arm-bsp/u-boot: add SDCard support for corstone1000 FVP

This change is to add SDCard support for corstone1000 FVP Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
arm-bsp/corstone1000: Add RDEPENDS to remove unwanted images.
2026-07-25 06:47:03 +00:00 · 2022-04-01 16:47:13 +01:00 · 2022-03-14 13:00:09 -04:00 · 2022-03-14 13:00:09 -04:00 · 2022-03-11 16:44:39 -05:00 · 2022-03-11 16:44:39 -05:00
110 changed files with 12750 additions and 674 deletions
@@ -1,4 +1,4 @@
-image: ghcr.io/siemens/kas/kas
+image: ghcr.io/siemens/kas/kas:latest-release

 stages:
  - prep
@@ -4,7 +4,6 @@ header:
 repos:
  meta-clang:
    url: https://github.com/kraj/meta-clang
-    refspec: master

 local_conf_header:
  clang: |
@@ -6,4 +6,3 @@ header:
 repos:
  meta-zephyr:
    url: https://git.yoctoproject.org/git/meta-zephyr
-    refspec: master
@@ -31,7 +31,7 @@ repos:

  meta-arm-image:
     url: https://git.gitlab.arm.com/arm-reference-solutions/meta-arm-image.git
-     refspec: aeb0571e8bc935f3f8b15c3b27ab4275e2069b5b
+     refspec: 9f611833ef58394b707836d69356c4e27d0265fc

 local_conf_header:
  base: |
@@ -33,7 +33,8 @@ local_conf_header:
    CONF_VERSION = "2"
    PACKAGE_CLASSES = "package_ipk"
    PACKAGECONFIG:remove:pn-qemu-system-native = "gtk+ sdl"
-    EXTRA_IMAGE_FEATURES:append = " debug-tweaks"
+    EXTRA_IMAGE_FEATURES:append = " debug-tweaks ssh-server-openssh"
+    FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
    IMAGE_CLASSES:append = " ${@oe.utils.ifelse(d.getVar('FVP_BASE_R_AEM_TARBALL_URI'), 'fvpboot', '')}"
    LICENSE_FLAGS_WHITELIST:append = " ${@oe.utils.vartrue('FVP_BASE_R_ARM_EULA_ACCEPT', 'Arm-FVP-EULA', '', d)}"

@@ -15,10 +15,14 @@ PREFERRED_VERSION_linux-yocto-rt ?= "5.14%"
 KERNEL_IMAGETYPE = "Image"
 KERNEL_DEVICETREE = "arm/fvp-baser-aemv8r64.dtb"

+UBOOT_MACHINE ?= "vexpress_aemv8r_defconfig"
+
 SERIAL_CONSOLES = "115200;ttyAMA0"

 IMAGE_FSTYPES += "wic"
-WKS_FILE ?= "fvp-base.wks"
+WKS_FILE ?= "efi-disk.wks.in"
+EFI_PROVIDER ?= "grub-efi"
+MACHINE_FEATURES:append = " efi"

 # As this is a virtual target that will not be used in the real world there is
 # no need for real SSH keys.  Disable rng-tools (which takes too long to
@@ -35,7 +39,6 @@ FVP_CONSOLE ?= "terminal_0"
 FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic"
 FVP_CONFIG[bp.dram_metadata.init_value] ?= "0"
 FVP_CONFIG[bp.dram_metadata.is_enabled] ?= "true"
-FVP_CONFIG[bp.dram_size] ?= "8"
 FVP_CONFIG[bp.exclusive_monitor.monitor_access_level] ?= "1"
 FVP_CONFIG[bp.pl011_uart0.unbuffered_output] ?= "1"
 FVP_CONFIG[bp.pl011_uart0.untimed_fifos] ?= "true"
@@ -58,4 +61,5 @@ FVP_CONFIG[gic_distributor.has-two-security-states] ?= "0"
 FVP_CONFIG[pctl.startup] ?= "0.0.0.*"
 FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
 FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
-FVP_CONFIG[bp.vis.rate_limit-enable] ?= "0"
+FVP_CONFIG[bp.vis.rate_limit-enable] ?= "0"
+FVP_CONFIG[bp.refcounter.use_real_time] ?= "1"
@@ -51,6 +51,8 @@ KERNEL_IMAGETYPE = "Image"

 INITRAMFS_IMAGE_BUNDLE ?= "1"

+RDEPENDS:${KERNEL_PACKAGE_NAME}-base ?= ""
+
 #telling the build system which image is responsible of the generation of the initramfs rootfs
 INITRAMFS_IMAGE = "corstone1000-initramfs-image"

@@ -28,12 +28,65 @@ where either a standard or Real-Time Linux kernel (PREEMPT\_RT) can be built
 and run:

 - boot-wrapper-aarch64: provides PSCI support
+ - U-Boot: v2021.07 - provides UEFI services
 - Linux kernel: linux-yocto-5.14
 - Linux kernel with PREEMPT\_RT support: linux-yocto-rt-5.14

 Note that the Real-Time Linux kernel (PREEMPT\_RT) does not use the real-time
 architectural extensions of the Armv8-R feature set.

+High-Level Architecture
+-----------------------
+
+The diagram below shows the current boot flow:
+
+    +---------------------------------------------------------------+
+    |                         Linux kernel                          |
+    +---------------------------------------------------------------+
+               /|\                                     /|\
+                |                                       |
+                | UEFI services                         |
+                |                         PSCI services |
+               \|/                                      |
+        +----------------+                              |     S-EL1
+    ----|     U-Boot     |------------------------------|-----------
+        +----------------+                              |     S-EL2
+               /|\                                      |
+                |                                       |
+                |                                       |
+                |                                       |
+    +--------------------------------------------------\|/----------+
+    |                        +----------------+ +----------------+  |
+    |  boot-wrapper-aarch64  |  Device tree   | |  PSCI handler  |  |
+    |                        +----------------+ +----------------+  |
+    +---------------------------------------------------------------+
+
+
+The firmware binary (generated as `linux-system.axf`) includes
+boot-wrapper-aarch64, the flattened device tree and U-Boot. U-Boot is configured
+to automatically detect a virtio block device and boot the UEFI payload at the
+path `/efi/boot/bootaa64.efi`. Using the standard build, the first partition
+contains a Grub image at this path, which boots the Linux kernel at `/Image` on
+the same partition. The second partition of the image contains the Linux root
+file system.
+
+There is no EL3 or non-secure world in the Armv8-R AArch64 architecture, so the
+reset vector starts boot-wrapper-aarch64 at S-EL2. Boot-wrapper-aarch64 is
+compiled with the `--enable-keep-el` flag, which causes it to boot U-Boot at
+S-EL2 too. U-Boot is compiled with the `CONFIG_ARMV8_SWITCH_TO_EL1` flag, which
+causes it to switch to S-EL1 before booting Linux.
+
+The bundled device tree is passed to U-Boot via register x0. U-Boot passes the
+same device tree to Linux via the UEFI system table.
+
+Power state management is provided by PSCI services in boot-wrapper-aarch64.
+Linux accesses the PSCI handler via HVC calls to S-EL2. U-Boot has been patched
+to prevent it from overriding the exception vector at S-EL2. The PSCI handler
+memory region is added to a `/memreserve/` node in the device tree.
+
+Please note that the final firmware architecture for the fvp-baser-aemv8r64 is
+not yet stabilized. The patches in this layer are provided for development and
+evaluation purposes only, and should not be used in production firmware.

 Quick start: Howto Build and Run
 --------------------------------
@@ -47,24 +100,24 @@ https://docs.yoctoproject.org/singleindex.html#required-packages-for-the-build-h
 Kas is a setup tool for bitbake based projects. The minimal supported version
 is 2.6, install it like so:

-    pip3 install --user kas
+    pip3 install --user --upgrade kas

 For more details on kas, see https://kas.readthedocs.io/.

 To build the images for fvp-base machine, you also need to:

- - download the ``FVP_Base_AEMv8R_11.15_14.tgz`` image AEM V8-R FVP Installer
+ - download the ``FVP_Base_AEMv8R_11.17_21.tgz`` image AEM V8-R FVP Installer
  (Linux) package from Arm's website:
-  https://silver.arm.com/download/download.tm?pv=4858045&p=4029857. You need
+  https://silver.arm.com/download/download.tm?pv=4865959&p=4029857. You need
   to have an account and be logged in to be able to download it
- - set absolute path to the ``FVP_Base_AEMv8R_11.15_14.tgz`` downloaded
+ - set absolute path to the ``FVP_Base_AEMv8R_11.17_21.tgz`` downloaded
   package in ``FVP_BASE_R_AEM_TARBALL_URI``
 - accept EULA in ``FVP_BASE_R_ARM_EULA_ACCEPT``


 The variables should be set like so:

-    FVP_BASE_R_AEM_TARBALL_URI="file:///absolute/path/to/FVP_Base_AEMv8R_11.15_14.tgz"
+    FVP_BASE_R_AEM_TARBALL_URI="file:///absolute/path/to/FVP_Base_AEMv8R_11.17_21.tgz"
    FVP_BASE_R_ARM_EULA_ACCEPT="True"

 **Note:** The host machine should have at least 50 GBytes of free disk space
@@ -82,21 +135,21 @@ Fetch the meta-arm repository into a build directory:

    mkdir -p ~/fvp-baser-aemv8r64-build
    cd ~/fvp-baser-aemv8r64-build
-    git clone https://git.yoctoproject.org/git/meta-arm
+    git clone https://git.yoctoproject.org/git/meta-arm -b honister


 ### Build
 Building with the standard Linux kernel:

    cd ~/fvp-baser-aemv8r64-build
-    export FVP_BASE_R_AEM_TARBALL_URI="file:///absolute/path/to/FVP_Base_AEMv8R_11.15_14.tgz"
+    export FVP_BASE_R_AEM_TARBALL_URI="file:///absolute/path/to/FVP_Base_AEMv8R_11.17_21.tgz"
    export FVP_BASE_R_ARM_EULA_ACCEPT="True"
    kas build meta-arm/kas/fvp-baser-aemv8r64-bsp.yml

 Building with the Real-Time Linux kernel (PREEMPT\_RT):

    cd ~/fvp-baser-aemv8r64-build
-    export FVP_BASE_R_AEM_TARBALL_URI="file:///absolute/path/to/FVP_Base_AEMv8R_11.15_14.tgz"
+    export FVP_BASE_R_AEM_TARBALL_URI="file:///absolute/path/to/FVP_Base_AEMv8R_11.17_21.tgz"
    export FVP_BASE_R_ARM_EULA_ACCEPT="True"
    kas build meta-arm/kas/fvp-baser-aemv8r64-rt-bsp.yml

@@ -118,17 +171,28 @@ To run an image after the build is done with the Real-Time Linux kernel

 **Note:** The terminal console login is `root` without password.

-To finish the fvp emulation, you need to close the telnet session and stop the
-runfvp script:
-
-1. To close the telnet session:
+To finish the fvp emulation, you need to close the telnet session:

 - Escape to telnet console with ``ctrl+]``.
 - Run ``quit`` to close the session.

-2. To stop the runfvp:
+### Networking
+The FVP is configured by default to use "user-mode networking", which simulates
+an IP router and DHCP server to avoid additional host dependencies and
+networking configuration. Outbound connections work automatically, e.g. by
+running:

- - Type ``ctrl+c`` and wait for kas process to finish.
+    wget www.arm.com
+
+Inbound connections require an explicit port mapping from the host. By default,
+port 8022 on the host is mapped to port 22 on the FVP, so that the following
+command will connect to an ssh server running on the FVP:
+
+    ssh root@localhost -p 8022
+
+Note that user-mode networking does not support ICMP, so `ping` will not work.
+For more information about user-mode networking, please see
+https://developer.arm.com/documentation/100964/1117/Introduction-to-Fast-Models/User-mode-networking?lang=en

 ### File sharing between host and fvp
 It is possible to share a directory between the host machine and the fvp using
@@ -142,6 +206,14 @@ launching the model:

    --parameter 'bp.virtiop9device.root_path=/path/to/host-mount-dir'

+e.g. for the standard Linux kernel:
+
+    kas shell --keep-config-unchanged \
+       meta-arm/kas/fvp-baser-aemv8r64-bsp.yml \
+           --command "../layers/meta-arm/scripts/runfvp \
+           --console -- --parameter \
+           'bp.virtiop9device.root_path=/path/to/host-mount-dir'"
+
 Once you are logged into the fvp, the host directory can be mounted in a
 directory on the model using the following command:

@@ -163,16 +235,27 @@ Known Issues and Limitations
 - Only PSCI CPU\_ON and CPU\_OFF functions are supported
 - Linux kernel does not support booting from secure EL2 on Armv8-R AArch64
 - Linux KVM does not support Armv8-R AArch64
+- Device DMA memory cache-coherence issue: the FVP `cache_state_modelled`
+  parameter will affect the cache coherence behavior of peripherals’ DMA. When
+  users set `cache_state_modelled=1`, they also have to set
+  `cci400.force_on_from_start=1` to force the FVP to enable snooping on upstream
+  ports.

 Change Log
 ----------

- Added virtio_net User Networking mode by default and removed instructions
+- Added U-Boot v2021.07 for UEFI support.
+- Updated boot-wrapper-aarch64 revision and added support for booting U-Boot.
+- Included boot-wrapper-aarch64 PSCI services in `/memreserve/` region.
+- Fixed the counter frequency initialization in boot-wrapper-aarch64.
+- Configured the FVP to use the default RAM size of 4 Gb
+- Fixed PL011 and SP805 register sizes in the device tree.
+- Added virtio\_net User Networking mode by default and removed instructions
  about tap networking setup.
 - Updated Linux kernel version from 5.10 to 5.14 for both standard and
  Real-Time (PREEMPT\_RT) builds.
- Enabled SMP support via boot-wrapper-aarch64 providing the PSCI CPU_ON and
-  CPU_OFF functions.
+- Enabled SMP support via boot-wrapper-aarch64 providing the PSCI CPU\_ON and
+  CPU\_OFF functions.
 - Introduced Armv8-R64 compiler flags.
 - Added Linux PREEMPT\_RT support via linux-yocto-rt-5.10.
 - Added support for file sharing with the host machine using Virtio P9.
@@ -2,14 +2,30 @@ COMPATIBLE_MACHINE = "fvp-baser-aemv8r64"

 FILESEXTRAPATHS:prepend := "${THISDIR}/files/${MACHINE}:"
 SRC_URI:append = " \
-    file://0001-Decouple-V2M_SYS-config-by-auto-detect-dtb-node.patch \
-    file://0002-arch64-Introduce-EL2-boot-code-for-v8-r64.patch \
-    file://0003-Allow-enable-psci-to-choose-between-smc-and-hvc.patch \
+    file://0001-aarch64-Rename-labels-and-prepare-for-lower-EL-booti.patch \
+    file://0002-aarch64-Prepare-for-EL1-booting.patch \
+    file://0003-aarch64-Prepare-for-lower-EL-booting.patch \
+    file://0004-gic-v3-Prepare-for-gicv3-with-EL2.patch \
+    file://0005-aarch64-Prepare-for-booting-with-EL2.patch \
+    file://0006-aarch64-Introduce-EL2-boot-code-for-Armv8-R-AArch64.patch \
+    file://0007-Allow-enable-psci-to-choose-between-smc-and-hvc.patch \
+    file://0008-aarch64-Disable-CNTPCT_EL0-trap-for-v8-R64.patch \
+    file://0009-lds-Mark-the-mem-range.patch \
+    file://0010-common-Introduce-the-libfdt.patch \
+    file://0011-common-Add-essential-libc-functions.patch \
+    file://0012-Makefile-Add-the-libfdt-to-the-Makefile-system.patch \
+    file://0013-platform-Add-print_hex-func.patch \
+    file://0014-common-Add-mem-usage-to-memreserve.patch \
+    file://0015-boot-Add-the-enable-keep-el-compile-option.patch \
+    file://0016-Makefile-Change-COUNTER_FREQ-to-100-MHz.patch \
    "

 BOOT_WRAPPER_AARCH64_CMDLINE = "\
 earlycon console=ttyAMA0 loglevel=8 rootfstype=ext4 root=/dev/vda1 rw"

-EXTRA_OECONF += "--enable-psci=hvc"
+EXTRA_OECONF += "--enable-psci=hvc --enable-keep-el"

