Update edk2 and edk2-platforms from edk2-stable202605 to edk2-stable202608 tags.
Add a backport for the SmbiosType2Generator clang build failure
introduced by the newer edk2 release.
Remove the same patch from RDN2 and RDV2, where it is not
applicable because those platforms use an older SHA-based edk2
release.
Update SBSA-ACS to use the new edk2 release.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Guard the inclusion of platform configuration files behind an override.
This prevents unwanted platform overrides from leaking in
DEVTOOL_EXTRA_OVERRIDES of other platform builds.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Update the TF-A LTS recipes to the lts-v2.14.9 tag.
This release adds mbedTLS as a submodule, matching how newer TF-A releases
provide this dependency. This is a change from earlier releases in the
2.14 LTS series and requires the mbedTLS sources to be fetched as part of
the TF-A source tree.
Also update fiptool-native to use the corresponding TF-A 2.14.9 revision.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Backport two TF-M security fixes for the Corstone-1000 platform.
The fixes address vulnerabilities in the TF-M firmware and keep the
platform aligned with upstream TF-M security updates.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Select the TF-A and TF-A Tests 2.15 release series for Corstone1000 and
update the FPGA and Cortex-A320 FVP documentation to reference the
2.15.0 recipe.
Remove the TF-A Cortex-A320 and multicore patches and the TF-A Tests
Cortex-A320 patch, as these changes are included upstream. Drop the
obsolete TFA_MBEDTLS workaround.
Add a patch to align the BL configuration mapping with the enclosing
shared RAM page. ARM_FW_CONFIG_BASE follows the meminfo_t structure and
is not page aligned, causing mmap_add_region_check() to reject the
mapping with -EINVAL. Base the mapping at ARM_SHARED_RAM_BASE while
preserving the firmware configuration load address and reserved space.
Add a Corstone1000 BL2 hook that waits 25 ms after arm_io_setup() and
before common GPT initialization when RESET_TO_BL2 and ARM_GPT_SUPPORT
are enabled. Enable the system counter and initialize the delay timer
before waiting, since their common initialization occurs later. Apply
the hook to FPGA, Cortex-A35 FVP and Cortex-A320 FVP builds.
The delay works around invalid MBR signatures observed during early
flash access on MPS3 with TF-A 2.15. It retains the common GPT-before-MMU
ordering and existing reset handling. This is a temporary timing
workaround: the underlying cause remains under investigation, and
25 ms is a tested delay rather than a documented hardware requirement.
Change-Id: Ic57f6474c6019edd58caeca8e2751d05d17678c7
Signed-off-by: Oscar Belshaw <Oscar.Belshaw@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Provide a TF-A fix to normalise CoT DTS cell expressions before cot-dt2c
parses the generated descriptor.
This avoids build failures where cot-dt2c reports "not a valid CoT DT file"
when parsing arithmetic expressions in generated CoT descriptors.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
OpenEmbedded Core is preparing to release and master has diverged. Until
we have also diverged, stick to the stable branches for oe-core and
bitbake.
meta-oe and meta-secure-core have not yet diverged, so they need to stay
on master for now.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Corstone-1000 performs PSA ADAC authentication while the device is
in CM. TF-M runtime provisioning then changes the lifecycle state and
resets the platform, which loses the authenticated debug permissions.
Add a Secure Debug build option that skips TF-M runtime provisioning.
This keeps the device in CM and avoids the provisioning reset until a
reset-safe design can preserve DCU_EN across reset and apply it from
BL2.
Update the Secure Debug guide to use Arm Development Studio's built-in
PSA-ADAC manager and obtain test credentials without building the
external SDM library. Document the connection setup and verify that
the system boots after authentication.
Signed-off-by: Ahmed Gomaa <ahmed.gomaa@arm.com>
Select TF-M and its native scripts at version 2.3 for both
Corstone-1000 and Corstone-1000-A320.
Remove 45 obsolete TF-M patches and two obsolete PSA-ADAC patches,
47 in total. Refresh three retained TF-M patches and renumber the
remaining series: 15 TF-M patches and two PSA-ADAC patches.
Drop the Corstone-specific PSA-ADAC revision override to use the
revision pinned by the generic TF-M 2.3 recipe, which includes the
required Corstone-1000 Secure Debug fixes.
Configure Corstone-1000 image signing with the TF-M default non-secure
PSA key ID required by TF-M 2.3 image verification. Without this
metadata, BL2 cannot select the expected built-in verification key.
Update the user guide recipe references to TF-M 2.3.0.
Signed-off-by: Ahmed Gomaa <ahmed.gomaa@arm.com>
TF-M 2.3 packages its image-signing wrapper as the
mcuboot_imagesign_wrapper console command. Add the required native
Python runtime dependencies and install the bundled MCUboot PEM
signing keys in the native sysroot.
Install TF-M's patched MCUboot imgtool package, including its
imgtool.keys Python modules for loading and handling cryptographic
keys. These modules are part of the signing tool implementation,
separate from the PEM signing-key files installed above.
Prefer this patched package through PYTHONPATH because it supports
PSA key IDs and writes them into signed image metadata.
Update tfm_sign_image.bbclass to invoke the console command when
available, retaining wrapper.py as a fallback for older TF-M versions.
Add optional PSA key ID arguments so platforms can provide the
identifier expected by BL2 during image verification.
Signed-off-by: Ahmed Gomaa <ahmed.gomaa@arm.com>
The upcoming 6.1 release is codenamed blacksail, so set that as the
layer compatibility. We can't also claim to be compatible with wrynose
as apart from potential dependency issues, the LICENSE changes mean this
layer will not parse successfully.
Signed-off-by: Ross Burton <ross.burton@arm.com>
The latest kernel produces the following ACPI message on rdn2 and
rdv2:
ACPI: PNP0A08:03: _OSC: platform retains control of PCIe features (AE_ERROR)
This message is benign, but causes the parselogs test in testimage to
fail. Add it to the list of ignored errors for both platforms.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Recent changes to the arm64 kernel defconfig changed CONFIG_E1000E from
built-in to a module. This breaks testimage networking on the SBSA
Reference platform.
testimage provides the target network configuration through the kernel
“ip=” command-line option. The kernel needs the network driver to be
built-in in order to configure the interface from this option during
boot. With e1000e built as a module, the interface is not available at
that point and testimage is unable to establish an SSH connection to the
target.
Set CONFIG_E1000E=y in the sbsa-ref kernel configuration to make the
driver built-in again and restore testimage SSH testing.
Signed-off-by: Jon Mason <jon.mason@arm.com>
GenerateCapsule expects a PEM that contains both the private key and the
matching certificate. The current capsule flow appends the certificate
to PAYLOAD_PRIVATE_KEY_PATH in place, which mutates the deployed key
file and adds another certificate block every time do_image_uefi_capsule
runs.
Prepare per-component signing PEMs under WORKDIR instead and pass those
files to the capsule JSON generator. This keeps the configured private
key unchanged, makes repeated capsule builds idempotent, and provides
GenerateCapsule with the combined key and certificate input it requires.
Rename the helper's primary signing input from --private_keys to
--signing_pems to reflect the actual input format, while keeping
--private_keys as a compatibility alias.
Generating the signing PEMs per component also allows each capsule
payload to use its own private key and matching certificate instead of
relying on a single mutated key file.
Use expr for the signing PEM counter because the BitBake shell parser
does not support arithmetic expansion.
Signed-off-by: Gianluca Andreotti <gianluca.andreotti@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update Corstone-1000 to OP-TEE 4.10.0.
Removed the local 4.9.0 recipes and patches that are included
upstream in 4.10.0.
Tested on the Corstone-1000 Cortex-A35 and Cortex-A320 FVPs.
Signed-off-by: Oscar Belshaw <Oscar.Belshaw@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If anything else in the BSP also wants or needs to add an early TA to
optee, that will conflict with this .bbappend adding its own
EARLY_TA_PATHS="..." argument to EXTRA_OEMAKE.
Instead, add the path to the ftpm TA to the newly introduced
EARLY_TA_PATHS bitbake variable, which the main recipe will use to
produce the make argument.
Passing CFG_EARLY_TA=y explicitly is not needed, as optee-os' build
system sets that automatically if the EARLY_TA_PATHS list is
non-empty.
CFG_CORE_HEAP_SIZE is somewhat harder to make play along nicely with
other .bbappends that might have an opinion on its proper (minimum)
value. For now, keep adding it explicitly to EXTRA_OEMAKE.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If two different .bbappends both try to add an "early TA" by appending
an EARLY_TA_PATHS="..." to EXTRA_OEMAKE, only one of them will
actually take effect.
For example, meta-arm itself has a .bbappend in optee-ftpm which adds
the ftpm TA if optee-ftpm is in MACHINE_FEATURES. If the BSP developer
wants to add another early TA, he has to take that into account and
very carefully ensure to create an EARLY_TA_PATHS="..." argument which
contains both the ftpm value as well as his desired extra TA.
Instead, let the main recipe define a variable which can simply be
appended to in the normal way, and which is used for deriving the
single EARLY_TA_PATHS="" argument in the make command line.
Handle the in-tree TAs similarly.
Signed-off-by: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Makefiles in TF-A have changed since this recipe was last altered,
and our BUILD_LDFLAGS are no longer being respected. This means the built
objects don't have the correct RPATH, so they fail to run if the host
doesn't have libcrypto.so.4 (from OpenSSL 4) installed.
Pass all of our BUILD_* flags via HOSTCC*, and delete the now redundant
sed operations.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The cert_create tool uses the OpenSSL engine API, which has been removed
from OpenSSL 4. Enable the engine stubs to fix the build until this is
resolved upstream.
Also shoe-horn BUILD_CFLAGS into cert_create/Makefile, so the define is
passed to the build.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
u-boot/lib/rsa/rsa-sign.c uses the OpenSSL engine API, but this has been
removed from OpenSSL 4. Patches are being worked on upstream and the
recipe in oe-core has those patches, but for ease we can simply enable
the stub API to fix the build until this old recipe is removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
gen-sbkeys creates and installs the secure boot signing keys, certificates,
and database used by U-Boot and systemd-boot. Both recipes require these
files during do_compile, but there was no dependency ensuring that
gen-sbkeys:do_install completed first.
