-+
- 	ret = ffa_retrieve_check_update(
- 		to_locked, memory_region->sender, share_state->fragments,
- 		share_state->fragment_constituent_counts,
--- 
-2.34.1
-

meta-arm-bsp/recipes-bsp/hafnium/files/tc/0006-feat-vhe-enable-vhe-and-disable-branch-protection-fo.patch

@@ -1,34 +0,0 @@
-From c235511a06a54bcccec97b3067c1004d3957b1d8 Mon Sep 17 00:00:00 2001
-From: Davidson K <davidson.kumaresan@arm.com>
-Date: Thu, 8 Sep 2022 10:47:10 +0530
-Subject: [PATCH] feat(vhe): enable vhe and disable branch protection for TC
-
-Signed-off-by: Davidson K <davidson.kumaresan@arm.com>
-Change-Id: I60cd607d9f2bf0114b482980e7ca68e24aaf4d1f
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- BUILD.gn | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/BUILD.gn b/BUILD.gn
-index 62ba763..f26ce03 100644
---- a/BUILD.gn
-+++ b/BUILD.gn
-@@ -238,7 +238,6 @@ aarch64_toolchains("secure_tc") {
-   heap_pages = 120
-   max_cpus = 8
-   max_vms = 16
--  branch_protection = "standard"
-   toolchain_args = {
-     plat_ffa = "//src/arch/aarch64/plat/ffa:spmc"
-     plat_psci = "//src/arch/aarch64/plat/psci:spmc"
-@@ -247,5 +246,6 @@ aarch64_toolchains("secure_tc") {
-     secure_world = "1"
-     pl011_base_address = "0x7ff80000"
-     enable_mte = "1"
-+    enable_vhe = "1"
-   }
- }
--- 
-2.34.1
-

meta-arm-bsp/recipes-bsp/hafnium/hafnium-tc.inc

@@ -3,23 +3,8 @@
 COMPATIBLE_MACHINE = "(tc?)"
 HAFNIUM_PLATFORM = "secure_tc"
 
-# Intermediate SHA with 2.7 baseline version
-SRCREV = "dd0561820946fe23bcd57cc129140437f72102a5"
-PV = "2.7+git${SRCPV}"
-
 FILESEXTRAPATHS:prepend:tc := "${THISDIR}/files/tc:"
-
-SRC_URI:remove = "file://0001-Fix-build-with-clang-15.patch"
-
 SRC_URI:append = " \
-        file://0001-feat-emulate-cntp-timer-register-accesses-using-cnth.patch \
-        file://0002-feat-emulate-interrupt-controller-register-access.patch \
-        file://0003-tc-increase-heap-pages.patch;patchdir=project/reference \
-        file://0004-feat-disable-alignment-check-for-EL0-partitions.patch \
-        file://0005-feat-vhe-set-STAGE1_NS-while-mapping-memory-from-NWd.patch \
-        file://0006-feat-vhe-enable-vhe-and-disable-branch-protection-fo.patch;patchdir=project/reference \
-        "
-
-do_compile() {
-    PATH="${S}/prebuilts/linux-x64/clang/bin:$PATH" oe_runmake -C ${S}
-}
+		file://0001-fix-fail-mapping-if-start-address-exceeds-page-table.patch \
+		file://0002-Extend-Stage-1-mapping-limit.patch \
+		 "

meta-arm-bsp/recipes-bsp/images/corstone1000-image.bb

@@ -3,30 +3,9 @@ DESCRIPTION = "This is the main image which is the container of all the binaries
                generated for the Corstone1000 platform."
 LICENSE = "MIT"
 
-COMPATIBLE_MACHINE = "corstone1000"
-
 inherit image
-inherit wic_nopt tfm_sign_image
+inherit wic_nopt
 
 PACKAGE_INSTALL = ""
 
 IMAGE_FSTYPES += "wic wic.nopt"
-
-do_sign_images() {
-    # Sign TF-A BL2
-    sign_host_image ${RECIPE_SYSROOT}/firmware/${TFA_BL2_BINARY} \
-        ${TFA_BL2_RE_IMAGE_LOAD_ADDRESS} ${TFA_BL2_RE_SIGN_BIN_SIZE}
-
-    # Update BL2 in the FIP image
-    cp ${RECIPE_SYSROOT}/firmware/${TFA_FIP_BINARY} .
-    fiptool update --tb-fw ${TFM_IMAGE_SIGN_DIR}/signed_${TFA_BL2_BINARY} \
-        ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY}
-
-    # Sign the FIP image
-    sign_host_image ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY} \
-        ${TFA_FIP_RE_IMAGE_LOAD_ADDRESS} ${TFA_FIP_RE_SIGN_BIN_SIZE}
-}
-do_sign_images[depends] = "\
-    trusted-firmware-a:do_populate_sysroot \
-    fiptool-native:do_populate_sysroot \
-    "

meta-arm-bsp/recipes-bsp/images/corstone1000-initramfs-image.bb

@@ -3,8 +3,6 @@ DESCRIPTION = "This is the main Linux image which includes an initramfs kernel/r
 
 LICENSE = "MIT"
 
-COMPATIBLE_MACHINE = "corstone1000"
-
 IMAGE_FSTYPES = "${INITRAMFS_FSTYPES}"
 
 inherit core-image
@@ -23,8 +21,8 @@ IMAGE_FEATURES:remove = "package-management"
 # all optee packages
 IMAGE_INSTALL += "optee-client"
 
-# external system linux userspace test application
-IMAGE_INSTALL += "corstone1000-external-sys-tests"
+# FF-A Debugfs driver
+IMAGE_INSTALL += "ffa-debugfs-mod"
 
-# TS PSA API tests commands for crypto, its, ps and iat
-IMAGE_INSTALL += "packagegroup-ts-tests-psa"
+# psa-arch-tests linux userspace application
+IMAGE_INSTALL += "secure-partitions-psa-api-tests"

meta-arm-bsp/recipes-bsp/images/firmware-image-juno.bb

@@ -63,10 +63,10 @@ do_deploy() {
     done
 
     if [ "${INITRAMFS_IMAGE_BUNDLE}" -eq 1 ]; then
-        cp -L -f ${DEPLOY_DIR_IMAGE}/Image-initramfs-juno.bin \
+        cp -L -f ${DEPLOY_DIR_IMAGE}/Image.gz-initramfs-juno.bin \
             ${D}/${UNPACK_DIR}/SOFTWARE/Image
     else
-        cp -L -f ${DEPLOY_DIR_IMAGE}/Image ${D}/${UNPACK_DIR}/SOFTWARE/
+        cp -L -f ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE} ${D}/${UNPACK_DIR}/SOFTWARE/
     fi
 
     # Compress the files

meta-arm-bsp/recipes-bsp/images/n1sdp-board-firmware_2020.07.27.bb

@@ -2,7 +2,7 @@ SUMMARY = "Board Firmware binaries for N1SDP"
 SECTION = "firmware"
 
 LICENSE = "STM-SLA0044-Rev5"
-LIC_FILES_CHKSUM = "file://LICENSES/MB/STM.TXT;md5=1b74d8c842307d03c116f2d71cbf868a"
+LIC_FILES_CHKSUM = "file://LICENSES/STM.TXT;md5=4b8dab81d0bfc0a5f63c9a983402705b"
 
 inherit deploy
 
@@ -11,9 +11,9 @@ INHIBIT_DEFAULT_DEPS = "1"
 PACKAGE_ARCH = "${MACHINE_ARCH}"
 COMPATIBLE_MACHINE = "n1sdp"
 
-SRC_URI = "git://git.gitlab.arm.com/arm-reference-solutions/board-firmware.git;protocol=https;branch=n1sdp"
+SRC_URI = "git://git.linaro.org/landing-teams/working/arm/n1sdp-board-firmware.git;protocol=https;branch=master"
 
-SRCREV = "6d5253584a9c2fdc2edbdc39bf6f2436215d1382"
+SRCREV  = "9a095cbdf8ef59a7433e2769e4e2e92782b68c50"
 
 S = "${WORKDIR}/git"
 
@@ -25,7 +25,6 @@ do_install() {
     cp -Rp --no-preserve=ownership ${S}/* ${D}${INSTALL_DIR}
 }
 