 TUNE_CCARGS = ""
+
+BOOT_WRAPPER_AARCH64_KERNEL = "u-boot.bin"
+do_deploy[depends] += "u-boot:do_deploy"
@@ -1,67 +0,0 @@
-From 7b8c821c22929cd2d3532f937672fcf05dc7d5d0 Mon Sep 17 00:00:00 2001
-Message-Id: <7b8c821c22929cd2d3532f937672fcf05dc7d5d0.1616744115.git.diego.sueiro@arm.com>
-From: Jaxson Han <jaxson.han@arm.com>
-Date: Thu, 25 Mar 2021 12:35:13 +0800
-Subject: [PATCH 1/2] Decouple V2M_SYS config by auto-detect dtb node
-
-An auto-detect switch is added to make it an option to enable/disable
-'arm,vexpress-sysreg', because not all platforms support this feature.
-
-Issue-ID: SCM-2221
-Signed-off-by: Jaxson Han <jaxson.han@arm.com>
-Change-Id: Ib8738aa62ca3902f7bdae2ad9a5a63aa2d225abf
-
-Upstream-Status: Pending
-Signed-off-by: Diego Sueiro <diego.sueiro@arm.com>
---
- Makefile.am | 2 +-
- platform.c  | 4 ++++
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile.am b/Makefile.am
-index af694b7..e131207 100644
--- a/Makefile.am
-+++ b/Makefile.am
-@@ -19,7 +19,7 @@ NR_CPUS         := $(shell echo $(CPU_IDS) | tr ',' ' ' | wc -w)
- DEFINES		= -DCNTFRQ=$(CNTFRQ)
- DEFINES		+= -DCPU_IDS=$(CPU_IDS)
- DEFINES		+= -DNR_CPUS=$(NR_CPUS)
-DEFINES		+= -DSYSREGS_BASE=$(SYSREGS_BASE)
-+DEFINES		+= $(if $(SYSREGS_BASE), -DSYSREGS_BASE=$(SYSREGS_BASE), )
- DEFINES		+= -DUART_BASE=$(UART_BASE)
- DEFINES		+= -DSTACK_SIZE=256
- 
-diff --git a/platform.c b/platform.c
-index a528a55..d11f568 100644
--- a/platform.c
-+++ b/platform.c
-@@ -23,10 +23,12 @@
- 
- #define PL011(reg)	((void *)UART_BASE + PL011_##reg)
- 
-+#ifdef SYSREGS_BASE
- #define V2M_SYS_CFGDATA		0xa0
- #define V2M_SYS_CFGCTRL		0xa4
- 
- #define V2M_SYS(reg)	((void *)SYSREGS_BASE + V2M_SYS_##reg)
-+#endif
- 
- static void print_string(const char *str)
- {
-@@ -59,6 +61,7 @@ void init_platform(void)
- 
- 	print_string("Boot-wrapper v0.2\r\n\r\n");
- 
-+#ifdef SYSREGS_BASE
- 	/*
- 	 * CLCD output site MB
- 	 */
-@@ -66,4 +69,5 @@ void init_platform(void)
- 	/* START | WRITE | MUXFPGA | SITE_MB */
- 	raw_writel((1 << 31) | (1 << 30) | (7 << 20) | (0 << 16),
- 				V2M_SYS(CFGCTRL));
-+#endif
- }
-- 
-2.17.1
-
@@ -0,0 +1,135 @@
+From 3e7cfbe39a2a053d2a6b0d928cc172ed9d1c6da8 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 25 May 2021 07:25:00 +0100
+Subject: [PATCH] aarch64: Rename labels and prepare for lower EL booting
+
+Prepare for booting from lower EL. Rename *_el3 relavant labels with
+*_el_max and *_no_el3 with *_keep_el. Since the original _no_el3 means
+"We neither do init sequence at this highest EL nor drop to lower EL
+when entering to kernel", we rename it with _keep_el to make it more
+clear for lower EL initialisation.
+
+Upstream-Status: Pending
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+---
+ arch/aarch64/boot.S | 28 ++++++++++++++++++++--------
+ arch/aarch64/psci.S |  9 +++++----
+ arch/aarch64/spin.S |  4 ++--
+ 3 files changed, 27 insertions(+), 14 deletions(-)
+
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index 27ba449..84e1646 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -21,18 +21,30 @@ ASM_FUNC(_start)
+ 
+ 	/*
+ 	 * EL3 initialisation
+	 * Boot sequence
+	 * If CurrentEL == EL3, then goto EL3 initialisation and drop to
+	 *   lower EL before entering the kernel.
+	 * Else, no initialisation and keep the current EL before
+	 *   entering the kernel.
+ 	 */
+ 	mrs	x0, CurrentEL
+ 	cmp	x0, #CURRENTEL_EL3
+-	b.eq	1f
+	b.eq	el3_init
+ 
+	/*
+	 * We stay in the current EL for entering the kernel
+	 */
+ 	mov	w0, #1
+-	ldr	x1, =flag_no_el3
+	ldr	x1, =flag_keep_el
+ 	str	w0, [x1]
+ 
+-	b	start_no_el3
+	b	start_keep_el
+ 
+-1:	mov	x0, #0x30			// RES1
+	/*
+	 * EL3 initialisation
+	 */
+el3_init:
+	mov	x0, #0x30			// RES1
+ 	orr	x0, x0, #(1 << 0)		// Non-secure EL1
+ 	orr	x0, x0, #(1 << 8)		// HVC enable
+ 
+@@ -124,7 +136,7 @@ ASM_FUNC(_start)
+ 
+ 	bl	gic_secure_init
+ 
+-	b	start_el3
+	b	start_el_max
+ 
+ err_invalid_id:
+ 	b	.
+@@ -151,7 +163,7 @@ ASM_FUNC(jump_kernel)
+ 	bl	find_logical_id
+ 	bl	setup_stack		// Reset stack pointer
+ 
+-	ldr	w0, flag_no_el3
+	ldr	w0, flag_keep_el
+ 	cmp	w0, #0			// Prepare Z flag
+ 
+ 	mov	x0, x20
+@@ -160,7 +172,7 @@ ASM_FUNC(jump_kernel)
+ 	mov	x3, x23
+ 
+ 	b.eq	1f
+-	br	x19			// No EL3
+	br	x19			// Keep current EL
+ 
+ 1:	mov	x4, #SPSR_KERNEL
+ 
+@@ -178,5 +190,5 @@ ASM_FUNC(jump_kernel)
+ 
+ 	.data
+ 	.align 3
+-flag_no_el3:
+flag_keep_el:
+ 	.long 0
+diff --git a/arch/aarch64/psci.S b/arch/aarch64/psci.S
+index 8bd224b..7b8919a 100644
+--- a/arch/aarch64/psci.S
+++ b/arch/aarch64/psci.S
+@@ -79,7 +79,7 @@ smc_exit:
+ 	ldp	x18, x19, [sp], #16
+ 	eret
+ 
+-ASM_FUNC(start_el3)
+ASM_FUNC(start_el_max)
+ 	ldr	x0, =vector
+ 	bl	setup_vector
+ 
+@@ -89,10 +89,11 @@ ASM_FUNC(start_el3)
+ 	b	psci_first_spin
+ 
+ /*
+- * This PSCI implementation requires EL3. Without EL3 we'll only boot the
+- * primary cpu, all others will be trapped in an infinite loop.
+ * This PSCI implementation requires the highest EL(EL3 or Armv8-R EL2).
+ * Without the highest EL, we'll only boot the primary cpu, all othersr
+ * will be trapped in an infinite loop.
+  */
+-ASM_FUNC(start_no_el3)
+ASM_FUNC(start_keep_el)
+ 	cpuid	x0, x1
+ 	bl	find_logical_id
+ 	cbz	x0, psci_first_spin
+diff --git a/arch/aarch64/spin.S b/arch/aarch64/spin.S
+index 1ea1c0b..bfb1d47 100644
+--- a/arch/aarch64/spin.S
+++ b/arch/aarch64/spin.S
+@@ -12,8 +12,8 @@
+ 
+ 	.text
+ 
+-ASM_FUNC(start_el3)
+-ASM_FUNC(start_no_el3)
+ASM_FUNC(start_el_max)
+ASM_FUNC(start_keep_el)
+ 	cpuid	x0, x1
+ 	bl	find_logical_id
+ 
@@ -0,0 +1,48 @@
+From 26f9b5354c2de9cc052531096ff92b04c3a3846f Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 25 May 2021 07:25:00 +0100
+Subject: [PATCH] aarch64: Prepare for EL1 booting
+
+When booting from EL1, add a check and skip the init of
+sctlr_el2 in jump_kernel
+
+Upstream-Status: Pending
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+---
+ arch/aarch64/boot.S            | 6 +++++-
+ arch/aarch64/include/asm/cpu.h | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index 84e1646..b589744 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -156,10 +156,14 @@ ASM_FUNC(jump_kernel)
+ 	ldr	x0, =SCTLR_EL1_KERNEL
+ 	msr	sctlr_el1, x0
+ 
+	mrs	x0, CurrentEL
+	cmp	x0, #CURRENTEL_EL2
+	b.lt	1f
+
+ 	ldr	x0, =SCTLR_EL2_KERNEL
+ 	msr	sctlr_el2, x0
+ 
+-	cpuid	x0, x1
+1:	cpuid	x0, x1
+ 	bl	find_logical_id
+ 	bl	setup_stack		// Reset stack pointer
+ 
+diff --git a/arch/aarch64/include/asm/cpu.h b/arch/aarch64/include/asm/cpu.h
+index 63eb1c3..b1003f4 100644
+--- a/arch/aarch64/include/asm/cpu.h
+++ b/arch/aarch64/include/asm/cpu.h
+@@ -11,6 +11,7 @@
+ 
+ #define MPIDR_ID_BITS		0xff00ffffff
+ 
+#define CURRENTEL_EL2		(2 << 2)
+ #define CURRENTEL_EL3		(3 << 2)
+ 
+ /*
@@ -1,314 +0,0 @@
-From 81fcc5cc80c9c3c812d92000b9116f6a02ff7e6c Mon Sep 17 00:00:00 2001
-Message-Id: <81fcc5cc80c9c3c812d92000b9116f6a02ff7e6c.1616744115.git.diego.sueiro@arm.com>
-In-Reply-To: <7b8c821c22929cd2d3532f937672fcf05dc7d5d0.1616744115.git.diego.sueiro@arm.com>
-References: <7b8c821c22929cd2d3532f937672fcf05dc7d5d0.1616744115.git.diego.sueiro@arm.com>
-From: Jaxson Han <jaxson.han@arm.com>
-Date: Thu, 25 Mar 2021 12:47:02 +0800
-Subject: [PATCH 2/2] arch64: Introduce EL2 boot code for v8-r64
-
-The v8-r64 boots from EL2 mode. In order to boot linux, EL2 boot mode
-is needed. Because there is no MMU supported for v8-r64 under EL2 mode,
-bootwrapper needs to switch to EL1 mode when jumpping to the kernel.
-
-Some register in gic-v3.h need to be auto-detected.
-
-Issue-ID: SCM-2221
-Signed-off-by: Jaxson Han <jaxson.han@arm.com>
-Change-Id: I52ca3f045f1ab50f32945420144752f396d95193
-
-Upstream-Status: Pending
-Signed-off-by: Diego Sueiro <diego.sueiro@arm.com>
---
- arch/aarch64/boot.S               | 76 +++++++++++++++++++++++++++----
- arch/aarch64/include/asm/cpu.h    |  3 ++
- arch/aarch64/include/asm/gic-v3.h | 23 ++++++++--
- arch/aarch64/psci.S               | 13 +++---
- arch/aarch64/spin.S               |  8 ++--
- arch/aarch64/utils.S              |  8 ++++
- 6 files changed, 110 insertions(+), 21 deletions(-)
-
-diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index e47cf59..5c3eb73 100644
--- a/arch/aarch64/boot.S
-+++ b/arch/aarch64/boot.S
-@@ -22,20 +22,30 @@ _start:
- 	bl	setup_stack
- 
- 	/*
-	 * EL3 initialisation
-+	 * Boot sequence
-+	 * If EL3, goto EL3 initialisation
-+	 * If EL2 && id_aa64mmfr0_el1.MSA == 0xf, do Armv8r initialisation
-+	 * Else no initialisation sequence
- 	 */
- 	mrs	x0, CurrentEL
- 	cmp	x0, #CURRENTEL_EL3
-	b.eq	1f
-+	beq	el3_init
-+	cmp	x0, #CURRENTEL_EL2
-+	beq	el2_init
- 
-+no_el_max:
- 	mov	w0, #1
- 	ldr	x1, =flag_no_el3
- 	str	w0, [x1]
- 
- 	bl	setup_stack
-	b	start_no_el3
-+	b	start_no_el_max
- 
-1:	mov	x0, #0x30			// RES1
-+	/*
-+	 * EL3 initialisation
-+	 */
-+el3_init:
-+	mov	x0, #0x30			// RES1
- 	orr	x0, x0, #(1 << 0)		// Non-secure EL1
- 	orr	x0, x0, #(1 << 8)		// HVC enable
- 
-@@ -93,14 +103,54 @@ _start:
- 	mov	x0, #ZCR_EL3_LEN_MASK		// SVE: Enable full vector len
- 	msr	ZCR_EL3, x0			// for EL2.
- 
-1:
-+	mov	w0, #SPSR_KERNEL
-+	ldr	x1, =spsr_to_elx
-+	str	w0, [x1]
-+	b	el_max_init
-+
-+	/*
-+	 * EL2 Armv8r initialisation
-+	 */
-+el2_init:
-+	/* Detect Armv8r */
-+	mrs	x1, id_aa64mmfr0_el1
-+	ubfx	x1, x1, #48, #4			// MSA
-+	cmp	x1, 0xf				// 0xf means Armv8r
-+	bne	no_el_max
-+
-+	mrs	x0, midr_el1
-+	msr	vpidr_el2, x0
-+
-+	mrs	x0, mpidr_el1
-+	msr	vmpidr_el2, x0
-+
-+	mov	x0, #(1 << 31)			// VTCR_MSA: VMSAv8-64 support
-+	msr	vtcr_el2, x0
-+
-+	/* Enable pointer authentication if present */
-+	mrs	x1, id_aa64isar1_el1
-+	ldr	x2, =(((0xff) << 24) | (0xff << 4))
-+	and	x1, x1, x2
-+	cbz	x1, 1f
-+
-+	mrs	x0, hcr_el2
-+	orr	x0, x0, #(1 << 40)		// AP key enable
-+	orr	x0, x0, #(1 << 41)		// AP insn enable
-+	msr	hcr_el2, x0
-+
-+1:	isb
-+	mov	w0, #SPSR_KERNEL_EL1
-+	ldr	x1, =spsr_to_elx
-+	str	w0, [x1]
-+	b	el_max_init
-+
-+el_max_init:
- 	ldr	x0, =CNTFRQ
- 	msr	cntfrq_el0, x0
- 
- 	bl	gic_secure_init
- 
-	b	start_el3
-
-+	b	start_el_max
- err_invalid_id:
- 	b	.
- 
-@@ -137,7 +187,7 @@ jump_kernel:
- 	b.eq	1f
- 	br	x19			// No EL3
- 
-1:	mov	x4, #SPSR_KERNEL
-+1:	ldr	w4, spsr_to_elx
- 
- 	/*
- 	 * If bit 0 of the kernel address is set, we're entering in AArch32
-@@ -145,13 +195,23 @@ jump_kernel:
- 	 */
- 	bfi	x4, x19, #5, #1
- 
-+	mrs	x18, CurrentEL
-+	cmp	x18, #CURRENTEL_EL2
-+	b.eq	1f
-+
- 	msr	elr_el3, x19
- 	msr	spsr_el3, x4
- 	eret
- 
-+1:	msr	elr_el2, x19
-+	msr	spsr_el2, x4
-+	eret
-+
- 	.ltorg
- 
- 	.data
- 	.align 3
- flag_no_el3:
- 	.long 0
-+spsr_to_elx:
-+	.long 0
-diff --git a/arch/aarch64/include/asm/cpu.h b/arch/aarch64/include/asm/cpu.h
-index ccb5397..2b3a0a4 100644
--- a/arch/aarch64/include/asm/cpu.h
-+++ b/arch/aarch64/include/asm/cpu.h
-@@ -11,6 +11,7 @@
- 
- #define MPIDR_ID_BITS		0xff00ffffff
- 
-+#define CURRENTEL_EL2		(2 << 2)
- #define CURRENTEL_EL3		(3 << 2)
- 
- /*
-@@ -24,6 +25,7 @@
- #define SPSR_I			(1 << 7)	/* IRQ masked */
- #define SPSR_F			(1 << 6)	/* FIQ masked */
- #define SPSR_T			(1 << 5)	/* Thumb */
-+#define SPSR_EL1H		(5 << 0)	/* EL1 Handler mode */
- #define SPSR_EL2H		(9 << 0)	/* EL2 Handler mode */
- #define SPSR_HYP		(0x1a << 0)	/* M[3:0] = hyp, M[4] = AArch32 */
- 
-@@ -42,6 +44,7 @@
- #else
- #define SCTLR_EL1_RESET		SCTLR_EL1_RES1
- #define SPSR_KERNEL		(SPSR_A | SPSR_D | SPSR_I | SPSR_F | SPSR_EL2H)
-+#define SPSR_KERNEL_EL1		(SPSR_A | SPSR_D | SPSR_I | SPSR_F | SPSR_EL1H)
- #endif
- 
- #ifndef __ASSEMBLY__
-diff --git a/arch/aarch64/include/asm/gic-v3.h b/arch/aarch64/include/asm/gic-v3.h
-index e743c02..f8ddb27 100644
--- a/arch/aarch64/include/asm/gic-v3.h
-+++ b/arch/aarch64/include/asm/gic-v3.h
-@@ -15,21 +15,38 @@
- #define ICC_CTLR_EL3	"S3_6_C12_C12_4"
- #define ICC_PMR_EL1	"S3_0_C4_C6_0"
- 
-+static inline uint32_t current_el(void)
-+{
-+	uint32_t val;
-+
-+	asm volatile ("mrs %0, CurrentEL" : "=r" (val));
-+	return val;
-+}
-+
- static inline uint32_t gic_read_icc_sre(void)
- {
- 	uint32_t val;
-	asm volatile ("mrs %0, " ICC_SRE_EL3 : "=r" (val));
-+
-+	if(current_el() == CURRENTEL_EL3)
-+		asm volatile ("mrs %0, " ICC_SRE_EL3 : "=r" (val));
-+	else
-+		asm volatile ("mrs %0, " ICC_SRE_EL2 : "=r" (val));
-+
- 	return val;
- }
- 
- static inline void gic_write_icc_sre(uint32_t val)
- {
-	asm volatile ("msr " ICC_SRE_EL3 ", %0" : : "r" (val));
-+	if(current_el() == CURRENTEL_EL3)
-+		asm volatile ("msr " ICC_SRE_EL3 ", %0" : : "r" (val));
-+	else
-+		asm volatile ("msr " ICC_SRE_EL2 ", %0" : : "r" (val));
- }
- 
- static inline void gic_write_icc_ctlr(uint32_t val)
- {
-	asm volatile ("msr " ICC_CTLR_EL3 ", %0" : : "r" (val));
-+	if(current_el() == CURRENTEL_EL3)
-+		asm volatile ("msr " ICC_CTLR_EL3 ", %0" : : "r" (val));
- }
- 
- #endif
-diff --git a/arch/aarch64/psci.S b/arch/aarch64/psci.S
-index 01ebe7d..0681d5e 100644
--- a/arch/aarch64/psci.S
-+++ b/arch/aarch64/psci.S
-@@ -45,8 +45,8 @@ vector:
- 
- 	.text
- 
-	.globl start_no_el3
-	.globl start_el3
-+	.globl start_no_el_max
-+	.globl start_el_max
- 
- err_exception:
- 	b err_exception
-@@ -101,7 +101,7 @@ smc_exit:
- 	eret
- 
- 
-start_el3:
-+start_el_max:
- 	ldr	x0, =vector
- 	bl	setup_vector
- 
-@@ -111,10 +111,11 @@ start_el3:
- 	b	psci_first_spin
- 
- /*
- * This PSCI implementation requires EL3. Without EL3 we'll only boot the
- * primary cpu, all others will be trapped in an infinite loop.
-+ * This PSCI implementation requires EL3 or AArch64-R EL2. Without EL max
-+ * we'll only boot the primary cpu, all others will be trapped in an infinite
-+ * loop.
-  */
-start_no_el3:
-+start_no_el_max:
- 	cpuid	x0, x1
- 	bl	find_logical_id
- 	cbz	x0, psci_first_spin
-diff --git a/arch/aarch64/spin.S b/arch/aarch64/spin.S
-index 72603cf..fa1d657 100644
--- a/arch/aarch64/spin.S
-+++ b/arch/aarch64/spin.S
-@@ -11,11 +11,11 @@
- 
- 	.text
- 
-	.globl start_no_el3
-	.globl start_el3
-+	.globl start_no_el_max
-+	.globl start_el_max
- 
-start_el3:
-start_no_el3:
-+start_el_max:
-+start_no_el_max:
- 	cpuid	x0, x1
- 	bl	find_logical_id
- 
-diff --git a/arch/aarch64/utils.S b/arch/aarch64/utils.S
-index ae22ea7..2a63fa7 100644
--- a/arch/aarch64/utils.S
-+++ b/arch/aarch64/utils.S
-@@ -41,6 +41,14 @@ find_logical_id:
-  * x0: vector address
-  */
- setup_vector:
-+	mrs	x1, CurrentEL
-+	cmp	x1, #CURRENTEL_EL2
-+	b.eq	1f
-+
- 	msr	VBAR_EL3, x0
- 	isb
- 	ret
-+
-+1:	msr	VBAR_EL2, x0
-+	isb
-+	ret
-- 
-2.17.1
-
@@ -0,0 +1,55 @@
+From ce628de7699dd6401ddf713efaa49872e2733619 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 25 May 2021 07:25:00 +0100
+Subject: [PATCH] aarch64: Prepare for lower EL booting
+
+Save SPSR_KERNEL into spsr_to_elx during el3_init.
+The jump_kernel will load spsr_to_elx into spsr_el3.
+
+This change will make it easier to control whether drop to lower EL
+before jumping to the kernel.
+
+Upstream-Status: Pending
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+---
+ arch/aarch64/boot.S | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index b589744..6b45afc 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -130,7 +130,16 @@ el3_init:
+ 	mov	x0, #ZCR_EL3_LEN_MASK		// SVE: Enable full vector len
+ 	msr	ZCR_EL3, x0			// for EL2.
+ 
+-1:
+	/*
+	 * Save SPSR_KERNEL into spsr_to_elx.
+	 * The jump_kernel will load spsr_to_elx into spsr_el3
+	 */
+1:	mov	w0, #SPSR_KERNEL
+	ldr	x1, =spsr_to_elx
+	str	w0, [x1]
+	b	el_max_init
+
+el_max_init:
+ 	ldr	x0, =COUNTER_FREQ
+ 	msr	cntfrq_el0, x0
+ 
+@@ -178,7 +187,7 @@ ASM_FUNC(jump_kernel)
+ 	b.eq	1f
+ 	br	x19			// Keep current EL
+ 
+-1:	mov	x4, #SPSR_KERNEL
+1:	ldr	w4, spsr_to_elx
+ 
+ 	/*
+ 	 * If bit 0 of the kernel address is set, we're entering in AArch32
+@@ -196,3 +205,5 @@ ASM_FUNC(jump_kernel)
+ 	.align 3
+ flag_keep_el:
+ 	.long 0
+spsr_to_elx:
+	.long 0
@@ -0,0 +1,105 @@
+From 483d363bf825082b6db6de3c57d169e741861891 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 25 May 2021 07:25:00 +0100
+Subject: [PATCH] gic-v3: Prepare for gicv3 with EL2
+
+This is a preparation for allowing boot-wrapper configuring the gicv3
+with EL2.
+
+When confiuring with EL2, since there is no ICC_CTLR_EL2, the
+ICC_CTLR_EL3 cannot be replaced with ICC_CTLR_EL2 simply.
+See [https://developer.arm.com/documentation/ihi0069/latest/].
+
+As the caller, gic_secure_init expects the ICC_CTLR to be written,
+we change the function into gic_init_icc_ctlr(). In the GIC spec,
+the r/w bits in this register ([6:0]) either affect EL3 IRQ routing
+(not applicable since no EL3), non-secure IRQ handling (not applicable
+since only secure state in Armv8-R aarch64), or are aliased to
+ICC_CTLR_EL1 bits.
+So, based on this, the new gic_init_icc_ctlr() would be:
+When currentEL is EL3, init ICC_CTLR_EL3 as before.
+When currentEL is not EL3, init ICC_CTLR_EL1 with ICC_CTLR_EL1_RESET.
+
+Upstream-Status: Pending
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+---
+ arch/aarch32/include/asm/gic-v3.h |  7 +++++++
+ arch/aarch64/include/asm/gic-v3.h | 23 ++++++++++++++++++++---
+ common/gic-v3.c                   |  2 +-
+ 3 files changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/arch/aarch32/include/asm/gic-v3.h b/arch/aarch32/include/asm/gic-v3.h
+index 65f38de..11e7bc7 100644
+--- a/arch/aarch32/include/asm/gic-v3.h
+++ b/arch/aarch32/include/asm/gic-v3.h
+@@ -9,6 +9,8 @@
+ #ifndef __ASM_AARCH32_GICV3_H
+ #define __ASM_AARCH32_GICV3_H
+ 
+#define ICC_CTLR_RESET (0UL)
+
+ static inline void gic_write_icc_sre(uint32_t val)
+ {
+ 	asm volatile ("mcr p15, 6, %0, c12, c12, 5" : : "r" (val));
+@@ -19,4 +21,9 @@ static inline void gic_write_icc_ctlr(uint32_t val)
+ 	asm volatile ("mcr p15, 6, %0, c12, c12, 4" : : "r" (val));
+ }
+ 
+static inline void gic_init_icc_ctlr()
+{
+	gic_write_icc_ctlr(ICC_CTLR_RESET);
+}
+
+ #endif
+diff --git a/arch/aarch64/include/asm/gic-v3.h b/arch/aarch64/include/asm/gic-v3.h
+index 5b32380..090ab0b 100644
+--- a/arch/aarch64/include/asm/gic-v3.h
+++ b/arch/aarch64/include/asm/gic-v3.h
+@@ -15,14 +15,31 @@
+ #define ICC_CTLR_EL3	"S3_6_C12_C12_4"
+ #define ICC_PMR_EL1	"S3_0_C4_C6_0"
+ 
+#define ICC_CTLR_EL3_RESET     (0UL)
+#define ICC_CTLR_EL1_RESET     (0UL)
+
+static inline uint32_t current_el(void)
+{
+	uint32_t val;
+
+	asm volatile ("mrs %0, CurrentEL" : "=r" (val));
+	return val;
+}
+
+ static inline void gic_write_icc_sre(uint32_t val)
+ {
+-	asm volatile ("msr " ICC_SRE_EL3 ", %0" : : "r" (val));
+	if (current_el() == CURRENTEL_EL3)
+		asm volatile ("msr " ICC_SRE_EL3 ", %0" : : "r" (val));
+	else
+		asm volatile ("msr " ICC_SRE_EL2 ", %0" : : "r" (val));
+ }
+ 
+-static inline void gic_write_icc_ctlr(uint32_t val)
+static inline void gic_init_icc_ctlr()
+ {
+-	asm volatile ("msr " ICC_CTLR_EL3 ", %0" : : "r" (val));
+	if (current_el() == CURRENTEL_EL3)
+		asm volatile ("msr " ICC_CTLR_EL3 ", %0" : : "r" (ICC_CTLR_EL3_RESET));
+	else
+		asm volatile ("msr " ICC_CTLR_EL1 ", %0" : : "r" (ICC_CTLR_EL1_RESET));
+ }
+ 
+ #endif
+diff --git a/common/gic-v3.c b/common/gic-v3.c
+index 6207007..a0fe564 100644
+--- a/common/gic-v3.c
+++ b/common/gic-v3.c
+@@ -117,6 +117,6 @@ void gic_secure_init(void)
+ 	gic_write_icc_sre(ICC_SRE_Enable | ICC_SRE_DIB | ICC_SRE_DFB | ICC_SRE_SRE);
+ 	isb();
+ 
+-	gic_write_icc_ctlr(0);
+	gic_init_icc_ctlr();
+ 	isb();
+ }
@@ -0,0 +1,63 @@
+From be814863cdd5f61d9a16eec012d500550053c8c6 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 25 May 2021 07:25:00 +0100
+Subject: [PATCH] aarch64: Prepare for booting with EL2
+
+Prepare for allowing boot-wrapper to be entered in EL2.
+Detect current EL and set the corresponding EL registers.
+
+Upstream-Status: Pending
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+---
+ arch/aarch64/boot.S  |  8 ++++++++
+ arch/aarch64/utils.S | 10 +++++++++-
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index 6b45afc..908764a 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -195,10 +195,18 @@ ASM_FUNC(jump_kernel)
+ 	 */
+ 	bfi	x4, x19, #5, #1
+ 
+	mrs	x5, CurrentEL
+	cmp	x5, #CURRENTEL_EL2
+	b.eq	1f
+
+ 	msr	elr_el3, x19
+ 	msr	spsr_el3, x4
+ 	eret
+ 
+1:	msr	elr_el2, x19
+	msr	spsr_el2, x4
+	eret
+
+ 	.ltorg
+ 
+ 	.data
+diff --git a/arch/aarch64/utils.S b/arch/aarch64/utils.S
+index 85c7f8a..f02a249 100644
+--- a/arch/aarch64/utils.S
+++ b/arch/aarch64/utils.S
+@@ -34,10 +34,18 @@ ASM_FUNC(find_logical_id)
+ 	ret
+ 
+ /*
+- * Setup EL3 vectors
+ * Setup EL3/EL2 vectors
+  * x0: vector address
+  */
+ ASM_FUNC(setup_vector)
+	mrs	x1, CurrentEL
+	cmp	x1, #CURRENTEL_EL2
+	b.eq    1f
+
+ 	msr	VBAR_EL3, x0
+ 	isb
+ 	ret
+
+1:	msr	VBAR_EL2, x0
+	isb
+	ret
@@ -0,0 +1,182 @@
+From 81df76f8d94cb6c31c01739b078a72bdb8497441 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 25 May 2021 07:25:00 +0100
+Subject: [PATCH] aarch64: Introduce EL2 boot code for Armv8-R AArch64
+
+The Armv8-R AArch64 profile does not support the EL3 exception level.
+The Armv8-R AArch64 profile allows for an (optional) VMSAv8-64 MMU
+at EL1, which allows to run off-the-shelf Linux. However EL2 only
+supports a PMSA, which is not supported by Linux, so we need to drop
+into EL1 before entering the kernel.
+
+We add a new err_invalid_arch symbol as a dead loop. If we detect the
+current Armv8-R aarch64 only supports with PMSA, meaning we cannot boot
+Linux anymore, then we jump to err_invalid_arch.
+
+During Armv8-R aarch64 init, to make sure nothing unexpected traps into
+EL2, we auto-detect and config FIEN and EnSCXT in HCR_EL2.
+
+The boot sequence is:
+If CurrentEL == EL3, then goto EL3 initialisation and drop to lower EL
+  before entering the kernel.
+If CurrentEL == EL2 && id_aa64mmfr0_el1.MSA == 0xf (Armv8-R aarch64),
+  if id_aa64mmfr0_el1.MSA_frac == 0x2,
+    then goto Armv8-R AArch64 initialisation and drop to EL1 before
+    entering the kernel.
+  else, which means VMSA unsupported and cannot boot Linux,
+    goto err_invalid_arch (dead loop).
+Else, no initialisation and keep the current EL before entering the
+  kernel.
+
+Upstream-Status: Pending
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+---
+ arch/aarch64/boot.S            | 92 +++++++++++++++++++++++++++++++++-
+ arch/aarch64/include/asm/cpu.h |  2 +
+ 2 files changed, 92 insertions(+), 2 deletions(-)
+
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index 908764a..def9192 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -24,16 +24,24 @@ ASM_FUNC(_start)
+ 	 * Boot sequence
+ 	 * If CurrentEL == EL3, then goto EL3 initialisation and drop to
+ 	 *   lower EL before entering the kernel.
+	 * If CurrentEL == EL2 && id_aa64mmfr0_el1.MSA == 0xf, then
+	 *   If id_aa64mmfr0_el1.MSA_frac == 0x2, then goto
+	 *     Armv8-R AArch64 initialisation and drop to EL1 before
+	 *     entering the kernel.
+	 *   Else, which means VMSA unsupported and cannot boot Linux,
+	 *     goto err_invalid_arch (dead loop).
+ 	 * Else, no initialisation and keep the current EL before
+ 	 *   entering the kernel.
+ 	 */
+ 	mrs	x0, CurrentEL
+-	cmp	x0, #CURRENTEL_EL3
+-	b.eq	el3_init
+	cmp	x0, #CURRENTEL_EL2
+	bgt	el3_init
+	beq	el2_init
+ 
+ 	/*
+ 	 * We stay in the current EL for entering the kernel
+ 	 */
+keep_el:
+ 	mov	w0, #1
+ 	ldr	x1, =flag_keep_el
+ 	str	w0, [x1]
+@@ -139,6 +147,85 @@ el3_init:
+ 	str	w0, [x1]
+ 	b	el_max_init
+ 
+	/*
+	 * EL2 Armv8-R AArch64 initialisation
+	 */
+el2_init:
+	/* Detect Armv8-R AArch64 */
+	mrs	x1, id_aa64mmfr0_el1
+	/*
+	 * Check MSA, bits [51:48]:
+	 * 0xf means Armv8-R AArch64.
+	 * If not 0xf, proceed in Armv8-A EL2.
+	 */
+	ubfx	x0, x1, #48, #4			// MSA
+	cmp	x0, 0xf
+	bne	keep_el
+	/*
+	 * Check MSA_frac, bits [55:52]:
+	 * 0x2 means EL1&0 translation regime also supports VMSAv8-64.
+	 */
+	ubfx	x0, x1, #52, #4			// MSA_frac
+	cmp	x0, 0x2
+	/*
+	 * If not 0x2, no VMSA, so cannot boot Linux and dead loop.
+	 * Also, since the architecture guarantees that those CPUID
+	 * fields never lose features when the value in a field
+	 * increases, we use blt to cover it.
+	*/
+	blt	err_invalid_arch
+
+	mrs	x0, midr_el1
+	msr	vpidr_el2, x0
+
+	mrs	x0, mpidr_el1
+	msr	vmpidr_el2, x0
+
+	mov	x0, #(1 << 31)			// VTCR_MSA: VMSAv8-64 support
+	msr	vtcr_el2, x0
+
+	/* Init HCR_EL2 */
+	mov	x0, #(1 << 31)			// RES1: Armv8-R aarch64 only
+
+	mrs	x1, id_aa64pfr0_el1
+	ubfx	x2, x1, #56, 4			// ID_AA64PFR0_EL1.CSV2
+	cmp	x2, 0x2
+	b.lt	1f
+	/*
+	 * Disable trap when accessing SCTXNUM_EL0 or SCTXNUM_EL1
+	 * if FEAT_CSV2.
+	 */
+	orr	x0, x0, #(1 << 53)		// HCR_EL2.EnSCXT
+
+1:	ubfx	x2, x1, #28, 4			// ID_AA64PFR0_EL1.RAS
+	cmp	x2, 0x2
+	b.lt	1f
+	/* Disable trap when accessing ERXPFGCDN_EL1 if FEAT_RASv1p1. */
+	orr	x0, x0, #(1 << 47)		// HCR_EL2.FIEN
+
+	/* Enable pointer authentication if present */
+1:	mrs	x1, id_aa64isar1_el1
+	/*
+	 * If ID_AA64ISAR1_EL1.{GPI, GPA, API, APA} == {0000, 0000, 0000, 0000}
+	 *   then HCR_EL2.APK and HCR_EL2.API are RES 0.
+	 * Else
+	 *   set HCR_EL2.APK and HCR_EL2.API.
+	 */
+	ldr	x2, =(((0xff) << 24) | (0xff << 4))
+	and	x1, x1, x2
+	cbz	x1, 1f
+
+	orr	x0, x0, #(1 << 40)		// HCR_EL2.APK
+	orr	x0, x0, #(1 << 41)		// HCR_EL2.API
+
+1:	msr	hcr_el2, x0
+	isb
+
+	mov	w0, #SPSR_KERNEL_EL1
+	ldr	x1, =spsr_to_elx
+	str	w0, [x1]
+	// fall through
+
+ el_max_init:
+ 	ldr	x0, =COUNTER_FREQ
+ 	msr	cntfrq_el0, x0
+@@ -148,6 +235,7 @@ el_max_init:
+ 	b	start_el_max
+ 
+ err_invalid_id:
+err_invalid_arch:
+ 	b	.
+ 
+ 	/*
+diff --git a/arch/aarch64/include/asm/cpu.h b/arch/aarch64/include/asm/cpu.h
+index b1003f4..91f803c 100644
+--- a/arch/aarch64/include/asm/cpu.h
+++ b/arch/aarch64/include/asm/cpu.h
+@@ -25,6 +25,7 @@
+ #define SPSR_I			(1 << 7)	/* IRQ masked */
+ #define SPSR_F			(1 << 6)	/* FIQ masked */
+ #define SPSR_T			(1 << 5)	/* Thumb */
+#define SPSR_EL1H		(5 << 0)	/* EL1 Handler mode */
+ #define SPSR_EL2H		(9 << 0)	/* EL2 Handler mode */
+ #define SPSR_HYP		(0x1a << 0)	/* M[3:0] = hyp, M[4] = AArch32 */
+ 
+@@ -43,6 +44,7 @@
+ #else
+ #define SCTLR_EL1_KERNEL	SCTLR_EL1_RES1
+ #define SPSR_KERNEL		(SPSR_A | SPSR_D | SPSR_I | SPSR_F | SPSR_EL2H)
+#define SPSR_KERNEL_EL1		(SPSR_A | SPSR_D | SPSR_I | SPSR_F | SPSR_EL1H)
+ #endif
+ 
+ #ifndef __ASSEMBLY__
@@ -1,4 +1,4 @@
-From 5120127e5f767b44a087c741a3438cef1e22ed50 Mon Sep 17 00:00:00 2001
+From f5a31b4f4ea8daaa0d337d5a2322ddb1912083fc Mon Sep 17 00:00:00 2001
 From: Qi Feng <qi.feng@arm.com>
 Date: Wed, 26 May 2021 17:52:01 +0800
 Subject: [PATCH] Allow --enable-psci to choose between smc and hvc
@@ -28,38 +28,47 @@ To use hvc, use --enable-psci=hvc.
 [1]: https://developer.arm.com/documentation/ddi0600/latest/