Add an explicit do_compile dependency on gen-sbkeys:do_install for both
U-Boot and systemd-boot to prevent the race, which was causing intermittent
CI failures.
The uki.bbclass also requires the secure boot keys and certificates, but
depends on systemd-boot:do_deploy, which ensures the keys are available before
they are needed.
Issues being tracked in meta-secure-core
https://github.com/Wind-River/meta-secure-core/issues/145https://github.com/Wind-River/meta-secure-core/issues/146
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make the COMPATIBLE_HOST in fvp-common.inc be both x86 and arm64, since
that is the large majority of the FVPs available.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the fvp-base model recipe to version 11.32.19.
The new release changes the package layout and installation process,
requiring updates to the license checksums, source checksums, install
procedure, and FVP binary linking.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Replace the incomplete Arm Development Studio steps with the configuration database and hardware connection flow.
Initialize the required submodules and document that the Secure Debug Manager library must be built before importing the configuration.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Replace manual partial and rollback capsule generation with a kas
shell command
- Remove incorrect MPS3 capsule transfer instructions
- Fix broken MPS3 section header
- Update incorrect capsule amount in instructions
Shortens documentation and improves clarity in capsule generation,
making it easier to see how the partial and rollback capsules differ.
Also correct the capsule count in the test setup instructions.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Juno firmware recipe currently depends on the
juno-latest-oe-uboot.zip archive hosted on Linaro. That archive is no
longer available, making the recipe impossible to build from scratch.
Replace the archive dependency with the individual firmware files
required to recreate the original directory layout. The recipe now
assembles the firmware tree during do_install(), generating the small
board-specific differences where appropriate.
The original archive contained duplicate copies of mbb_v151.ebf,
io_b118.bit, and tapid.arm under the HBI0262B/C/D directories. The only
meaningful differences between those directories are the PMS firmware
filename and references to it, so the recipe generates the board-specific
files with sed rather than storing duplicate copies.
Similarly, the SITE1 images.txt files only differ in the referenced DTB,
so those are generated from a common template.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Extract the full list of licenses from third_party_licenses.txt.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Part of the GCC license is -only, not -or-later. Thanks to Denys
Dmytriyenko and Joshua Watt for their diligent review.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
openembedded-core now parses the LICENSE field as a SPDX license
expression[1], so convert the license statements.
This is mostly replacing "&" with "AND", but we can also use "WITH" in
the GCC recipes.
[1] oe-core e9d424738d6 ("classes/conf/lib: Parse LICENSE as SPDX Expression")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-ftpm tagged the 4.10 release, but had no functional changes (that
is, they tagged the same commit of 4.9.0 with 4.10.0). Update the
recipe name to match the latest version, and not have people think that
one package was held back.
Also, modify the version checking to be less incorrect
Signed-off-by: Jon Mason <jon.mason@arm.com>
The source tree is question is not tagged or branched with any version.
Update to the latest commit, change the recipe name to denote it is
'git' and not versioned, and fix the upgrade-status. Also, update the
git URL.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The source tree is question is not tagged or branched with any version.
Update to the latest commit, change the recipe name to denote it is
'git' and not versioned, and fix the upgrade-status. Also, update the
git URL.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the recipes to the newest release. Also, Arm Binary Toolchains
have moved to https://gitlab.arm.com/tooling/gnu-toolchains-for-arm
The new location has a new layout, which means the upstream version
check needs to change. Unfortunately, they are not using tags, but do
seem to use branch names like a tag. So, using that for the version
check.
Signed-off-by: Jon Mason <jon.mason@arm.com>
CI is seeing intermittent boot test timeout errors, where the FVP is
almost to shell but times out before getting there. To get around this,
lengthen the timeout to allow for more opportunity to complete
successfully.
By default, the timeout is 600 seconds. Increase this by 50% to 900.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 A320 FVP CI matrix to run testimage jobs.
This enables testimage coverage for both the firmware-only and no-firmware
entries.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 with Cortex-A320 FVP recipe to use the
11.31.cs1000_a320_2 release from Arm Developer.
Switch the source URL to the new package layout, add the architecture-specific
download tokens, and update the x86_64 and aarch64 SHA256 checksums.
The new package extracts directly into the FVP install directory, so update the
install step and license paths accordingly.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 with Cortex-A320 changelog, release notes,
user guide, tests documentation and metadata for the 2026.05 release.
Add the new 2026.05 changelog entry for the Corstone-1000 with
Cortex-A320 specific updates and align the component version tables and
Yocto distribution component versions with the current release content.
Refresh the user guide and tests documentation to align with the
2026.05 release state, including release tag references, recipe version
references, report links
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 changelog, release notes and user guide for
the 2026.05 wrynose release.
Add the new 2026.05 changelog entry and capture the main release work,
including the component upgrades, TF-M GPT and PSA FWU changes, and the
updated SSH-enabled build flow.
Refresh the component version tables and Yocto distribution component
versions in changelog for the new release.
Update the user guide to align with the 2026.05 release branch and
documentation state, including the Yocto release name, recipe version
references, release tag references, and related asset and report links.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
u-boot v2026.04 changed to kbuild 6.1, which broke how ubootefi.var is
used. Apply patch from u-boot mailing list to address the issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the recipes to 4.10.0 and update the git recipes to 4.10.0
Since corstone1000 is still using 4.9.0, move that to meta-arm-bsp
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update edk2-firmware to the latest release.
Of note, GCC5 make variable has been removed. Use the GCC make variable
instead. Also, these changes caused the need to modify the sbsa-acs
patches.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The policy in meta-arm is to only have the latest version and the
latest LTS version. Remove all of the older LTS versions to comply with
this policy.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for the newest release of TF-A.
mnedtls was made a git submodule, and moved location. Given that this
will be the location going forward, I thought it best to change inc file
to point by default to the new location, and have the LTS versions to
point to the old location in their recipes.
Also, seeing some weird behavior with CPUs not coming on line in
sbsa-ref and qemuarm-secureboot. So, pinning those back to the LTS
until they can be sorted out.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Place psa-arch-tests under ${S}/ts-external/psatest and update the
recipe paths to match.
This keeps the external source layout aligned with trusted-services,
updates the Corstone-1000 patch locations, and lets devtool modify work
against the same psa-arch-tests tree that CMake and
apply_local_src_patches use.
Signed-off-by: Arthur Cassegrain <arthur.cassegrain@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add recipes for newest version of tf-m. Of note, mbedtls has been
removed in favor of the TF-PSA-Crypto library. This is having a cascade
into the other recipes, with a removal from the core inc file and add of
the individual lines to the specific versions.
TF-PSA-Crypto is Apache 2.0 licensed. So, no need to change the recipe
license field.
Signed-off-by: Jon Mason <jon.mason@arm.com>
In TF-M 2.3.0, Musca S1 was removed, but B1 is still present. In an
effort to keep coverage, swapping S1 and B1.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Warnings being always fatal is quite anti-social because sometimes there
are temporary warnings that we don't want to break the CI.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Set the default cache directory to be the build tree so we don't assume
anything about the runner environment by default.
After this change, runners that don't set CACHE_DIR will need to set it
explicltly in their variables.
Signed-off-by: Ross Burton <ross.burton@arm.com>
With the new GCC, we're seeing the following error:
| In file included from /builder/meta-arm/build/tmp/work/armv8-5a-poky-linux/ts-sp-smm-gateway/git/sources/ts/components/common/dlmalloc/malloc_wrapper.c:62:
| /builder/meta-arm/build/tmp/work/armv8-5a-poky-linux/ts-sp-smm-gateway/git/sources/ts/components/common/dlmalloc/malloc.c: In function 'add_segment':
| /builder/meta-arm/build/tmp/work/armv8-5a-poky-linux/ts-sp-smm-gateway/git/sources/ts/components/common/dlmalloc/malloc.c:4002:7: error: variable 'nfences' set but not used [-Werror=unused-but-set-variable=]
| 4002 | int nfences = 0;
| | ^~~~~~~
To workaround this issue, add "-Wno-error=unused-but-set-variable" to TARGET_CFLAGS
Signed-off-by: Jon Mason <jon.mason@arm.com>
New GCC is logging errors for unused-but-set-variable in
tftf/tests/runtime_services/standard_service/psci/api_tests/psci_stat/test_psci_stat.c
Workaround this by adding -Wno-unused-but-set-variable to the Makefile
Refer to https://github.com/TrustedFirmware-A/tf-a-tests/issues/4
For the upstream resolution, if/when that arrives.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a separate Corstone-1000 Armv9-A Edge-AI documentation
set for the Cortex-A320 platform.
Populate the new documentation tree with the initial index,
user guide, software architecture, release notes, change log,
and supporting images.
Keep common Corstone-1000 material in the existing documentation
set and move A320-specific content into the new standalone
document set.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Lisa Durbin <lisa.durbin@arm.com>
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Add a --dry-run option to scripts/runfvp to print the constructed
FVP command line and exit without launching the model.
This is useful for checking parameters and reusing them with different
FVP binaries.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some platforms (like Allwinner A64/sun50i_a64) have LTO enabled
in the Makefiles, which causes a linking error when using ld:
| [...]/aarch64-oe-linux/aarch64-oe-linux-ld: -f may not be used without -shared
Add an option to be able to indicate in the recipe if the plaform has LTO enabled,
and only pass LD to make in case LTO is disabled, otherwise let it use $CC (as set by the Makefile).
The option is disabled by default to keep the existing behavior.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
GenFv requires libuuid in the native sysroot.