-FILES:${PN}-staticdev += " ${INSTALL_DIR}/LIB/sensor.a"
 FILES:${PN} = "${INSTALL_DIR}"
 SYSROOT_DIRS += "${INSTALL_DIR}"
 

meta-arm-bsp/recipes-bsp/scp-firmware/files/tc/0001-tc0-fix-sensor-data-api-call.patch

@@ -0,0 +1,65 @@
+From 33a2173e13453ecc4f766f0e69302524401df1b0 Mon Sep 17 00:00:00 2001
+From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Date: Mon, 14 Feb 2022 08:28:46 +0000
+Subject: [PATCH 1/4] tc0: fix sensor data api call
+
+Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Change-Id: I827abeeac8317e4dd466cc0c4d493cdc90e7e39d
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ module/thermal_mgmt/src/mod_thermal_mgmt.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/module/thermal_mgmt/src/mod_thermal_mgmt.c b/module/thermal_mgmt/src/mod_thermal_mgmt.c
+index dbd45c74..6e2ff5ba 100644
+--- a/module/thermal_mgmt/src/mod_thermal_mgmt.c
++++ b/module/thermal_mgmt/src/mod_thermal_mgmt.c
+@@ -20,7 +20,7 @@
+ #include <fwk_mm.h>
+ #include <fwk_module.h>
+ #include <fwk_status.h>
+-#include <fwk_thread.h>
++#include <fwk_core.h>
+ 
+ #include <stdint.h>
+ #include <stdlib.h>
+@@ -372,7 +372,7 @@ static int read_temperature(void)
+         .id = mod_thermal_event_id_read_temp,
+     };
+ 
+-    return fwk_thread_put_event(&event);
++    return fwk_put_event(&event);
+ #else
+     int status;
+     uint64_t value;
+@@ -574,22 +574,22 @@ static int thermal_mgmt_process_event(
+     struct fwk_event *resp_event)
+ {
+     struct mod_sensor_event_params *params;
+-    uint64_t value;
++    struct mod_sensor_data ms_data;
+     int status;
+ 
+     if (fwk_id_is_equal(event->id, mod_thermal_event_id_read_temp)) {
+         /* Temperature-reading event */
+         status =
+-            mod_ctx.sensor_api->get_value(mod_ctx.config->sensor_id, &value);
++            mod_ctx.sensor_api->get_data(mod_ctx.config->sensor_id, &ms_data);
+         if (status == FWK_SUCCESS) {
+-            mod_ctx.cur_temp = (uint32_t)value;
++            mod_ctx.cur_temp = (uint32_t)ms_data.value;
+         }
+     } else if (fwk_id_is_equal(event->id, mod_sensor_event_id_read_request)) {
+         /* Response event from Sensor HAL */
+         params = (struct mod_sensor_event_params *)event->params;
+ 
+-        if (params->status == FWK_SUCCESS) {
+-            mod_ctx.cur_temp = (uint32_t)params->value;
++        if (params->sensor_data->status == FWK_SUCCESS) {
++            mod_ctx.cur_temp = (uint32_t)params->sensor_data->value;
+             status = FWK_SUCCESS;
+         } else {
+             status = FWK_E_DEVICE;
+-- 
+2.30.2
+

meta-arm-bsp/recipes-bsp/scp-firmware/files/tc/0002-tc0-fix-mpmm-config.patch

@@ -0,0 +1,92 @@
+From 736bd8aeceefd474c15a97e4a4ec99f07ef9a82c Mon Sep 17 00:00:00 2001
+From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Date: Fri, 11 Feb 2022 18:28:43 +0000
+Subject: [PATCH 2/4] tc0: fix mpmm config
+
+Do not enable MPMM in standard features set.
+
+Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Change-Id: I7b273a2055452e2e8cd78a0d932514a6f2947ec5
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ product/tc0/scp_ramfw/config_mpmm.c | 15 ---------------
+ 1 file changed, 15 deletions(-)
+
+diff --git a/product/tc0/scp_ramfw/config_mpmm.c b/product/tc0/scp_ramfw/config_mpmm.c
+index 3bfe99d3..13d866a5 100644
+--- a/product/tc0/scp_ramfw/config_mpmm.c
++++ b/product/tc0/scp_ramfw/config_mpmm.c
+@@ -27,7 +27,6 @@ enum core_pd_idx {
+     CORE7_IDX
+ };
+ 
+-#if defined(PLATFORM_VARIANT) && (PLATFORM_VARIANT == TC0_VARIANT_STD)
+ static struct mod_mpmm_pct_table k_pct[] = {
+     { .cores_online = 4,
+       .default_perf_limit = 1153 * 1000000UL,
+@@ -115,7 +114,6 @@ static struct mod_mpmm_pct_table m_pct[] = {
+                           },
+                         } },
+ };
+-#endif
+ 
+ static struct mod_mpmm_pct_table m_elp_pct[] = {
+     { .cores_online = 1,
+@@ -132,7 +130,6 @@ static struct mod_mpmm_pct_table m_elp_pct[] = {
+                         } },
+ };
+ 
+-#if defined(PLATFORM_VARIANT) && (PLATFORM_VARIANT == TC0_VARIANT_STD)
+ static const struct mod_mpmm_core_config k_core_config[] = {
+     [0] = {
+         .pd_id = FWK_ID_ELEMENT_INIT(FWK_MODULE_IDX_POWER_DOMAIN, CORE0_IDX),
+@@ -180,7 +177,6 @@ static const struct mod_mpmm_core_config m_core_config[] = {
+         .core_starts_online = false,
+         },
+ };
+-#endif
+ 
+ static const struct mod_mpmm_core_config m_elp_core_config[] = {
+     [0] = {
+@@ -191,7 +187,6 @@ static const struct mod_mpmm_core_config m_elp_core_config[] = {
+         },
+ };
+ 
+-#if defined(PLATFORM_VARIANT) && (PLATFORM_VARIANT == TC0_VARIANT_STD)
+ static const struct mod_mpmm_domain_config k_domain_conf[] = {
+     [0] = {
+         .perf_id = FWK_ID_ELEMENT_INIT(
+@@ -219,7 +214,6 @@ static const struct mod_mpmm_domain_config m_domain_conf[] = {
+     },
+     [1] = {0},
+ };
+-#endif
+ 
+ static const struct mod_mpmm_domain_config m_elp_domain_conf[] = {
+     [0] = {
+@@ -236,14 +230,6 @@ static const struct mod_mpmm_domain_config m_elp_domain_conf[] = {
+ };
+ 
+ static const struct fwk_element element_table[] = {
+-#if defined(PLATFORM_VARIANT) && (PLATFORM_VARIANT == TC0_VAR_EXPERIMENT_POWER)
+-    [0] = {
+-        .name = "MPMM_MATTERHORN_ELP_ARM_ELEM",
+-        .sub_element_count = 1,
+-        .data = m_elp_domain_conf,
+-    },
+-    [1] = { 0 },
+-#else
+     [0] = {
+         .name = "MPMM_KLEIN_ELEM",
+         .sub_element_count = 4,
+@@ -260,7 +246,6 @@ static const struct fwk_element element_table[] = {
+         .data = m_elp_domain_conf,
+     },
+     [3] = { 0 },
+-#endif
+ };
+ 
+ static const struct fwk_element *mpmm_get_element_table(fwk_id_t module_id)
+-- 
+2.30.2
+

meta-arm-bsp/recipes-bsp/scp-firmware/files/tc/0003-tc0-rename-platform-variant-to-platform-feature-set.patch