 Issue-Id: SCM-2654
+Upstream-Status: Pending
 Signed-off-by: Qi Feng <qi.feng@arm.com>
 Change-Id: Ib8afabdad2d98bc37371d165bbb6f1f9b88bfc87

 Upstream-Status: Pending
 Signed-off-by: Huifeng Zhang <Huifeng.Zhang@arm.com>
 ---
- Makefile.am  |  2 +-
+ Makefile.am  | 10 +++++-----
 configure.ac | 14 +++++++++-----
- 2 files changed, 10 insertions(+), 6 deletions(-)
+ 2 files changed, 14 insertions(+), 10 deletions(-)

 diff --git a/Makefile.am b/Makefile.am
-index ef6b793..a9ddd16 100644
+index f941b07..88a27de 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -47,7 +47,7 @@ BOOTMETHOD	:= psci.o
- OFILES		+= psci.o
- PSCI_NODE	:= psci {				\
- 			compatible = \"arm,psci\";	\
+@@ -50,11 +50,11 @@ endif
+ if PSCI
+ ARCH_OBJ	+= psci.o
+ COMMON_OBJ	+= psci.o
+-PSCI_NODE	:= psci {				\
+-			compatible = \"arm,psci\";	\
 -			method = \"smc\";		\
-+			method = \"$(PSCI_METHOD)\";	\
- 			cpu_on = <$(PSCI_CPU_ON)>;	\
- 			cpu_off = <$(PSCI_CPU_OFF)>;	\
+-			cpu_on = <$(PSCI_CPU_ON)>;	\
+-			cpu_off = <$(PSCI_CPU_OFF)>;	\
+PSCI_NODE	:= psci {						\
+			compatible = \"arm,psci\";			\
+			method = \"$(PSCI_METHOD)\";			\
+			cpu_on = <$(PSCI_CPU_ON)>;			\
+			cpu_off = <$(PSCI_CPU_OFF)>;			\
 		   };
+ CPU_NODES	:= $(shell perl -I $(SCRIPT_DIR) $(SCRIPT_DIR)/addpsci.pl $(KERNEL_DTB))
+ else
 diff --git a/configure.ac b/configure.ac
-index 6914eb4..9aab4a1 100644
+index 9e3b722..53e51be 100644
 --- a/configure.ac
 +++ b/configure.ac
@@ -83,13 +83,17 @@ AS_IF([test "x$X_IMAGE" != "x"],
 # Allow a user to pass --enable-psci
 AC_ARG_ENABLE([psci],
- 	AS_HELP_STRING([--enable-psci], [enable the psci boot method]),
-	[USE_PSCI=$enableval])
+ 	AS_HELP_STRING([--disable-psci], [disable the psci boot method]),
+-	[USE_PSCI=$enableval], [USE_PSCI="yes"])
 -AM_CONDITIONAL([PSCI], [test "x$USE_PSCI" = "xyes"])
 -AS_IF([test "x$USE_PSCI" = "xyes"], [], [USE_PSCI=no])
 -
@@ -68,7 +77,7 @@ index 6914eb4..9aab4a1 100644
 +		yes|smc) USE_PSCI=smc ;;
 +		hvc) USE_PSCI=hvc ;;
 +		*) AC_MSG_ERROR([Bad value "${enableval}" for --enable-psci. Use "smc" or "hvc"]) ;;
-+	esac])
+	esac], [USE_PSCI="yes"])
 +AM_CONDITIONAL([PSCI], [test "x$USE_PSCI" = "xyes" -o "x$USE_PSCI" = "xsmc" -o "x$USE_PSCI" = "xhvc"])
 +
 +AS_IF([test "x$USE_PSCI" = "xno" -a "x$KERNEL_ES" = "x32"],
@@ -78,6 +87,3 @@ index 6914eb4..9aab4a1 100644
 
 # Allow a user to pass --with-initrd
 AC_ARG_WITH([initrd],
-- 
-2.32.0
-
@@ -0,0 +1,48 @@
+From 3f4614e02f0f8d2522510578da2752f8e3511bb3 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Mon, 25 Oct 2021 17:09:13 +0800
+Subject: [PATCH] aarch64: Disable CNTPCT_EL0 trap for v8-R64
+
+To allow EL1 to access CNTPCT_EL0 without traping into EL2, we need to
+set CNTHCTL_EL2.EL1PCTEN to 1.
+
+For v8-R64, the CNTHCTL_EL2 register follows the v8-A architecture.
+However, as described in the v8-A architecture profile, the
+CNTHCTL_EL2's bit assignments are different according to whether the
+FEAT_VHE is implemented.
+
+Since v8-R64 does not support FEAT_VHE, we do not need to detect
+FEAT_VHE. We can simply set CNTHCTL_EL2.EL1PCTEN to 1.
+
+Issue-ID: SCM-3508
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: I4147e66341c8153312021e6f2ab67d0037246da1
+---
+ arch/aarch64/boot.S | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index def9192..6dbd5cc 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -219,6 +219,18 @@ el2_init:
+ 	orr	x0, x0, #(1 << 41)		// HCR_EL2.API
+ 
+ 1:	msr	hcr_el2, x0
+
+	/*
+	 * To disable trap when accessing CNTPCT_EL0, we need to set
+	 * CNTHCTL_EL2.EL1PCTEN to 1. However, the CNTHCTL_EL2 bit assignments
+	 * are different according to whether the FEAT_VHE is implemented.
+	 *
+	 * For Armv8-R AArch64, FEAT_VHE is not supported, so we do not need to
+	 * detect FEAT_VHE(ID_AA64MMFR1_EL1.VH) and simply set
+	 * CNTHCTL_EL2.EL1PCTEN to 1.
+	 */
+	mov	x0, #1				// CNTHCTL_EL2.EL1PCTEN
+	msr	cnthctl_el2, x0
+ 	isb
+ 
+ 	mov	w0, #SPSR_KERNEL_EL1
@@ -0,0 +1,38 @@
+From 2851f0e6c1216894b9498d7b91256bb1ef49e544 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 2 Nov 2021 15:10:28 +0800
+Subject: [PATCH] lds: Mark the mem range
+
+Add firmware_start and firmware_end, so that we can use them to
+calculate the mem range of boot-wrapper and then set the range to
+/memreserve/ of dtb.
+
+Issue-ID: SCM-3815
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: Idc5a2894e193c75381049a0f359b4b2a51c567ee
+---
+ model.lds.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/model.lds.S b/model.lds.S
+index d4e7e13..ab98ddf 100644
+--- a/model.lds.S
+++ b/model.lds.S
+@@ -64,6 +64,7 @@ SECTIONS
+ #endif
+ 
+ 	.boot PHYS_OFFSET: {
+		PROVIDE(firmware_start = .);
+ 		*(.init)
+ 		*(.text*)
+ 		*(.data* .rodata* .bss* COMMON)
+@@ -76,6 +77,7 @@ SECTIONS
+ 		mbox = .;
+ 		QUAD(0x0)
+ 	}
+	PROVIDE(firmware_end = .);
+ 
+ 	ASSERT(etext <= (PHYS_OFFSET + TEXT_LIMIT), ".text overflow!")
+ }
@@ -0,0 +1,101 @@
+From 0f2c7ca446063be6b193fbf870d38c0af19e15c5 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 28 Dec 2021 17:28:25 +0800
+Subject: [PATCH] common: Add essential libc functions
+
+The libfdt uses some of the libc functions, e.g. memcmp, memmove,
+strlen .etc. Add them in lib.c.
+
+The code is copied from TF-A (v2.5) [1] project, which is under the
+terms of BSD license. It is the same with boot-wrapper.
+
+[1]: https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git
+
+Issue-Id: SCM-3814
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: If3b55b00afa8694c7522df989a41e0b38eda1d38
+---
+ common/lib.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 70 insertions(+), 1 deletion(-)
+
+diff --git a/common/lib.c b/common/lib.c
+index fcf5f69..0be1c4a 100644
+--- a/common/lib.c
+++ b/common/lib.c
+@@ -32,4 +32,73 @@ void *memset(void *s, int c, size_t n)
+ 	return s;
+ }
+ 
+-/* TODO: memmove and memcmp could also be called */
+int memcmp(const void *s1, const void *s2, size_t len)
+{
+	const unsigned char *s = s1;
+	const unsigned char *d = s2;
+	unsigned char sc;
+	unsigned char dc;
+
+	while (len--) {
+		sc = *s++;
+		dc = *d++;
+		if (sc - dc)
+			return (sc - dc);
+	}
+
+	return 0;
+}
+
+void *memmove(void *dst, const void *src, size_t len)
+{
+	if ((size_t)dst - (size_t)src >= len) {
+		/* destination not in source data, so can safely use memcpy */
+		return memcpy(dst, src, len);
+	} else {
+		/* copy backwards... */
+		const char *end = dst;
+		const char *s = (const char *)src + len;
+		char *d = (char *)dst + len;
+		while (d != end)
+			*--d = *--s;
+	}
+	return dst;
+}
+
+void *memchr(const void *src, int c, size_t len)
+{
+	const unsigned char *s = src;
+
+	while (len--) {
+		if (*s == (unsigned char)c)
+			return (void *) s;
+		s++;
+	}
+
+	return NULL;
+}
+
+char *strrchr(const char *p, int ch)
+{
+	char *save;
+	char c;
+
+	c = ch;
+	for (save = NULL;; ++p) {
+		if (*p == c)
+			save = (char *)p;
+		if (*p == '\0')
+			return (save);
+	}
+	/* NOTREACHED */
+}
+
+size_t strlen(const char *s)
+{
+	const char *cursor = s;
+
+	while (*cursor)
+		cursor++;
+
+	return cursor - s;
+}
@@ -0,0 +1,61 @@
+From de5d2b6c200ae5dd8113751e58bf7cf5844eec5a Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 28 Dec 2021 17:42:48 +0800
+Subject: [PATCH] Makefile: Add the libfdt to the Makefile system
+
+Add the libfdt into Makefile system. The libfdt uses const value and
+thus gcc will enable the stack guard. The stack guard will fail the
+compile. Add -fno-stack-protector to fix it.
+
+Issue-Id: SCM-3814
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: I472bc28cdc5cde3b22461a4b7d7a3752ae382b4b
+---
+ Makefile.am | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 88a27de..5e8668a 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -36,6 +36,9 @@ PSCI_CPU_OFF	:= 0x84000002
+ COMMON_SRC	:= common/
+ COMMON_OBJ	:= boot.o bakery_lock.o platform.o lib.o
+ 
+LIBFDT_SRC	:= common/libfdt/
+LIBFDT_OBJS	:= fdt.o fdt_ro.o fdt_rw.o
+
+ ARCH_OBJ	:= boot.o stack.o utils.o
+ 
+ if BOOTWRAPPER_32
+@@ -125,11 +128,12 @@ CHOSEN_NODE	:= chosen {						\
+ CPPFLAGS	+= $(INITRD_FLAGS)
+ CFLAGS		+= -I$(top_srcdir)/include/ -I$(top_srcdir)/$(ARCH_SRC)/include/
+ CFLAGS		+= -Wall -fomit-frame-pointer
+CFLAGS 		+= -fno-stack-protector
+ CFLAGS		+= -ffunction-sections -fdata-sections
+ CFLAGS		+= -fno-pic -fno-pie
+ LDFLAGS		+= --gc-sections
+ 
+-OBJ		:= $(addprefix $(ARCH_SRC),$(ARCH_OBJ)) $(addprefix $(COMMON_SRC),$(COMMON_OBJ))
+OBJ		:= $(addprefix $(ARCH_SRC),$(ARCH_OBJ)) $(addprefix $(COMMON_SRC),$(COMMON_OBJ)) $(addprefix $(LIBFDT_SRC),$(LIBFDT_OBJS))
+ 
+ # Don't lookup all prerequisites in $(top_srcdir), only the source files. When
+ # building outside the source tree $(ARCH_SRC) needs to be created.
+@@ -150,10 +154,13 @@ $(ARCH_SRC):
+ $(COMMON_SRC):
+ 	$(MKDIR_P) $@
+ 
+$(LIBFDT_SRC):
+	$(MKDIR_P) $@
+
+ %.o: %.S Makefile | $(ARCH_SRC)
+ 	$(CC) $(CPPFLAGS) -D__ASSEMBLY__ $(CFLAGS) $(DEFINES) -c -o $@ $<
+ 
+-%.o: %.c Makefile | $(COMMON_SRC)
+%.o: %.c Makefile | $(COMMON_SRC) $(LIBFDT_SRC)
+ 	$(CC) $(CPPFLAGS) $(CFLAGS) $(DEFINES) -c -o $@ $<
+ 
+ model.lds: $(LD_SCRIPT) Makefile
@@ -0,0 +1,67 @@
+From 5b8cb5192dbd0332e027e8999c3afe4433983291 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Wed, 29 Dec 2021 10:50:21 +0800
+Subject: [PATCH] platform: Add print_hex func
+
+Refine the print functions, and add a new print_hex func to print hex
+numbers.
+
+Issue-Id: SCM-3814
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: Ic960345d9ef0b41d81d30c4a4dbd9c31139907c4
+---
+ common/platform.c | 33 +++++++++++++++++++++++++--------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+diff --git a/common/platform.c b/common/platform.c
+index d11f568..8269392 100644
+--- a/common/platform.c
+++ b/common/platform.c
+@@ -30,20 +30,37 @@
+ #define V2M_SYS(reg)	((void *)SYSREGS_BASE + V2M_SYS_##reg)
+ #endif
+ 
+-static void print_string(const char *str)
+static void print_char(const char c)
+ {
+ 	uint32_t flags;
+	do {
+		flags = raw_readl(PL011(UARTFR));
+	} while (flags & PL011_UARTFR_FIFO_FULL);
+ 
+	raw_writel(c, PL011(UARTDR));
+
+	do {
+		flags = raw_readl(PL011(UARTFR));
+	} while (flags & PL011_UARTFR_BUSY);
+}
+
+void print_string(const char *str)
+{
+ 	while (*str) {
+-		do
+-			flags = raw_readl(PL011(UARTFR));
+-		while (flags & PL011_UARTFR_FIFO_FULL);
+		print_char(*str++);
+	}
+}
+ 
+-		raw_writel(*str++, PL011(UARTDR));
+#define HEX_CHARS_PER_INT (2 * sizeof(int))
+
+void print_hex(unsigned int val)
+{
+ 
+-		do
+-			flags = raw_readl(PL011(UARTFR));
+-		while (flags & PL011_UARTFR_BUSY);
+	const char hex_chars[16] = "0123456789abcdef";
+	int i;
+	for (i = HEX_CHARS_PER_INT - 1; i >= 0; i--) {
+		int v = (val >> (4 * i)) & 0xf;
+		print_char(hex_chars[v]);
+ 	}
+ }
+ 
@@ -0,0 +1,96 @@
+From b447242cd2457bec20d47fe6a8a5758d97a3bde3 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Wed, 19 Jan 2022 16:19:02 +0800
+Subject: [PATCH] common: Add mem usage to /memreserve/
+
+Set /memreserve/ to prevent next boot stages from overrding PSCI
+services with libfdt.
+
+Issue-Id: SCM-3815
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: I2ea80cdf736a910fa2c3deb622e21d50f04be960
+---
+ Makefile.am          |  2 +-
+ common/boot.c        |  1 +
+ common/device_tree.c | 34 ++++++++++++++++++++++++++++++++++
+ include/boot.h       |  1 +
+ 4 files changed, 37 insertions(+), 1 deletion(-)
+ create mode 100644 common/device_tree.c
+
+diff --git a/Makefile.am b/Makefile.am
+index 5e8668a..734de92 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -34,7 +34,7 @@ endif
+ PSCI_CPU_OFF	:= 0x84000002
+ 
+ COMMON_SRC	:= common/
+-COMMON_OBJ	:= boot.o bakery_lock.o platform.o lib.o
+COMMON_OBJ	:= boot.o bakery_lock.o platform.o lib.o device_tree.o
+ 
+ LIBFDT_SRC	:= common/libfdt/
+ LIBFDT_OBJS	:= fdt.o fdt_ro.o fdt_rw.o
+diff --git a/common/boot.c b/common/boot.c
+index c74d34c..ee2bea0 100644
+--- a/common/boot.c
+++ b/common/boot.c
+@@ -63,6 +63,7 @@ void __noreturn first_spin(unsigned int cpu, unsigned long *mbox,
+ {
+ 	if (cpu == 0) {
+ 		init_platform();
+		dt_add_memreserve();
+ 
+ 		*mbox = (unsigned long)&entrypoint;
+ 		sevl();
+diff --git a/common/device_tree.c b/common/device_tree.c
+new file mode 100644
+index 0000000..4d0876c
+--- /dev/null
+++ b/common/device_tree.c
+@@ -0,0 +1,34 @@
+/*
+ * device_tree.c - Basic device tree node handler
+ *
+ * Copyright (C) 2021 ARM Limited. All rights reserved.
+ *
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE.txt file.
+ */
+#include <libfdt.h>
+
+extern unsigned long dtb;
+extern char firmware_start[], firmware_end[];
+
+extern void print_string(const char *str);
+
+static void *blob;
+
+
+void dt_add_memreserve(void)
+{
+	int ret;
+
+	blob = (void*)&dtb;
+	print_string("Add /memreserve/\n\r");
+
+	fdt_open_into(blob, blob, fdt_totalsize(blob) +
+		      sizeof(struct fdt_reserve_entry));
+	ret = fdt_add_mem_rsv(blob, (uint64_t)firmware_start,
+			      (uint64_t)(firmware_end - firmware_start));
+
+	if(ret < 0) {
+		print_string("reserve mem add err\n\r");
+	}
+}
+diff --git a/include/boot.h b/include/boot.h
+index d75e013..c3e2ec1 100644
+--- a/include/boot.h
+++ b/include/boot.h
+@@ -16,4 +16,5 @@ void __noreturn spin(unsigned long *mbox, unsigned long invalid, int is_entry);
+ void __noreturn first_spin(unsigned int cpu, unsigned long *mbox,
+ 			   unsigned long invalid_addr);
+ 
+void dt_add_memreserve(void);
+ #endif
@@ -0,0 +1,102 @@
+From 8271c21bcff260295203214b7b8c87cdb8236453 Mon Sep 17 00:00:00 2001
+From: Jaxson Han <jaxson.han@arm.com>
+Date: Tue, 4 Jan 2022 17:01:55 +0800
+Subject: [PATCH] boot: Add the --enable-keep-el compile option
+
+Add --enable-keep-el compile option to enable boot-wrapper booting next
+stage at EL2.
+The Armv8R AArch64 boots at EL2. If the next stage requires EL2 booting,
+the boot-wrapper should not drop to EL1.
+Currently, this option only works for Armv8R AArch64. Also, to work with
+Linux PSCI, this option will cause secondary cores booting at EL1.
+
+Issue-Id: SCM-3813
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Jaxson Han <jaxson.han@arm.com>
+Change-Id: I3ba9c87cf0b59d163ca433f74c9e3a46e5ca2c63
+---
+ Makefile.am         | 4 ++++
+ arch/aarch64/boot.S | 6 +++++-
+ common/psci.c       | 6 ++++++
+ configure.ac        | 5 +++++
+ 4 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 734de92..054becd 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -33,6 +33,10 @@ PSCI_CPU_ON	:= 0xc4000003
+ endif
+ PSCI_CPU_OFF	:= 0x84000002
+ 
+if KEEP_EL
+DEFINES		+= -DKEEP_EL
+endif
+
+ COMMON_SRC	:= common/
+ COMMON_OBJ	:= boot.o bakery_lock.o platform.o lib.o device_tree.o
+ 
+diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
+index 6dbd5cc..157c097 100644
+--- a/arch/aarch64/boot.S
+++ b/arch/aarch64/boot.S
+@@ -233,7 +233,11 @@ el2_init:
+ 	msr	cnthctl_el2, x0
+ 	isb
+ 
+#ifdef KEEP_EL
+	mov	w0, #SPSR_KERNEL
+#else
+ 	mov	w0, #SPSR_KERNEL_EL1
+#endif
+ 	ldr	x1, =spsr_to_elx
+ 	str	w0, [x1]
+ 	// fall through
+@@ -313,5 +317,5 @@ ASM_FUNC(jump_kernel)
+ 	.align 3
+ flag_keep_el:
+ 	.long 0
+-spsr_to_elx:
+ASM_DATA(spsr_to_elx)
+ 	.long 0
+diff --git a/common/psci.c b/common/psci.c
+index a0e8700..945780b 100644
+--- a/common/psci.c
+++ b/common/psci.c
+@@ -18,6 +18,8 @@
+ #error "No MPIDRs provided"
+ #endif
+ 
+extern unsigned int spsr_to_elx;
+
+ static unsigned long branch_table[NR_CPUS];
+ 
+ bakery_ticket_t branch_table_lock[NR_CPUS];
+@@ -44,6 +46,10 @@ static int psci_cpu_on(unsigned long target_mpidr, unsigned long address)
+ 	ret = psci_store_address(cpu, address);
+ 	bakery_unlock(branch_table_lock, this_cpu);
+ 
+#ifdef KEEP_EL
+	spsr_to_elx = SPSR_KERNEL_EL1;
+#endif
+
+ 	return ret;
+ }
+ 
+diff --git a/configure.ac b/configure.ac
+index 53e51be..0e07db3 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -25,6 +25,11 @@ AS_IF([test "x$BOOTWRAPPER_ES" = x32 -a "x$KERNEL_ES" != x32],
+ 	[AC_MSG_ERROR([a 32-bit boot-wrapper cannot launch a 64-bit kernel])]
+ )
+ 
+AC_ARG_ENABLE([keep-el],
+	AC_HELP_STRING([--enable-keep-el], [keep exception level when start kernel]),
+	[KEEP_EL=yes], [KEEP_EL=no])
+AM_CONDITIONAL([KEEP_EL], [test "x$KEEP_EL" = xyes])
+
+ # Allow a user to pass --with-kernel-dir
+ AC_ARG_WITH([kernel-dir],
+ 	AS_HELP_STRING([--with-kernel-dir], [specify the root Linux kernel build directory (required)]),
@@ -0,0 +1,34 @@
+From dd3e3f414d0e6ed1643c2e2ccac676b7fc1dc7a9 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Tue, 1 Feb 2022 11:28:46 +0000
+Subject: [PATCH] Makefile: Change COUNTER_FREQ to 100 MHz
+
+Older Arm Fast Models (AEM < RevC) had a base frequency of 24 MHz. but
+the RevC base models use 100 MHz. There is not a robust method of
+determining the configured base frequency at runtime, so update
+COUNTER_FREQ to be 100 MHz.
+
+Issue-Id: SCM-3871
+Upstream-Status: Pending
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: Ia9ad0f8ee488d1a887791f1fa1d8f3bf9c5887fd
+---
+ Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index 40bc5d6..b48173c 100644
+--- a/Makefile.am
+++ b/Makefile.am
+@@ -13,7 +13,7 @@ SCRIPT_DIR	:= $(top_srcdir)/scripts
+ PHYS_OFFSET	:= $(shell perl -I $(SCRIPT_DIR) $(SCRIPT_DIR)/findmem.pl $(KERNEL_DTB))
+ UART_BASE	:= $(shell perl -I $(SCRIPT_DIR) $(SCRIPT_DIR)/findbase.pl $(KERNEL_DTB) 0 'arm,pl011')
+ SYSREGS_BASE	:= $(shell perl -I $(SCRIPT_DIR) $(SCRIPT_DIR)/findbase.pl $(KERNEL_DTB) 0 'arm,vexpress-sysreg' 2> /dev/null)
+-COUNTER_FREQ	:= 24000000
+COUNTER_FREQ	:= 100000000
+ 
+ CPU_IDS		:= $(shell perl -I $(SCRIPT_DIR) $(SCRIPT_DIR)/findcpuids.pl $(KERNEL_DTB))
+ NR_CPUS         := $(shell echo $(CPU_IDS) | tr ',' ' ' | wc -w)
+-- 
+2.25.1
+
@@ -7,8 +7,11 @@ TFM_DEBUG = "1"
 ## Default is the MPS3 board
 TFM_PLATFORM_IS_FVP ?= "FALSE"
 EXTRA_OECMAKE += "-DPLATFORM_IS_FVP=${TFM_PLATFORM_IS_FVP}"
+EXTRA_OECMAKE += "-DCC312_LEGACY_DRIVER_API_ENABLED=OFF"

-SRCREV_tfm = "ca8c634a3dc15b42d41655a14e512b642320893a"
+SRCBRANCH_tfm = "master"
+SRCREV_tfm = "f8c7e5361b92b16108165601ea81c5d01feb3c22"
+SRCREV_mbedtls = "d65aeb37349ad1a50e0f6c9b694d4b5290d60e49"
 SRCREV_mcuboot = "29099e1d17f93ae1d09fe945ad191b703aacd3d8"