Add util-linux-libuuid-native and pass required flags through to the
BaseTools makefiles. This can be missed on machines with libuuid
headers installed, as the build may find the host copy instead.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
${IMAGE_NAME} expands to a timestamped filename which gets written into
the .fvpconf. A mismatch occurs when do_image reruns (regenerating the
.fvpconf with a new timestamp) but do_image_wic hits sstate (leaving the
old .wic on disk), causing the FVP to fail at startup with:
Can't stat <image>-<timestamp>.wic! (error 2)
Use IMAGE_LINK_NAME instead, which is the stable symlink that always
points to the most recently built .wic.
Signed-off-by: Marek Bykowski <marek.bykowski@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove Cortex-A320-specific content from the base Corstone-1000
documentation.
Drop the A320-only sections, commands, notes, and subsystem image from
the shared Corstone-1000 software architecture and user guide now that
the platform is documented in its own standalone document set.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add CI coverage for the Corstone-1000 with Cortex-A320 FVP machine.
Build the Corstone-1000 with Cortex-A320 FVP with the firmware-only
configuration and run both `none` and `tftf`.
Also run `none` for the no-firmware build.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add `corstone1000-a320-fvp` as a dedicated machine instead of enabling
the Cortex-A320 variant through a kas overlay on `corstone1000-fvp`.
Move the A320-specific machine features, overrides, FVP executable
selection, and Ethos-U85 configuration into the new machine
configuration. Keep the generic `corstone1000-fvp` machine focused on
the base FVP platform.
Update the A320 kas to use `corstone1000-a320-fvp` directly, and
allow pregenerated SSH host keys for the new virtual machine.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a shared Corstone-1000 kas configuration for building SSH-enabled
mass storage images across the supported Corstone-1000 machines.
Enable Dropbear SSH in the mass storage OS image, add pregenerated SSH
host keys for FVP builds, and document the SSH image build flow in the
user guides.
SSH support is too large for the flash OS image, so provide a dedicated
`core-image-minimal` kas configuration for SSH-enabled mass storage
images instead.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Fix the Corstone-1000 with Cortex-A320 override for the
Trusted Firmware-A errata list.
The override was misspelled as
`ENABLE_CORTEX_A35_ERRATA:cortexta320` instead of
`ENABLE_CORTEX_A35_ERRATA:cortexa320`.
Rename the list to `ENABLE_CORTEX_A_ERRATA`, since it is shared by
the Cortex-A35 and Cortex-A320 variants.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This series wires up Arm FF-A support for EFI runtime services by
factoring runtime-safe helpers into the FF-A bus, layer the EFI
variable TEE transport on top, and then rehome the helper exports
so there’s a single implementation shared between boot and
runtime paths. Corstone1000 enables the self-test command and
expands the runtime variable selftest so it exercises non-volatile
storage across reboots.
Key Changes
===========
- Add the FF-A runtime transport patch stack to the corstone1000
U-Boot recipe.
- Enable EFI runtime variable handling over FF-A and include the
bootefi selftests and sandbox FF-A runtime transport test.
- Increase the FIP partition sizes from 2MiB to 2.5MiB
and update TFA_FIP_RE_SIGN_BIN_SIZE from 0x00200000 to 0x00280000
to reflect the new allocation. The size of u-boot-EFI-2025.10-r0.bin
has increased from ~707KB to ~944KB following the FF-A/EFI runtime
related changes. As this binary is packaged within the FIP, the
overall signed FIP size has grown accordingly.
- Add a Yocto patch to increase the FIP partition size from
2MB to 2.5MB in the TF-M flash layout for Corstone-1000.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-M build system has introduced a ground-breaking change since v2.0.0.
Enable TF-M regression test build, following build instructions in TF-M
document [1].
Add the BUILD_REGRESSION_TESTS variable to enable regression test
builds. Individual regression test suites can be selected by
passing the appropriate TF-M CMake options through EXTRA_OECMAKE.
If regression test is enabled, build TF-M and tests from tf-m-tests
directory.
The build files for Normal World build will be installed.
[1]: https://trustedfirmware-m.readthedocs.io/en/latest/building/tests_build_instruction.html
Signed-off-by: David Hu <david.hu2@arm.com>
Signed-off-by: Gergely Kovacs <Gergely.Kovacs2@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With the latest version of acpica (20260408), the following error is
being encountered in edk2 platforms for Arm SGI
| "iasl" -p/builder/meta-arm/build/tmp/work/rdn2-poky-linux/edk2-firmware/202602/build/Build/RdN2/DEBUG_GCC5/AARCH64/Platform/ARM/SgiPkg/AcpiTables/RdN2AcpiTables/OUTPUT/./SsdtEvents.aml /builder/meta-arm/build/tmp/work/rdn2-poky-linux/edk2-firmware/202602/build/Build/RdN2/DEBUG_GCC5/AARCH64/Platform/ARM/SgiPkg/AcpiTables/RdN2AcpiTables/OUTPUT/./SsdtEvents.iiii
| /builder/meta-arm/build/tmp/work/rdn2-poky-linux/edk2-firmware/202602/build/Build/RdN2/DEBUG_GCC5/AARCH64/Platform/ARM/SgiPkg/AcpiTables/RdN2AcpiTables/OUTPUT/./SsdtEvents.iiii 61: Printf ("GPIO0 Pin0 Toggled")
| Error 6010 - Internal compiler error ^ (Invalid parse opcode in OpcGenerateAmlOpcode)
Since this appears to be a debug message, and the relevant platforms are
a work in progress. Work around this issue by removing the printf.
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Add `wic`` image manipulation requirement, `mtools`, to prerequisites
- switch the `kas` install step to a user-local virtual environment
removing `sudo` requirement
- Add `wic` install step
- replaced the mount/unmount acs_results and capsule staging steps
with non-`sudo` wic-based image manipulation.
- Adds guidance for using serial-console without `sudo`
- Standardise capsule transfer to the root of the BOOT partition
- Update docs to align with new non-`sudo` requirement for
`create_keys_and_sign.sh` interactive script.
These updates remove several unnecessary `sudo`` dependencies when
running OOB CS1K testing.
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Use the correct `${WORKSPACE}` script path without the stray `./` prefix.
This avoids an invalid command path.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a U-Boot patch to disable CONFIG_EFI_DEBUG_SUPPORT in the
Corstone1000 defconfigs.
EFI debug support is now enabled by default and changes the EFI memory
layout. On Corstone1000 this can cause a boot failure after
ExitBootServices(), reproduced on the Cortex-A320 FVP path with MTE
enabled.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone1000 U-Boot patches to detect FVP platforms
by matching "fvp" in the device tree name instead of relying on
the exact arm/corstone1000-fvp string.
This fixes FVP-specific handling for Corstone1000 variants,
including capsule image selection and virtio setup.
Also restore CONFIG_BOARD_LATE_INIT in the Corstone1000
defconfigs, since the virtio probing runs from
board_late_init() and would otherwise never execute.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Uses the new GPT duplicate operation during a firmware update. This also
adds flash erase protections so that the operation is not too slow and
erasing flash multiple times redundantly.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
These patches add functionality to duplicate GPT partition entries. This
combines a "create-write" into a single step, letting the GPT library
handle it, useful for the Corstone1000 firmware update process.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
These patches backport bug fixes for the GPT library in TF-M.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Returning from the finally block at the end of the start_fvp() function
is discarding exceptions. Since start_fvp() is near to the top off the
call tree, this hides uncaught exceptions thrown by most of the code,
which makes detecting and debugging issues hard.
This is resolved by removing the return statement from the finally
block, allowing exceptions to propagate normally.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for Screen the GNU terminal multiplexer. The -t/--terminal
option now accepts "screen" as a terminal type. When selected, the tool
must be run from within an existing Screen session, and each FVP
terminal is opened in a new Screen window.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Improve usability by detecting which terminal types are available on the
system.
Extend the terminal abstraction to support checking whether a terminal
can be executed, and add basic validation for all terminal types. Update
the documentation to reflect the new behavior.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The initramfs for Corstone1000 is based on core-image-minimal, which has
GRUB included as a package. Corstone1000 uses U-Boot's efiloader to load
the initramfs and kernel and therefore does not require GRUB for boot.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Print an error message if the FVP binary cannot be found, instead of
failing silently.
Signed-off-by: Roger Knecht <roger.knecht@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When --selected_components is not specified, the script should include
all components as documented in the help text. However, the current
implementation skips all components when the parameter is empty,
resulting in an error.
Fix the filtering logic to only apply when --selected_components is
explicitly provided with values.
Signed-off-by: Kevin Hao <kexin.hao@windriver.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that Xen has been removed, clean up the remaining references to
the meta-virtualization layer.
This was done as a separate commit to make reverting easier in the
future in case we need to add back meta-virtualization for some other
builds.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We originally added Xen builds to our CI to exercise Xen on Arm. Now
that the Yocto autobuilder has jobs that test Xen on qemuarm/qemuarm64
we no longer need the builds in meta-arm as they don't provide any more
coverage.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove the user-guide warning and rebuild steps for the
disable_module_autoloading workaround on Corstone-1000 with Cortex-A320.
With the NPU reset issue fixed, this workaround is no longer
needed.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Derive host base addresses from offsets and add ext sys reset bitfields
- Deassert CPUWAIT with a bitmask
- Enable ext sys boot handling for Corstone1000 with Cortex-A320
- Add the new downstream TF‑M patches to the recipe
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Replace `systemready-patch` with `iot-platform-assets` in the guide.
- Update the Corstone-1000 asset paths and U85 kas command examples.
Align the user guide with the renamed asset repository, avoiding
stale commands and broken paths.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To workaround the CPU topology issue with edk2-firmware, we can specify
the number of processors being used, which seems to setup the CPU
topology mask correctly (and thus no errors). With this addressed, we
can use the latest edk2 firmware, which allows us to use the latest TF-A
version.
Signed-off-by: Jon Mason <jon.mason@arm.com>
rdv1 has been EOLed, and requires keeping around some recipes because
of its removal. Also, the FVP is x86 only, thus limiting CI.