@@ -0,0 +1,202 @@
+From 50e63f11762348bcd95d809af248f620f03d9ce4 Mon Sep 17 00:00:00 2001
+From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Date: Fri, 11 Feb 2022 18:16:54 +0000
+Subject: [PATCH 3/4] tc0: rename platform variant to platform feature set
+
+THe PLATFORM_VARIANT flag was added to differentiate the software
+features enabled in SCP firmware. But this flag misleads to a new
+variant of same platform. This commits renames PLATFORM_VARIANT to
+PLATFORM_FEATURE_SET
+
+Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Change-Id: I93c0bc3e11fe18192bb8246df851345bdc473974
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ product/tc0/doc/{variants.md => features.md} | 28 +++++++++-----------
+ product/tc0/scp_ramfw/CMakeLists.txt         | 26 +++---------------
+ product/tc0/scp_ramfw/Firmware.cmake         |  2 +-
+ product/tc0/scp_ramfw/config_scmi_perf.c     |  8 +++---
+ product/tc0/scp_romfw/CMakeLists.txt         |  6 ++---
+ product/tc0/scp_romfw/Firmware.cmake         |  2 +-
+ 6 files changed, 25 insertions(+), 47 deletions(-)
+ rename product/tc0/doc/{variants.md => features.md} (77%)
+
+diff --git a/product/tc0/doc/variants.md b/product/tc0/doc/features.md
+similarity index 77%
+rename from product/tc0/doc/variants.md
+rename to product/tc0/doc/features.md
+index fbf616db..3ef520e2 100644
+--- a/product/tc0/doc/variants.md
++++ b/product/tc0/doc/features.md
+@@ -1,4 +1,4 @@
+-# TC0 Platform Variants
++# TC0 Platform Features
+ 
+ Copyright (c) 2022, Arm Limited. All rights reserved.
+ 
+@@ -7,30 +7,27 @@ Copyright (c) 2022, Arm Limited. All rights reserved.
+ 
+ Documentation for TC0 platform can be found at [1].
+ 
++### Standard
++
++The standard build provides all the features described in [1].
++For this default features, it's not required to provide any extra parameters in
++the build commands.
++
++### MPMM/Power/Performance (Experimental)
++
+ For the purpose of experimenting some of the software features that have been
+-introduced in SCP-firmware a new variant of TC0 has been created.
+-The variant(s) can be chosen at build time by adding:
++introduced in SCP-firmware of TC0. This can be enabled at build time, by adding:
+ 
+ ```sh
+ 
+ make -f Makefile.cmake \
+     PRODUCT=tc0 \
+     MODE=<debug,release> \
+-    EXTRA_CONFIG_ARGS+=-DSCP_PLATFORM_VARIANT=<0,1>
++    EXTRA_CONFIG_ARGS+=-DSCP_PLATFORM_FEATURE_SET=1
+ 
+ ```
+ 
+-
+-### Variant 0 (Standard build)
+-
+-The standard build provides all the features described in [1].
+-For this default variant, it's not required to provide any extra parameters in
+-the build commands.
+-
+-
+-### Variant 1 (Power/Performance testing)
+-
+-This variant adds support for the following software features:
++This adds support for the following software features:
+ - Traffic Cop
+ - MPMM (Maximum Power Mitigation Mechanism)
+ - Thermal Management
+@@ -63,7 +60,6 @@ Once built, the features above will act as:
+ 
+ ## Limitations
+ 
+-- The "variant" option is available only with the CMake build.
+ - The Thermal functionality is limited at this time cause the constant
+   temperature being sampled.
+ 
+diff --git a/product/tc0/scp_ramfw/CMakeLists.txt b/product/tc0/scp_ramfw/CMakeLists.txt
+index 96310320..ce3178ee 100644
+--- a/product/tc0/scp_ramfw/CMakeLists.txt
++++ b/product/tc0/scp_ramfw/CMakeLists.txt
+@@ -11,25 +11,13 @@
+ 
+ add_executable(tc0-bl2)
+ 
++set(SCP_PLATFORM_FEATURE_SET ${SCP_PLATFORM_FEATURE_SET_INIT} CACHE STRING "1")
+ 
+-# SCP_PLATFORM_VARIANT options:
+-# - 'TC0_VARIANT_STD' for TC0 standard build
+-# - 'TC0_VAR_EXPERIMENT_POWER' for TC0 with power/performance plugins used for
+-#   evaluation purposes
+-
+-
+-target_compile_definitions(tc0-bl2 PUBLIC -DTC0_VARIANT_STD=0)
+-target_compile_definitions(tc0-bl2 PUBLIC -DTC0_VAR_EXPERIMENT_POWER=1)
+-
+-
+-set(SCP_PLATFORM_VARIANT ${SCP_PLATFORM_VARIANT_INIT} CACHE STRING "1")
+-
+-
+-if (SCP_PLATFORM_VARIANT STREQUAL "1")
+-    message(NOTICE "SCP_PLATFORM_VARIANT set to EXPERIMENT_POWER (tc0-bl2)\n")
++if (SCP_PLATFORM_FEATURE_SET STREQUAL "1")
++    message(NOTICE "TC0 platform features MPMM/POWER/PERFORMANCE is experimental (tc0-bl2)\n")
+ 
+     target_compile_definitions(tc0-bl2
+-        PUBLIC -DPLATFORM_VARIANT=TC0_VAR_EXPERIMENT_POWER)
++	PUBLIC -DTC0_FEATURES_MPMM_POWER_PERF)
+ 
+     set(SCP_ENABLE_PLUGIN_HANDLER TRUE PARENT_SCOPE)
+     set(SCP_ENABLE_FAST_CHANNELS TRUE PARENT_SCOPE)
+@@ -56,12 +44,6 @@ if (SCP_PLATFORM_VARIANT STREQUAL "1")
+     list(PREPEND SCP_MODULE_PATHS
+         "${CMAKE_CURRENT_LIST_DIR}/../module/tc0_power_model")
+     target_sources(tc0-bl2 PRIVATE "config_tc0_power_model.c")
+-
+-else()
+-    message(NOTICE "SCP_PLATFORM_VARIANT set to STANDARD (tc0-bl2)\n")
+-
+-    target_compile_definitions(tc0-bl2
+-        PUBLIC -DPLATFORM_VARIANT=TC0_VARIANT_STD)
+ endif()
+ 
+ 
+diff --git a/product/tc0/scp_ramfw/Firmware.cmake b/product/tc0/scp_ramfw/Firmware.cmake
+index 11d8eaab..4a555296 100644
+--- a/product/tc0/scp_ramfw/Firmware.cmake
++++ b/product/tc0/scp_ramfw/Firmware.cmake
+@@ -27,7 +27,7 @@ set(SCP_ENABLE_FAST_CHANNELS_INIT FALSE)
+ 
+ set(SCP_ENABLE_PLUGIN_HANDLER_INIT FALSE)
+ 
+-set(SCP_PLATFORM_VARIANT_INIT 0)
++set(SCP_PLATFORM_FEATURE_SET_INIT 0)
+ 
+ set(SCP_ARCHITECTURE "armv7-m")
+ 
+diff --git a/product/tc0/scp_ramfw/config_scmi_perf.c b/product/tc0/scp_ramfw/config_scmi_perf.c
+index a4a47b3a..3e91939a 100644
+--- a/product/tc0/scp_ramfw/config_scmi_perf.c
++++ b/product/tc0/scp_ramfw/config_scmi_perf.c
+@@ -129,7 +129,7 @@ static const struct mod_scmi_perf_domain_config domains[] = {
+     },
+ };
+ 
+-#if defined(PLATFORM_VARIANT) && (PLATFORM_VARIANT == TC0_VAR_EXPERIMENT_POWER)
++#ifdef TC0_FEATURES_MPMM_POWER_PERF
+ static const struct mod_scmi_plugin_config plugins_table[] = {
+     [0] = {
+         .id = FWK_ID_MODULE_INIT(FWK_MODULE_IDX_TRAFFIC_COP),
+@@ -156,9 +156,9 @@ const struct fwk_module_config config_scmi_perf = {
+ #else
+         .fast_channels_alarm_id = FWK_ID_NONE_INIT,
+ #endif
+-#if defined(PLATFORM_VARIANT) && (PLATFORM_VARIANT == TC0_VAR_EXPERIMENT_POWER)
+-        .plugins = plugins_table,
+-        .plugins_count = FWK_ARRAY_SIZE(plugins_table),
++#ifdef TC0_FEATURES_MPMM_POWER_PERF
++	.plugins = plugins_table,
++	.plugins_count = FWK_ARRAY_SIZE(plugins_table),
+ #endif
+     })
+ };
+diff --git a/product/tc0/scp_romfw/CMakeLists.txt b/product/tc0/scp_romfw/CMakeLists.txt
+index f9f40ad3..09cd2f5d 100644
+--- a/product/tc0/scp_romfw/CMakeLists.txt
++++ b/product/tc0/scp_romfw/CMakeLists.txt
+@@ -48,6 +48,6 @@ target_include_directories(tc0-bl1
+     PUBLIC $<TARGET_PROPERTY:cmsis::core-m,INTERFACE_INCLUDE_DIRECTORIES>)
+ 
+ cmake_dependent_option(
+-    SCP_PLATFORM_VARIANT "Choose platform software variant?"
+-    "${SCP_PLATFORM_VARIANT_INIT}" "DEFINED SCP_PLATFORM_VARIANT_INIT"
+-    "${SCP_PLATFORM_VARIANT}")
++    SCP_PLATFORM_FEATURE_SET "Choose platform software features?"
++    "${SCP_PLATFORM_FEATURE_SET_INIT}" "DEFINED SCP_PLATFORM_FEATURE_SET_INIT"
++    "${SCP_PLATFORM_FEATURE_SET}")
+diff --git a/product/tc0/scp_romfw/Firmware.cmake b/product/tc0/scp_romfw/Firmware.cmake
+index ab4468be..e1360159 100644
+--- a/product/tc0/scp_romfw/Firmware.cmake
++++ b/product/tc0/scp_romfw/Firmware.cmake
+@@ -21,7 +21,7 @@ set(SCP_ENABLE_NOTIFICATIONS_INIT TRUE)
+ 
+ set(SCP_ENABLE_IPO_INIT FALSE)
+ 
+-set(SCP_PLATFORM_VARIANT_INIT 0)
++set(SCP_PLATFORM_FEATURE_SET_INIT 0)
+ 
+ set(SCP_ARCHITECTURE "armv7-m")
+ 
+-- 
+2.30.2
+