 PV = "1.5+git${SRCREV_tfm}"
@@ -23,14 +26,9 @@ do_prepare_recipe_sysroot[depends]+= "virtual/trusted-firmware-a:do_populate_sys
 require trusted-firmware-m-sign-host-images.inc

 do_install() {
-  if [ ! -d "${B}/install/outputs/ARM/CORSTONE1000" ]
-  then
-    bbfatal "'${B}/install/outputs/ARM/CORSTONE1000' output folder not found!"
-  fi
-
-  install -D -p -m 0644 ${B}/install/outputs/ARM/CORSTONE1000/tfm_s_signed.bin ${D}/firmware/tfm_s_signed.bin
-  install -D -p -m 0644 ${B}/install/outputs/ARM/CORSTONE1000/bl2_signed.bin ${D}/firmware/bl2_signed.bin
-  install -D -p -m 0644 ${B}/install/outputs/ARM/CORSTONE1000/bl1.bin ${D}/firmware/bl1.bin
+  install -D -p -m 0644 ${B}/install/outputs/tfm_s_signed.bin ${D}/firmware/tfm_s_signed.bin
+  install -D -p -m 0644 ${B}/install/outputs/bl2_signed.bin ${D}/firmware/bl2_signed.bin
+  install -D -p -m 0644 ${B}/install/outputs/bl1.bin ${D}/firmware/bl1.bin