Signed-off-by: Jon Mason <jon.mason@arm.com>
sgi575 has been EOLed, and requires keeping around some recipes because
of its removal. Also, the FVP is x86 only, thus limiting CI.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some of the soon-to-be-added FVPs have the execute issue still. So,
re-add this until it can be resolved. Also, address S issue that
changed upstream between the original removal and now.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 user guide to reflect the current Ethos-U85
test and workaround flow.
As the Corstone-1000 software stack moves to the in-tree ethosu
driver, switch the Ethos-U85 test instructions from delegate_runner to
Mesa's test_teflon application. Also update the guide to use the
renamed ethos-u85-test kas fragment and to apply the Mesa patch needed
to package test_teflon into the image.
Also replace the disable_module_autoloading kas fragment in the A320
workaround instructions with the disable-ethosu patch, to align with
the workaround flow used in systemready-patch.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone-1000 with Cortex-A320 FVP now supports SMP, so update the
documentation to reflect the current status.
Update the user guide to state that SMP is supported on Corstone-1000 with
Cortex-A35 FVP and on Corstone-1000 with Cortex-A320 FVP.
Add the Cortex-A320 multicore build and run commands.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone1000 with Cortex A320 now uses the in-tree ethosu driver, so the
external meta-ethos layer (and its meta-sca dependency) is no longer needed.
Remove meta-ethos and meta-sca from the Corstone-1000 A320 kas
config, drop the layer dependency on meta-ethos, and stop
installing arm-npu-ethosu. Update the Corstone-1000
change log to reflect the removed layers.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Align the Corstone1000 Ethos-U85 device tree to match the upstream
bindings used by the in-tree Ethos-U DRM accel driver.
- Rework the Corstone1000 U-Boot patch to replace the legacy arm,ethosu-direct
node with an upstream-style Ethos-U85 node (arm,ethos-u85), add the
required clocks/clock-names, and switch the SRAM description to
mmio-sram.
- Drop meta-ethos specific properties (reserved-memory/dma-ranges,
/region-cfgs/mem-config) from the U-Boot DT.
- Enable required kernel options for the in-tree driver and SRAM provider:
- CONFIG_SRAM
- CONFIG_DRM
- CONFIG_DRM_ACCEL
- CONFIG_DRM_ACCEL_ARM_ETHOSU
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
linux-yocto does not currently ship a 6.19 recipe, so add a
meta-arm-bsp linux-yocto_6.19.bb that tracks linux-yocto-dev v6.19/base.
Pin SRCREV_machine to fixed revision to keep builds reproducible.
Update Corstone-1000 to prefer linux-yocto 6.19 and align
the user guide pointers accordingly.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The U-Boot maintainers rejected the previous patch [1] for two primary
reasons:
1. The Cortex-A320 changes should be considered a separate platform
2. The NPU node bindings do not match those in the Linux kernel
The former is handled by this commit. The latter point has not been
resolved, hence marking the newly added patch as Inappropriate. This is
simply the first step in resolving the comments.
[1] https://lore.kernel.org/all/20251127154752.589691-1-frazer.carsley@arm.com
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Rework the patch that enables the OF_UPSTREAM config option to split
off the extra device tree nodes into their own dtsi files, making it
easier to combine them in different ways. The rest of the patches have
changed only so that they can be applied cleanly.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone1000 used to use its own implementation of a GPT parser for use
in a capsule update. The patches in this commit replace what exists with
the generic GPT library, as well as other minor self-explanatory fixes.
The wic file has undergone two changes as a result of this:
1. The partition type GUID of each of the four partitions that can be
updated by a capsule update must match the GUID of each capsule. This
allows for the existing partition to be matched with its updated
image. Different machines (e.g. MPS3 vs FVP) have different GUIDs for
these images hence the need for separate files.
2. The second bank has been removed from provisioning. Because the
library supports dynamic creation of partitions, the second bank no
longer needs to be provisioned at build time. However, a small
reserved partition is still created above the 32KiB mark to force
wic to size the disk as 64KiB and write this into the GPT header
for the library to read on initialisation.
Finally, the size of bl1_1 is reduced by one of the patches in this
commit, so this is also reflected in the recipe.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The patches added in this commit add a generic GPT library for use in
flash devices. Corstone1000 could use these to manage partitions during
a firmware update.
The patches are all backports from trusted-firmware-m (TF-M) main
branch and can be removed if Corstone1000 upgrades when the next version
of TF-M is released.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Split off the main portion of the SCP firmware recipe into an include
file and create a git versioned recipe. This allows for building and
testing the latest sources.
Signed-off-by: Jon Mason <jon.mason@arm.com>
New versions of the FVPs have been released. Update the recipes to use
them. License SHA changes caused by 3rd party software versions used
being modified and white space changes.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Massive layout changes inside the FVP tarball. The files are not
located in *_FVP anymore, including the license files, which were in 2
locations in previous releases. The tarball changed from
Linux64/Linux64_armv8l to Linux_x86/Linux_armv8. It hchanged extention
from tgz to tar.gz
Also, adding skip of dev-so, due to libstdc++.so and libsystemc.so being
symlinks and fvps being a binary.
NOTE: the license file changes are due to version bumps for sdl, ffmpeg,
libvpx, and python. The license changes in the managements utilities
was version changes in clang and golang, and removal of wxWidgets,
libstdc++-6.dll, libgcc_s_seh-1.dll, and libwinpthread-1.dll
Signed-off-by: Jon Mason <jon.mason@arm.com>
To improve portability, testing coverage, and future platform enablement.
- Replace FVP-only multicore checks with platform-generic checks.
- Add the corresponding TF-M patch to the Corstone-1000 recipe.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To improve portability, testing coverage, and future platform enablement.
- Replace FVP-only multicore guards with platform-generic guards.
- Add the corresponding TF-A patch to the Corstone-1000 recipe.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To improve portability, testing coverage, and future platform enablement.
- Gate multicore on `MACHINE_FEATURES += "corstone1000_smp"`.
- Change recipe overrides from `:corstone1000-fvp` to `:corstone1000`.
- Update the Corstone-1000 multicore kas/doc references.
Signed-off-by: Alex Chapman <alex.chapman@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The recipe previously only copied the Python BaseTools into the native
sysroot, which was sufficient for capsule signing but not for Firmware
Volume (FV) creation. Downstream recipes that build UEFI capsule
update images for embedded platforms need GenFfs and GenFv to assemble
FV images - a key component of the UEFI Capsule Update format used for
system firmware updates.
Add the brotli submodule source (build-time dependency of both tools),
build the C BaseTools (Common, BrotliCompress, GenFfs, GenFv) and
install the binaries into ${bindir} together with GenerateCapsule.py
and the Common Python library so that capsule-generating recipes can
consume them from the native sysroot.
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The oe-core master branch just switched from whinlatter to wrynose[1] so
follow this change in our layers.
[1] oe-core cd1179544d7 ("layer.conf: Update to wrynose")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Add the corstone1000 patch that inserts a compiler barrier before the
first HOST_AO_LOCK_BITS write in CC_LibInit().
On corstone1000-mps3 with GCC 15.x, TF-M can HardFault on that first
AO lock register update. Adding the barrier avoids the fault.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Compiles of edk2-firmware with GCC 15 on the host will fail:
main.c: In function ‘ProcessArgs’:
| main.c:163:42: error: too many arguments to function ‘p->process’; expected 0, have 2
| 163 | (*p->process)( *argv, *(argv+1) );
| | ~^~~~~~~~~~~~ ~~~~~
We actually already had the fix for this, but were doing SRC_URI +=
_before_ the include file did SRC_URI =, so the patch was never applied.
Move the require to the top of the recipe so this ordering problem does
not happen, and fix the line-endings in the patch that never got applied.
[ YOCTO #16116 ]
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If the sstate is being mounted into the container then the hashserver
also needs to be shared, and not stored inside the build tree. Mark
BB_HASHSERVE as being set via an environment variable so the GitLab
runner environment can set the correct location.
This fixes a long-standing problem causing substandard reuse, which now
is detected and causes a warning in oe-core[1].
[1] oe-core 491de0db64a ("sanity.bbclass: warn when sstate is outside of
build dir, but hash equiv database is inside it")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When the binary toolchain support was removed[1] we no longer used this
variable, but a few instances of it was left behind.
[1] meta-arm 03af0c72f1 ("arm-toolchain: remove external-arm-toolchain")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Do the changes necessary to get qemuarm64-secureboot to work with edk2
firmware, and add it to CI. The CI changes needed to make it dynamic
based on edk2.yml or u-boot.yml required moving the relevant parts into
inc files.
Signed-off-by: Jon Mason <jon.mason@arm.com>
edk2 has been broken on qemuarm64 for an unknown amount of time. Add it
to CI to prevent this from happening (until edk2 works on
qemuarm64-secureboot).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make the relevant correction for the following warning in qemu:
warning: short-form boolean option 'readonly' deprecated
Please use readonly=on instead
Signed-off-by: Jon Mason <jon.mason@arm.com>
The INSANE_SKIPs were not sufficient because the chrpath code used in
nativesdk builds still warns, so instead of hiding the warnings fix them
instead: remove the pointless RPATHs in the embedded Python libaries,
and delete the static libraries.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Change the layout to enhance readability and add TS fTPM related
information.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable execution of the tpm2-tools self-test against the Trusted
Services fTPM SP. The test is integrated into OEQA but is disabled by
default due to its long execution time (over three hours on fvp-base)
and inconsistent results. While individual tests pass when run in
isolation, running the full suite results in failures. Despite this,
it remains the most comprehensive verification currently available.
Testing can be enabled by setting the RUN_TPM2_TESTS variable.
Signed-off-by: Gabor Toth <gabor.toth2@arm.com>
Signed-off-by: Gyorgy Szing <gyorgy.szint@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Trusted Services has introduced a Firmware TPM (fTPM) secure partition.
This change enables building and deploying the fTPM SP through meta-arm.
The secure partition is based on the TPM2 reference implementation,
msp-tpm20-ref, which has been patched to use MbedTLS as its
crypto backend and psa-its for non-volatile storage.