meta-arm-bsp/recipes-bsp/scp-firmware/files/tc/0004-tc0-support-platform-feature-set-options-in-firmware.patch

@@ -0,0 +1,114 @@
+From 3e737dd47b228bdeffb06e39bffec7a4a436b244 Mon Sep 17 00:00:00 2001
+From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Date: Wed, 9 Feb 2022 16:02:10 +0000
+Subject: [PATCH 4/4] tc0: support platform feature set options in firmware.mk
+
+Support existing platform feature set options that is in cmake to
+firmware.mk. Two feature set for TC0 are
+0. Standard
+1. MPMM/Power/Performance (Experimental)
+
+Build option to select the feature set is using:
+make PRODUCT=tc0 MODE=<debug,release> SCP_PLATFORM_FEATURE_SET=<0,1>
+
+The default value is set to 0 (Standard).
+Refer product/tc0/doc/features.md for more details.
+
+Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
+Change-Id: I4028686a8f8461e0e2c29e15d5e52eb1d37ca60a
+Upstream-Status: Pending [Not submitted to upstream yet]
+---
+ product/tc0/scp_ramfw/firmware.mk | 41 +++++++++++++++++++++++++++++--
+ product/tc0/scp_romfw/firmware.mk | 12 +++++++++
+ 2 files changed, 51 insertions(+), 2 deletions(-)
+
+diff --git a/product/tc0/scp_ramfw/firmware.mk b/product/tc0/scp_ramfw/firmware.mk
+index ec6e6679..d7515f5b 100644
+--- a/product/tc0/scp_ramfw/firmware.mk
++++ b/product/tc0/scp_ramfw/firmware.mk
+@@ -9,8 +9,24 @@ BS_FIRMWARE_CPU := cortex-m3
+ BS_FIRMWARE_HAS_NOTIFICATION := yes
+ BS_FIRMWARE_HAS_RESOURCE_PERMISSIONS := yes
+ BS_FIRMWARE_USE_NEWLIB_NANO_SPECS := yes
+-BS_FIRMWARE_HAS_FAST_CHANNELS := no
+-BS_FIRMWARE_HAS_PERF_PLUGIN_HANDLER := no
++
++DEFAULT_SCP_PLATFORM_FEATURE_SET := 0
++
++export SCP_PLATFORM_FEATURE_SET ?= $(DEFAULT_SCP_PLATFORM_FEATURE_SET)
++ifneq ($(filter-out 0 1, $(SCP_PLATFORM_FEATURE_SET)),)
++    $(error "Invalid for SCP_PLATFORM_FEATURE_SET parameter. Valid options are \
++      0 or 1. Aborting...")
++endif
++
++ifeq ($(SCP_PLATFORM_FEATURE_SET),0)
++    BS_FIRMWARE_HAS_PERF_PLUGIN_HANDLER := no
++    BS_FIRMWARE_HAS_FAST_CHANNELS := no
++else
++    DEFINES += TC0_FEATURES_MPMM_POWER_PERF
++    BS_FIRMWARE_HAS_PERF_PLUGIN_HANDLER := yes
++    BS_FIRMWARE_HAS_FAST_CHANNELS := yes
++    $(info "TC0 platform features POWER/PERFORMANCE is experimental")
++endif
+ 
+ BS_FIRMWARE_MODULES := \
+     armv7m_mpu \
+@@ -44,6 +60,16 @@ ifeq ($(BS_FIRMWARE_HAS_RESOURCE_PERMISSIONS),yes)
+     BS_FIRMWARE_MODULES += resource_perms
+ endif
+ 
++ifeq ($(SCP_PLATFORM_FEATURE_SET),1)
++BS_FIRMWARE_MODULES += \
++        traffic_cop \
++        mpmm \
++        sensor \
++        reg_sensor \
++        thermal_mgmt \
++        tc0_power_model
++endif
++
+ BS_FIRMWARE_SOURCES := \
+     config_system_power.c \
+     config_armv7m_mpu.c \
+@@ -75,4 +101,15 @@ ifeq ($(BS_FIRMWARE_HAS_RESOURCE_PERMISSIONS),yes)
+     BS_FIRMWARE_SOURCES += config_resource_perms.c
+ endif
+ 
++ifeq ($(SCP_PLATFORM_FEATURE_SET),1)
++    BS_FIRMWARE_SOURCES += \
++        config_traffic_cop.c \
++        config_mpmm.c \
++        config_sensor.c \
++        config_reg_sensor.c \
++        config_thermal_mgmt.c \
++        config_tc0_power_model.c
++endif
++
++
+ include $(BS_DIR)/firmware.mk
+diff --git a/product/tc0/scp_romfw/firmware.mk b/product/tc0/scp_romfw/firmware.mk
+index 9977712f..0012b9fa 100644
+--- a/product/tc0/scp_romfw/firmware.mk
++++ b/product/tc0/scp_romfw/firmware.mk
+@@ -9,6 +9,18 @@ BS_FIRMWARE_CPU := cortex-m3
+ BS_FIRMWARE_HAS_NOTIFICATION := yes
+ BS_FIRMWARE_USE_NEWLIB_NANO_SPECS := yes
+ 
++DEFAULT_SCP_PLATFORM_FEATURE_SET := 0
++
++export SCP_PLATFORM_FEATURE_SET ?= $(DEFAULT_SCP_PLATFORM_FEATURE_SET)
++ifneq ($(filter-out 0 1, $(SCP_PLATFORM_FEATURE_SET)),)
++    $(error "Invalid for SCP_PLATFORM_FEATURE_SET parameter. Valid options are \
++      0 or 1. Aborting...")
++endif
++
++ifeq ($(SCP_PLATFORM_FEATURE_SET),1)
++    $(info "TC0 platform features POWER/PERFORMANCE is experimental")
++endif
++
+ BS_FIRMWARE_MODULE_HEADERS_ONLY := \
+     power_domain \
+     timer
+-- 
+2.30.2
+

meta-arm-bsp/recipes-bsp/scp-firmware/scp-firmware-juno.inc

@@ -5,12 +5,3 @@ COMPATIBLE_MACHINE = "juno"
 SCP_PLATFORM = "juno"
 FW_TARGETS = "scp"
 FW_INSTALL:append = " romfw_bypass"
-
-do_install:append() {
-    for TYPE in ${FW_INSTALL}; do
-        if [ "$TYPE" = "romfw_bypass" ]; then
-            install -D "${B}/${TYPE}/${FW_TARGETS}/bin/${SCP_PLATFORM}-bl1-bypass.bin" "${D}/firmware/${FW}_${TYPE}.bin"
-            install -D "${B}/${TYPE}/${FW_TARGETS}/bin/${SCP_PLATFORM}-bl1-bypass" "${D}/firmware/${FW}_${TYPE}.elf"
-        fi
-    done
-}

meta-arm-bsp/recipes-bsp/scp-firmware/scp-firmware-n1sdp.inc

@@ -3,20 +3,14 @@
 SCP_PLATFORM  = "n1sdp"
 SCP_LOG_LEVEL = "INFO"
 