  #
  # Signing TF-A BL2 and the FIP image
@@ -0,0 +1,60 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
+
+From f4d3fcdd4ba747a0fd6875f9626c06ad01b889c7 Mon Sep 17 00:00:00 2001
+From: Vishnu Banavath <vishnu.banavath@arm.com>
+Date: Fri, 14 Jan 2022 15:24:18 +0000
+Subject: [PATCH] efi_loader: fix null pointer exception with get_image_info
+
+get_img_info API implemented for corstone1000 target does not
+check the input attributes and as a result uboot crash's with
+null pointer access. This change is to fix the null pointer
+exception.
+
+Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
+
+diff --git a/lib/efi_loader/efi_firmware.c b/lib/efi_loader/efi_firmware.c
+index a7f7598eab..d5f4788c8f 100644
+--- a/lib/efi_loader/efi_firmware.c
+++ b/lib/efi_loader/efi_firmware.c
+@@ -344,26 +344,29 @@ static efi_status_t efi_corstone1000_img_info_get (
+ 	int i = 0;
+ 
+ 	*image_info_size = sizeof(*image_info);
+-	*descriptor_version = EFI_FIRMWARE_IMAGE_DESCRIPTOR_VERSION;
+-	*descriptor_count = 1;//dfu_num;
+-	*descriptor_size = sizeof(*image_info);
+	if(descriptor_version)
+	    *descriptor_version = EFI_FIRMWARE_IMAGE_DESCRIPTOR_VERSION;
+	if(descriptor_count)
+	    *descriptor_count = 1;
+	if(descriptor_size)
+	    *descriptor_size = sizeof(*image_info);
+ 	if (package_version)
+ 		*package_version = 0xffffffff; /* not supported */
+ 	if(package_version_name)
+ 		*package_version_name = NULL; /* not supported */
+ 
+ 	if(image_info == NULL) {
+-		log_info("image_info is null\n");
+		log_debug("image_info is null\n");
+ 		return EFI_BUFFER_TOO_SMALL;
+ 	}
+ 
+-	image_info[i].image_index = i;
+	image_info[i].image_index = 1;
+ 	image_info[i].image_type_id = *image_type;
+ 	image_info[i].image_id = 0;
+-	image_info[i].image_id_name = "wic";
+-	image_info[i].version = 1;
+	image_info[i].image_id_name = L"wic image";
+	image_info[i].version = 0;
+ 	image_info[i].version_name = NULL;
+-	image_info[i].size = 0x1000;
+	image_info[i].size = 0;
+ 	image_info[i].attributes_supported = IMAGE_ATTRIBUTE_IMAGE_UPDATABLE |
+ 					     IMAGE_ATTRIBUTE_AUTHENTICATION_REQUIRED;
+ 	image_info[i].attributes_setting = IMAGE_ATTRIBUTE_IMAGE_UPDATABLE;
+-- 
+2.17.1
+
@@ -0,0 +1,166 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
+
+From fb675d2367b012161711f74f39c498379435d537 Mon Sep 17 00:00:00 2001
+From: Vishnu Banavath <vishnu.banavath@arm.com>
+Date: Thu, 31 Mar 2022 14:59:12 +0100
+Subject: [PATCH] plat/corstone1000: add support for SDCard
+
+These changes are to add SDCard support for corstone1000 FVP.
+
+Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
+
+diff --git a/arch/arm/dts/corstone1000-fvp.dts b/arch/arm/dts/corstone1000-fvp.dts
+index 92da15df4e..fc2fabd1cd 100644
+--- a/arch/arm/dts/corstone1000-fvp.dts
+++ b/arch/arm/dts/corstone1000-fvp.dts
+@@ -21,6 +21,42 @@
+                smsc,irq-push-pull;
+        };
+ 
+       regulators {
+               compatible = "simple-bus";
+               #address-cells = <1>;
+               #size-cells = <0>;
+
+               corstone1000_fixed_3v3: fixed-regulator-0 {
+                       compatible = "regulator-fixed";
+                       regulator-name = "3V3";
+                       regulator-min-microvolt = <3300000>;
+                       regulator-max-microvolt = <3300000>;
+                       regulator-always-on;
+               };
+       };
+
+       mmc0: mmci@40300000 {
+               compatible = "arm,pl18x", "arm,primecell";
+               reg = <0x40300000 0x1000>;
+               interrupt-parent = <&gic>;
+               interrupts = <GIC_SPI 117 0xf04>;
+               max-frequency = <12000000>;
+               vmmc-supply = <&corstone1000_fixed_3v3>;
+               clocks = <&smbclk>, <&refclk100mhz>;
+               clock-names = "smclk", "apb_pclk";
+       };
+
+       mmc1: mmci@50000000 {
+               compatible = "arm,pl18x", "arm,primecell";
+               reg = <0x50000000 0x10000>;
+               interrupt-parent = <&gic>;
+               interrupts = <GIC_SPI 115 0xf04>;
+               max-frequency = <12000000>;
+               vmmc-supply = <&corstone1000_fixed_3v3>;
+               clocks = <&smbclk>, <&refclk100mhz>;
+               clock-names = "smclk", "apb_pclk";
+       };
+
+ };
+ 
+ &refclk {
+diff --git a/arch/arm/include/asm/gpio.h b/arch/arm/include/asm/gpio.h
+index 7609367884..b1846938c7 100644
+--- a/arch/arm/include/asm/gpio.h
+++ b/arch/arm/include/asm/gpio.h
+@@ -4,7 +4,7 @@
+ 	!defined(CONFIG_ARCH_ROCKCHIP) && !defined(CONFIG_ARCH_ASPEED) && \
+ 	!defined(CONFIG_ARCH_U8500) && !defined(CONFIG_CORTINA_PLATFORM) && \
+ 	!defined(CONFIG_TARGET_BCMNS3) && !defined(CONFIG_TARGET_TOTAL_COMPUTE) && \
+-	!defined(CONFIG_ARCH_QEMU)
+	!defined(CONFIG_ARCH_QEMU) && !defined(CONFIG_TARGET_CORSTONE1000)
+ #include <asm/arch/gpio.h>
+ #endif
+ #include <asm-generic/gpio.h>
+diff --git a/board/armltd/corstone1000/corstone1000.c b/board/armltd/corstone1000/corstone1000.c
+index 113a8238c7..32e5d3034f 100644
+--- a/board/armltd/corstone1000/corstone1000.c
+++ b/board/armltd/corstone1000/corstone1000.c
+@@ -46,14 +46,30 @@ static struct mm_region corstone1000_mem_map[] = {
+ 		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+ 			 PTE_BLOCK_NON_SHARE |
+ 			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
+-        }, {
+-                /* USB */
+-                .virt = 0x40200000UL,
+-                .phys = 0x40200000UL,
+-                .size = 0x00100000UL,
+-                .attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+-                         PTE_BLOCK_NON_SHARE |
+-                         PTE_BLOCK_PXN | PTE_BLOCK_UXN
+	}, {
+		/* USB */
+		.virt = 0x40200000UL,
+		.phys = 0x40200000UL,
+		.size = 0x00100000UL,
+		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+				 PTE_BLOCK_NON_SHARE |
+				 PTE_BLOCK_PXN | PTE_BLOCK_UXN
+	}, {
+		/* MMC0 */
+		.virt = 0x40300000UL,
+		.phys = 0x40300000UL,
+		.size = 0x00100000UL,
+		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+				 PTE_BLOCK_NON_SHARE |
+				 PTE_BLOCK_PXN | PTE_BLOCK_UXN
+	}, {
+		/* MMC1 */
+		.virt = 0x50000000UL,
+		.phys = 0x50000000UL,
+		.size = 0x00100000UL,
+		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+				 PTE_BLOCK_NON_SHARE |
+				 PTE_BLOCK_PXN | PTE_BLOCK_UXN
+ 	}, {
+                  /* ethernet */
+                 .virt = 0x40100000UL,
+diff --git a/configs/corstone1000_defconfig b/configs/corstone1000_defconfig
+index 45904ec98d..e72cd30aee 100644
+--- a/configs/corstone1000_defconfig
+++ b/configs/corstone1000_defconfig
+@@ -38,7 +38,13 @@ CONFIG_CMD_EFIDEBUG=y
+ CONFIG_CMD_FAT=y
+ CONFIG_OF_CONTROL=y
+ CONFIG_REGMAP=y
+-# CONFIG_MMC is not set
+CONFIG_CLK=y
+CONFIG_CMD_MMC=y
+CONFIG_DM_MMC=y
+CONFIG_ARM_PL180_MMCI=y
+CONFIG_MMC_SDHCI_ADMA_HELPERS=y
+CONFIG_MMC_WRITE=y
+CONFIG_DM_GPIO=y
+ CONFIG_DM_ETH=y
+ CONFIG_DM_SERIAL=y
+ CONFIG_USB=y
+diff --git a/drivers/mmc/arm_pl180_mmci.c b/drivers/mmc/arm_pl180_mmci.c
+index b2d1b4f9aa..5d1ee64356 100644
+--- a/drivers/mmc/arm_pl180_mmci.c
+++ b/drivers/mmc/arm_pl180_mmci.c
+@@ -539,7 +539,7 @@ static int arm_pl180_mmc_of_to_plat(struct udevice *dev)
+ 
+ static const struct udevice_id arm_pl180_mmc_match[] = {
+ 	{ .compatible = "arm,pl180" },
+-	{ .compatible = "arm,primecell" },
+	{ .compatible = "arm,pl18x" },
+ 	{ /* sentinel */ }
+ };
+ 
+diff --git a/include/configs/corstone1000.h b/include/configs/corstone1000.h
+index c4a1146b52..114aca2059 100644
+--- a/include/configs/corstone1000.h
+++ b/include/configs/corstone1000.h
+@@ -99,7 +99,10 @@
+ #define CONFIG_SYS_MAXARGS		64	/* max command args */
+ 
+ #define BOOT_TARGET_DEVICES(func) \
+-    func(USB, usb, 0)
+	func(USB, usb, 0) \
+	func(MMC, mmc, 0) \
+	func(MMC, mmc, 1)
+
+ #include <config_distro_bootcmd.h>
+ #define CONFIG_EXTRA_ENV_SETTINGS				\
+ 				BOOTENV                         \
+-- 
+2.25.1
+
@@ -0,0 +1,126 @@
+From 0b1b542cbc1d159e57eef0656133bb233451d23d Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Thu, 19 Aug 2021 16:53:09 +0100
+Subject: [PATCH 01/12] armv8: Disable pointer authentication traps for EL1
+
+The use of ARMv8.3 pointer authentication (PAuth) is governed by fields
+in HCR_EL2, which trigger a 'trap to EL2' if not enabled. The reset
+value of these fields is 'architecturally unknown' so we must ensure
+that the fields are enabled (to disable the traps) if we are entering
+the kernel at EL1.
+
+The APK field disables PAuth instruction traps and the API field
+disables PAuth register traps
+
+Add code to disable the traps in armv8_switch_to_el1_m. Prior to doing
+so, it checks fields in the ID_AA64ISAR1_EL1 register to ensure pointer
+authentication is supported by the hardware.
+
+The runtime checks require a second temporary register, so add this to
+the EL1 transition macro signature and update 2 call sites.
+
+Issue-Id: SCM-2443
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/53b40e8d54fcdb834e10e6538084517524b8401b]
+Change-Id: I12159c327a2cca006b973a08fe414f73314e7eb1
+---
+ arch/arm/cpu/armv8/fsl-layerscape/spintable.S |  2 +-
+ arch/arm/cpu/armv8/transition.S               |  2 +-
+ arch/arm/include/asm/macro.h                  | 11 ++++++++--
+ arch/arm/include/asm/system.h                 | 21 +++++++++++++++++++
+ 4 files changed, 32 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
+index 363ded03e6..d6bd188459 100644
+--- a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
+++ b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
+@@ -93,7 +93,7 @@ __secondary_boot_func:
+ 4:
+ #ifdef CONFIG_ARMV8_SWITCH_TO_EL1
+ 	switch_el x7, _dead_loop, 0f, _dead_loop
+-0:	armv8_switch_to_el1_m x4, x6, x7
+0:	armv8_switch_to_el1_m x4, x6, x7, x9
+ #else
+ 	switch_el x7, 0f, _dead_loop, _dead_loop
+ 0:	armv8_switch_to_el2_m x4, x6, x7
+diff --git a/arch/arm/cpu/armv8/transition.S b/arch/arm/cpu/armv8/transition.S
+index a31af4ffc8..9dbdff3a4f 100644
+--- a/arch/arm/cpu/armv8/transition.S
+++ b/arch/arm/cpu/armv8/transition.S
+@@ -40,7 +40,7 @@ ENTRY(armv8_switch_to_el1)
+ 	 * now, jump to the address saved in x4.
+ 	 */
+ 	br x4
+-1:	armv8_switch_to_el1_m x4, x5, x6
+1:	armv8_switch_to_el1_m x4, x5, x6, x7
+ ENDPROC(armv8_switch_to_el1)
+ .popsection
+ 
+diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h
+index bb33b4bc89..5ee72d0e78 100644
+--- a/arch/arm/include/asm/macro.h
+++ b/arch/arm/include/asm/macro.h
+@@ -238,7 +238,7 @@ lr	.req	x30
+  * For loading 64-bit OS, x0 is physical address to the FDT blob.
+  * They will be passed to the guest.
+  */
+-.macro armv8_switch_to_el1_m, ep, flag, tmp
+.macro armv8_switch_to_el1_m, ep, flag, tmp, tmp2
+ 	/* Initialize Generic Timers */
+ 	mrs	\tmp, cnthctl_el2
+ 	/* Enable EL1 access to timers */
+@@ -288,7 +288,14 @@ lr	.req	x30
+ 	b.eq	1f
+ 
+ 	/* Initialize HCR_EL2 */
+-	ldr	\tmp, =(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
+	/* Only disable PAuth traps if PAuth is supported */
+	mrs	\tmp, id_aa64isar1_el1
+	ldr	\tmp2, =(ID_AA64ISAR1_EL1_GPI | ID_AA64ISAR1_EL1_GPA | \
+		      ID_AA64ISAR1_EL1_API | ID_AA64ISAR1_EL1_APA)
+	tst	\tmp, \tmp2
+	mov	\tmp2, #(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
+	orr	\tmp, \tmp2, #(HCR_EL2_APK | HCR_EL2_API)
+	csel	\tmp, \tmp2, \tmp, eq
+ 	msr	hcr_el2, \tmp
+ 
+ 	/* Return to the EL1_SP1 mode from EL2 */
+diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
+index 11fceec4d2..77aa18909e 100644
+--- a/arch/arm/include/asm/system.h
+++ b/arch/arm/include/asm/system.h
+@@ -75,10 +75,31 @@
+ /*
+  * HCR_EL2 bits definitions
+  */
+#define HCR_EL2_API		(1 << 41) /* Trap pointer authentication
+				             instructions                     */
+#define HCR_EL2_APK		(1 << 40) /* Trap pointer authentication
+				             key access                       */
+ #define HCR_EL2_RW_AARCH64	(1 << 31) /* EL1 is AArch64                   */
+ #define HCR_EL2_RW_AARCH32	(0 << 31) /* Lower levels are AArch32         */
+ #define HCR_EL2_HCD_DIS		(1 << 29) /* Hypervisor Call disabled         */
+ 
+/*
+ * ID_AA64ISAR1_EL1 bits definitions
+ */
+#define ID_AA64ISAR1_EL1_GPI	(0xF << 28) /* Implementation-defined generic
+				               code auth algorithm            */
+#define ID_AA64ISAR1_EL1_GPA	(0xF << 24) /* QARMA generic code auth
+				               algorithm                      */
+#define ID_AA64ISAR1_EL1_API	(0xF << 8)  /* Implementation-defined address
+				               auth algorithm                 */
+#define ID_AA64ISAR1_EL1_APA	(0xF << 4)  /* QARMA address auth algorithm   */
+
+/*
+ * ID_AA64PFR0_EL1 bits definitions
+ */
+#define ID_AA64PFR0_EL1_EL3	(0xF << 12) /* EL3 implemented                */
+#define ID_AA64PFR0_EL1_EL2	(0xF << 8)  /* EL2 implemented                */
+
+ /*
+  * CPACR_EL1 bits definitions
+  */
+-- 
+2.25.1
+
@@ -0,0 +1,109 @@
+From b76b9a4388f921359046c3d59748b06a2ffa99ce Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Tue, 19 Oct 2021 15:47:21 +0100
+Subject: [PATCH 02/12] doc: Add documentation for the Arm VExpress64 board
+ configs
+
+Create a new documentation section for Arm Ltd boards with a sub-page
+for the VExpress64 boards (FVP-A and Juno).
+
+Issue-Id: SCM-3533
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/6c2f16b3c95a0bb7f5d6f65512dceb0dc75ac00a]
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I9e6244e9c4949c0a60acb32216fb71e933af40ed
+---
+ doc/board/armltd/index.rst      |  9 ++++++
+ doc/board/armltd/vexpress64.rst | 51 +++++++++++++++++++++++++++++++++
+ doc/board/index.rst             |  1 +
+ 3 files changed, 61 insertions(+)
+ create mode 100644 doc/board/armltd/index.rst
+ create mode 100644 doc/board/armltd/vexpress64.rst
+
+diff --git a/doc/board/armltd/index.rst b/doc/board/armltd/index.rst
+new file mode 100644
+index 0000000000..b6786c114f
+--- /dev/null
+++ b/doc/board/armltd/index.rst
+@@ -0,0 +1,9 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Arm Ltd
+=============
+
+.. toctree::
+   :maxdepth: 2
+
+   vexpress64.rst
+diff --git a/doc/board/armltd/vexpress64.rst b/doc/board/armltd/vexpress64.rst
+new file mode 100644
+index 0000000000..b98b096544
+--- /dev/null
+++ b/doc/board/armltd/vexpress64.rst
+@@ -0,0 +1,51 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Arm Versatile Express
+=====================
+
+The vexpress_* board configuration supports the following platforms:
+
+ * FVP_Base_RevC-2xAEMvA
+ * Juno development board
+
+Fixed Virtual Platforms
+-----------------------
+
+The Fixed Virtual Platforms (FVP) are complete simulations of an Arm system,
+including processor, memory and peripherals. They are set out in a "programmer's
+view", which gives a comprehensive model on which to build and test software.
+
+The supported FVPs are available free of charge and can be downloaded from the
+Arm developer site [1]_ (user registration might be required).
+
+Supported features:
+
+ * GICv3
+ * Generic timer
+ * PL011 UART
+
+The default configuration assumes that U-Boot is bootstrapped using a suitable
+bootloader, such as Trusted Firmware-A [4]_. The u-boot binary can be passed
+into the TF-A build: ``make PLAT=<platform> all fip BL33=u-boot.bin``
+
+The FVPs can be debugged using Arm Development Studio [2]_.
+
+Juno
+----
+
+Juno is an Arm development board with the following features:
+
+ * Arm Cortex-A72/A57 and Arm Cortex-A53 in a "big.LITTLE" configuration
+ * A PCIe Gen2.0 bus with 4 lanes
+ * 8GB of DRAM
+ * GICv2
+
+More details can be found in the board documentation [3]_.
+
+References
+----------
+
+.. [1] https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
+.. [2] https://developer.arm.com/tools-and-software/embedded/arm-development-studio
+.. [3] https://developer.arm.com/tools-and-software/development-boards/juno-development-board
+.. [4] https://trustedfirmware-a.readthedocs.io/
+\ No newline at end of file
+diff --git a/doc/board/index.rst b/doc/board/index.rst
+index 747511f7dd..5c08de16b0 100644
+--- a/doc/board/index.rst
+++ b/doc/board/index.rst
+@@ -10,6 +10,7 @@ Board-specific doc
+    advantech/index
+    AndesTech/index
+    amlogic/index
+   armltd/index
+    atmel/index
+    congatec/index
+    coreboot/index
+-- 
+2.25.1
+
@@ -0,0 +1,173 @@
+From 14bd61e78264812edea18c442db99bb83c5f93c0 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Tue, 19 Oct 2021 15:39:52 +0100
+Subject: [PATCH 03/12] vexpress64: Refactor header file to make it easier to
+ add new FVPs
+
+Rename from vexpress_aemv8a.h -> vepxress_aemv8.h as new FVPs may not be
+v8-A. No change in behavior.
+
+This is towards future work to enable support for the FVP_BaseR.
+
+Issue-Id: SCM-3537
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/17fe55fd6fe9d32270380f574b33ff0bc15bb47e]
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: Ie992e69d1b51c6f8939b1bea22e35658e96df6c6
+---
+ board/armltd/vexpress64/Kconfig               |  2 +-
+ doc/README.semihosting                        |  2 +-
+ .../{vexpress_aemv8a.h => vexpress_aemv8.h}   | 48 ++++++++++---------
+ 3 files changed, 27 insertions(+), 25 deletions(-)
+ rename include/configs/{vexpress_aemv8a.h => vexpress_aemv8.h} (88%)
+
+diff --git a/board/armltd/vexpress64/Kconfig b/board/armltd/vexpress64/Kconfig
+index 1d13f542e6..4aab3f092e 100644
+--- a/board/armltd/vexpress64/Kconfig
+++ b/board/armltd/vexpress64/Kconfig
+@@ -7,7 +7,7 @@ config SYS_VENDOR
+ 	default "armltd"
+ 
+ config SYS_CONFIG_NAME
+-	default "vexpress_aemv8a"
+	default "vexpress_aemv8"
+ 
+ config JUNO_DTB_PART
+ 	string "NOR flash partition holding DTB"
+diff --git a/doc/README.semihosting b/doc/README.semihosting
+index c019999bed..f382d0131e 100644
+--- a/doc/README.semihosting
+++ b/doc/README.semihosting
+@@ -25,7 +25,7 @@ or turning on CONFIG_BASE_FVP for the more full featured model.
+ Rather than create a new armv8 board similar to armltd/vexpress64, add
+ semihosting calls to the existing one, enabled with CONFIG_SEMIHOSTING
+ and CONFIG_BASE_FVP both set. Also reuse the existing board config file
+-vexpress_aemv8a.h but differentiate the two models by the presence or
+vexpress_aemv8.h but differentiate the two models by the presence or
+ absence of CONFIG_BASE_FVP. This change is tested and works on both the
+ Foundation and Base fastmodel simulators.
+ 
+diff --git a/include/configs/vexpress_aemv8a.h b/include/configs/vexpress_aemv8.h
+similarity index 88%
+rename from include/configs/vexpress_aemv8a.h
+rename to include/configs/vexpress_aemv8.h
+index 7318fb6c58..38141fe023 100644
+--- a/include/configs/vexpress_aemv8a.h
+++ b/include/configs/vexpress_aemv8.h
+@@ -4,36 +4,37 @@
+  *   configurations.
+  */
+ 
+-#ifndef __VEXPRESS_AEMV8A_H
+-#define __VEXPRESS_AEMV8A_H
+#ifndef __VEXPRESS_AEMV8_H
+#define __VEXPRESS_AEMV8_H
+ 
+ #define CONFIG_REMAKE_ELF
+ 
+ /* Link Definitions */
+-#ifdef CONFIG_TARGET_VEXPRESS64_BASE_FVP
+#ifdef CONFIG_TARGET_VEXPRESS64_JUNO
+#define CONFIG_SYS_INIT_SP_ADDR         (CONFIG_SYS_SDRAM_BASE + 0x7fff0)
+#else
+ /* ATF loads u-boot here for BASE_FVP model */
+ #define CONFIG_SYS_INIT_SP_ADDR         (CONFIG_SYS_SDRAM_BASE + 0x03f00000)
+-#elif CONFIG_TARGET_VEXPRESS64_JUNO
+-#define CONFIG_SYS_INIT_SP_ADDR         (CONFIG_SYS_SDRAM_BASE + 0x7fff0)
+ #endif
+ 
+ #define CONFIG_SYS_BOOTM_LEN (64 << 20)      /* Increase max gunzip size */
+ 
+ /* CS register bases for the original memory map. */
+-#define V2M_PA_CS0			0x00000000
+-#define V2M_PA_CS1			0x14000000
+-#define V2M_PA_CS2			0x18000000
+-#define V2M_PA_CS3			0x1c000000
+-#define V2M_PA_CS4			0x0c000000
+-#define V2M_PA_CS5			0x10000000
+#define V2M_BASE			0x80000000
+#define V2M_PA_BASE			0x00000000
+
+#define V2M_PA_CS0			(V2M_PA_BASE + 0x00000000)
+#define V2M_PA_CS1			(V2M_PA_BASE + 0x14000000)
+#define V2M_PA_CS2			(V2M_PA_BASE + 0x18000000)
+#define V2M_PA_CS3			(V2M_PA_BASE + 0x1c000000)
+#define V2M_PA_CS4			(V2M_PA_BASE + 0x0c000000)
+#define V2M_PA_CS5			(V2M_PA_BASE + 0x10000000)
+ 
+ #define V2M_PERIPH_OFFSET(x)		(x << 16)
+ #define V2M_SYSREGS			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(1))
+ #define V2M_SYSCTL			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(2))
+ #define V2M_SERIAL_BUS_PCI		(V2M_PA_CS3 + V2M_PERIPH_OFFSET(3))
+ 
+-#define V2M_BASE			0x80000000
+-
+ /* Common peripherals relative to CS7. */
+ #define V2M_AACI			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(4))
+ #define V2M_MMCI			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(5))
+@@ -72,16 +73,16 @@
+ 
+ /* Generic Interrupt Controller Definitions */
+ #ifdef CONFIG_GICV3
+-#define GICD_BASE			(0x2f000000)
+-#define GICR_BASE			(0x2f100000)
+#define GICD_BASE			(V2M_PA_BASE + 0x2f000000)
+#define GICR_BASE			(V2M_PA_BASE + 0x2f100000)
+ #else
+ 
+-#ifdef CONFIG_TARGET_VEXPRESS64_BASE_FVP
+-#define GICD_BASE			(0x2f000000)
+-#define GICC_BASE			(0x2c000000)
+-#elif CONFIG_TARGET_VEXPRESS64_JUNO
+#ifdef CONFIG_TARGET_VEXPRESS64_JUNO
+ #define GICD_BASE			(0x2C010000)
+ #define GICC_BASE			(0x2C02f000)
+#else
+#define GICD_BASE			(V2M_PA_BASE + 0x2f000000)
+#define GICC_BASE			(V2M_PA_BASE + 0x2c000000)
+ #endif
+ #endif /* !CONFIG_GICV3 */
+ 
+@@ -91,7 +92,7 @@
+ #ifndef CONFIG_TARGET_VEXPRESS64_JUNO
+ /* The Vexpress64 simulators use SMSC91C111 */
+ #define CONFIG_SMC91111			1
+-#define CONFIG_SMC91111_BASE		(0x01A000000)
+#define CONFIG_SMC91111_BASE		(V2M_PA_BASE + 0x01A000000)
+ #endif
+ 
+ /* PL011 Serial Configuration */
+@@ -117,7 +118,7 @@
+ #ifdef CONFIG_TARGET_VEXPRESS64_JUNO
+ #define PHYS_SDRAM_2			(0x880000000)
+ #define PHYS_SDRAM_2_SIZE		0x180000000
+-#elif CONFIG_TARGET_VEXPRESS64_BASE_FVP && CONFIG_NR_DRAM_BANKS == 2
+#elif CONFIG_NR_DRAM_BANKS == 2
+ #define PHYS_SDRAM_2			(0x880000000)
+ #define PHYS_SDRAM_2_SIZE		0x80000000
+ #endif
+@@ -194,6 +195,7 @@
+ 				"  booti $kernel_addr - $fdt_addr; " \
+ 				"fi"
+ #endif
+
+ #endif
+ 
+ /* Monitor Command Prompt */
+@@ -207,7 +209,7 @@
+ /* Store environment at top of flash in the same location as blank.img */
+ /* in the Juno firmware. */
+ #else
+-#define CONFIG_SYS_FLASH_BASE		0x0C000000
+#define CONFIG_SYS_FLASH_BASE		(V2M_PA_BASE + 0x0C000000)
+ /* 256 x 256KiB sectors */
+ #define CONFIG_SYS_MAX_FLASH_SECT	256
+ /* Store environment at top of flash */
+@@ -224,4 +226,4 @@
+ #define CONFIG_SYS_FLASH_EMPTY_INFO	/* flinfo indicates empty blocks */
+ #define FLASH_MAX_SECTOR_SIZE		0x00040000
+ 
+-#endif /* __VEXPRESS_AEMV8A_H */
+#endif /* __VEXPRESS_AEMV8_H */
+-- 
+2.25.1
+
@@ -0,0 +1,99 @@
+From 3615110f3f478a6b3551fa9f9dc54317e6718e7d Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Tue, 19 Oct 2021 16:34:25 +0100
+Subject: [PATCH 04/12] vexpress64: Clean up BASE_FVP boot configuration
+
+Move env var address values to #defines so they can be reused elsewhere.
+
+Rename env var names to those recommended in the README.
+
+Fix issue where fdt is called with invalid arguments when booting
+without a ramdisk.
+
+Issue-Id: SCM-3537
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/90f262a6951f530ec60bf78a681b117f625cbe3f]
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I2cd9a1245860302857b6ad6d738b8f7fc4d4d038
+---
+ include/configs/vexpress_aemv8.h | 50 ++++++++++++++++++++------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/include/configs/vexpress_aemv8.h b/include/configs/vexpress_aemv8.h
+index 38141fe023..9223eb2207 100644
+--- a/include/configs/vexpress_aemv8.h
+++ b/include/configs/vexpress_aemv8.h
+@@ -7,6 +7,8 @@
+ #ifndef __VEXPRESS_AEMV8_H
+ #define __VEXPRESS_AEMV8_H
+ 
+#include <linux/stringify.h>
+
+ #define CONFIG_REMAKE_ELF
+ 
+ /* Link Definitions */
+@@ -166,33 +168,43 @@
+ 
+ 
+ #elif CONFIG_TARGET_VEXPRESS64_BASE_FVP
+
+#define VEXPRESS_KERNEL_ADDR	0x80080000
+#define VEXPRESS_FDT_ADDR		0x8fc00000
+#define VEXPRESS_BOOT_ADDR		0x8fd00000
+#define VEXPRESS_RAMDISK_ADDR	0x8fe00000
+
+ #define CONFIG_EXTRA_ENV_SETTINGS	\
+ 				"kernel_name=Image\0"		\
+-				"kernel_addr=0x80080000\0"	\
+-				"initrd_name=ramdisk.img\0"	\
+-				"initrd_addr=0x88000000\0"	\
+-				"fdtfile=devtree.dtb\0"		\
+-				"fdt_addr=0x83000000\0"		\
+-				"boot_name=boot.img\0"		\
+-				"boot_addr=0x8007f800\0"
+				"kernel_addr_r=" __stringify(VEXPRESS_KERNEL_ADDR) "\0"	\
+				"ramdisk_name=ramdisk.img\0"	\
+				"ramdisk_addr_r=" __stringify(VEXPRESS_RAMDISK_ADDR) "\0" \
+				"fdtfile=devtree.dtb\0"	\
+				"fdt_addr_r=" __stringify(VEXPRESS_FDT_ADDR) "\0"	\
+				"boot_name=boot.img\0" \
+				"boot_addr_r=" __stringify(VEXPRESS_BOOT_ADDR) "\0"
+ 
+ #ifndef CONFIG_BOOTCOMMAND
+-#define CONFIG_BOOTCOMMAND	"if smhload ${boot_name} ${boot_addr}; then " \
+#define CONFIG_BOOTCOMMAND	"if smhload ${boot_name} ${boot_addr_r}; then " \
+ 				"  set bootargs; " \
+-				"  abootimg addr ${boot_addr}; " \
+-				"  abootimg get dtb --index=0 fdt_addr; " \
+-				"  bootm ${boot_addr} ${boot_addr} " \
+-				"  ${fdt_addr}; " \
+				"  abootimg addr ${boot_addr_r}; " \
+				"  abootimg get dtb --index=0 fdt_addr_r; " \
+				"  bootm ${boot_addr_r} ${boot_addr_r} " \
+				"  ${fdt_addr_r}; " \
+ 				"else; " \
+ 				"  set fdt_high 0xffffffffffffffff; " \
+ 				"  set initrd_high 0xffffffffffffffff; " \
+-				"  smhload ${kernel_name} ${kernel_addr}; " \
+-				"  smhload ${fdtfile} ${fdt_addr}; " \
+-				"  smhload ${initrd_name} ${initrd_addr} "\
+-				"  initrd_end; " \
+-				"  fdt addr ${fdt_addr}; fdt resize; " \
+-				"  fdt chosen ${initrd_addr} ${initrd_end}; " \
+-				"  booti $kernel_addr - $fdt_addr; " \
+				"  smhload ${kernel_name} ${kernel_addr_r}; " \
+				"  smhload ${fdtfile} ${fdt_addr_r}; " \
+				"  smhload ${ramdisk_name} ${ramdisk_addr_r} "\
+				"  ramdisk_end; " \
+				"  fdt addr ${fdt_addr_r}; fdt resize; " \
+				"  if test -n ${ramdisk_end}; then "\
+				"    fdt chosen ${ramdisk_addr_r} ${ramdisk_end}; " \
+				"  else; " \
+				"    fdt chosen; " \
+				"  fi; " \
+				"  booti $kernel_addr_r - $fdt_addr_r; " \
+ 				"fi"
+ #endif
+ 
+-- 
+2.25.1
+
@@ -0,0 +1,106 @@
+From 72fe643b81755a4935c789b2f4f0132ed7eaf8e1 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Mon, 4 Oct 2021 14:03:35 +0100
+Subject: [PATCH 05/12] vexpress64: Enable OF_CONTROL and OF_BOARD for
+ VExpress64
+
+Capture x0 in lowlevel_init.S as potential fdt address. Modify
+board_fdt_blob_setup to use fdt address from either vexpress_aemv8.h
+or lowlevel_init.S.
+
+Issue-Id: SCM-3534
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/2661397464e47d45cd25bbc5e6b9de7594b3268d]
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: If60e2fbcbda23613f591752ddfabe66fb44623c5
+---
+ board/armltd/vexpress64/Makefile        |  5 +++++
+ board/armltd/vexpress64/lowlevel_init.S | 12 ++++++++++++
+ board/armltd/vexpress64/vexpress64.c    | 24 ++++++++++++++++++++++++
+ 3 files changed, 41 insertions(+)
+ create mode 100644 board/armltd/vexpress64/lowlevel_init.S
+
+diff --git a/board/armltd/vexpress64/Makefile b/board/armltd/vexpress64/Makefile
+index 868dc4f629..5703e75967 100644
+--- a/board/armltd/vexpress64/Makefile
+++ b/board/armltd/vexpress64/Makefile
+@@ -5,3 +5,8 @@
+ 
+ obj-y	:= vexpress64.o
+ obj-$(CONFIG_TARGET_VEXPRESS64_JUNO)	+= pcie.o
+ifdef CONFIG_OF_BOARD
+ifndef CONFIG_TARGET_VEXPRESS64_JUNO
+obj-y += lowlevel_init.o
+endif
+endif
+diff --git a/board/armltd/vexpress64/lowlevel_init.S b/board/armltd/vexpress64/lowlevel_init.S
+new file mode 100644
+index 0000000000..3dcfb85d0e
+--- /dev/null
+++ b/board/armltd/vexpress64/lowlevel_init.S
+@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * (C) Copyright 2021 Arm Limited
+ */
+
+.global save_boot_params
+save_boot_params:
+
+	adr	x8, prior_stage_fdt_address
+	str	x0, [x8]
+
+	b	save_boot_params_ret
+diff --git a/board/armltd/vexpress64/vexpress64.c b/board/armltd/vexpress64/vexpress64.c
+index 2e4260286b..b8408e35e5 100644
+--- a/board/armltd/vexpress64/vexpress64.c
+++ b/board/armltd/vexpress64/vexpress64.c
+@@ -85,7 +85,15 @@ int dram_init_banksize(void)
+ 	return 0;
+ }
+ 
+/* Assigned in lowlevel_init.S
+ * Push the variable into the .data section so that it
+ * does not get cleared later.
+ */
+unsigned long __section(".data") prior_stage_fdt_address;
+
+ #ifdef CONFIG_OF_BOARD
+
+#ifdef CONFIG_TARGET_VEXPRESS64_JUNO
+ #define JUNO_FLASH_SEC_SIZE	(256 * 1024)
+ static phys_addr_t find_dtb_in_nor_flash(const char *partname)
+ {
+@@ -131,14 +139,30 @@ static phys_addr_t find_dtb_in_nor_flash(const char *partname)
+ 	return ~0;
+ }
+ 
+#endif
+
+ void *board_fdt_blob_setup(void)
+ {
+#ifdef CONFIG_TARGET_VEXPRESS64_JUNO
+ 	phys_addr_t fdt_rom_addr = find_dtb_in_nor_flash(CONFIG_JUNO_DTB_PART);
+ 
+ 	if (fdt_rom_addr == ~0UL)
+ 		return NULL;
+ 
+ 	return (void *)fdt_rom_addr;
+#endif
+
+#ifdef VEXPRESS_FDT_ADDR
+	if (fdt_magic(VEXPRESS_FDT_ADDR) == FDT_MAGIC) {
+		return (void *)VEXPRESS_FDT_ADDR;
+	}
+#endif
+
+	if (fdt_magic(prior_stage_fdt_address) == FDT_MAGIC) {
+		return (void *)prior_stage_fdt_address;
+	}
+
+	return NULL;
+ }
+ #endif
+ 
+-- 
+2.25.1
+
@@ -0,0 +1,62 @@
+From 814420f327e1933594b88c1f4d53ef6ac16d9faa Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Mon, 11 Oct 2021 11:57:26 +0100
+Subject: [PATCH 06/12] vexpress64: Enable VIRTIO_NET network driver
+
+The SMSC driver is using the old driver model.
+
+Init the virtio system in vexpress64.c so that the network device is
+discovered.
+
+Issue-Id: SCM-3534
+Upstream-Status: Backport [https://source.denx.de/u-boot/u-boot/-/commit/439581dca4c786dbbdd2d6be024e0b907a3b0c80]
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I1b7d9eb142bf02dd88e99bcd7e44789a154885dd
+---
+ board/armltd/vexpress64/vexpress64.c | 7 +++++++
+ include/configs/vexpress_aemv8.h     | 4 ++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/board/armltd/vexpress64/vexpress64.c b/board/armltd/vexpress64/vexpress64.c
+index b8408e35e5..821f9cfc3b 100644
+--- a/board/armltd/vexpress64/vexpress64.c
+++ b/board/armltd/vexpress64/vexpress64.c
+@@ -18,6 +18,10 @@
+ #include <dm/platform_data/serial_pl01x.h>
+ #include "pcie.h"
+ #include <asm/armv8/mmu.h>
+#ifdef CONFIG_VIRTIO_NET
+#include <virtio_types.h>
+#include <virtio.h>
+#endif
+ 
+ DECLARE_GLOBAL_DATA_PTR;
+ 
+@@ -64,6 +68,9 @@ __weak void vexpress64_pcie_init(void)
+ int board_init(void)
+ {
+ 	vexpress64_pcie_init();
+#ifdef CONFIG_VIRTIO_NET
+	virtio_init();
+#endif
+ 	return 0;
+ }
+ 
+diff --git a/include/configs/vexpress_aemv8.h b/include/configs/vexpress_aemv8.h
+index 9223eb2207..68422237dd 100644
+--- a/include/configs/vexpress_aemv8.h
+++ b/include/configs/vexpress_aemv8.h
+@@ -91,8 +91,8 @@
+ /* Size of malloc() pool */
+ #define CONFIG_SYS_MALLOC_LEN		(CONFIG_ENV_SIZE + (8 << 20))
+ 
+-#ifndef CONFIG_TARGET_VEXPRESS64_JUNO
+-/* The Vexpress64 simulators use SMSC91C111 */
+#if defined(CONFIG_TARGET_VEXPRESS64_BASE_FVP) && !defined(CONFIG_DM_ETH)
+/* The Vexpress64 BASE_FVP simulator uses SMSC91C111 */
+ #define CONFIG_SMC91111			1
+ #define CONFIG_SMC91111_BASE		(V2M_PA_BASE + 0x01A000000)
+ #endif
+-- 
+2.25.1
+
@@ -0,0 +1,259 @@
+From f8dfb0973b9972a3e65f2efa48fac0b3bb009b29 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Wed, 26 May 2021 17:41:10 +0100
+Subject: [PATCH 07/12] armv8: Add ARMv8 MPU configuration logic
+
+Detect whether an MMU is present at the current exception level. If
+not, initialize the MPU instead of the MMU during init, and clear the
+MPU regions before transition to Linux.
+
+The MSA in use at EL1&0 may be configurable but can only by determined
+by inspecting VTCR_EL2 at EL2, so assume that there is an MMU for
+backwards compatibility.
+
+Provide a default (blank) MPU memory map, which can be overridden by
+board configurations.
+
+Issue-Id: SCM-2443
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I0ee3879f9d7f03fe940664b3551c68eeaa458d17
+---
+ arch/arm/cpu/armv8/cache_v8.c    | 101 ++++++++++++++++++++++++++++++-
+ arch/arm/include/asm/armv8/mpu.h |  59 ++++++++++++++++++
+ arch/arm/include/asm/system.h    |  19 ++++++
+ 3 files changed, 176 insertions(+), 3 deletions(-)
+ create mode 100644 arch/arm/include/asm/armv8/mpu.h
+
+diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c
+index 15cecb5e0b..2a49966e8f 100644
+--- a/arch/arm/cpu/armv8/cache_v8.c
+++ b/arch/arm/cpu/armv8/cache_v8.c
+@@ -15,6 +15,7 @@
+ #include <asm/global_data.h>
+ #include <asm/system.h>
+ #include <asm/armv8/mmu.h>
+#include <asm/armv8/mpu.h>
+ 
+ DECLARE_GLOBAL_DATA_PTR;
+ 
+@@ -365,6 +366,91 @@ __weak u64 get_page_table_size(void)
+ 	return size;
+ }
+ 
+static void mpu_clear_regions(void)
+{
+	int i;
+
+	for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) {
+		setup_el2_mpu_region(i, 0, 0);
+	}
+}
+
+static struct mpu_region default_mpu_mem_map[] = {{0,}};
+__weak struct mpu_region *mpu_mem_map = default_mpu_mem_map;
+
+static void mpu_setup(void)
+{
+	int i;
+
+	if (current_el() != 2) {
+		panic("MPU configuration is only supported at EL2");
+	}
+
+	set_sctlr(get_sctlr() & ~(CR_M | CR_WXN));
+
+	asm volatile("msr MAIR_EL2, %0" : : "r" MEMORY_ATTRIBUTES);
+
+	for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) {
+		setup_el2_mpu_region(i,
+			PRBAR_ADDRESS(mpu_mem_map[i].start)
+				| PRBAR_OUTER_SH | PRBAR_AP_RW_ANY,
+			PRLAR_ADDRESS(mpu_mem_map[i].end)
+				| mpu_mem_map[i].attrs | PRLAR_EN_BIT
+			);
+	}
+
+	set_sctlr(get_sctlr() | CR_M);
+}
+
+static bool el_has_mmu(void)
+{
+	if (current_el() < 2) {
+		// We have no way of knowing, so assuming we have an MMU
+		return true;
+	}
+
+	uint64_t id_aa64mmfr0;
+	asm volatile("mrs %0, id_aa64mmfr0_el1"
+			: "=r" (id_aa64mmfr0) : : "cc");
+	uint64_t msa = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_MASK;
+	uint64_t msa_frac = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_FRAC_MASK;
+
+	switch (msa) {
+		case ID_AA64MMFR0_EL1_MSA_VMSA:
+			/*
+			 * VMSA supported in all translation regimes.
+			 * No support for PMSA.
+			 */
+			return true;
+		case ID_AA64MMFR0_EL1_MSA_USE_FRAC:
+			/* See MSA_frac for the supported MSAs. */
+			switch (msa_frac) {
+				case ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA:
+					/*
+					 * PMSA not supported in any translation
+					 * regime.
+					 */
+					return true;
+				case ID_AA64MMFR0_EL1_MSA_FRAC_VMSA:
+					/*
+					* PMSA supported in all translation
+					* regimes. No support for VMSA.
+					*/
+				case ID_AA64MMFR0_EL1_MSA_FRAC_PMSA:
+					/*
+					 * PMSA supported in all translation
+					 * regimes.
+					 */
+					return false;
+				default:
+					panic("Unsupported id_aa64mmfr0_el1 " \
+						"MSA_frac value");
+			}
+		default:
+			panic("Unsupported id_aa64mmfr0_el1 MSA value");
+	}
+}
+
+ void setup_pgtables(void)
+ {
+ 	int i;
+@@ -479,8 +565,13 @@ void dcache_enable(void)
+ 	/* The data cache is not active unless the mmu is enabled */
+ 	if (!(get_sctlr() & CR_M)) {
+ 		invalidate_dcache_all();
+-		__asm_invalidate_tlb_all();
+-		mmu_setup();
+
+		if (el_has_mmu()) {
+			__asm_invalidate_tlb_all();
+			mmu_setup();
+		} else {
+			mpu_setup();
+		}
+ 	}
+ 
+ 	set_sctlr(get_sctlr() | CR_C);
+@@ -499,7 +590,11 @@ void dcache_disable(void)
+ 	set_sctlr(sctlr & ~(CR_C|CR_M));
+ 
+ 	flush_dcache_all();
+-	__asm_invalidate_tlb_all();
+
+	if (el_has_mmu())
+		__asm_invalidate_tlb_all();
+	else
+		mpu_clear_regions();
+ }
+ 
+ int dcache_status(void)
+diff --git a/arch/arm/include/asm/armv8/mpu.h b/arch/arm/include/asm/armv8/mpu.h
+new file mode 100644
+index 0000000000..8de627cafd
+--- /dev/null
+++ b/arch/arm/include/asm/armv8/mpu.h
+@@ -0,0 +1,59 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * (C) Copyright 2021 Arm Limited
+ */
+
+#ifndef _ASM_ARMV8_MPU_H_
+#define _ASM_ARMV8_MPU_H_
+
+#include <asm/armv8/mmu.h>
+#include <linux/stringify.h>
+
+#define PRSELR_EL2		S3_4_c6_c2_1
+#define PRBAR_EL2		S3_4_c6_c8_0
+#define PRLAR_EL2		S3_4_c6_c8_1
+#define MPUIR_EL2		S3_4_c0_c0_4
+
+#define PRBAR_ADDRESS(addr)	((addr) & ~(0x3fULL))
+
+/* Access permissions */
+#define PRBAR_AP(val)		(((val) & 0x3) << 2)
+#define PRBAR_AP_RW_HYP		PRBAR_AP(0x0)
+#define PRBAR_AP_RW_ANY		PRBAR_AP(0x1)
+#define PRBAR_AP_RO_HYP		PRBAR_AP(0x2)
+#define PRBAR_AP_RO_ANY		PRBAR_AP(0x3)
+
+/* Shareability */
+#define PRBAR_SH(val)		(((val) & 0x3) << 4)
+#define PRBAR_NON_SH		PRBAR_SH(0x0)
+#define PRBAR_OUTER_SH		PRBAR_SH(0x2)
+#define PRBAR_INNER_SH		PRBAR_SH(0x3)
+
+/* Memory attribute (MAIR idx) */
+#define PRLAR_ATTRIDX(val)	(((val) & 0x7) << 1)
+#define PRLAR_EN_BIT		(0x1)
+#define PRLAR_ADDRESS(addr)	((addr) & ~(0x3fULL))
+
+#ifndef __ASSEMBLY__
+
+static inline void setup_el2_mpu_region(uint8_t region, uint64_t base, uint64_t limit)
+{
+	asm volatile("msr " __stringify(PRSELR_EL2) ", %0" : : "r" (region));
+	asm volatile("msr " __stringify(PRBAR_EL2) ", %0" : : "r" (base));
+	asm volatile("msr " __stringify(PRLAR_EL2) ", %0" : : "r" (limit));
+
+	asm volatile("isb");
+}
+
+#endif
+
+struct mpu_region {
+	u64 start;
+	u64 end;
+	u64 attrs;
+};
+
+extern struct mpu_region *mpu_mem_map;
+
+#endif /* _ASM_ARMV8_MPU_H_ */
+diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
+index 77aa18909e..deb3158943 100644
+--- a/arch/arm/include/asm/system.h
+++ b/arch/arm/include/asm/system.h
+@@ -94,6 +94,25 @@
+ 				               auth algorithm                 */
+ #define ID_AA64ISAR1_EL1_APA	(0xF << 4)  /* QARMA address auth algorithm   */
+ 
+/*
+ * ID_AA64MMFR0_EL1 bits definitions
+ */
+#define ID_AA64MMFR0_EL1_MSA_FRAC_MASK		(0xFUL << 52) /* Memory system
+								 architecture
+								 frac         */
+#define ID_AA64MMFR0_EL1_MSA_FRAC_VMSA		(0x2UL << 52) /* EL1&0 supports
+								 VMSA         */
+#define ID_AA64MMFR0_EL1_MSA_FRAC_PMSA		(0x1UL << 52) /* EL1&0 only
+							         supports PMSA*/
+#define ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA	(0x0UL << 52) /* No PMSA
+								 support      */
+#define ID_AA64MMFR0_EL1_MSA_MASK		(0xFUL << 48) /* Memory system
+								 architecture */
+#define ID_AA64MMFR0_EL1_MSA_USE_FRAC		(0xFUL << 48) /* Use MSA_FRAC */
+#define ID_AA64MMFR0_EL1_MSA_VMSA		(0x0UL << 48) /* Memory system
+								 architecture
+								 is VMSA      */
+
+ /*
+  * ID_AA64PFR0_EL1 bits definitions
+  */
+-- 
+2.25.1
+
@@ -0,0 +1,98 @@
+From 377b3d6d79e26e85dabf0fe0726ac179e9229523 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Fri, 10 Dec 2021 11:41:19 +0000
+Subject: [PATCH 08/12] armv8: Allow disabling exception vectors on non-SPL
+ builds
+
+On the BASER_FVP, U-Boot shares EL2 with another bootloader, so we do
+not wish to overide the exception vector, but we are also not using an
+SPL build.
+
+Therefore, add ARMV8_EXCEPTION_VECTORS, which disables exception vectors
+in a similar way to ARMV8_SPL_EXCEPTION_VECTORS.
+
+Rename ARMV8_SPL_EXCEPTION_VECTORS -> SPL_ARMV8_EXCEPTION_VECTORS so
+that both config flags be be targeted using CONFIG_IS_ENABLED.
+
+Issue-Id: SCM-3728
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I0cf0fc6d7ef4d45791411cf1f67c65e198cc8b2b
+---
+ arch/arm/cpu/armv8/Kconfig  | 11 ++++++++---
+ arch/arm/cpu/armv8/Makefile |  6 ++----
+ arch/arm/cpu/armv8/start.S  |  4 ++--
+ 3 files changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/cpu/armv8/Kconfig b/arch/arm/cpu/armv8/Kconfig
+index b7a10a8e34..77dae1f84a 100644
+--- a/arch/arm/cpu/armv8/Kconfig
+++ b/arch/arm/cpu/armv8/Kconfig
+@@ -1,9 +1,8 @@
+ if ARM64
+ 
+-config ARMV8_SPL_EXCEPTION_VECTORS
+config ARMV8_EXCEPTION_VECTORS
+ 	bool "Install crash dump exception vectors"
+-	depends on SPL
+-	default n
+	default y
+ 	help
+ 	  The default exception vector table is only used for the crash
+ 	  dump, but still takes quite a lot of space in the image size.
+@@ -11,6 +10,12 @@ config ARMV8_SPL_EXCEPTION_VECTORS
+ 	  Say N here if you are running out of code space in the image
+ 	  and want to save some space at the cost of less debugging info.
+ 
+config SPL_ARMV8_EXCEPTION_VECTORS
+	bool "Install crash dump exception vectors in the SPL"
+	depends on SPL
+	help
+	  Same as ARMV8_EXCEPTION_VECTORS, but for SPL builds
+
+ config ARMV8_MULTIENTRY
+         bool "Enable multiple CPUs to enter into U-Boot"
+ 
+diff --git a/arch/arm/cpu/armv8/Makefile b/arch/arm/cpu/armv8/Makefile
+index d85ddde430..be2a4b126c 100644
+--- a/arch/arm/cpu/armv8/Makefile
+++ b/arch/arm/cpu/armv8/Makefile
+@@ -13,10 +13,8 @@ ifndef CONFIG_$(SPL_)SYS_DCACHE_OFF
+ obj-y	+= cache_v8.o
+ obj-y	+= cache.o
+ endif
+-ifdef CONFIG_SPL_BUILD
+-obj-$(CONFIG_ARMV8_SPL_EXCEPTION_VECTORS) += exceptions.o
+-else
+-obj-y	+= exceptions.o
+obj-$(CONFIG_$(SPL_)ARMV8_EXCEPTION_VECTORS) += exceptions.o
+ifndef CONFIG_SPL_BUILD
+ obj-y	+= exception_level.o
+ endif
+ obj-y	+= tlb.o
+diff --git a/arch/arm/cpu/armv8/start.S b/arch/arm/cpu/armv8/start.S
+index 662449156b..2389e4773a 100644
+--- a/arch/arm/cpu/armv8/start.S
+++ b/arch/arm/cpu/armv8/start.S
+@@ -108,7 +108,7 @@ pie_fixup_done:
+ 	bl reset_sctrl
+ #endif
+ 
+-#if defined(CONFIG_ARMV8_SPL_EXCEPTION_VECTORS) || !defined(CONFIG_SPL_BUILD)
+#if CONFIG_IS_ENABLED(ARMV8_EXCEPTION_VECTORS)
+ .macro	set_vbar, regname, reg
+ 	msr	\regname, \reg
+ .endm
+@@ -382,7 +382,7 @@ ENDPROC(smp_kick_all_cpus)
+ /*-----------------------------------------------------------------------*/
+ 
+ ENTRY(c_runtime_cpu_setup)
+-#if defined(CONFIG_ARMV8_SPL_EXCEPTION_VECTORS) || !defined(CONFIG_SPL_BUILD)
+#if CONFIG_IS_ENABLED(ARMV8_EXCEPTION_VECTORS)
+ 	/* Relocate vBAR */
+ 	adr	x0, vectors
+ 	switch_el x1, 3f, 2f, 1f
+-- 
+2.25.1
+
@@ -0,0 +1,163 @@
+From 5facc2d1389074475f90a0713cefe0e3f69379d8 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Wed, 14 Jul 2021 12:44:27 +0100
+Subject: [PATCH 09/12] armv8: ARMV8_SWITCH_TO_EL1 improvements
+
+Convert CONFIG_ARMV8_SWITCH_TO_EL1 to a Kconfig variable.
+
+Add support for switching to EL1 to bootefi.
+
+Add the environment variable armv8_switch_to_el1 to allow configuring
+whether to switch to EL1 at runtime. This overrides the compile-time
+option.
+
+Issue-Id: SCM-3728
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: If98478148d6d8d1f732acac5439276700614815f
+---
+ arch/arm/cpu/armv8/Kconfig           |  8 +++++++
+ arch/arm/cpu/armv8/exception_level.c | 21 ++++++++++++++--
+ arch/arm/lib/bootm.c                 | 36 ++++++++++++++++------------
+ scripts/config_whitelist.txt         |  1 -
+ 4 files changed, 48 insertions(+), 18 deletions(-)
+
+diff --git a/arch/arm/cpu/armv8/Kconfig b/arch/arm/cpu/armv8/Kconfig
+index 77dae1f84a..e994c261a1 100644
+--- a/arch/arm/cpu/armv8/Kconfig
+++ b/arch/arm/cpu/armv8/Kconfig
+@@ -179,4 +179,12 @@ config ARMV8_SECURE_BASE
+ 
+ endif
+ 
+config ARMV8_SWITCH_TO_EL1
+	bool "Switch to EL1 before booting the operating system"
+	default n
+	help
+	  Switch to EL1 before booting the operating system, if for example the
+	  operating system does not support booting at EL2, or you wish to prevent
+	  any hypervisors from running. Supported for bootm, booti and bootefi.
+
+ endif
+diff --git a/arch/arm/cpu/armv8/exception_level.c b/arch/arm/cpu/armv8/exception_level.c
+index b11936548f..4aad1550f4 100644
+--- a/arch/arm/cpu/armv8/exception_level.c
+++ b/arch/arm/cpu/armv8/exception_level.c
+@@ -40,19 +40,36 @@ static void entry_non_secure(struct jmp_buf_data *non_secure_jmp)
+  * trusted firmware being one embodiment). The operating system shall be
+  * started at exception level EL2. So here we check the exception level
+  * and switch it if necessary.
+ *
+ * If armv8_switch_to_el1 (config or env var) is enabled, also switch to EL1
+ * before booting the operating system.
+  */
+ void switch_to_non_secure_mode(void)
+ {
+ 	struct jmp_buf_data non_secure_jmp;
+ 
+ 	/* On AArch64 we need to make sure we call our payload in < EL3 */
+-	if (current_el() == 3) {
+
+	int switch_to_el1 = env_get_yesno("armv8_switch_to_el1");
+#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
+	if (switch_to_el1 == -1) {
+			switch_to_el1 = 1;
+	}
+#endif
+
+	if (current_el() > 2) {
+ 		if (setjmp(&non_secure_jmp))
+ 			return;
+ 		dcache_disable();	/* flush cache before switch to EL2 */
+-
+ 		/* Move into EL2 and keep running there */
+ 		armv8_switch_to_el2((uintptr_t)&non_secure_jmp, 0, 0, 0,
+ 				    (uintptr_t)entry_non_secure, ES_TO_AARCH64);
+	} else if (switch_to_el1 == 1 && current_el() > 1) {
+		if (setjmp(&non_secure_jmp))
+			return;
+		dcache_disable();	/* flush cache before switch to EL1 */
+		/* Move into EL1 and keep running there */
+		armv8_switch_to_el1((uintptr_t)&non_secure_jmp, 0, 0, 0,
+				    (uintptr_t)entry_non_secure, ES_TO_AARCH64);
+ 	}
+ }
+diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
+index f60ee3a7e6..a87dd37664 100644
+--- a/arch/arm/lib/bootm.c
+++ b/arch/arm/lib/bootm.c
+@@ -317,7 +317,6 @@ __weak void update_os_arch_secondary_cores(uint8_t os_arch)
+ {
+ }
+ 
+-#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
+ static void switch_to_el1(void)
+ {
+ 	if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
+@@ -332,7 +331,6 @@ static void switch_to_el1(void)
+ 				    ES_TO_AARCH64);
+ }
+ #endif
+-#endif
+ 
+ /* Subcommand: GO */
+ static void boot_jump_linux(bootm_headers_t *images, int flag)
+@@ -359,21 +357,29 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
+ 
+ 		update_os_arch_secondary_cores(images->os.arch);
+ 
+		int armv8_switch_to_el1 = env_get_yesno("armv8_switch_to_el1");
+ #ifdef CONFIG_ARMV8_SWITCH_TO_EL1
+-		armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
+-				    (u64)switch_to_el1, ES_TO_AARCH64);
+-#else
+-		if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
+-		    (images->os.arch == IH_ARCH_ARM))
+-			armv8_switch_to_el2(0, (u64)gd->bd->bi_arch_number,
+-					    (u64)images->ft_addr, 0,
+-					    (u64)images->ep,
+-					    ES_TO_AARCH32);
+-		else
+-			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
+-					    images->ep,
+-					    ES_TO_AARCH64);
+		if (armv8_switch_to_el1 == -1) {
+			armv8_switch_to_el1 = 1;
+		}
+ #endif
+		if (armv8_switch_to_el1 == 1) {
+			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
+					    (u64)switch_to_el1, ES_TO_AARCH64);
+		} else {
+			if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
+					(images->os.arch == IH_ARCH_ARM))
+				armv8_switch_to_el2(0,
+						    (u64)gd->bd->bi_arch_number,
+						    (u64)images->ft_addr, 0,
+						    (u64)images->ep,
+						    ES_TO_AARCH32);
+			else
+				armv8_switch_to_el2((u64)images->ft_addr,
+						    0, 0, 0,
+						    images->ep,
+						    ES_TO_AARCH64);
+		}
+ 	}
+ #else
+ 	unsigned long machid = gd->bd->bi_arch_number;
+diff --git a/scripts/config_whitelist.txt b/scripts/config_whitelist.txt
+index 3dbcc042a8..60455d12e3 100644
+--- a/scripts/config_whitelist.txt
+++ b/scripts/config_whitelist.txt
+@@ -46,7 +46,6 @@ CONFIG_ARMADA168
+ CONFIG_ARMV7_SECURE_BASE
+ CONFIG_ARMV7_SECURE_MAX_SIZE
+ CONFIG_ARMV7_SECURE_RESERVE_SIZE
+-CONFIG_ARMV8_SWITCH_TO_EL1
+ CONFIG_ARM_ARCH_CP15_ERRATA
+ CONFIG_ARM_GIC_BASE_ADDRESS
+ CONFIG_ARM_PL180_MMCI_BASE
+-- 
+2.25.1
+
@@ -0,0 +1,73 @@
+From 8360c16a9261a90944ef922733ae5b56e8eed5a6 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Fri, 10 Dec 2021 16:37:26 +0000
+Subject: [PATCH 10/12] armv8: Make disabling HVC configurable when switching
+ to EL1
+
+On the BASER_FVP there is no EL3, so HVC is used to provide PSCI
+services. Therefore we cannot disable hypercalls.
+
+Create CONFIG_ARMV8_DISABLE_HVC (dependent on CONFIG_ARMV8_TO_EL1) to
+control whether to disable HVC exceptions in HCR_EL2->HCD
+
+Issue-Id: SCM-3728
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I463d82f1db8a3cafcab40a9c0c208753569cc300
+---
+ arch/arm/cpu/armv8/Kconfig   |  9 +++++++++
+ arch/arm/include/asm/macro.h | 10 ++++++++--
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/cpu/armv8/Kconfig b/arch/arm/cpu/armv8/Kconfig
+index e994c261a1..cd49529346 100644
+--- a/arch/arm/cpu/armv8/Kconfig
+++ b/arch/arm/cpu/armv8/Kconfig
+@@ -187,4 +187,13 @@ config ARMV8_SWITCH_TO_EL1
+ 	  operating system does not support booting at EL2, or you wish to prevent
+ 	  any hypervisors from running. Supported for bootm, booti and bootefi.
+ 
+config ARMV8_DISABLE_HVC
+	bool "Disable HVC calls before switching to EL1"
+	depends on ARMV8_SWITCH_TO_EL1
+	default y
+	help
+	  If switching to EL1 before loading the operating system, disable taking
+	  hypercalls back to EL2. May be disabled if, for example, PSCI services are
+	  running at EL2.
+
+ endif
+diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h
+index 5ee72d0e78..d6b5d7d7f3 100644
+--- a/arch/arm/include/asm/macro.h
+++ b/arch/arm/include/asm/macro.h
+@@ -293,9 +293,12 @@ lr	.req	x30
+ 	ldr	\tmp2, =(ID_AA64ISAR1_EL1_GPI | ID_AA64ISAR1_EL1_GPA | \
+ 		      ID_AA64ISAR1_EL1_API | ID_AA64ISAR1_EL1_APA)
+ 	tst	\tmp, \tmp2
+-	mov	\tmp2, #(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
+	mov	\tmp2, #(HCR_EL2_RW_AARCH64)
+ 	orr	\tmp, \tmp2, #(HCR_EL2_APK | HCR_EL2_API)
+ 	csel	\tmp, \tmp2, \tmp, eq
+#ifdef CONFIG_ARMV8_DISABLE_HVC
+	orr	\tmp, \tmp, #(HCR_EL2_HCD_DIS)
+#endif
+ 	msr	hcr_el2, \tmp
+ 
+ 	/* Return to the EL1_SP1 mode from EL2 */
+@@ -308,7 +311,10 @@ lr	.req	x30
+ 
+ 1:
+ 	/* Initialize HCR_EL2 */
+-	ldr	\tmp, =(HCR_EL2_RW_AARCH32 | HCR_EL2_HCD_DIS)
+	ldr	\tmp, =(HCR_EL2_RW_AARCH32)
+#ifdef CONFIG_ARMV8_DISABLE_HVC
+	orr	\tmp, \tmp, #(HCR_EL2_HCD_DIS)
+#endif
+ 	msr	hcr_el2, \tmp
+ 
+ 	/* Return to AArch32 Supervisor mode from EL2 */
+-- 
+2.25.1
+
@@ -0,0 +1,37 @@
+From 3362e6910fe3f4d431b4034299f1b8d79a45e693 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Fri, 10 Dec 2021 15:09:09 +0000
+Subject: [PATCH 11/12] vexpress64: Do not set COUNTER_FREQUENCY
+
+VExpress boards normally run as a second-stage bootloader so should not
+need to modify CNTFRQ_EL0. On the BASER_FVP, U-Boot can modify it if
+running at EL2, but shouldn't because it might be different from the
+value being used by the first-stage bootloader (which might be
+providing PSCI services).
+
+Issue-Id: SCM-3728
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: I137473d721e58e4c348b9641f5b9778178d3bb65
+---
+ include/configs/vexpress_aemv8.h | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/include/configs/vexpress_aemv8.h b/include/configs/vexpress_aemv8.h
+index 68422237dd..567a6dbf36 100644
+--- a/include/configs/vexpress_aemv8.h
+++ b/include/configs/vexpress_aemv8.h
+@@ -70,9 +70,6 @@
+ #define V2M_SYS_CFGCTRL			(V2M_SYSREGS + 0x0a4)
+ #define V2M_SYS_CFGSTAT			(V2M_SYSREGS + 0x0a8)
+ 
+-/* Generic Timer Definitions */
+-#define COUNTER_FREQUENCY		24000000	/* 24MHz */
+-
+ /* Generic Interrupt Controller Definitions */
+ #ifdef CONFIG_GICV3
+ #define GICD_BASE			(V2M_PA_BASE + 0x2f000000)
+-- 
+2.25.1
+
@@ -0,0 +1,275 @@
+From fdc36eaf590bfadfa184ccf589076e0b3420b859 Mon Sep 17 00:00:00 2001
+From: Peter Hoyes <Peter.Hoyes@arm.com>
+Date: Mon, 24 May 2021 11:47:53 +0100
+Subject: [PATCH 12/12] vexpress64: Add BASER_FVP vexpress board variant
+
+The BASER_FVP board variant is implemented on top of the BASE_FVP board
+config (which, in turn, is based on the Juno Versatile Express board
+config). They all share a similar memory map - for BASER_FVP the map is
+inverted from the BASE_FVP
+(https://developer.arm.com/documentation/100964/1114/Base-Platform/Base---memory/BaseR-Platform-memory-map)
+
+ * Create new TARGET_VEXPRESS64_BASER_FVP target, which uses the same
+   board config as BASE_FVP and JUNO
+ * Implement inverted memory map in vexpress_aemv8.h
+ * Create vexpress_aemv8r defconfig
+ * Provide MPU and MMU memory maps for the BASER_FVP
+ * Provide default value for LNX_KRNL_IMG_TEXT_OFFSET_BASE
+ * Update vexpress64 documentation
+
+Issue-Id: SCM-3728
+Upstream-Status: Inappropriate [other]
+  Temporary patch
+Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
+Change-Id: Id173e52afad473abcf3f61c6bf374fc31f17edd3
+---
+ arch/arm/Kconfig                     |  8 +++++
+ board/armltd/vexpress64/Kconfig      |  6 +++-
+ board/armltd/vexpress64/MAINTAINERS  |  7 ++++
+ board/armltd/vexpress64/vexpress64.c | 52 ++++++++++++++++++++++++++++
+ configs/vexpress_aemv8r_defconfig    | 27 +++++++++++++++
+ doc/board/armltd/vexpress64.rst      |  1 +
+ include/configs/vexpress_aemv8.h     | 42 ++++++++++++++++++++++
+ 7 files changed, 142 insertions(+), 1 deletion(-)
+ create mode 100644 configs/vexpress_aemv8r_defconfig
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 0448787b8b..7bf39264e3 100644
+--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
+@@ -1157,6 +1157,14 @@ config TARGET_VEXPRESS64_BASE_FVP
+ 	select PL01X_SERIAL
+ 	select SEMIHOSTING
+ 
+config TARGET_VEXPRESS64_BASER_FVP
+	bool "Support Versatile Express ARMv8r64 FVP BASE model"
+	select ARM64
+	select DM
+	select DM_SERIAL
+	select PL01X_SERIAL
+	select LINUX_KERNEL_IMAGE_HEADER
+
+ config TARGET_VEXPRESS64_JUNO
+ 	bool "Support Versatile Express Juno Development Platform"
+ 	select ARM64
+diff --git a/board/armltd/vexpress64/Kconfig b/board/armltd/vexpress64/Kconfig
+index 4aab3f092e..e824173fe1 100644
+--- a/board/armltd/vexpress64/Kconfig
+++ b/board/armltd/vexpress64/Kconfig
+@@ -1,4 +1,5 @@
+-if TARGET_VEXPRESS64_BASE_FVP || TARGET_VEXPRESS64_JUNO
+if TARGET_VEXPRESS64_BASE_FVP || TARGET_VEXPRESS64_JUNO || \
+	TARGET_VEXPRESS64_BASER_FVP
+ 
+ config SYS_BOARD
+ 	default "vexpress64"
+@@ -16,4 +17,7 @@ config JUNO_DTB_PART
+ 	  The ARM partition name in the NOR flash memory holding the
+ 	  device tree blob to configure U-Boot.
+ 
+config LNX_KRNL_IMG_TEXT_OFFSET_BASE
+    default 0x0
+
+ endif
+diff --git a/board/armltd/vexpress64/MAINTAINERS b/board/armltd/vexpress64/MAINTAINERS
+index 0ba044d7ff..e89d9711b8 100644
+--- a/board/armltd/vexpress64/MAINTAINERS
+++ b/board/armltd/vexpress64/MAINTAINERS
+@@ -14,3 +14,10 @@ JUNO DEVELOPMENT PLATFORM BOARD
+ M:	Linus Walleij <linus.walleij@linaro.org>
+ S:	Maintained
+ F:	configs/vexpress_aemv8a_juno_defconfig
+
+VEXPRESS_AEMV8R BOARD
+M:	Diego Sueiro <diego.sueiro@arm.com>
+M:	Peter Hoyes <peter.hoyes@arm.com>
+R:	Andre Przywara <andre.przywara@arm.com>
+S:	Maintained
+F:	configs/vexpress_aemv8r_defconfig
+diff --git a/board/armltd/vexpress64/vexpress64.c b/board/armltd/vexpress64/vexpress64.c
+index 821f9cfc3b..07c76609ab 100644
+--- a/board/armltd/vexpress64/vexpress64.c
+++ b/board/armltd/vexpress64/vexpress64.c
+@@ -18,6 +18,7 @@
+ #include <dm/platform_data/serial_pl01x.h>
+ #include "pcie.h"
+ #include <asm/armv8/mmu.h>
+#include <asm/armv8/mpu.h>
+ #ifdef CONFIG_VIRTIO_NET
+ #include <virtio_types.h>
+ #include <virtio.h>
+@@ -36,6 +37,56 @@ U_BOOT_DRVINFO(vexpress_serials) = {
+ 	.plat = &serial_plat,
+ };
+ 
+#ifdef CONFIG_TARGET_VEXPRESS64_BASER_FVP
+
+static struct mpu_region vexpress64_aemv8r_mem_map[] = {
+       {
+               .start = 0x0UL,
+               .end = 0x7fffffffUL,
+               .attrs = PRLAR_ATTRIDX(MT_NORMAL)
+       }, {
+               .start = 0x80000000UL,
+               .end = 0xffffffffUL,
+               .attrs = PRLAR_ATTRIDX(MT_DEVICE_NGNRNE)
+       }, {
+               .start = 0x100000000UL,
+               .end = 0xffffffffffUL,
+               .attrs = PRLAR_ATTRIDX(MT_NORMAL)
+       }, {
+               /* List terminator */
+               0,
+       }
+};
+
+struct mpu_region *mpu_mem_map = vexpress64_aemv8r_mem_map;
+
+static struct mm_region vexpress64_mem_map[] = {
+	{
+		.virt = 0x0UL,
+		.phys = 0x0UL,
+		.size = 0x80000000UL,
+		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) |
+			 PTE_BLOCK_INNER_SHARE
+	}, {
+		.virt = 0x80000000UL,
+		.phys = 0x80000000UL,
+		.size = 0x80000000UL,
+		.attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+			 PTE_BLOCK_NON_SHARE |
+			 PTE_BLOCK_PXN | PTE_BLOCK_UXN
+	},
+	{
+		.virt = 0x100000000UL,
+		.phys = 0x100000000UL,
+		.size = 0xff00000000UL,
+		.attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) |
+			 PTE_BLOCK_INNER_SHARE
+	}, {
+		/* List terminator */
+		0,
+	}
+};
+#else
+ static struct mm_region vexpress64_mem_map[] = {
+ 	{
+ 		.virt = 0x0UL,
+@@ -55,6 +106,7 @@ static struct mm_region vexpress64_mem_map[] = {
+ 		0,
+ 	}
+ };
+#endif
+ 
+ struct mm_region *mem_map = vexpress64_mem_map;
+ 
+diff --git a/configs/vexpress_aemv8r_defconfig b/configs/vexpress_aemv8r_defconfig
+new file mode 100644
+index 0000000000..37c393b66f
+--- /dev/null
+++ b/configs/vexpress_aemv8r_defconfig
+@@ -0,0 +1,27 @@
+CONFIG_ARM=y
+CONFIG_TARGET_VEXPRESS64_BASER_FVP=y
+CONFIG_SYS_TEXT_BASE=0x00080000
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_SYS_LOAD_ADDR=0x10000000
+CONFIG_SYS_MALLOC_F_LEN=0x2000
+CONFIG_NR_DRAM_BANKS=2
+CONFIG_ENV_SIZE=0x40000
+CONFIG_ENV_SECT_SIZE=0x40000
+CONFIG_IDENT_STRING=" vexpress_aemv8r64"
+CONFIG_DISTRO_DEFAULTS=y
+CONFIG_BOOTDELAY=3
+CONFIG_USE_BOOTARGS=y
+CONFIG_BOOTARGS="console=ttyAMA0 earlycon=pl011,0x9c090000 rootfstype=ext4 root=/dev/vda2 rw rootwait"
+# CONFIG_USE_BOOTCOMMAND is not set
+# CONFIG_DISPLAY_CPUINFO is not set
+CONFIG_SYS_PROMPT="VExpress64# "
+CONFIG_DM_ETH=y
+CONFIG_OF_CONTROL=y
+CONFIG_OF_BOARD=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_VIRTIO_NET=y
+CONFIG_ARMV8_SWITCH_TO_EL1=y
+CONFIG_ARMV8_DISABLE_HVC=n
+CONFIG_ARMV8_EXCEPTION_VECTORS=n
+CONFIG_ARCH_FIXUP_FDT_MEMORY=n
+diff --git a/doc/board/armltd/vexpress64.rst b/doc/board/armltd/vexpress64.rst
+index b98b096544..b8efbc1565 100644
+--- a/doc/board/armltd/vexpress64.rst
+++ b/doc/board/armltd/vexpress64.rst
+@@ -6,6 +6,7 @@ Arm Versatile Express
+ The vexpress_* board configuration supports the following platforms:
+ 
+  * FVP_Base_RevC-2xAEMvA
+ * FVP_BaseR_AEMv8R
+  * Juno development board
+ 
+ Fixed Virtual Platforms
+diff --git a/include/configs/vexpress_aemv8.h b/include/configs/vexpress_aemv8.h
+index 567a6dbf36..d0173735db 100644
+--- a/include/configs/vexpress_aemv8.h
+++ b/include/configs/vexpress_aemv8.h
+@@ -22,8 +22,13 @@
+ #define CONFIG_SYS_BOOTM_LEN (64 << 20)      /* Increase max gunzip size */
+ 
+ /* CS register bases for the original memory map. */
+#ifdef CONFIG_TARGET_VEXPRESS64_BASER_FVP
+#define V2M_BASE			0x00000000
+#define V2M_PA_BASE			0x80000000
+#else
+ #define V2M_BASE			0x80000000
+ #define V2M_PA_BASE			0x00000000
+#endif
+ 
+ #define V2M_PA_CS0			(V2M_PA_BASE + 0x00000000)
+ #define V2M_PA_CS1			(V2M_PA_BASE + 0x14000000)
+@@ -205,6 +210,43 @@
+ 				"fi"
+ #endif
+ 
+#elif CONFIG_TARGET_VEXPRESS64_BASER_FVP
+
+#define BOOTENV_DEV_MEM(devtypeu, devtypel, instance) \
+	"bootcmd_mem= " \
+		"source ${scriptaddr}; " \
+		"if test $? -eq 1; then " \
+		"  env import -t ${scriptaddr}; " \
+		"  if test -n $uenvcmd; then " \
+		"    echo Running uenvcmd ...; " \
+		"    run uenvcmd; " \
+		"  fi; " \
+		"fi\0"
+#define BOOTENV_DEV_NAME_MEM(devtypeu, devtypel, instance) "mem "
+
+#define BOOT_TARGET_DEVICES(func)	\
+	func(MEM, mem, na)		\
+	func(VIRTIO, virtio, 0)		\
+	func(PXE, pxe, na)		\
+	func(DHCP, dhcp, na)
+
+#include <config_distro_bootcmd.h>
+
+#define VEXPRESS_KERNEL_ADDR		0x00200000
+#define VEXPRESS_PXEFILE_ADDR		0x0fb00000
+#define VEXPRESS_FDT_ADDR		0x0fc00000
+#define VEXPRESS_SCRIPT_ADDR		0x0fd00000
+#define VEXPRESS_RAMDISK_ADDR		0x0fe00000
+
+#define CONFIG_EXTRA_ENV_SETTINGS       \
+		"kernel_addr_r=" __stringify(VEXPRESS_KERNEL_ADDR) "\0" \
+		"pxefile_addr_r=" __stringify(VEXPRESS_PXEFILE_ADDR) "\0" \
+		"fdt_addr_r=" __stringify(VEXPRESS_FDT_ADDR) "\0" \
+		"fdtfile=board.dtb\0" \
+		"scriptaddr=" __stringify(VEXPRESS_SCRIPT_ADDR) "\0"  \
+		"ramdisk_addr_r=" __stringify(VEXPRESS_RAMDISK_ADDR) "\0" \
+		BOOTENV
+
+ #endif
+ 
+ /* Monitor Command Prompt */
+-- 
+2.25.1
+
@@ -63,6 +63,8 @@ SRC_URI:append:corstone1000 = " \
      file://0049-efi_loader-Fix-loaded-image-alignment.patch \
      file://0050-Comment-mm_communicate-failure-log.patch \
      file://0051-efi_loader-send-bootcomplete-message-to-secure-encla.patch \
+      file://0052-efi_loader-fix-null-pointer-exception-with-get_image.patch \
+      file://0053-plat-corstone1000-add-support-for-SDCard.patch \
      "