Signed-off-by: Gabor Toth <gabor.toth2@arm.com>
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The wheel includes the tests which are in a non-namespaced module, and
will then conflict with other recipes (such as python3-cryptography) that
also install non-namespaced tests.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Set FILESEXTRAPATHS so that artifacts that meta-arm injects can still be
found when using the include from a different layer.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a CI test for the LTS versions of recipes currently supported.
Use fvp-base, since that provides good coverage and is being used for
the latest version testing.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the TF-A recipes to the latest stables/LTS versions. Not all of
the versions updated the version of mbedtls being used (and even the
updates didn't update to the latest stable version of mbedtls). We're
using the mbedtls version specified in
docs/getting_started/prerequisites.rst, not the latest available.
Also, update the related fiptools and tf-a-tests (which don't map to the
same releases, but were all verified to be at the latest versions).
No real change in cot-dt2c code, but updating the SHA to the latest.
Signed-off-by: Jon Mason <jon.mason@arm.com>
quilt-native is required by do_apply_local_src_patches task.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
GCC 15 (and GCC 14, and probably others) are finding new problems in
trusted-firmware m, and these cannot simply be ignored (as they are
fatal build errors). Clear the ld security flags to get around those
issues, backport a couple of patches for fixes that have been addressed
upstream, and create a patch to work around some casting issues in
functions that are removed in newer versions of the code. This
refactoring caused some minor clean up of existing corstone1000 tfm
patches.
Also, use size based optimization for corstone1000. With this, the bl1
is too big to fit into flash. The correct way to solve this would be to
remove TFA_DEBUG, but that causes a rabbit hole of problems related to
heap being enabled or not. This works around the issue until it can be
resolved properly.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update edk2, edk2-platforms, and sbsa-acs to the latest versions/SHAs.
A bleeding edge patch from upstream is needed to correct a build race in
antlr, and the latest SHA for edk2-platforms is needed to work around
some compilation issues with ENABLE_TPM in fvp-base.
Signed-off-by: Jon Mason <jon.mason@arm.com>
A recent change to image dependencies in oe-core master[1] means that
TESTIMAGE_AUTO tries to test more images than before.
Explicitly reset TESTIMAGE_AUTO for core-image-initramfs-boot so that it
doesn't try to testimage an initramfs.
[1] oe-core b75c21fb950 ("image_types_wic.bbclass: add depend on initramfs")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Clone all trusted-services dependencies into the TS source tree under
ts-external/ instead of ${UNPACKDIR}
This alignes the layout with devtool git-submodule handling.
NOTICE: we can't clone in external as TS already contains files there
and it would conflict.
Signed-off-by: Arthur Cassegrain <arthur.cassegrain@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the corstone1000 variant to apply its psa-adac patches
against the new external/ directory.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Arthur Cassegrain <arthur.cassegrain@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Clone all trusted-firmware-m dependencies into the tfm source
tree under external/ instead of ${UNPACKDIR}.
This aligns the layout with devtool git-submodule handling,
ensuring the recipe sees a consistent source tree at build time
and allowing dependencies to be patched via devtool in the same
way as the main tf-m repository.
(reworked to avoid use internal variables for checkout)
to clone tf-m dependencies use hardcoded path for reproductibility
and avoid using BB_GIT_DEFAULT_DESTSUFFIX which may depend on
yocto version.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Arthur Cassegrain <arthur.cassegrain@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We currently don't have coverage for trusted-firmware-m 2.1.x, which is
the LTS. Since musca-b1 and musca-s1 are essentially the same, use b1
for the LTS coverage.
Signed-off-by: Jon Mason <jon.mason@arm.com>
For some reason, sgi575 won't boot to shell with
core-image-full-cmdline, but it will with other images. Since we're
going to drop this machine soon (as it has been EOL'ed), modify the
image type for CI to core-image-base (As that one appears to boot
faster).
Signed-off-by: Jon Mason <jon.mason@arm.com>
* Set Linux kernel preferred version for Corstone-1000 to 6.18
* Update Corstone-1000 user guide.
* Recent kernel versions removed the deprecated CONFIG_LIBCRC32C
Kconfig symbol as part of the CRC library cleanup.
Replace CONFIG_LIBCRC32C with CONFIG_CRC32, which provides the
generic CRC32/CRC32C library support used by in-kernel consumers.
* The ext3 driver was removed historically and ext4 carries
compatibility for ext3 on-disk format.
* Amend External System patch to adhere to Kernel v6.18 RemoteProc
API.
* Add #address-cells and #size-cells parameters to ethosu dts node
No functional change intended.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
meta-arm-systemready was intended to allow people writing BSPs to run
the SystemReady Architecture Compliance Suite[1] within the Yocto build
environment. However, whilst this seems like a good idea, there are
several problems:
- This layer only supports the IR band and v2 of the ACS. The ACS is now
at v3 and the bands altered, so there is no value in running obsolete
tests.
- Execution of the tests takes a long time, we have integration to run
the tests on a virtual fvp-base machine but execution takes many tens
of hours (our CI times out after 12, on a high-performance worker).
Running the tests in CI, and in particular inside BitBake, isn't
obviously the right thing to do.
- Execution on the tests on real hardware is not trivial, as testimage
has virtual targets as a primary usecase. It is unclear if anyone has
managed to use this layer on physical hardware.
Because of these issues, remove the layer. There are better integration
points for automated ACS testing, and this integration is obsolete.
[1] https://github.com/ARM-software/arm-systemready
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The downloads page for FVPs is broken down into sub-pages for each
"Ecosystem". Organize this file to match that. Also, rename fvp-v3-r1
to "rd" to make more obvious what this refers to.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The corstone1000-a320 FVP is a unique download and should be treated as
such in our CI. Split the relevant parts off, add it to the fvps.yml
file, workaround the staticdev and useless-rpath errors that were
present in the FVP tarball, and the correct depends in the machine
config file.
Also, add this machine to the CI so that any issues can be found with
this unique configuration.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch ignores the built-in FVP UART name when setting the terminal
names on tmux.
The rationale is that appending FVP UART name takes a lot of space
making it unusable on complex platforms with many terminals.
Signed-off-by: Filipe Rinaldi <filipe.rinaldi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The removed patch file breaks the U-Boot efi_selftest utility and has
been denied by upstream in any event. All subsequent patches renumbered.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
All patches have been rebased onto the v2025.10 release branch, with the
changes primarily being updating of offsets and surrounding code in each
hunk.
One minor change between v2024.04 and v2025.10 is that a
CONFIG_BOARD_INIT option was added and must be enabled in order to link
in the `board_init()` symbol. As such, the firmware update patch adding
`board_init()` has been modified to enable this option as well.
The patch that enabled OF_UPSTREAM has been modified slightly in order
to incorporate upstream changes between versions: the SMP changes to the
Corstone1000 FVP device tree were incorporated into the Linux kernel so
are no longer needed in the U-Boot specific device tree. As such, the
patch adding A320 support adds these CPU nodes in order to override them
where appropriate.
In the process, signatures are removed from each patch.
Beyond this, the directory in which U-Boot searches for the EFI capsule
CRT file changed from object tree to source tree, so the recipe is
updated to reflect that.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This fixes a build error due to:
patching file Makefile
Hunk #1 FAILED at 12.
1 out of 1 hunk FAILED -- rejects in file Makefile
Patch 0001-Makefile-Avoid-variable-override.patch can be reverse-applied
Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We have a newer gcc-arm-none-eabi now, so this can be removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make changes across U-Boot, and OP-TEE OS to swap
the GIC-600 for GIC-700 as the latest version of the FVP
swaps the GIC.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump Corstone-1000 machine OP-TEE version from 4.7.0
to version 4.9.0.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update Corstone-1000 documentation to reflect 2026 copyright and
current supported host environment.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-A has a number for variables to control how host binaries are built:
- Our BUILD_CC is HOSTCC; this is set in the recipes
- Our BUILD_CFLAGS is HOSTCCFLAGS; this is not set
- Our BUILD_LDFLAGS has no corresponding variable
However when uninative is enabled we really need to pass BUILD_LDFLAGS
as otherwise there can be link problems:
ld: libcrypto.so: undefined reference to `__isoc23_strtol@GLIBC_2.38'
Patch into the TF-A makefiles support for HOSTLDFLAGS and ensure that we
set all three of the relevant BUILD_ variables.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
2 of the fvp-base specific u-boot patches were merged in the 2026.01
release. Remove those, as they are no longer necessary.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The kernel upgrades are now in oe-core, so we can drop this workaround.
This reverts commit 341a0fd976.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The linux-yocto kernel has strict configuration warnings enabled and this
often causes warning, for example with 6.18.3:
[INFO]: the following symbols were not found in the active configuration:
- CONFIG_SND_SOC_ROCKCHIP
- CONFIG_SLIM_QCOM_CTRL
For these machines we're using the upstream defconfig and not a config
file that we're maintaining, so fixing these problems upstream is slower
than one would like.
As we don't maintain the config, we can disable the checker for these
two machines. This is _not_ precedence for disabling the audit for any
machines where we're not simply using the upstream defconfig without any
changes.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The path changed when the trusted-firmware-m recipe began to inherit
firmware.bbclass.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The paths for these files has changed due to the change to the
trusted-firmware-m recipe now using the custom firmware.bbclass.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
For builds using multiconfig, all of the firmware binaries listed were
being placed in the ${DEPLOYDIR} directly without preserving their
directory hierarchy. This meant that paths to firmware binaries relative
to the ${DEPLOYDIR} differed between builds depending on whether
multiconfig was enabled or not.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update edk2-firmware and edk2-basetools to the 202511 stable release.