-SRCREV  = "de7e464ecd77130147103cf48328099c2d0e6289"
+# master branch at n1sdp: Introduce trusted board boot
+SRCREV  = "3e4c34ceccc1c960eb3a4adaa922f2a0c6b36be3"
 PV .= "+git${SRCPV}"
 
 COMPATIBLE_MACHINE:n1sdp = "n1sdp"
 
 DEPENDS += "fiptool-native"
 DEPENDS += "trusted-firmware-a"
-DEPENDS += "n1sdp-board-firmware"
-
-# The n1sdp sensor library is needed for building SCP N1SDP Platform
-# https://github.com/ARM-software/SCP-firmware/tree/master/product/n1sdp
-EXTRA_OECMAKE:append = " \
-    -DSCP_N1SDP_SENSOR_LIB_PATH=${RECIPE_SYSROOT}/n1sdp-board-firmware_source/LIB/sensor.a \
-"
 
 do_install:append() {
    fiptool \

meta-arm-bsp/recipes-bsp/scp-firmware/scp-firmware-tc.inc

@@ -1,6 +1,20 @@
 # TC specific SCP configuration
 
-COMPATIBLE_MACHINE = "(tc1)"
+# Intermediate SHA with 2.9 baseline version
+# This has support for SCP features MPMM/POWER/PERFORMANCE for TC0
+SRCREV = "027b567fde5e3767fb1678bda28cf59fa7aac06d"
+PV = "2.9.0+git${SRCPV}"
 
+FILESEXTRAPATHS:prepend := "${THISDIR}/files/tc:"
+SRC_URI:append:tc = " \
+    file://0001-tc0-fix-sensor-data-api-call.patch \
+    file://0002-tc0-fix-mpmm-config.patch \
+    file://0003-tc0-rename-platform-variant-to-platform-feature-set.patch \
+    file://0004-tc0-support-platform-feature-set-options-in-firmware.patch \
+    "
+
+COMPATIBLE_MACHINE = "(tc?)"
+
+SCP_PLATFORM:tc0 = "tc0"
 SCP_PLATFORM:tc1 = "tc1"
 FW_TARGETS = "scp"

meta-arm-bsp/recipes-bsp/scp-firmware/scp-firmware_2.10.%.bbappend

@@ -2,9 +2,6 @@
 
 MACHINE_SCP_REQUIRE ?= ""
 
-MACHINE_SCP_REQUIRE:juno = "scp-firmware-juno.inc"
 MACHINE_SCP_REQUIRE:n1sdp = "scp-firmware-n1sdp.inc"
-MACHINE_SCP_REQUIRE:sgi575 = "scp-firmware-sgi575.inc"
-MACHINE_SCP_REQUIRE:tc = "scp-firmware-tc.inc"
 
 require ${MACHINE_SCP_REQUIRE}

meta-arm-bsp/recipes-bsp/scp-firmware/scp-firmware_2.9.%.bbappend

@@ -0,0 +1,9 @@
+# Include machine specific SCP configurations
+
+MACHINE_SCP_REQUIRE ?= ""
+
+MACHINE_SCP_REQUIRE:juno = "scp-firmware-juno.inc"
+MACHINE_SCP_REQUIRE:sgi575 = "scp-firmware-sgi575.inc"
+MACHINE_SCP_REQUIRE:tc = "scp-firmware-tc.inc"
+
+require ${MACHINE_SCP_REQUIRE}

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/0001-plat-tc-Increase-maximum-BL2-size.patch

@@ -1,7 +1,7 @@
-From 008cfc6457c239466ca62610d59aaf1a78f6b2f6 Mon Sep 17 00:00:00 2001
+From 923deccc1de17b05826143e476b840253bb2bb7b Mon Sep 17 00:00:00 2001
 From: Tudor Cretu <tudor.cretu@arm.com>
 Date: Fri, 21 May 2021 14:56:37 +0000
-Subject: [PATCH 1/7] plat: tc: Increase maximum BL2 size.
+Subject: [PATCH] plat: tc: Increase maximum BL2 size.
 
 BL2 size gets increased due to the firmware update changes.
 Increase the MAX_BL2_SIZE by 8Kb.
@@ -10,11 +10,11 @@ Signed-off-by: Tudor Cretu <tudor.cretu@arm.com>
 Change-Id: I1cb28b0eb7f834426873ff9f4c40bd496413806f
 Upstream-Status: Pending [Not submitted to upstream yet]
 ---
- plat/arm/board/tc/include/platform_def.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
+ plat/arm/board/tc/include/platform_def.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/plat/arm/board/tc/include/platform_def.h b/plat/arm/board/tc/include/platform_def.h
-index 745d91cab..cd77773aa 100644
+index ccabced9e..f45457b9f 100644
 --- a/plat/arm/board/tc/include/platform_def.h
 +++ b/plat/arm/board/tc/include/platform_def.h
 @@ -120,9 +120,9 @@
@@ -22,12 +22,12 @@ index 745d91cab..cd77773aa 100644
   */
  #if TRUSTED_BOARD_BOOT
 -# define PLAT_ARM_MAX_BL2_SIZE		0x20000
-+# define PLAT_ARM_MAX_BL2_SIZE		0x25000
++# define PLAT_ARM_MAX_BL2_SIZE		0x22000
  #else
 -# define PLAT_ARM_MAX_BL2_SIZE		0x14000
-+# define PLAT_ARM_MAX_BL2_SIZE		0x19000
++# define PLAT_ARM_MAX_BL2_SIZE		0x16000
  #endif
- 
+
  /*
 @@ -130,7 +130,7 @@
   * calculated using the current BL31 PROGBITS debug size plus the sizes of
@@ -35,9 +35,9 @@ index 745d91cab..cd77773aa 100644
   */
 -#define PLAT_ARM_MAX_BL31_SIZE		0x3F000
 +#define PLAT_ARM_MAX_BL31_SIZE		0x4F000
- 
+
  /*
   * Size of cacheable stacks
 -- 
-2.30.2
+2.17.1
 

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/0002-Enable-CI-700-interconnect.patch

@@ -0,0 +1,34 @@
+From 366215a3705228a12efe9f92f1d1033f34ee89fa Mon Sep 17 00:00:00 2001
+From: Rupinderjit Singh <rupinderjit.singh@arm.com>
+Date: Thu, 21 Apr 2022 14:45:23 +0100
+Subject: [PATCH] Enable CI-700 interconnect
+
+Signed-off-by: Rupinderjit Singh <rupinderjit.singh@arm.com>
+Change-Id: Ie56d47a0b65274a467e98b9ecd3caf25dfe10544
+
+Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/14918]
+
+---
+ fdts/tc.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fdts/tc.dts b/fdts/tc.dts
+index 7c0e84260..d0985851d 100644
+--- a/fdts/tc.dts
++++ b/fdts/tc.dts
+@@ -461,6 +461,12 @@
+ 		status = "okay";
+ 	};
+ 
++        cmn-pmu {
++                compatible = "arm,ci-700";
++                reg = <0x0 0x50000000 0x0 0x10000000>;
++                interrupts = <0x0 460 0x4>;
++        };
++
+ 	dp0: display@2cc00000 {
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
+-- 
+2.25.1
+

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0001-Fix-FF-A-version-in-SPMC-manifest.patch