 #
@@ -74,3 +76,21 @@ SRC_URI:append:fvp-base = " file://bootargs.cfg"
 # FVP BASE ARM32
 #
 SRC_URI:append:fvp-base-arm32 = " file://0001-Add-vexpress_aemv8a_aarch32-variant.patch"
+
+#
+# FVP BASER
+#
+SRC_URI:append:fvp-baser-aemv8r64 = " \
+    file://0001-armv8-Disable-pointer-authentication-traps-for-EL1.patch \
+    file://0002-doc-Add-documentation-for-the-Arm-VExpress64-board-c.patch \
+    file://0003-vexpress64-Refactor-header-file-to-make-it-easier-to.patch \
+    file://0004-vexpress64-Clean-up-BASE_FVP-boot-configuration.patch \
+    file://0005-vexpress64-Enable-OF_CONTROL-and-OF_BOARD-for-VExpre.patch \
+    file://0006-vexpress64-Enable-VIRTIO_NET-network-driver.patch \
+    file://0007-armv8-Add-ARMv8-MPU-configuration-logic.patch \
+    file://0008-armv8-Allow-disabling-exception-vectors-on-non-SPL-b.patch \
+    file://0009-armv8-ARMV8_SWITCH_TO_EL1-improvements.patch \
+    file://0010-armv8-Make-disabling-HVC-configurable-when-switching.patch \
+    file://0011-vexpress64-Do-not-set-COUNTER_FREQUENCY.patch \
+    file://0012-vexpress64-Add-BASER_FVP-vexpress-board-variant.patch \
+    "
@@ -0,0 +1,54 @@
+Upstream-Status: Backport
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+
+From e33a814e772cdc36436c8c188d8c42d019fda639 Mon Sep 17 00:00:00 2001
+From: Dirk Mueller <dmueller@suse.com>
+Date: Tue, 14 Jan 2020 18:53:41 +0100
+Subject: [PATCH] scripts/dtc: Remove redundant YYLOC global declaration
+
+gcc 10 will default to -fno-common, which causes this error at link
+time:
+
+  (.text+0x0): multiple definition of `yylloc'; dtc-lexer.lex.o (symbol from plugin):(.text+0x0): first defined here
+
+This is because both dtc-lexer as well as dtc-parser define the same
+global symbol yyloc. Before with -fcommon those were merged into one
+defintion. The proper solution would be to to mark this as "extern",
+however that leads to:
+
+  dtc-lexer.l:26:16: error: redundant redeclaration of 'yylloc' [-Werror=redundant-decls]
+   26 | extern YYLTYPE yylloc;
+      |                ^~~~~~
+In file included from dtc-lexer.l:24:
+dtc-parser.tab.h:127:16: note: previous declaration of 'yylloc' was here
+  127 | extern YYLTYPE yylloc;
+      |                ^~~~~~
+cc1: all warnings being treated as errors
+
+which means the declaration is completely redundant and can just be
+dropped.
+
+Signed-off-by: Dirk Mueller <dmueller@suse.com>
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+[robh: cherry-pick from upstream]
+Cc: stable@vger.kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+---
+ scripts/dtc/dtc-lexer.l | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/scripts/dtc/dtc-lexer.l b/scripts/dtc/dtc-lexer.l
+index 5c6c3fd557d7..b3b7270300de 100644
+--- a/scripts/dtc/dtc-lexer.l
+++ b/scripts/dtc/dtc-lexer.l
+@@ -23,7 +23,6 @@ LINECOMMENT	"//".*\n
+ #include "srcpos.h"
+ #include "dtc-parser.tab.h"
+ 
+-YYLTYPE yylloc;
+ extern bool treesource_error;
+ 
+ /* CAUTION: this will stop working if we ever use yyless() or yyunput() */
+-- 
+2.30.2
+
@@ -13,7 +13,7 @@
                #size-cells = <0x2>;
                device_type = "memory";
                reg = <0x0        0x0        0x0 0x80000000>,
-                      <0x00000008 0x80000000 0x1 0x80000000>;
+                      <0x00000008 0x80000000 0x0 0x80000000>;
        };