Patches from upstream were needed to get it compiling with clang.
edk2 dropped support for 32bit arm and x86, see
https://edk2.groups.io/g/devel/topic/rfc_remove_ovmf_ia32_and/114152215
Therefore, we're dropping qemuarm edk2 testing and relevant bits
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for v2.14.0, and update corstone1000 config and patches to
use it. TF-A seems to have changed their poetry settings from POETRY to
host-poetry (when specifying an alternative location/disabling). So, it
is necessary to modify that for all platforms using COT and v2.14.0
NOTE: sbsa-ref is having issues with fip.bin being too large. So, set
the version to the LTS until that is resolved.
Signed-off-by: Jon Mason <jon.mason@arm.com>
In master, xen images fail to build as the xt-masquerade module is not
built by the kernel. This has been fixed in the linux-yocto 6.18.3
upgrade but that is not yet merged.
Until it is merged, we can temporarily update the kmeta in our CI.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Allow TF-M v2.2.2 to boot with Secure Debug enabled on Corstone-1000 and
align the driver implementation with the current psa-adac library.
- Add missing DRBG macros to fix the
"Failed to generate challenge!" error during Secure Debug.
- Fix an unintended platform reset occurring immediately after setting
the debug enable bits in the dcu_en register while in SE LCS.
Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The PCI subsystem with 6.18 is now warning on boot:
PCI: OF: of_root node is NULL, cannot create PCI host bridge node
Until this can be root-caused, ignore it.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With kernel 6.18 the kernel will now warn if it tries to run a command
from a ramdisk but it cannot be found[1]. This happens with the
qemuarm64-secureboot machine (but not qemuarm64) because u-boot appears
to be populating the devicetree with a ramdisk entry:
loading kernel to address 40400000 size 1702a00
1 qfw ready qfw 0 qfw
** Booting bootflow 'qfw' with qfw
## Flattened Device Tree blob at 7e659890
Booting using the fdt blob at 0x7e659890
Working FDT set to 7e659890
Loading Ramdisk to 7bcfd000, end 7d3ffa00 ... OK
Loading Device Tree to 000000007d621000, end 000000007d626534 ... OK
Working FDT set to 7d621000
Starting kernel ...
The kernel tries to mount and boot this ramdisk but fails because it
isn't a valid initrd or initramfs. The boot continues as usual, but this
warning in the logs triggers parselogs.
Until the boot flow is properly resolved, ignore the message.
[1] linux 98aa4d5d242d ("init/main.c: add warning when file specified in rdinit is inaccessible")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The TF-A can install files with dtb extension. This is not handled in
the firmware.bbclass so append it here.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Replace inherit deploy with firmware.
Initialize TFM_DEBUG using the FIRMWARE_DEBUG_BUILD variable. Initialize
TFM_PLATFORM with FIRMWARE_PLATFORM.
Refactor do_install to use ${FIRMWARE_DIR} and remove now redundant
configuration.
Refactor corstone1000 config files to use ${FIRMWARE_DIR} and the
base do_install.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Replace inherit deploy with firmware.
Initialize SCP_DEBUG using the FIRMWARE_DEBUG_BUILD variable. Initialize
SCP_PLATFORM using the FIRMWARE_PLATFORM variable.
Refactor do_install to use ${FIRMWARE_DIR} and remove now redundant
configuration.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Replace inherit deploy with firmware.
Initialize TFA_DEBUG using the FIRMWARE_DEBUG_BUILD variable. Initialize
TFA_PLATFORM with FIRMWARE_PLATFORM.
Refactor do_install to use ${FIRMWARE_DIR} and remove now redundant
configuration. Drop the redundant ${TFA_PLATFORM} suffixes.
Update BSP conf files to use the new deploy location, including
symlinking back to ${DEPLOYDIR} where necessary.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are now a handful of firmware component recipes in meta-arm, each
of which does its own (slightly different) deployment handling.
Introduce a bbclass to standardize this, with the aim of cleaning up the
DEPLOY_DIR_IMAGE. Crucially, each firmware component deploys into a
${PN} subdirectory of DEPLOY_DIR_IMAGE. This has a few advantages:
* Many Arm components have the same or similar binary names (BL1, BL2
etc). This ensures unique naming and avoids confusion.
* Recipes can afford to be less picky about which binaries are deployed.
This simplifies component recipes.
* It is easier to deploy debug symbols in a common way to an expected
location.
* It keeps the DEPLOY_DIR_IMAGE clean in the face of ever-increasing
firmware complexity.
The bbclass also provides a FIRMWARE_DEBUG_BUILD variable to control the
build type of the firmware in one place, defaulting to the global
DEBUG_BUILD. This should allow BSPs in meta-arm-bsp to more easily
provide a release build by default (by providing an easy switch for
development purposes when needed).
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are times where we need to produce multiple versions of the
trusted-firmed binaries in a given build, but the names for the binaries
are hard-coded in the Makefile and do_install().
This patch adds a new variable, TFA_INSTALL_SUFFIX, that is added to
do_install() that can uniquely name the resulting binaries. By default,
the suffix is empty so that default behavior is not changed.
Signed-off-by: Ryan Eatmon <reatmon@ti.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When the git version of this recipe was created, the application of local
patches was left out.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update TF-M to the latest hotfix release and rebase the Corstone1000
patches, and drop
0008-Platform-Corstone1000-Increase-BL1-size-and-align-bi.patch
0009-Platform-CS1K-Adapt-ADAC-enabled-build-to-the-new-BL.patch
as they are in the TF-Mv2.2.2 release
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add git recipe versions that track the latest git versions of u-boot and
the various OP-TEE recipes. This, in combination with the previously
existing trusted firmware a and m recipes, allows for using the latest
code in platform development and testing (as part of CI).
For CI usage, a KAS yml file has been created to allow for those recipes
to be used, and an entry for fvp-base has been added to the gitlab CI
yml file.
NOTE: the wildcard for corstone1000 u-boot PREFERRED_VERSION was causing
it to pick-up the newest version (and failing to apply the patches).
The wildcard is unnecessary, since it is using a layer supplied package.
So, remove it and everyone is happy.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the TF-A git recipe to the latest tag. The license SHA needed to
be updated due to adding of some memmap sources from mbed, which are
under the Apache 2.0 license, which is already present in the inc file.
Signed-off-by: Jon Mason <jon.mason@arm.com>
u-boot has accepted some of the fvp-base patches. Take the upstream
versions and rebase the third patch to apply.
Signed-off-by: Jon Mason <jon.mason@arm.com>
2025-12-10 12:00:04 -05:00
429 changed files with 12433 additions and 15796 deletions
@@ -28,6 +28,13 @@ Note that currently meta-arm's `scripts` directory isn't in `PATH`, so a full pa
`runfvp` will automatically start terminals connected to each of the serial ports that the machine specifies. This can be controlled by using the `--terminals` option, for example `--terminals=none` will mean no terminals are started, and `--terminals=tmux` will start the terminals in [`tmux`][tmux] sessions. Alternatively, passing `--console` will connect the serial port directly to the current session, without needing to open further windows.
The tool attempts to automatically select a suitable terminal type. To see which terminal type is selected by default in your environment, run `runfvp --help`.
`runfvp` determines availability by checking for required executables in your PATH as well as environment variables specific to each terminal type. If any of these checks fail, the corresponding terminal type is disabled.
The --help output also lists all currently available terminal types.
When using `-terminals=screen`, `runfvp` must be launched from within an existing [`screen`][screen] session. Normally, screen sets the `STY` environment variable to reference the current session. However, if the session is renamed or if `kas` is started from within the screen session, this value may become invalid or be lost. In such cases, `STY` must be set manually. Use `screen -ls` to view the list of currently attached sessions.
The default terminal can also be configured by writing a [INI-style][INI] configuration file to `~/.config/runfvp.conf`:
abstract:Arm Corstone-1000 with Cortex-A320 is a reference solution for IoT devices. It is part of Total Solution for IoT which consists of hardware and software reference implementation.
This document contains a summary of the new features, changes and fixes in each release of the Corstone-1000 with Cortex-A320 software stack.
## Version 2026.05 {.reference}
The following changes are present in this release:
- Continued Corstone-1000 with Cortex-A320 enablement across U-Boot, TF-A, TF-M, OP-TEE, and Linux with the split A320 device tree, GIC-700 support, Ethos-U85 DT alignment, and NPU reset via the external-system controller.
- Enabled and documented FVP SMP builds and platform-agnostic multicore support, including the errata override fixes for Corstone-1000 with Cortex-A320 and removal of the reboot workaround note.
- Split Corstone-1000 with Cortex-A320 FVP support into a dedicated machine configuration and standalone documentation.
### Corstone-1000 with Cortex-A320 components versions {.reference}
The following component versions are available:
Table: Corstone-1000 with Cortex-A320 component versions
### Yocto distribution components versions {.reference}
The following Yocto distribution components versions are available:
Table: Yocto distribution component versions
+-------------------+------------+
| Component | Version |
+===================+============+
| meta-arm | wrynose |
+-------------------+------------+
| bitbake | 22021758e6 |
+-------------------+------------+
| meta-openembedded | 9af4488d46 |
+-------------------+------------+
| openembedded-core | 06dd66e622 |
+-------------------+------------+
| meta-yocto | 8251bdad5f |
+-------------------+------------+
| meta-secure-core | 07a99ae241 |
+-------------------+------------+
| busybox | 1.37.0 |
+-------------------+------------+
| musl | 1.2.6 |
+-------------------+------------+
| gcc-arm-none-eabi | 15.2.rel1 |
+-------------------+------------+
| gcc-cross-aarch64 | 15.2.0 |
+-------------------+------------+
| openssl | 3.5.6 |
+-------------------+------------+
## Version 2025.12 {.reference}
The following changes are present in this release:
- Delivered end-to-end Cortex-A320 enablement across U-Boot, TF-A, TF-M, OP-TEE, Yocto machine layers, and documentation, including device-tree updates, MPIDR handling, and FVP model renaming.
- Rolled out the PSA Firmware Update (DEN0118) pipeline: U-Boot capsule parsing, Bootloader Abstraction Layer in TF-M, ESRT exposure, and Trusted Services IPC bridges replacing legacy capsule code.