@@ -1,34 +0,0 @@
-Upstream-Status: Inappropriate
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-
-From a31aee0988ef64724ec5866f10709f51f8cb3237 Mon Sep 17 00:00:00 2001
-From: emeara01 <emekcan.aras@arm.com>
-Date: Wed, 11 May 2022 14:37:06 +0100
-Subject: [PATCH] Fix FF-A version in SPMC manifest
-
-OPTEE does not support FF-A version 1.1 in SPMC at the moment.
-This commit corrects the FF-A version in corstone1000_spmc_manifest.dts.
-This patch will not be upstreamed and will be dropped once
-OPTEE version is updated for Corstone1000.
-
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
----
- .../corstone1000/common/fdts/corstone1000_spmc_manifest.dts     | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts b/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts
-index 8e49ab83f..5baa1b115 100644
---- a/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts
-+++ b/plat/arm/board/corstone1000/common/fdts/corstone1000_spmc_manifest.dts
-@@ -20,7 +20,7 @@
- 	attribute {
- 		spmc_id = <0x8000>;
- 		maj_ver = <0x1>;
--		min_ver = <0x1>;
-+		min_ver = <0x0>;
- 		exec_state = <0x0>;
- 		load_address = <0x0 0x2002000>;
- 		entrypoint = <0x0 0x2002000>;
--- 
-2.17.1
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/n1sdp/bl_size.patch

@@ -0,0 +1,40 @@
+From 80b1efa92486a87f9e82dbf665ef612291148de8 Mon Sep 17 00:00:00 2001
+From: Adam Johnston <adam.johnston@arm.com>
+Date: Tue, 14 Jun 2022 11:19:30 +0000
+Subject: [PATCH] arm-bsp/trusted-firmware-a: N1SDP trusted boot
+
+Increase max size of BL2 on N1SDP by 4KB to enable trusted boot
+Decrease max size of BL1 on N1SDP by 8KB so BL1/BL2 fits above BL31 progbits
+
+Signed-off-by: Adam Johnston <adam.johnston@arm.com>
+Upstream-Status: Pending [Flagged to upstream]
+
+---
+ plat/arm/board/n1sdp/include/platform_def.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/plat/arm/board/n1sdp/include/platform_def.h b/plat/arm/board/n1sdp/include/platform_def.h
+index c9b81bafa..7468a31ed 100644
+--- a/plat/arm/board/n1sdp/include/platform_def.h
++++ b/plat/arm/board/n1sdp/include/platform_def.h
+@@ -91,7 +91,7 @@
+  * PLAT_ARM_MAX_BL1_RW_SIZE is calculated using the current BL1 RW debug size
+  * plus a little space for growth.
+  */
+-#define PLAT_ARM_MAX_BL1_RW_SIZE	0xE000
++#define PLAT_ARM_MAX_BL1_RW_SIZE	0xC000
+ 
+ /*
+  * PLAT_ARM_MAX_ROMLIB_RW_SIZE is define to use a full page
+@@ -110,7 +110,7 @@
+  * little space for growth.
+  */
+ #if TRUSTED_BOARD_BOOT
+-# define PLAT_ARM_MAX_BL2_SIZE		0x20000
++# define PLAT_ARM_MAX_BL2_SIZE		0x21000
+ #else
+ # define PLAT_ARM_MAX_BL2_SIZE		0x14000
+ #endif
+-- 
+2.35.1
+

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0002-Makefile-add-trusty_sp_fw_config-build-option.patch

@@ -1,46 +0,0 @@
-From 2f8b0cc6be3787717247d1c02a45181a5ac6f125 Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Mon, 11 Apr 2022 14:36:54 +0100
-Subject: [PATCH 2/7] Makefile: add trusty_sp_fw_config build option
-
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Change-Id: Ief90ae9113d32265ee2200f35f3e517b7b9a4bea
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- Makefile                            | 4 ++++
- docs/plat/arm/arm-build-options.rst | 4 ++++
- 2 files changed, 8 insertions(+)
-
-diff --git a/Makefile b/Makefile
-index 3941f8698..a20d647a2 100644
---- a/Makefile
-+++ b/Makefile
-@@ -531,6 +531,10 @@ ifneq (${SPD},none)
-             DTC_CPPFLAGS	+=	-DOPTEE_SP_FW_CONFIG
-         endif
- 
-+        ifeq ($(findstring trusty_sp,$(ARM_SPMC_MANIFEST_DTS)),trusty_sp)
-+            DTC_CPPFLAGS	+=	-DTRUSTY_SP_FW_CONFIG
-+        endif
-+
-         ifeq ($(TS_SP_FW_CONFIG),1)
-             DTC_CPPFLAGS	+=	-DTS_SP_FW_CONFIG
-         endif
-diff --git a/docs/plat/arm/arm-build-options.rst b/docs/plat/arm/arm-build-options.rst
-index 339ebbe33..3c9a41fb8 100644
---- a/docs/plat/arm/arm-build-options.rst
-+++ b/docs/plat/arm/arm-build-options.rst
-@@ -107,6 +107,10 @@ Arm Platform Build Options
-    device tree. This flag is defined only when ``ARM_SPMC_MANIFEST_DTS`` manifest
-    file name contains pattern optee_sp.
- 
-+-  ``TRUSTY_SP_FW_CONFIG``: DTC build flag to include Trusty as SP in
-+   tb_fw_config device tree. This flag is defined only when
-+   ``ARM_SPMC_MANIFEST_DTS`` manifest file name contains pattern trusty_sp.
-+
- -  ``TS_SP_FW_CONFIG``: DTC build flag to include Trusted Services (Crypto and
-    internal-trusted-storage) as SP in tb_fw_config device tree.
- 
--- 
-2.30.2
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0003-fix-plat-arm-increase-sp-max-image-size.patch

@@ -1,30 +0,0 @@
-From 0060b1a4fbe3bc9992f59a2d4cb986821f7bcf13 Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Mon, 11 Apr 2022 18:31:01 +0100
-Subject: [PATCH 3/7] fix(plat/arm): increase sp max image size
-
-Increase ARM_SP_MAX_SIZE to support Trusty image.
-
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Change-Id: I9ef9e755769445aee998062a7fba508fad50b33e
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- include/plat/arm/common/fconf_arm_sp_getter.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/plat/arm/common/fconf_arm_sp_getter.h b/include/plat/arm/common/fconf_arm_sp_getter.h
-index aa628dfd3..3ed953d1c 100644
---- a/include/plat/arm/common/fconf_arm_sp_getter.h
-+++ b/include/plat/arm/common/fconf_arm_sp_getter.h
-@@ -13,7 +13,7 @@
- /* arm_sp getter */
- #define arm__sp_getter(prop)	arm_sp.prop
- 
--#define ARM_SP_MAX_SIZE		U(0xb0000)
-+#define ARM_SP_MAX_SIZE		U(0x2000000)
- #define ARM_SP_OWNER_NAME_LEN	U(8)
- 
- struct arm_sp_t {
--- 
-2.30.2
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0004-fix-plat-tc-increase-tc_tzc_dram1_size.patch