        cpus {
@@ -111,7 +111,7 @@

        uart@9c090000 {
                compatible = "arm,pl011", "arm,primecell";
-                reg = <0x0 0x9c090000 0x0 0x10000>;
+                reg = <0x0 0x9c090000 0x0 0x1000>;
                interrupts = <0x0 5 0x4>;
                clocks = <&refclk24mhz>, <&refclk100mhz>;
                clock-names = "uartclk", "apb_pclk";
@@ -119,7 +119,7 @@

        uart@9c0a0000 {
                compatible = "arm,pl011", "arm,primecell";
-                reg = <0x0 0x9c0a0000 0x0 0x10000>;
+                reg = <0x0 0x9c0a0000 0x0 0x1000>;
                interrupts = <0x0 6 0x4>;
                clocks = <&refclk24mhz>, <&refclk100mhz>;
                clock-names = "uartclk", "apb_pclk";
@@ -127,7 +127,7 @@

        uart@9c0b0000 {
                compatible = "arm,pl011", "arm,primecell";
-                reg = <0x0 0x9c0b0000 0x0 0x10000>;
+                reg = <0x0 0x9c0b0000 0x0 0x1000>;
                interrupts = <0x0 7 0x4>;
                clocks = <&refclk24mhz>, <&refclk100mhz>;
                clock-names = "uartclk", "apb_pclk";
@@ -135,7 +135,7 @@

        uart@9c0c0000 {
                compatible = "arm,pl011", "arm,primecell";
-                reg = <0x0 0x9c0c0000 0x0 0x10000>;
+                reg = <0x0 0x9c0c0000 0x0 0x1000>;
                interrupts = <0x0 8 0x4>;
                clocks = <&refclk24mhz>, <&refclk100mhz>;
                clock-names = "uartclk", "apb_pclk";
@@ -143,7 +143,7 @@

        wdt@9c0f0000 {
                compatible = "arm,sp805", "arm,primecell";
-                reg = <0x0 0x9c0f0000 0x0 0x10000>;
+                reg = <0x0 0x9c0f0000 0x0 0x1000>;
                interrupts = <0x0 0 0x4>;
                clocks = <&refclk24mhz>, <&refclk100mhz>;
                clock-names = "wdog_clk", "apb_pclk";
@@ -143,24 +143,6 @@ SRC_URI:append:corstone1000 = " ${@bb.utils.contains('MACHINE_FEATURES', \
 # corstone1000 has limited flash memory constraints
 KERNEL_EXTRA_FEATURES:corstone1000 = ""
 KERNEL_FEATURES:corstone1000 = ""
-# No need to include the kernel image in the rootfs
-# So, let's delete the package doing that and uninstalling the initial
-# kernel binary.
-# The kernel binary needed is the initramfs bundle
-
-FILES:kernel-image-image:corstone1000=""
-
-# Uninstalling the initial kernel binary
-
-do_install:append:corstone1000() {
-    if [ -e "${D}/${KERNEL_IMAGEDEST}/$imageType-${KERNEL_VERSION}" ]; then
-        rm ${D}/${KERNEL_IMAGEDEST}/$imageType-${KERNEL_VERSION}
-    fi
-
-    if [ -e "${D}/${KERNEL_IMAGEDEST}/$imageType" ]; then
-        rm ${D}/${KERNEL_IMAGEDEST}/$imageType
-    fi
-}

 #
 # FVP BASE KMACHINE
@@ -6,7 +6,9 @@ SRCREV_machine = "d4f3318ed8fab6316cb7a269b8f42306632a3876"
 SRCREV_meta = "8d0ed83a864cc91eef4d2abbc90f13d4ecd1c213"

 SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \
-           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"
+           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA} \
+           file://0001-scripts-dtc-Remove-redundant-YYLOC-global-declaratio.patch \
+          "

 LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
 LINUX_VERSION = "5.3.18"
@@ -2,14 +2,14 @@ KBRANCH ?= "v5.4/standard/base"

 require recipes-kernel/linux/linux-yocto.inc

-SRCREV_machine ?= "807b4668ff7fe3be031ace442a84d70821ef9571"
-SRCREV_meta ?= "98ba88191b7c489bc0d83b6c87a31b2330fcd886"
+SRCREV_machine ?= "f840db108606f987e174f1658dc120795798e808"
+SRCREV_meta ?= "63746f1a36196425c38a1bc45dfddbcd6f979850"

 SRC_URI = "git://git.yoctoproject.org/linux-yocto.git;name=machine;branch=${KBRANCH}; \
           git://git.yoctoproject.org/yocto-kernel-cache;type=kmeta;name=meta;branch=yocto-5.4;destsuffix=${KMETA}"

 LIC_FILES_CHKSUM = "file://COPYING;md5=bbea815ee2795b2f4230826c0c6b8814"
-LINUX_VERSION ?= "5.4.139"
+LINUX_VERSION ?= "5.4.183"

 DEPENDS += "openssl-native util-linux-native"