- Hardened the new firmware update flow with EFI self-tests, metadata restructuring for partial and multi-image acceptance, and RSE-COMMS gating refinements.
- Upgraded key firmware components (TF-A 2.13.0, TF-M 2.2.1, Trusted Services 1.2.0, OP-TEE OS 4.7.0) and introduced targeted test skips plus integer-only build modes to keep validation green.
- Cleaned and renumbered downstream patch series across Trusted Services and TF-M while removing obsolete integrations to align with upstream baselines.
- Refreshed release material and architecture guides to describe the A320 profile, PSA FWU behavior, and updated software stack.
- Added KAS profiles, machine includes, and automated FVP selection logic to streamline developer workflows for the refreshed platform configuration.
### Corstone-1000 with Cortex-A320 components versions {.reference}
The following component versions are available:
Table: Corstone-1000 with Cortex-A320 component versions
You expressly assume all liabilities and risks relating to your use or operation
of your software and hardware designed or modified using the Arm Tools,
including without limitation, your software or hardware designed or
intended for safety-critical applications. Should your software or hardware
prove defective, you assume the entire cost of all necessary servicing, repair
or correction.
## Release notes - 2026.05 {.reference}
The following knowns issues and limitations are present in this release:
- Crypto isolation is not supported in the Secure world of Corstone-1000. Additionally, clients in
the Normal world are not isolated from one another. Therefore, if an end user wants to add a new
Secure Partition (SP) (such as a software TPM) that accesses the Crypto service via the SE-Proxy,
they are responsible for implementing their own isolation mechanisms to ensure proper security boundaries.
- DSTREAM debug probe may experience unreliable USB connectivity when used with Arm DS for secure debug.
This issue is under active investigation, and we are working to identify and resolve compatibility issues in a future update.
As a more stable alternative, the ULINKpro debug probe is recommended for use with Corstone-1000 in secure debug scenarios.
## Release notes - 2025.12 {.reference}
The following knowns issues and limitations are present in this release:
- Corstone-1000 with Cortex-A320 FVP does not currently support Symmetric Multiprocessing
- Corstone-1000 with Cortex-A320 FVP becomes unresponsive when the Linux kernel driver for the Ethos-U85 NPU loads automatically after a software reboot.
- Crypto isolation is not supported in the Secure world of Corstone-1000. Additionally, clients in
the Normal world are not isolated from one another. Therefore, if an end user wants to add a new
Secure Partition (SP) (such as a software TPM) that accesses the Crypto service via the SE-Proxy,
they are responsible for implementing their own isolation mechanisms to ensure proper security boundaries.
- DSTREAM debug probe may experience unreliable USB connectivity when used with Arm DS for secure debug.
This issue is under active investigation, and we are working to identify and resolve compatibility issues in a future update.
As a more stable alternative, the ULINKpro debug probe is recommended for use with Corstone-1000 in secure debug scenarios.
## Support {.reference}
For technical support, email [Arm subsystem support](mailto:support-subsystem-iot@arm.com).
For security issues, contact [Arm Security](mailto:psirt@arm.com).
The combination of Corstone-1000 software and hardware reference solution is [PSA Level-2 ready certified]($psa_l2_ready) as well as [Arm SystemReady Devicetree certified]($systemready_ir_certification). Please rely on the Corstone-1000 platform for certification needs.
More information on the Corstone-1000 subsystems product(s), variants and design can be
found on [Arm Developer]($arm_developer_cs1000_website).
This document explicitly focuses on the software part of the solution and
provides internal details on the software components. The reference
software package of the platform can be retrieved following instructions
present in the user guide document.
## Design overview {.reference}
This variant of the Corstone-1000 platform replaces the Host System's Cortex-A35
processor with a Cortex-A320. In this configuration, the optional External System
(previously a Cortex-M3) is replaced by an Arm Ethos-U85 Neural Processing Unit (NPU).
The Ethos-U85 runs in the direct drive configuration, where the Host System is
It is a lengthy chain to boot the software on Corstone-1000.
### TF-M BL1\_1 {.reference}
On power-up, the Secure Enclave begins execution from TF-M BL1\_1, which resides in ROM and serves as
the Root of Trust (RoT) for the device.
TF-M BL1\_1 is the immutable bootloader and is responsible for:
- Provisioning the device during the first boot
- Performing hardware initialization
- Verifying the integrity and authenticity of the next stage in the boot chain
At boot time, TF-M BL1\_1:
- Copies the TF-M BL1\_2 image from OTP to RAM.
- Verifies the integrity of BL1\_2 by comparing its computed hash with the hash stored in OTP.
### TF-M BL1\_2 {.reference}
During provisioning, the TF-M BL1\_2 binary, along with its hashes and cryptographic keys, is stored
in One-Time Programmable (OTP) memory.
Once verified, TF-M BL1\_2:
- Takes control and verifies the next stage in the boot chain, which is TF-M BL2.
- Computes the hash of the BL2 image and compares it with the BL2 hash stored in OTP to ensure
integrity before transferring execution to BL2.
The TF-M BL1 design details can be found in the [TF-M design documents]($trusted_firmware_m_bl1_website).
:::note
Corstone-1000 has some differences compared to this design due to memory (OTP/ROM) limitations:
- BL1\_1 code size is larger than needed because it handles most of the hardware initialization instead of the BL1\_2.
- BL1\_2 cannot be updated during provisioning time because the provisioning bundle that contains its code is located in the ROM.
- BL1\_2 does not use the post-quantum LMS verification.
- BL2 cannot be updated because it is verified by comparing the computed hash to the hash stored in the OTP.
:::
### TF-M BL2 {.reference}
In this system, TF-M BL2 refers to MCUBoot.
On the first boot, MCUBoot can provision additional cryptographic keys. It is responsible for authenticating both:
- TF-M (Trusted Firmware-M), and
- The initial bootloader of the Host system, [Trusted Firmware-A (TF-A) BL2]($trusted_firmware_a_bl2_website)
This authentication is done by verifying the digital signatures of the respective images.
MCUBoot performs image verification in the following steps:
1. Load the image from non-volatile memory into RAM.
2. Validate the image's signature using the corresponding public key.
:::note
The public key present in the image header is validated by comparing with the hash. Depending on the image, the hash of the public key is either stored in the OTP or part of the software which is being already verified in the previous stages.
:::
The execution control is passed to TF-M after the verification.
As the runtime executable of the Secure Enclave, TF-M initializes itself before
bringing the Host system out of reset.
### Host system authentication {.reference}
The Host system follows the boot standard defined in [Trusted Board Boot Requirements Client]($trusted_board_boot_requirements_client_pdf)
to authenticate the Secure and Non-secure software.
The [Firmware Image Package (FIP)]($trusted_firmware_a_fip_guide) packs bootloader images and
other payloads into a single archive.
The FIP for Corstone-1000 contains:
- Trusted firmware-A BL2
- AP EL3 Runtime firmware, BL31 image
- AP Secure Payload, BL32 image
- AP Normal world firmware -U-boot, BL33 image
- Trusted OS Firmware configuration file used by Trusted OS (BL32), TOS_FW_CONFIG
- Key certificates
- Content certificates
To load and validate TF-A BL2, TF-M BL2 first parses the GUID Partition Table (GPT)
to locate the FIP. It then determines the offset of TF-A BL2 within the FIP.
:::note
TF-M does not check the FIP signature, it only checks the TF-A BL2's signature in the FIP.
:::
The implicitly trusted components are:
- A SHA-256 hash of the Root of Trust Public Key (ROTPK.) For development purposes, a development ROTPK is used and its hash embedded into the TF-A BL2 image. This public key is provided by the TF-A source code.
- TF-A BL2 image - it can be trusted because it has been verified by TF-M BL2 before starting TF-A.
The remaining components in the Chain of Trust (CoT) are either certificates or bootloader images.
#### Bootloader authentication {.reference}
The FIP contains two types of certificates:
- Content Certificates used to store the hash of a bootloader image.
- Key Certificates used to verify public keys used to sign Content Certificates.
The Host system bootloader images are authenticated by computing their hash and comparing it to the corresponding hash found in the Content Certificate.
#### Certificates verification {.reference}
The public keys defined in the Trusted Key Certificate are used to verify the later certificates in
the CoT process. The Trusted Key Certificate is verified with the Root of Trust Public Key.
#### UEFI authenticated variables {.reference}
For UEFI Secure Boot, authenticated variables can be accessed from the secure flash.
The feature has been integrated in U-Boot, which authenticates the images as per the UEFI
specification before executing them.
## Secure services {.reference}
Corstone-1000 is unique in offering a secure environment for running trusted workloads.
While the Host system includes TrustZone technology, the platform also features a hardware-isolated
Secure Enclave, specifically designed to execute these secure workloads.
In Corstone-1000, essential Secure Services—such as Cryptography, Protected Storage,
Internal Trusted Storage, and Attestation—are provided through PSA Functional APIs implemented in TF-M.
From the user's perspective, there is no difference when communicating with these services,
whether they run in the Secure Enclave or in the Secure world of the Host system.
The diagram below illustrates the data flow for such calls.
The Secure Enclave Proxy Secure Partition (SE Proxy SP) is a proxy managed by OP-TEE that forwards
Secure Service calls to the Secure Enclave. This communication uses the
[RSE communication protocol](https://tf-m-user-guide.trustedfirmware.org/platform/arm/rse/rse_comms.html).
While the protocol supports shared memory and MHU interrupts as a doorbell mechanism between cores,
in Corstone-1000, the entire message is currently transmitted through the MHU channels.
Corstone-1000 implements Isolation Level 2 using the Cortex-M0+ Memory Protection Unit (MPU).
Users can define their own secure services to run either in the Host system's Secure World or in
the Secure Enclave. This choice involves a trade-off between latency and security.
Services running in the Secure Enclave benefit from strong, hardware-enforced isolation,
offering higher security but at the cost of increased latency. In contrast, services running in the
Host Secure World experience lower latency, but rely on TrustZone technology for virtualized isolation,
which offers comparatively less robust security.