@@ -1,69 +0,0 @@
-From 000e19d360a5ad9abd7d823af86a364bac2afc58 Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Mon, 11 Apr 2022 17:38:17 +0100
-Subject: [PATCH 4/7] fix(plat/tc): increase tc_tzc_dram1_size
-
-Increase TC_TZC_DRAM1_SIZE for Trusty image and its memory size.
-Update OP-TEE reserved memory range in DTS
-
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Change-Id: Iad433c3c155f28860b15bde2398df653487189dd
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- fdts/tc.dts                              |  4 ++--
- plat/arm/board/tc/include/platform_def.h | 10 ++++++----
- 2 files changed, 8 insertions(+), 6 deletions(-)
-
-diff --git a/fdts/tc.dts b/fdts/tc.dts
-index 20992294b..af64504a4 100644
---- a/fdts/tc.dts
-+++ b/fdts/tc.dts
-@@ -213,8 +213,8 @@
- 			linux,cma-default;
- 		};
- 
--		optee@0xfce00000 {
--			reg = <0x00000000 0xfce00000 0 0x00200000>;
-+		optee@0xf8e00000 {
-+			reg = <0x00000000 0xf8e00000 0 0x00200000>;
- 			no-map;
- 		};
- 	};
-diff --git a/plat/arm/board/tc/include/platform_def.h b/plat/arm/board/tc/include/platform_def.h
-index cd77773aa..35d8fd24e 100644
---- a/plat/arm/board/tc/include/platform_def.h
-+++ b/plat/arm/board/tc/include/platform_def.h
-@@ -31,7 +31,7 @@
-  */
- #define TC_TZC_DRAM1_BASE		(ARM_AP_TZC_DRAM1_BASE -	\
- 					 TC_TZC_DRAM1_SIZE)
--#define TC_TZC_DRAM1_SIZE		UL(0x02000000)	/* 32 MB */
-+#define TC_TZC_DRAM1_SIZE		UL(0x06000000)	/* 96 MB */
- #define TC_TZC_DRAM1_END		(TC_TZC_DRAM1_BASE +		\
- 					 TC_TZC_DRAM1_SIZE - 1)
- 
-@@ -68,7 +68,9 @@
-  * max size of BL32 image.
-  */
- #if defined(SPD_spmd)
--#define PLAT_ARM_SPMC_BASE		TC_TZC_DRAM1_BASE
-+#define TC_EL2SPMC_LOAD_ADDR		(TC_TZC_DRAM1_BASE + 0x04000000)
-+
-+#define PLAT_ARM_SPMC_BASE		TC_EL2SPMC_LOAD_ADDR
- #define PLAT_ARM_SPMC_SIZE		UL(0x200000)  /* 2 MB */
- #endif
- 
-@@ -259,8 +261,8 @@
- 		(TZC_REGION_ACCESS_RDWR(TZC_NSAID_DEFAULT))
- 
- /*
-- * The first region below, TC_TZC_DRAM1_BASE (0xfd000000) to
-- * ARM_SCP_TZC_DRAM1_END (0xffffffff) will mark the last 48 MB of DRAM as
-+ * The first region below, TC_TZC_DRAM1_BASE (0xf9000000) to
-+ * ARM_SCP_TZC_DRAM1_END (0xffffffff) will mark the last 112 MB of DRAM as
-  * secure. The second and third regions gives non secure access to rest of DRAM.
-  */
- #define TC_TZC_REGIONS_DEF	\
--- 
-2.30.2
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0005-feat-plat-tc-add-spmc-manifest-with-trusty-sp.patch

@@ -1,169 +0,0 @@
-From a04466ceb81a04c5179e8064837c34a89c2b11bd Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Mon, 11 Apr 2022 14:43:15 +0100
-Subject: [PATCH 5/7] feat(plat/tc): add spmc manifest with trusty sp
-
-Add SPMC manifest with Trusty SP. Define Trusty's load address,
-vcpu count, memory size.
-
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Change-Id: If4363580a478776d233f7f391a30e1cb345453c2
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- .../tc/fdts/tc_spmc_trusty_sp_manifest.dts    | 120 ++++++++++++++++++
- plat/arm/board/tc/fdts/tc_tb_fw_config.dts    |   7 +-
- 2 files changed, 126 insertions(+), 1 deletion(-)
- create mode 100644 plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts
-
-diff --git a/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts b/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts
-new file mode 100644
-index 000000000..e2ea7b811
---- /dev/null
-+++ b/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts
-@@ -0,0 +1,120 @@
-+/*
-+ * Copyright (c) 2022, Arm Limited. All rights reserved.
-+ *
-+ * SPDX-License-Identifier: BSD-3-Clause
-+ */
-+/dts-v1/;
-+
-+/ {
-+	compatible = "arm,ffa-core-manifest-1.0";
-+	#address-cells = <2>;
-+	#size-cells = <1>;
-+
-+	attribute {
-+		spmc_id = <0x8000>;
-+		maj_ver = <0x1>;
-+		min_ver = <0x1>;
-+		exec_state = <0x0>;
-+		load_address = <0x0 0xfd000000>;
-+		entrypoint = <0x0 0xfd000000>;
-+		binary_size = <0x80000>;
-+	};
-+
-+	hypervisor {
-+		compatible = "hafnium,hafnium";
-+		vm1 {
-+			is_ffa_partition;
-+			debug_name = "trusty";
-+			load_address = <0xf901f000>;
-+			vcpu_count = <8>;
-+			mem_size = <0x3f00000>; /* 64MB TZC DRAM - 1MB align */
-+		};
-+#ifdef TS_SP_FW_CONFIG
-+		vm2 {
-+			is_ffa_partition;
-+			debug_name = "internal-trusted-storage";
-+			load_address = <0xfee00000>;
-+			vcpu_count = <1>;
-+			mem_size = <2097152>; /* 2MB TZC DRAM */
-+		};
-+		vm3 {
-+			is_ffa_partition;
-+			debug_name = "crypto";
-+			load_address = <0xfec00000>;
-+			vcpu_count = <1>;
-+			mem_size = <2097152>; /* 2MB TZC DRAM */
-+		};
-+#endif
-+	};
-+
-+	cpus {
-+		#address-cells = <0x2>;
-+		#size-cells = <0x0>;
-+
-+		CPU0:cpu@0 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x0>;
-+			enable-method = "psci";
-+		};
-+
-+		/*
-+		 * SPMC (Hafnium) requires secondary cpu nodes are declared in
-+		 * descending order
-+		 */
-+		CPU7:cpu@700 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x700>;
-+			enable-method = "psci";
-+		};
-+
-+		CPU6:cpu@600 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x600>;
-+			enable-method = "psci";
-+		};
-+
-+		CPU5:cpu@500 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x500>;
-+			enable-method = "psci";
-+		};
-+
-+		CPU4:cpu@400 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x400>;
-+			enable-method = "psci";
-+		};
-+
-+		CPU3:cpu@300 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x300>;
-+			enable-method = "psci";
-+		};
-+
-+		CPU2:cpu@200 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x200>;
-+			enable-method = "psci";
-+		};
-+
-+		CPU1:cpu@100 {
-+			device_type = "cpu";
-+			compatible = "arm,armv8";
-+			reg = <0x0 0x100>;
-+			enable-method = "psci";
-+		};
-+	};
-+
-+	/* 96MB of TC_TZC_DRAM1_BASE */
-+	memory@f9000000 {
-+		device_type = "memory";
-+		reg = <0x0 0xf9000000 0x6000000>;
-+	};
-+};
-diff --git a/plat/arm/board/tc/fdts/tc_tb_fw_config.dts b/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-index 4c6ccef25..a72772fb3 100644
---- a/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-+++ b/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2020-2021, Arm Limited. All rights reserved.
-+ * Copyright (c) 2020-2022, Arm Limited. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  */
-@@ -47,6 +47,11 @@
- 		       uuid = "486178e0-e7f8-11e3-bc5e-0002a5d5c51b";
- 		       load-address = <0xfd280000>;
- 		};
-+#elif TRUSTY_SP_FW_CONFIG
-+		trusty {
-+		       uuid = "40ee25f0-a2bc-304c-8c4c-a173c57d8af1";
-+		       load-address = <0xf901f000>;
-+		};
- #else
- 		cactus-primary {
- 			uuid = "b4b5671e-4a90-4fe1-b81f-fb13dae1dacb";
--- 
-2.30.2
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0006-feat-plat-tc-update-dts-with-trusty-compatible-strin.patch

@@ -1,50 +0,0 @@
-From 96151af7eed28d63fdaa1ac6de2d14a9c71f1d4a Mon Sep 17 00:00:00 2001
-From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Date: Wed, 30 Mar 2022 12:14:49 +0000
-Subject: [PATCH 6/7] feat(plat/tc): update dts with trusty compatible string
-
-Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
-Change-Id: Ic6661df479e114bf3f464165c14df5fa02dc0139
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- fdts/tc.dts | 26 ++++++++++++++++++++++++++
- 1 file changed, 26 insertions(+)
-
-diff --git a/fdts/tc.dts b/fdts/tc.dts
-index af64504a4..dc86958bf 100644
---- a/fdts/tc.dts
-+++ b/fdts/tc.dts
-@@ -555,4 +555,30 @@
- 		compatible = "arm,trace-buffer-extension";
- 		interrupts = <1 2 4>;
- 	};
-+
-+	trusty {
-+		#size-cells = <0x02>;
-+		#address-cells = <0x02>;
-+		ranges = <0x00>;
-+		compatible = "android,trusty-v1";
-+
-+		virtio {
-+			compatible = "android,trusty-virtio-v1";
-+		};
-+
-+		test {
-+			compatible = "android,trusty-test-v1";
-+		};
-+
-+		log {
-+			compatible = "android,trusty-log-v1";
-+		};
-+
-+		irq {
-+			ipi-range = <0x08 0x0f 0x08>;
-+			interrupt-ranges = <0x00 0x0f 0x00 0x10 0x1f 0x01 0x20 0x3f 0x02>;
-+			interrupt-templates = <0x01 0x00 0x8001 0x01 0x01 0x04 0x8001 0x01 0x00 0x04>;
-+			compatible = "android,trusty-irq-v1";
-+		};
-+	};
- };
--- 
-2.30.2
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0007-feat-arm-tc-Update-trusty-load-address-in-dts-files.patch

@@ -1,44 +0,0 @@
-From ea9556a14bec0249ac6e01e4a55cbb04fd15b51a Mon Sep 17 00:00:00 2001
-From: Rupinderjit Singh <rupinderjit.singh@arm.com>
-Date: Wed, 27 Jul 2022 09:23:58 +0100
-Subject: [PATCH] feat(arm/tc): Update trusty load-address in dts files.
-
-Change is required to align with sp header size change from 0x1000 to 0x4000
-
-Signed-off-by: Rupinderjit Singh <rupinderjit.singh@arm.com>
-Change-Id: Ieeaa7450196b33ecff1612cf3b55cf173a7941e0
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts | 2 +-
- plat/arm/board/tc/fdts/tc_tb_fw_config.dts            | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts b/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts
-index e2ea7b811..66a686c9a 100644
---- a/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts
-+++ b/plat/arm/board/tc/fdts/tc_spmc_trusty_sp_manifest.dts
-@@ -25,7 +25,7 @@
- 		vm1 {
- 			is_ffa_partition;
- 			debug_name = "trusty";
--			load_address = <0xf901f000>;
-+			load_address = <0xf901c000>;
- 			vcpu_count = <8>;
- 			mem_size = <0x3f00000>; /* 64MB TZC DRAM - 1MB align */
- 		};
-diff --git a/plat/arm/board/tc/fdts/tc_tb_fw_config.dts b/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-index a72772fb3..a5bb520fe 100644
---- a/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-+++ b/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-@@ -50,7 +50,7 @@
- #elif TRUSTY_SP_FW_CONFIG
- 		trusty {
- 		       uuid = "40ee25f0-a2bc-304c-8c4c-a173c57d8af1";
--		       load-address = <0xf901f000>;
-+		       load-address = <0xf901c000>;
- 		};
- #else
- 		cactus-primary {
--- 
-2.25.1
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0008-feat-plat-tc-add-firmware-update-secure-partition.patch

@@ -1,63 +0,0 @@
-From 16f183e3c09d64fee92638ea9d0017ac7973ddf8 Mon Sep 17 00:00:00 2001
-From: Tudor Cretu <tudor.cretu@arm.com>
-Date: Fri, 24 Sep 2021 12:09:53 +0000
-Subject: [PATCH 1/2] feat(plat/tc): add firmware update secure partition
-
-Firmware update is a trusted service secure partition that implements
-the PSA firmware update specification. It executes in the secure world
-in total compute platform.
-
-Signed-off-by: Davidson K <davidson.kumaresan@arm.com>
-Signed-off-by: Tudor Cretu <tudor.cretu@arm.com>
-Change-Id: I6223d247b078de8c03b068185bf120b3d502f500
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- plat/arm/board/tc/fdts/tc_spmc_optee_sp_manifest.dts | 9 ++++++++-
- plat/arm/board/tc/fdts/tc_tb_fw_config.dts           | 4 ++++
- 2 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/plat/arm/board/tc/fdts/tc_spmc_optee_sp_manifest.dts b/plat/arm/board/tc/fdts/tc_spmc_optee_sp_manifest.dts
-index 92e2ddda6..23ad06888 100644
---- a/plat/arm/board/tc/fdts/tc_spmc_optee_sp_manifest.dts
-+++ b/plat/arm/board/tc/fdts/tc_spmc_optee_sp_manifest.dts
-@@ -28,7 +28,7 @@
- 			load_address = <0xfd280000>;
- 			vcpu_count = <8>;
- #ifdef TS_SP_FW_CONFIG
--			mem_size = <26738688>; /* 25MB TZC DRAM */
-+			mem_size = <20447232>; /* 19MB TZC DRAM */
- #else
- 			mem_size = <30928896>; /* 29MB TZC DRAM */
- #endif
-@@ -48,6 +48,13 @@
- 			vcpu_count = <1>;
- 			mem_size = <2097152>; /* 2MB TZC DRAM */
- 		};
-+		vm4 {
-+			is_ffa_partition;
-+			debug_name = "firmware-update";
-+			load_address = <0xfe600000>;
-+			vcpu_count = <1>;
-+			mem_size = <6291456>; /* 6MB TZC DRAM */
-+		};
- #endif
- 	};
- 
-diff --git a/plat/arm/board/tc/fdts/tc_tb_fw_config.dts b/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-index a5bb520fe..2c640b363 100644
---- a/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-+++ b/plat/arm/board/tc/fdts/tc_tb_fw_config.dts
-@@ -41,6 +41,10 @@
- 		       uuid = "d9df52d5-16a2-4bb2-9aa4-d26d3b84e8c0";
- 		       load-address = <0xfec00000>;
- 		};
-+		firmware-update {
-+		       uuid = "6823a838-1b06-470e-9774-0cce8bfb53fd";
-+		       load-address = <0xfe600000>;
-+		};
- #endif
- #if OPTEE_SP_FW_CONFIG
- 		op-tee {
--- 
-2.34.1
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc/0009-feat-plat-tc-reserve-4-MB-for-stmm-communication-use.patch

@@ -1,35 +0,0 @@
-From a8cdd6c67d26c15642338a45279db5e39cf4e565 Mon Sep 17 00:00:00 2001
-From: Davidson K <davidson.kumaresan@arm.com>
-Date: Fri, 3 Jun 2022 18:16:31 +0530
-Subject: [PATCH 2/2] feat(plat/tc): reserve 4 MB for stmm communication used
- for firmware update
-
-The firmware update secure partition and u-boot communicates using
-the stmm communication layer and it needs a dedicated memory region.
-
-Signed-off-by: Davidson K <davidson.kumaresan@arm.com>
-Change-Id: I8d4da5c26843d225983dcaee0757694a6d43234c
-Upstream-Status: Pending [Not submitted to upstream yet]
----
- fdts/tc.dts | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/fdts/tc.dts b/fdts/tc.dts
-index dc86958bf..cb504c4a2 100644
---- a/fdts/tc.dts
-+++ b/fdts/tc.dts
-@@ -217,6 +217,11 @@
- 			reg = <0x00000000 0xf8e00000 0 0x00200000>;
- 			no-map;
- 		};
-+
-+		fwu_mm@0xfca00000 {
-+			reg = <0x00000000 0xfca00000 0 0x00400000>;
-+			no-map;
-+		};
- 	};
- 
- 	psci {
--- 
-2.34.1
-

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc

@@ -3,10 +3,12 @@
 COMPATIBLE_MACHINE = "(corstone1000)"
 
 FILESEXTRAPATHS:prepend := "${THISDIR}/files/corstone1000:"
+SRCREV_tfa = "cf89fd57ed3286d7842eef41cd72a3977eb6d317"
+PV = "2.6+git${SRCPV}"
 
-SRC_URI:append = " \ 
-	file://0001-Fix-FF-A-version-in-SPMC-manifest.patch \
-	"
+SRC_URI:remove = " \
+     file://ssl.patch \
+     "  
 
 TFA_DEBUG = "1"
 TFA_UBOOT ?= "1"
@@ -37,3 +39,6 @@ EXTRA_OEMAKE:append = " \
                         BL32=${RECIPE_SYSROOT}/lib/firmware/tee-pager_v2.bin \
                         LOG_LEVEL=50 \
                         "
+
+# trigger TF-M build so TF-A binaries get signed
+do_deploy[depends]+= "virtual/trusted-firmware-m:do_prepare_recipe_sysroot"