## PSA secure firmware update {.reference}
The Corstone-1000 platform necessitates a robust, secure, and flexible firmware update mechanism
including partial capsule update to ensure fielded devices can receive critical patches, feature enhancements,
and security fixes without compromising system integrity. To meet these requirements, we have implemented the
# Build, flash and run {.chapter permissions=non-confidential}
The Arm Corstone-1000 with Cortex-A320 software stack uses the Yocto Project to build a tiny Linux distribution suitable for the Arm Corstone-1000 with Cortex-A320 platform (kernel and initramfs filesystem less than 6 MB on the flash).
The Corstone-1000 with Cortex-A320 software stack can be run on [Arm Corstone-1000 with Cortex-A320 FVP (Fixed Virtual Platform)](https://developer.arm.com/downloads/-/arm-ecosystem-fvps) and is built on top of Yocto Project's [Wrynose release]($meta_arm_repository_release_branch).
The Yocto Project relies on the [BitBake](https://docs.yoctoproject.org/bitbake.html#bitbake-documentation) tool as its build tool. Please see the [Yocto Project documentation](https://docs.yoctoproject.org/) for more information.
## Prerequisites {.reference}
This guide assumes that your host machine is running Ubuntu 24.04 LTS (with `sudo` rights), with at least
32GB of free disk space and 16GB of RAM as minimum requirement.
The following prerequisites must be available on the host system:
- Git 2.39.2 or greater.
- Python 3.11.2 or greater.
- GNU Tar 1.34 or greater.
- GNU Compiler Collection 12.2 or greater.
- GNU Make 4.3 or greater.
- tmux 3.3 or greater.
Please follow the steps described in the Yocto mega manual:
- [Compatible Linux Distribution](https://docs.yoctoproject.org/singleindex.html#compatible-linux-distribution)
Within the Yocto Project, each component included in the Corstone-1000 with Cortex-A320 software stack is specified as
a [BitBake recipe](https://docs.yoctoproject.org/bitbake/2.2/bitbake-user-manual/bitbake-user-manual-intro.html#recipes).
The recipes specific to the Corstone-1000 with Cortex-A320 BSP are located at:
`${WORKSPACE}/meta-arm/meta-arm-bsp/`.
`${WORKSPACE}` refers to the absolute path to your workspace where the `meta-arm` repository will be cloned. Consider exporting it (e.g., `export WORKSPACE=$(realpath .)`) if you're already in the workspace directory,
so you can copy and paste the commands from this guide verbatim.
Building binaries natively on Windows and AArch64 Linux is not supported. Use an Intel or AMD 64-bit architecture Linux based development machine to build the software stack and transfer the binaries to run the software stack on an FVP in Windows or AArch64 Linux if required.
:::
1. Create a new folder that will be your workspace:
```
mkdir ${WORKSPACE}
cd ${WORKSPACE}
```
2. Install kas version 4.4 with `sudo` rights:
```
sudo pip3 install kas==4.4
```
Ensure the kas installation directory is visible on the `$PATH` environment variable.
3. Clone the `meta-arm` Yocto layer in the workspace `${WORKSPACE}`.
4. Accept the EULA on the [Arm Developer](https://developer.arm.com/downloads/-/arm-ecosystem-fvps/eula) site to build a Corstone-1000 with Cortex-A320 image for FVP as follows:
```
export ARM_FVP_EULA_ACCEPT="True"
```
5. Build a Corstone-1000 with Cortex-A320 image:
```
kas build meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml
```
A clean build takes a significant amount of time given that all of the development machine utilities are also
built along with the target images. Those development machine utilities include executables (Python,
CMake, etc.) and the required toolchains.
Once the build succeeds, all output binaries will be placed in `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/`.
Everything apart from the Secure Enclave ROM firmware is bundled into a single binary, the
The output binaries run in the Corstone-1000 with Cortex-A320 platform are the following:
- The Secure Enclave ROM firmware: `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/trusted-firmware-m/bl1.bin`
- The internal firmware flash image: `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-flash-firmware-image-corstone1000-a320-fvp.wic`
## Build with SSH {.reference}
The `meta-arm/kas/corstone1000-a320-fvp.yml` build produces an image for booting from flash.
To build a bootable mass storage OS image with Dropbear SSH enabled, run:
```
kas build meta-arm/ci/corstone1000-a320-fvp.yml:meta-arm/kas/corstone1000-ssh.yml
```
The mass storage OS image can be found at `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/core-image-minimal-corstone1000-a320-fvp.wic`
:::note
The generated `core-image-minimal-corstone1000-a320-fvp.fvpconf` attaches the mass storage OS image to `board.msd_mmc.p_mmc_file`.
:::
## Run {.reference}
Once the platform is turned ON, the Secure Enclave will start to boot, wherein the relevant memory contents of the `*.wic`
file are copied to their respective memory locations. Firewall policies are enforced
on memories and peripherals before bringing the Host Processor out of reset.
The Host Processor will boot TrustedFirmware-A, OP-TEE, U-Boot and then Linux before presenting a login prompt.
A Fixed Virtual Platform (FVP) model of the Corstone-1000 with Cortex-A320 platform must be available to run the
Corstone-1000 with Cortex-A320 FVP software image.
A Yocto recipe is provided to download the latest supported FVP version.
The recipe is located at `${WORKSPACE}/meta-arm/meta-arm/recipes-devtools/fvp/fvp-corstone1000-a320.bb`.
The latest FVP version is `11.31.cs1000_a320_2` for Corstone-1000 with Cortex-A320, and the model is automatically downloaded and installed when using the `runfvp` command as follows:
```
kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml \
-c "../meta-arm/scripts/runfvp -- --version"
```
The FVP can also be manually downloaded from [Arm Developer](https://developer.arm.com/downloads/-/arm-ecosystem-fvps) to download the Corstone-1000 with Cortex-A320 FVP package.
To set up the FVP:
1. Run `tmux`:
```
cd ${WORKSPACE} && tmux
```
2. Run the FVP within `tmux`:
```
kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml \
-c "../meta-arm/scripts/runfvp --terminals=tmux"
```
When the script is executed, three terminal instances will be launched:
- one for the Secure Enclave processing element
- two for the Host processor processing element.
```
corstone1000-a320-fvp login:
```
3. Log in using the `root` username.
## Security issue reporting {.reference}
To report any security issues identified with Corstone-1000 with Cortex-A320, please send an email to [psirt@arm.com](mailto:psirt@arm.com).
This document contains a summary of the new features, changes and
fixes in each release of Corstone-1000 software stack.
***************
Version 2026.05
***************
Changes
=======
- Upgraded key Corstone-1000 components to U-Boot 2025.10, TF-A 2.14.1, TF-M 2.2.2, OP-TEE 4.9.0, Trusted Services 1.3.0, and Linux 6.19.
- Added GPT support in TF-M and updated MCUboot to use the GPT library for firmware-update partitions.
- Extended the TF-M firmware update flow with GPT fixes, partition create/remove/duplicate operations, metadata-only handling, flash erase protection, stale partition cleanup, and better handling of older images during PSA FWU.
- Added SSH-enabled build overlay for FVP mass-storage images.
- Removed GRUB from the initramfs boot package set.
- Delivered end-to-end Cortex-A320 enablement across U-Boot, TF-A, TF-M, OP-TEE, Yocto machine layers, and documentation, including device-tree updates, MPIDR handling, and FVP model renaming.
- Rolled out the PSA Firmware Update (DEN0118) pipeline: U-Boot capsule parsing, Bootloader Abstraction Layer in TF-M, ESRT exposure, and Trusted Services IPC bridges replacing legacy capsule code.
- Hardened the new firmware update flow with EFI self-tests, metadata restructuring for partial and multi-image acceptance, and RSE-COMMS gating refinements.
- Upgraded key firmware components (TF-A 2.13.0, TF-M 2.2.1, Trusted Services 1.2.0, OP-TEE OS 4.7.0) and introduced targeted test skips plus integer-only build modes to keep validation green.
- Cleaned and renumbered downstream patch series across Trusted Services and TF-M while removing obsolete integrations to align with upstream baselines.
- Refreshed release material and architecture guides to describe the A320 profile, PSA FWU behavior, and updated software stack.
- Added KAS profiles, machine includes, and automated FVP selection logic to streamline developer workflows for the refreshed platform configuration.
@@ -19,6 +19,24 @@ intended for safety-critical applications. Should Your Software or Your Hardware
prove defective, you assume the entire cost of all necessary servicing, repair
or correction.
***********************
Release notes - 2026.05
***********************
The same notes as the 2025.05 release still apply.
***********************
Release notes - 2025.12
***********************
The same notes as the 2025.05 release still apply.
Known Issues or Limitations
---------------------------
- Corstone-1000 with Cortex-A320 FVP does not currently support Symmetric Multiprocessing
- Corstone-1000 with Cortex-A320 FVP becomes unresponsive when the Linux kernel driver for the Ethos-U85 NPU loads automatically after a software reboot.
***********************
Release notes - 2025.05
***********************
@@ -268,4 +286,4 @@ For all security issues, contact Arm by email at psirt@arm.com.
--------------
*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*
*Copyright (c) 2022-2026, Arm Limited. All rights reserved.*
Loaded 100 of 429 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Ross Burton
Jon Mason
Clement Faure
Harsimran Singh Tungal
Oscar Belshaw
Ahmed Gomaa
Gianluca Andreotti
Rasmus Villemoes
Jaipaul Cheernam
Alex Chapman
Arthur Cassegrain
Michael Safwat
Gyorgy Sarvari
Marek Bykowski
Hugues KAMBA MPIANA
David Hu
Frazer Carsley
Gyorgy Szing
Roger Knecht
Kevin Hao
Jose Quaresma
Igor Opaniuk
Gabor Toth
Jan Kiszka
Filipe Rinaldi
Jan Luebbe
Devaraj Ranganna
Bence Balogh
Peter Hoyes
Ryan Eatmon