@@ -1,45 +0,0 @@
-FILESEXTRAPATHS:prepend := "${THISDIR}/psa-arch-tests/corstone1000:"
-
-DEPENDS += "cmake-native"
-
-export CMAKE_BUILD_PARALLEL_LEVEL
-CMAKE_BUILD_PARALLEL_LEVEL = "${@oe.utils.parallel_make(d, True)}"
-
-COMPATIBLE_MACHINE = "corstone1000"
-
-SRC_URI:append = "\
-    file://0001-psa-arch-test-sysroot_compiler_flags_fix.patch \
-    file://0002-arm-bsp-psa-arch-test-Fixing-psa-arch-tests-cmake.patch \
-    file://0003-corstone1000-port-crypto-config.patch;patchdir=../psa-arch-tests \
-    "
-
-FILES:${PN} += "${libdir}/libts.so*  ${libdir}/deployments  ${bindir}/psa-*"
-FILES:${PN}-dev = "${includedir}/deployments/psa-api-test/"
-
-INSANE_SKIP:${PN} += "rpaths"
-
-do_configure() {
-    for PSA_API_TEST in ${PSA_API_TESTS}; do
-        cmake \
-        -DSYSROOT_YOCTO=${RECIPE_SYSROOT} \
-        -S ${S}/$PSA_API_TEST -B "${B}/$PSA_API_TEST"
-    done
-}
-
-do_compile() {
-    for PSA_API_TEST in ${PSA_API_TESTS}; do
-        cmake --build "${B}/$PSA_API_TEST"
-    done
-}
-
-do_install() {
-    for PSA_API_TEST in ${PSA_API_TESTS}; do
-        install -d -m 0755 ${D}${libdir}/${PSA_API_TEST}
-        install -d -m 0755 ${D}${includedir}/${PSA_API_TEST}
-        install -m 0755 ${B}/${PSA_API_TEST}/libts_install/arm-linux/lib/*.so* ${D}${libdir}
-	install -d -m 0755 ${B}/${PSA_API_TEST}/libts_install/arm-linux/include ${D}${includedir}/${PSA_API_TEST}
-	psafile_fullpath=`ls ${B}/${PSA_API_TEST}/psa-*`
-	psafile_filename="`basename -s .bin ${psafile_fullpath}`"
-        install -D -p -m 0755 ${psafile_fullpath} ${D}/${bindir}/${psafile_filename}
-    done
-}
@@ -1,68 +0,0 @@
-Upstream-Status: Inappropriate [Not for upstreaming in the original repo]
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-
-From 340ef6788d2803543b15235bf16a79cbc02235bd Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <Emekcan.Aras@arm.com>
-Date: Mon, 6 Dec 2021 10:21:59 +0000
-
-[PATCH] arm-bsp/psa-arch-test: Integrate psa-arch-test
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
---
- deployments/libts/libts-import.cmake         | 4 +++-
- external/MbedTLS/MbedTLS.cmake               | 1 +
- external/psa_arch_tests/psa_arch_tests.cmake | 1 +
- 3 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/deployments/libts/libts-import.cmake b/deployments/libts/libts-import.cmake
-index 792ba86..e3793e8 100644
--- a/deployments/libts/libts-import.cmake
-+++ b/deployments/libts/libts-import.cmake
-@@ -19,7 +19,6 @@ if(NOT DEFINED PROCESSOR_COUNT)
- 	ProcessorCount(PROCESSOR_COUNT)
- 	set(PROCESSOR_COUNT ${PROCESSOR_COUNT} CACHE STRING "Number of cores to use for parallel builds.")
- endif()
-
- set(LIBTS_INSTALL_PATH "${CMAKE_CURRENT_BINARY_DIR}/libts_install" CACHE PATH "libts installation directory")
- set(LIBTS_PACKAGE_PATH "${LIBTS_INSTALL_PATH}/lib/cmake" CACHE PATH "libts CMake package directory")
- set(LIBTS_SOURCE_DIR "${TS_ROOT}/deployments/libts/${TS_ENV}" CACHE PATH "libts source directory")
-@@ -27,9 +26,12 @@ set(LIBTS_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/libts-build" CACHE PATH
- 
- file(MAKE_DIRECTORY ${LIBTS_BINARY_DIR})
- 
-+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} --sysroot=${SYSROOT_YOCTO}")
-+
- #Configure the library
- execute_process(COMMAND
- 	${CMAKE_COMMAND}
-+		-DCMAKE_SYSROOT=${SYSROOT_YOCTO}
- 		-DCMAKE_INSTALL_PREFIX=${LIBTS_INSTALL_PATH}
- 		-GUnix\ Makefiles
- 		${LIBTS_SOURCE_DIR}
-diff --git a/external/MbedTLS/MbedTLS.cmake b/external/MbedTLS/MbedTLS.cmake
-index 3cbaed1..8c53f88 100644
--- a/external/MbedTLS/MbedTLS.cmake
-+++ b/external/MbedTLS/MbedTLS.cmake
-@@ -59,6 +59,7 @@ set(PSA_CRYPTO_API_INCLUDE "${MBEDTLS_INSTALL_PATH}/include" CACHE STRING "PSA C
- #Configure the library
- execute_process(COMMAND
- 	${CMAKE_COMMAND}
-+		-DCMAKE_SYSROOT=${SYSROOT_YOCTO}
- 		-DENABLE_PROGRAMS=OFF
- 		-DENABLE_TESTING=OFF
- 		-DUNSAFE_BUILD=ON
-diff --git a/external/psa_arch_tests/psa_arch_tests.cmake b/external/psa_arch_tests/psa_arch_tests.cmake
-index e6ab73f..af00cfc 100644
--- a/external/psa_arch_tests/psa_arch_tests.cmake
-+++ b/external/psa_arch_tests/psa_arch_tests.cmake
-@@ -52,6 +52,7 @@ string(REPLACE ";" " " PSA_ARCH_TEST_EXTERNAL_DEFS "${PSA_ARCH_TEST_EXTERNAL_DEF
- # Configure the psa-arch-test library
- execute_process(COMMAND
- 	${CMAKE_COMMAND}
-+			-DCMAKE_SYSROOT=${SYSROOT_YOCTO}
- 			-DTOOLCHAIN=INHERIT
- 			-DCMAKE_TOOLCHAIN_FILE=${TS_EXTERNAL_LIB_TOOLCHAIN_FILE}
- 			-DPSA_INCLUDE_PATHS=${PSA_ARCH_TESTS_EXTERNAL_INCLUDE_PATHS}
-- 
-2.25.1
-
@@ -1,49 +0,0 @@
-Upstream-Status: Pending [Not submitted to upstream yet]
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-
-From 4a1f2fd2c3c3f8e00364d3b1a8c76a61e41a483f Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <Emekcan.Aras@arm.com>
-Date: Sat, 11 Dec 2021 09:32:44 +0000
-Subject: [PATCH] arm-bsp/psa-arch-test: Fixing psa-arch-tests cmake
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
---
- external/psa_arch_tests/psa_arch_tests.cmake | 9 +++++----
- 1 file changed, 5 insertions(+), 4 deletions(-)
-
-diff --git a/external/psa_arch_tests/psa_arch_tests.cmake b/external/psa_arch_tests/psa_arch_tests.cmake
-index af00cfc..e4b4f6b 100644
--- a/external/psa_arch_tests/psa_arch_tests.cmake
-+++ b/external/psa_arch_tests/psa_arch_tests.cmake
-@@ -25,15 +25,13 @@ find_program(GIT_COMMAND "git")
- if (NOT GIT_COMMAND)
- 	message(FATAL_ERROR "Please install git")
- endif()
-
-+if ("${PSA_ARCH_TESTS_PATH}" STREQUAL "DOWNLOAD")
- # Fetching psa-arch-tests
- FetchContent_Declare(
- 	psa-arch-tests
- 	GIT_REPOSITORY ${PSA_ARCH_TESTS_URL}
- 	GIT_TAG ${PSA_ARCH_TESTS_REFSPEC}
- 	GIT_SHALLOW TRUE
-	PATCH_COMMAND git stash
-		COMMAND git apply ${CMAKE_CURRENT_LIST_DIR}/modify_attest_config.patch
- )
- 
- # FetchContent_GetProperties exports psa-arch-tests_SOURCE_DIR and psa-arch-tests_BINARY_DIR variables
-@@ -42,7 +40,10 @@ if(NOT psa-arch-tests_POPULATED)
- 	message(STATUS "Fetching psa-arch-tests")
- 	FetchContent_Populate(psa-arch-tests)
- endif()
-
-+else()
-+    set(psa-arch-tests_SOURCE_DIR "${TS_ROOT}/../psa-arch-tests")
-+    set(psa-arch-tests_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}")
-+endif()
- # Ensure list of include paths is separated correctly
- string(REPLACE ";" "\\;" PSA_ARCH_TESTS_EXTERNAL_INCLUDE_PATHS "${PSA_ARCH_TESTS_EXTERNAL_INCLUDE_PATHS}")
- 
-- 
-2.25.1
-
@@ -1,6 +0,0 @@
-# Machine specific configurations
-
-MACHINE_PSA_REQUIRE ?= ""
-MACHINE_PSA_REQUIRE:corstone1000 = "psa-arch-tests-corstone1000.inc"
-
-require ${MACHINE_PSA_REQUIRE}
@@ -0,0 +1,258 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From ddff15a07e2fb7eddfa1d988fce25d82cb22f7ee Mon Sep 17 00:00:00 2001
+From: Gyorgy Szing <Gyorgy.Szing@arm.com>
+Date: Wed, 8 Dec 2021 04:20:34 +0100
+Subject: [PATCH 01/15] Enhance mbedtls fetch process
+
+Update management of MbedTLS external component to be optimized
+for download speed insted of availability.
+The updated process is:
+  - check if binary is available. If yes configure build to use it
+    and stop.
+  - if not, check is source is available. If yes, build it and use
+    the resulting binary.
+  - if not, then download the source using git, compile it and use
+    the resulting binary
+
+The following variables can be set on the command line to alter the
+behavior of the module:
+  - MBEDTLS_URL git repo URL to fetch from.
+  - MBEDTLS_REFSPEC revision to fetch
+  - MBEDTLS_SOURCE_DIR to specify location of source code in
+    local file syetem.
+  - MBEDTLS_INSTALL_DIR to specify location of binary.
+
+I.e. cmake -S <...> -B <...> -DMBEDTLS_INSTALL_DIR=~/mbedtls
+will make the resulting binary installed to ~/mbedtls. This can be
+used later to speed up a clean build an use the prebuilt binary.
+
+Change-Id: I8a9ad8b3303e6dfa0a7c9c3d7e4b4787b94d925a
+Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
+---
+ external/MbedTLS/MbedTLS.cmake | 192 ++++++++++++++++++++-------------
+ 1 file changed, 119 insertions(+), 73 deletions(-)
+
+diff --git a/external/MbedTLS/MbedTLS.cmake b/external/MbedTLS/MbedTLS.cmake
+index 3cbaed15..935be765 100644
+--- a/external/MbedTLS/MbedTLS.cmake
+++ b/external/MbedTLS/MbedTLS.cmake
+@@ -1,96 +1,142 @@
+ #-------------------------------------------------------------------------------
+-# Copyright (c) 2020-2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2020-2022, Arm Limited and Contributors. All rights reserved.
+ #
+ # SPDX-License-Identifier: BSD-3-Clause
+ #
+ #-------------------------------------------------------------------------------
+
+-# Determine the number of processes to run while running parallel builds.
+-# Pass -DPROCESSOR_COUNT=<n> to cmake to override.
+-if(NOT DEFINED PROCESSOR_COUNT)
+-	include(ProcessorCount)
+-	ProcessorCount(PROCESSOR_COUNT)
+-	set(PROCESSOR_COUNT ${PROCESSOR_COUNT} CACHE STRING "Number of cores to use for parallel builds.")
+-endif()
+set(MBEDTLS_URL "https://github.com/ARMmbed/mbedtls.git"
+		CACHE STRING "Mbed TLS repository URL")
+set(MBEDTLS_REFSPEC "mbedtls-3.0.0"
+		CACHE STRING "Mbed TLS git refspec")
+set(MBEDTLS_SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/mbedtls-src"
+		CACHE PATH "MbedTLS source directory")
+set(MBEDTLS_INSTALL_DIR "${CMAKE_CURRENT_BINARY_DIR}/mbedtls_install"
+		CACHE PATH "Mbed TLS installation directory")
+
+-set(MBEDTLS_URL "https://github.com/ARMmbed/mbedtls.git" CACHE STRING "Mbed TLS repository URL")
+-set(MBEDTLS_REFSPEC "mbedtls-3.0.0" CACHE STRING "Mbed TLS git refspec")
+-set(MBEDTLS_INSTALL_PATH "${CMAKE_CURRENT_BINARY_DIR}/mbedtls_install" CACHE PATH "Mbed TLS installation directory")
+-set(MBEDTLS_PACKAGE_PATH "${MBEDTLS_INSTALL_PATH}/lib/mbedtls/cmake" CACHE PATH "Mbed TLS CMake package directory")
+find_library(MBEDCRYPTO_LIB_FILE
+				NAMES libmbedcrypto.a mbedcrypto.a libmbedcrypto.lib mbedcrypto.lib
+				PATHS ${MBEDTLS_INSTALL_DIR}
+				PATH_SUFFIXES "lib"
+				DOC "Location of mberdrypto library."
+				NO_DEFAULT_PATH
+)
+
+-include(FetchContent)
+set(MBEDCRYPTO_LIB_FILE ${MBEDCRYPTO_LIB_FILE})
+unset(MBEDCRYPTO_LIB_FILE CACHE)
+
+-# Checking git
+-find_program(GIT_COMMAND "git")
+-if (NOT GIT_COMMAND)
+-	message(FATAL_ERROR "Please install git")
+-endif()
+set(MBEDTLS_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/mbedtls-build")
+
+-# Fetching Mbed TLS
+-FetchContent_Declare(
+-	mbedtls
+-	GIT_REPOSITORY ${MBEDTLS_URL}
+-	GIT_TAG ${MBEDTLS_REFSPEC}
+-	GIT_SHALLOW TRUE
+-)
+# Binary not found and it needs to be built.
+if (NOT MBEDCRYPTO_LIB_FILE)
+	# Determine the number of processes to run while running parallel builds.
+	# Pass -DPROCESSOR_COUNT=<n> to cmake to override.
+	if(NOT DEFINED PROCESSOR_COUNT)
+		include(ProcessorCount)
+		ProcessorCount(PROCESSOR_COUNT)
+		set(PROCESSOR_COUNT ${PROCESSOR_COUNT}
+				CACHE STRING "Number of cores to use for parallel builds.")
+	endif()
+
+-# FetchContent_GetProperties exports mbedtls_SOURCE_DIR and mbedtls_BINARY_DIR variables
+-FetchContent_GetProperties(mbedtls)
+-if(NOT mbedtls_POPULATED)
+-	message(STATUS "Fetching Mbed TLS")
+-	FetchContent_Populate(mbedtls)
+-endif()
+	# See if the source is available locally
+	find_file(MBEDCRYPTO_HEADER_FILE
+		NAMES crypto.h
+		PATHS ${MBEDTLS_SOURCE_DIR}
+		PATH_SUFFIXES "include/psa"
+		NO_DEFAULT_PATH
+	)
+	set(MBEDCRYPTO_HEADER_FILE ${MBEDCRYPTO_HEADER_FILE})
+	unset(MBEDCRYPTO_HEADER_FILE CACHE)
+
+-# Convert the include path list to a string. Needed to make parameter passing to
+-# Mbed TLS build work fine.
+-string(REPLACE ";" "\\;" MBEDTLS_EXTRA_INCLUDES "${MBEDTLS_EXTRA_INCLUDES}")
+	# Source not found, fetch it.
+	if (NOT MBEDCRYPTO_HEADER_FILE)
+		include(FetchContent)
+
+-find_package(Python3 COMPONENTS Interpreter)
+-if (NOT Python3_Interpreter_FOUND)
+-	message(FATAL_ERROR "Python 3 interpreter not found.")
+-endif()
+		# Checking git
+		find_program(GIT_COMMAND "git")
+		if (NOT GIT_COMMAND)
+			message(FATAL_ERROR "Please install git")
+		endif()
+
+-#Configure Mbed TLS to build only mbedcrypto lib
+-execute_process(COMMAND ${Python3_EXECUTABLE} scripts/config.py crypto WORKING_DIRECTORY ${mbedtls_SOURCE_DIR})
+-
+-# Advertise Mbed TLS as the provider of the psa crypto API
+-set(PSA_CRYPTO_API_INCLUDE "${MBEDTLS_INSTALL_PATH}/include" CACHE STRING "PSA Crypto API include path")
+-
+-#Configure the library
+-execute_process(COMMAND
+-	${CMAKE_COMMAND}
+-		-DENABLE_PROGRAMS=OFF
+-		-DENABLE_TESTING=OFF
+-		-DUNSAFE_BUILD=ON
+-		-DCMAKE_INSTALL_PREFIX=${MBEDTLS_INSTALL_PATH}
+-		-DCMAKE_TOOLCHAIN_FILE=${TS_EXTERNAL_LIB_TOOLCHAIN_FILE}
+-		-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY
+-		-DEXTERNAL_DEFINITIONS=-DMBEDTLS_USER_CONFIG_FILE="${MBEDTLS_USER_CONFIG_FILE}"
+-		-DEXTERNAL_INCLUDE_PATHS=${MBEDTLS_EXTRA_INCLUDES}
+-		-GUnix\ Makefiles
+-		${mbedtls_SOURCE_DIR}
+-	WORKING_DIRECTORY
+-		${mbedtls_BINARY_DIR}
+-	RESULT_VARIABLE _exec_error
+-)
+		# Fetching Mbed TLS
+		FetchContent_Declare(
+			mbedtls
+			SOURCE_DIR ${MBEDTLS_SOURCE_DIR}
+			BINARY_DIR ${MBEDTLS_BINARY_DIR}
+			GIT_REPOSITORY ${MBEDTLS_URL}
+			GIT_TAG ${MBEDTLS_REFSPEC}
+			GIT_SHALLOW TRUE
+		)
+
+-if (_exec_error)
+-	message(FATAL_ERROR "Configuration step of Mbed TLS failed with ${_exec_error}.")
+-endif()
+		# FetchContent_GetProperties exports mbedtls_SOURCE_DIR and mbedtls_BINARY_DIR variables
+		FetchContent_GetProperties(mbedtls)
+		# FetchContent_Populate will fail if the source directory is removed since it will try to
+		# do an "update" and not a "populate" action. As a workaround, remove the subbuild directory.
+		# Note: this fix assumes, the default subbuild location is used.
+		file(REMOVE_RECURSE "${CMAKE_CURRENT_BINARY_DIR}/_deps/mbedtls-subbuild")
+
+		# If the source directory has been moved, the binary dir must be regenerated from scratch.
+		file(REMOVE_RECURSE "${MBEDTLS_BINARY_DIR}")
+
+-#TODO: add dependency to generated project on this file!
+-#TODO: add custom target to rebuild Mbed TLS
+		if (NOT mbedtls_POPULATED)
+			message(STATUS "Fetching Mbed TLS")
+			FetchContent_Populate(mbedtls)
+		endif()
+		set_property(DIRECTORY APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${MBEDTLS_SOURCE_DIR})
+	endif()
+
+-#Build the library
+-execute_process(COMMAND
+-		${CMAKE_COMMAND} --build ${mbedtls_BINARY_DIR} --parallel ${PROCESSOR_COUNT} --target install
+	# Build mbedcrypto library
+
+	# Convert the include path list to a string. Needed to make parameter passing to
+	# Mbed TLS build work fine.
+	string(REPLACE ";" "\\;" MBEDTLS_EXTRA_INCLUDES "${MBEDTLS_EXTRA_INCLUDES}")
+
+	find_package(Python3 REQUIRED COMPONENTS Interpreter)
+
+	#Configure Mbed TLS to build only mbedcrypto lib
+	execute_process(COMMAND ${Python3_EXECUTABLE} scripts/config.py crypto WORKING_DIRECTORY ${MBEDTLS_SOURCE_DIR})
+
+	# Advertise Mbed TLS as the provider of the psa crypto API
+	set(PSA_CRYPTO_API_INCLUDE "${MBEDTLS_INSTALL_DIR}/include" CACHE STRING "PSA Crypto API include path")
+
+	#Configure the library
+	execute_process(COMMAND
+		${CMAKE_COMMAND} -E env CROSS_COMPILE=${CROSS_COMPILE}
+			${CMAKE_COMMAND}
+				-DENABLE_PROGRAMS=OFF
+				-DENABLE_TESTING=OFF
+				-DUNSAFE_BUILD=ON
+				-DCMAKE_INSTALL_PREFIX=${MBEDTLS_INSTALL_DIR}
+				-DCMAKE_TOOLCHAIN_FILE=${TS_EXTERNAL_LIB_TOOLCHAIN_FILE}
+				-DCMAKE_TRY_COMPILE_TARGET_TYPE=STATIC_LIBRARY
+				-DEXTERNAL_DEFINITIONS=-DMBEDTLS_USER_CONFIG_FILE="${MBEDTLS_USER_CONFIG_FILE}"
+				-DEXTERNAL_INCLUDE_PATHS=${MBEDTLS_EXTRA_INCLUDES}
+				-GUnix\ Makefiles
+				${MBEDTLS_SOURCE_DIR}
+		WORKING_DIRECTORY
+			${MBEDTLS_BINARY_DIR}
+ 		RESULT_VARIABLE _exec_error
+ 	)
+-if (_exec_error)
+-	message(FATAL_ERROR "Build step of Mbed TLS failed with ${_exec_error}.")
+
+	if (_exec_error)
+		message(FATAL_ERROR "Configuration step of Mbed TLS failed with ${_exec_error}.")
+	endif()
+
+	#Build the library
+	execute_process(COMMAND
+			${CMAKE_COMMAND} --build ${MBEDTLS_BINARY_DIR} --parallel ${PROCESSOR_COUNT} --target install
+			RESULT_VARIABLE _exec_error
+		)
+
+	if (_exec_error)
+		message(FATAL_ERROR "Build step of Mbed TLS failed with ${_exec_error}.")
+	endif()
+
+	set(MBEDCRYPTO_LIB_FILE "${MBEDTLS_INSTALL_DIR}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}mbedcrypto${CMAKE_STATIC_LIBRARY_SUFFIX}")
+ endif()
+
+ #Create an imported target to have clean abstraction in the build-system.
+ add_library(mbedcrypto STATIC IMPORTED)
+-set_property(TARGET mbedcrypto PROPERTY IMPORTED_LOCATION "${MBEDTLS_INSTALL_PATH}/lib/${CMAKE_STATIC_LIBRARY_PREFIX}mbedcrypto${CMAKE_STATIC_LIBRARY_SUFFIX}")
+-set_property(TARGET mbedcrypto PROPERTY INTERFACE_INCLUDE_DIRECTORIES "${MBEDTLS_INSTALL_PATH}/include")
+set_property(DIRECTORY ${CMAKE_SOURCE_DIR} APPEND PROPERTY CMAKE_CONFIGURE_DEPENDS ${MBEDCRYPTO_LIB_FILE})
+set_property(TARGET mbedcrypto PROPERTY IMPORTED_LOCATION ${MBEDCRYPTO_LIB_FILE})
+set_property(TARGET mbedcrypto PROPERTY INTERFACE_INCLUDE_DIRECTORIES "${MBEDTLS_INSTALL_DIR}/include")
+--
+2.25.1
@@ -0,0 +1,41 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From ba99622ba2f0048159bea2d0086173b8d5365473 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Fri, 11 Feb 2022 12:30:45 +0000
+Subject: [PATCH 02/15] Fix format specifier in logging_caller
+
+A previous change increased the width of the opstatus value
+returned by an rpc endpoint from 32 to 64 bits. This change
+corrects the printf format specifier in the rpc logging_caller
+that corresponds to logging the opstatus value.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: Ie695a6bf8cf8014317b85196d7b933d344782b2c
+---
+ components/rpc/common/logging/logging_caller.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/components/rpc/common/logging/logging_caller.c b/components/rpc/common/logging/logging_caller.c
+index 07c33de5..cac03f2f 100644
+--- a/components/rpc/common/logging/logging_caller.c
+++ b/components/rpc/common/logging/logging_caller.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -87,7 +87,7 @@ static rpc_status_t call_invoke(void *context, rpc_call_handle handle, uint32_t
+
+ 	if (status == TS_RPC_CALL_ACCEPTED) {
+
+-		fprintf(this_instance->log_file, "op_status: %d\n", *opstatus);
+		fprintf(this_instance->log_file, "op_status: %ld\n", *opstatus);
+ 		fprintf(this_instance->log_file, "resp_len: %ld\n", *resp_len);
+ 	}
+
+--
+2.25.1
@@ -0,0 +1,65 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From ba6af6e6500a2ba25ab6c01d641383c24f9fab07 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Fri, 11 Feb 2022 13:42:59 +0000
+Subject: [PATCH 03/15] Update refspecs for mbedtls and psa-arch-tests for
+ v3.1.0
+
+Updates external component refspecs to use mbedtls 3.1.0 and
+compatible API tests from psa-arch-test.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: I1b5cebd7de3c1885f5f8a8ea21ba5e4c52aefaf4
+---
+ external/MbedTLS/MbedTLS.cmake               |  2 +-
+ external/psa_arch_tests/psa_arch_tests.cmake | 17 ++++++-----------
+ 2 files changed, 7 insertions(+), 12 deletions(-)
+
+diff --git a/external/MbedTLS/MbedTLS.cmake b/external/MbedTLS/MbedTLS.cmake
+index 935be765..3350d8a0 100644
+--- a/external/MbedTLS/MbedTLS.cmake
+++ b/external/MbedTLS/MbedTLS.cmake
+@@ -7,7 +7,7 @@
+
+ set(MBEDTLS_URL "https://github.com/ARMmbed/mbedtls.git"
+ 		CACHE STRING "Mbed TLS repository URL")
+-set(MBEDTLS_REFSPEC "mbedtls-3.0.0"
+set(MBEDTLS_REFSPEC "mbedtls-3.1.0"
+ 		CACHE STRING "Mbed TLS git refspec")
+ set(MBEDTLS_SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/mbedtls-src"
+ 		CACHE PATH "MbedTLS source directory")
+diff --git a/external/psa_arch_tests/psa_arch_tests.cmake b/external/psa_arch_tests/psa_arch_tests.cmake
+index e6ab73f7..f6d2fb9f 100644
+--- a/external/psa_arch_tests/psa_arch_tests.cmake
+++ b/external/psa_arch_tests/psa_arch_tests.cmake
+@@ -5,20 +5,15 @@
+ #
+ #-------------------------------------------------------------------------------
+
+-# Determine the number of processes to run while running parallel builds.
+-# Pass -DPROCESSOR_COUNT=<n> to cmake to override.
+-if(NOT DEFINED PROCESSOR_COUNT)
+-	include(ProcessorCount)
+-	ProcessorCount(PROCESSOR_COUNT)
+-	set(PROCESSOR_COUNT ${PROCESSOR_COUNT} CACHE STRING "Number of cores to use for parallel builds.")
+-endif()
+# Temporarily using modified tests used for tf-m verification
+set(PSA_ARCH_TESTS_URL "https://github.com/bensze01/psa-arch-tests.git" CACHE STRING "psa-arch-tests repository URL")
+set(PSA_ARCH_TESTS_REFSPEC "fix-multipart-aead" CACHE STRING "psa-arch-tests git refspec")
+
+-set(PSA_ARCH_TESTS_URL "https://github.com/ARM-software/psa-arch-tests.git" CACHE STRING "psa-arch-tests repository URL")
+-set(PSA_ARCH_TESTS_REFSPEC "master" CACHE STRING "psa-arch-tests git refspec")
+#set(PSA_ARCH_TESTS_URL "https://github.com/ARM-software/psa-arch-tests.git" CACHE STRING "psa-arch-tests repository URL")
+#set(PSA_ARCH_TESTS_REFSPEC "2a1852252a9b9af655cbe02d5d3c930952d0d798" CACHE STRING "psa-arch-tests v22.01_API1.4_ADAC_BETA")
+ set(PSA_ARCH_TESTS_INSTALL_PATH "${CMAKE_CURRENT_BINARY_DIR}/psa-arch-tests_install" CACHE PATH "psa-arch-tests installation directory")
+ set(PSA_ARCH_TESTS_PACKAGE_PATH "${PSA_ARCH_TESTS_INSTALL_PATH}/libpsa-arch-tests/cmake" CACHE PATH "psa-arch-tests CMake package directory")
+-
+-include(FetchContent)
+set(PSA_ARCH_TESTS_SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/psa_arch_tests-src" CACHE PATH "psa-arch-tests source.")
+
+ # Checking git
+ find_program(GIT_COMMAND "git")
+--
+2.25.1
@@ -0,0 +1,124 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 68e189877ea1aa893facafb8b336e92112555e07 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Fri, 11 Feb 2022 14:19:26 +0000
+Subject: [PATCH 05/15] Add defence against uninitialised multi-part
+ transaction
+
+Adds checks for the condition where there is an attempt to
+setup a multi-part transaction without first initialising
+transaction state.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: I754479260fed0490d8f32b41a077d26028dc9903
+---
+ components/service/crypto/client/psa/psa_cipher.c | 14 +++++++++++++-
+ components/service/crypto/client/psa/psa_hash.c   |  8 +++++++-
+ components/service/crypto/client/psa/psa_mac.c    | 10 ++++++++--
+ 3 files changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/components/service/crypto/client/psa/psa_cipher.c b/components/service/crypto/client/psa/psa_cipher.c
+index 70836ea6..3ab8ea21 100644
+--- a/components/service/crypto/client/psa/psa_cipher.c
+++ b/components/service/crypto/client/psa/psa_cipher.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -13,6 +13,12 @@ psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
+ 	psa_key_id_t key,
+ 	psa_algorithm_t alg)
+ {
+	if (psa_crypto_client_instance.init_status != PSA_SUCCESS)
+		return psa_crypto_client_instance.init_status;
+
+	if (operation->handle)
+		return PSA_ERROR_BAD_STATE;
+
+ 	return crypto_caller_cipher_encrypt_setup(&psa_crypto_client_instance.base,
+ 		&operation->handle,
+ 		key, alg);
+@@ -22,6 +28,12 @@ psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
+ 	psa_key_id_t key,
+ 	psa_algorithm_t alg)
+ {
+	if (psa_crypto_client_instance.init_status != PSA_SUCCESS)
+		return psa_crypto_client_instance.init_status;
+
+	if (operation->handle)
+		return PSA_ERROR_BAD_STATE;
+
+ 	return crypto_caller_cipher_decrypt_setup(&psa_crypto_client_instance.base,
+ 		&operation->handle,
+ 		key, alg);
+diff --git a/components/service/crypto/client/psa/psa_hash.c b/components/service/crypto/client/psa/psa_hash.c
+index 7005c390..83278de6 100644
+--- a/components/service/crypto/client/psa/psa_hash.c
+++ b/components/service/crypto/client/psa/psa_hash.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -14,6 +14,9 @@ psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
+ 	if (psa_crypto_client_instance.init_status != PSA_SUCCESS)
+ 		return psa_crypto_client_instance.init_status;
+
+	if (operation->handle)
+		return PSA_ERROR_BAD_STATE;
+
+ 	return crypto_caller_hash_setup(&psa_crypto_client_instance.base,
+ 		&operation->handle, alg);
+ }
+@@ -55,6 +58,9 @@ psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
+ psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
+ 	psa_hash_operation_t *target_operation)
+ {
+	if (target_operation->handle)
+		return PSA_ERROR_BAD_STATE;
+
+ 	return crypto_caller_hash_clone(&psa_crypto_client_instance.base,
+ 		source_operation->handle,
+ 		&target_operation->handle);
+diff --git a/components/service/crypto/client/psa/psa_mac.c b/components/service/crypto/client/psa/psa_mac.c
+index 5efa1c4d..5c5eb32a 100644
+--- a/components/service/crypto/client/psa/psa_mac.c
+++ b/components/service/crypto/client/psa/psa_mac.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -16,6 +16,9 @@ psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
+ 	if (psa_crypto_client_instance.init_status != PSA_SUCCESS)
+ 		return psa_crypto_client_instance.init_status;
+
+	if (operation->handle)
+		return PSA_ERROR_BAD_STATE;
+
+ 	return crypto_caller_mac_sign_setup(&psa_crypto_client_instance.base,
+ 		&operation->handle,
+ 		key, alg);
+@@ -28,7 +31,10 @@ psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
+ 	if (psa_crypto_client_instance.init_status != PSA_SUCCESS)
+ 		return psa_crypto_client_instance.init_status;
+
+-	return crypto_caller_mac_sign_setup(&psa_crypto_client_instance.base,
+	if (operation->handle)
+		return PSA_ERROR_BAD_STATE;
+
+	return crypto_caller_mac_verify_setup(&psa_crypto_client_instance.base,
+ 		&operation->handle,
+ 		key, alg);
+ }
+--
+2.25.1
@@ -0,0 +1,521 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From d800f7eaa25efca41535a223ef5d524651dee103 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Fri, 11 Feb 2022 14:24:53 +0000
+Subject: [PATCH 06/15] Integrate AEAD operation support
+
+Resolves issues and integrates AEAD support into the crypto service
+provider and clients.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: I5fbe78a2dd825f592e26fd665f60c18b576f9de9
+---
+ .../caller/packed-c/crypto_caller_aead.h      |  70 +++---
+ .../client/caller/stub/crypto_caller_aead.h   |  12 +-
+ .../service/crypto/client/psa/psa_aead.c      | 221 +++++++++++++++---
+ .../factory/full/crypto_provider_factory.c    |  16 +-
+ .../component-test/component-test.cmake       |   4 +-
+ deployments/crypto/opteesp/CMakeLists.txt     |   4 +-
+ deployments/libts/linux-pc/CMakeLists.txt     |   4 +-
+ deployments/se-proxy/opteesp/CMakeLists.txt   |   4 +-
+ 8 files changed, 263 insertions(+), 72 deletions(-)
+
+diff --git a/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h b/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h
+index 3d9947d5..c4ffb20c 100644
+--- a/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h
+++ b/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -20,38 +20,6 @@
+ extern "C" {
+ #endif
+
+-static inline psa_status_t crypto_caller_aead_encrypt(struct service_client *context,
+-	psa_key_id_t key,
+-	psa_algorithm_t alg,
+-	const uint8_t *nonce,
+-	size_t nonce_length,
+-	const uint8_t *additional_data,
+-	size_t additional_data_length,
+-	const uint8_t *plaintext,
+-	size_t plaintext_length,
+-	uint8_t *aeadtext,
+-	size_t aeadtext_size,
+-	size_t *aeadtext_length)
+-{
+-	return PSA_ERROR_NOT_SUPPORTED;
+-}
+-
+-static inline psa_status_t crypto_caller_aead_decrypt(struct service_client *context,
+-	psa_key_id_t key,
+-	psa_algorithm_t alg,
+-	const uint8_t *nonce,
+-	size_t nonce_length,
+-	const uint8_t *additional_data,
+-	size_t additional_data_length,
+-	const uint8_t *aeadtext,
+-	size_t aeadtext_length,
+-	uint8_t *plaintext,
+-	size_t plaintext_size,
+-	size_t *plaintext_length)
+-{
+-	return PSA_ERROR_NOT_SUPPORTED;
+-}
+-
+ static inline psa_status_t common_aead_setup(struct service_client *context,
+ 	uint32_t *op_handle,
+ 	psa_key_id_t key,
+@@ -247,7 +215,7 @@ static inline psa_status_t crypto_caller_aead_set_lengths(struct service_client
+ {
+ 	psa_status_t psa_status = PSA_ERROR_GENERIC_ERROR;
+ 	struct ts_crypto_aead_set_lengths_in req_msg;
+-	size_t req_fixed_len = sizeof(struct ts_crypto_aead_abort_in);
+	size_t req_fixed_len = sizeof(struct ts_crypto_aead_set_lengths_in);
+ 	size_t req_len = req_fixed_len;
+
+ 	req_msg.op_handle = op_handle;
+@@ -611,6 +579,40 @@ static inline psa_status_t crypto_caller_aead_abort(struct service_client *conte
+ 	return psa_status;
+ }
+
+/**
+ * The maximum data length that may be carried in an update operation will be
+ * constrained by the maximum call payload capacity imposed by the end-to-end
+ * RPC call path. These functions return the maximum update size when serialization
+ * overheads are considered. This allows large paylaods to be processed in
+ * maximum size chunks.
+ */
+static inline size_t crypto_caller_aead_max_update_ad_size(const struct service_client *context)
+{
+	/* Returns the maximum number of bytes of additional data that may be
+	 * carried as a parameter of the aead_update_ad operation
+	 * using the packed-c encoding.
+	 */
+	size_t payload_space = context->service_info.max_payload;
+	size_t overhead = sizeof(struct ts_crypto_aead_update_ad_in) + TLV_HDR_LEN;
+
+	return (payload_space > overhead) ? payload_space - overhead : 0;
+}
+
+static inline size_t crypto_caller_aead_max_update_size(const struct service_client *context)
+{
+	/* Returns the maximum number of bytes that may be
+	 * carried as a parameter of the aead_update operation
+	 * using the packed-c encoding.
+	 */
+	size_t payload_space = context->service_info.max_payload;
+	size_t overhead = sizeof(struct ts_crypto_aead_update_in) + TLV_HDR_LEN;
+
+	/* Allow for output to be a whole number of blocks */
+	overhead += PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE;
+
+	return (payload_space > overhead) ? payload_space - overhead : 0;
+}
+
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/components/service/crypto/client/caller/stub/crypto_caller_aead.h b/components/service/crypto/client/caller/stub/crypto_caller_aead.h
+index 18aa8cec..455e7ac1 100644
+--- a/components/service/crypto/client/caller/stub/crypto_caller_aead.h
+++ b/components/service/crypto/client/caller/stub/crypto_caller_aead.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -135,6 +135,16 @@ static inline psa_status_t crypto_caller_aead_abort(struct service_client *conte
+ 	return PSA_ERROR_NOT_SUPPORTED;
+ }
+
+static inline size_t crypto_caller_aead_max_update_ad_size(const struct service_client *context)
+{
+	return 0;
+}
+
+static inline size_t crypto_caller_aead_max_update_size(const struct service_client *context)
+{
+	return 0;
+}
+
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/components/service/crypto/client/psa/psa_aead.c b/components/service/crypto/client/psa/psa_aead.c
+index 22fd3da1..e4579e63 100644
+--- a/components/service/crypto/client/psa/psa_aead.c
+++ b/components/service/crypto/client/psa/psa_aead.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -8,37 +8,6 @@
+ #include "psa_crypto_client.h"
+ #include "crypto_caller_selector.h"
+
+-
+-psa_status_t psa_aead_encrypt(psa_key_id_t key,
+-	psa_algorithm_t alg,
+-	const uint8_t *nonce,
+-	size_t nonce_length,
+-	const uint8_t *additional_data,
+-	size_t additional_data_length,
+-	const uint8_t *plaintext,
+-	size_t plaintext_length,
+-	uint8_t *aeadtext,
+-	size_t aeadtext_size,
+-	size_t *aeadtext_length)
+-{
+-	return PSA_ERROR_NOT_SUPPORTED;
+-}
+-
+-psa_status_t psa_aead_decrypt(psa_key_id_t key,
+-	psa_algorithm_t alg,
+-	const uint8_t *nonce,
+-	size_t nonce_length,
+-	const uint8_t *additional_data,
+-	size_t additional_data_length,
+-	const uint8_t *aeadtext,
+-	size_t aeadtext_length,
+-	uint8_t *plaintext,
+-	size_t plaintext_size,
+-	size_t *plaintext_length)
+-{
+-	return PSA_ERROR_NOT_SUPPORTED;
+-}
+-
+ psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
+ 	psa_key_id_t key,
+ 	psa_algorithm_t alg)
+@@ -143,3 +112,191 @@ psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
+ 	return crypto_caller_aead_abort(&psa_crypto_client_instance.base,
+ 		operation->handle);
+ }
+
+static psa_status_t multi_aead_update_ad(psa_aead_operation_t *operation,
+	const uint8_t *input,
+	size_t input_length)
+{
+	psa_status_t psa_status = PSA_SUCCESS;
+	size_t max_update_size =
+		crypto_caller_aead_max_update_ad_size(&psa_crypto_client_instance.base);
+	size_t bytes_input = 0;
+
+	if (!max_update_size) {
+
+		/* Don't know the max update size so assume that the entire
+		 * input and output can be handled in a single update.  If
+		 * this isn't true, the first aead update operation will fail
+		 * safely.
+		 */
+		max_update_size = input_length;
+	}
+
+	while (bytes_input < input_length) {
+
+		size_t bytes_remaining = input_length - bytes_input;
+		size_t update_len = (bytes_remaining < max_update_size) ?
+			bytes_remaining :
+			max_update_size;
+
+		psa_status = psa_aead_update_ad(operation,
+			&input[bytes_input], update_len);
+
+		if (psa_status != PSA_SUCCESS) break;
+
+		bytes_input += update_len;
+	}
+
+	return psa_status;
+}
+
+static psa_status_t multi_aead_update(psa_aead_operation_t *operation,
+	const uint8_t *input,
+	size_t input_length,
+	uint8_t *output,
+	size_t output_size,
+	size_t *output_length)
+{
+	psa_status_t psa_status = PSA_SUCCESS;
+	size_t max_update_size =
+		crypto_caller_aead_max_update_size(&psa_crypto_client_instance.base);
+	size_t bytes_input = 0;
+	size_t bytes_output = 0;
+
+	*output_length = 0;
+
+	if (!max_update_size) {
+
+		/* Don't know the max update size so assume that the entire
+		 * input and output can be handled in a single update.  If
+		 * this isn't true, the first aead update operation will fail
+		 * safely.
+		 */
+		max_update_size = input_length;
+	}
+
+	while ((bytes_input < input_length) && (bytes_output < output_size)) {
+
+		size_t update_output_len = 0;
+		size_t bytes_remaining = input_length - bytes_input;
+		size_t update_len = (bytes_remaining < max_update_size) ?
+			bytes_remaining :
+			max_update_size;
+
+		psa_status = psa_aead_update(operation,
+			&input[bytes_input], update_len,
+			&output[bytes_output], output_size - bytes_output, &update_output_len);
+
+		if (psa_status != PSA_SUCCESS) break;
+
+		bytes_input += update_len;
+		bytes_output += update_output_len;
+	}
+
+	if (psa_status == PSA_SUCCESS) {
+
+		*output_length = bytes_output;
+	}
+
+	return psa_status;
+}
+
+psa_status_t psa_aead_encrypt(psa_key_id_t key,
+	psa_algorithm_t alg,
+	const uint8_t *nonce,
+	size_t nonce_length,
+	const uint8_t *additional_data,
+	size_t additional_data_length,
+	const uint8_t *plaintext,
+	size_t plaintext_length,
+	uint8_t *aeadtext,
+	size_t aeadtext_size,
+	size_t *aeadtext_length)
+{
+	psa_aead_operation_t operation = psa_aead_operation_init();
+	size_t bytes_output = 0;
+	*aeadtext_length = 0;
+
+	psa_status_t psa_status = psa_aead_encrypt_setup(&operation, key, alg);
+	if (psa_status != PSA_SUCCESS) return psa_status;
+
+	if ((psa_status = psa_aead_set_lengths(&operation, additional_data_length, plaintext_length),
+			psa_status == PSA_SUCCESS) &&
+		(psa_status = psa_aead_set_nonce(&operation, nonce, nonce_length),
+			psa_status == PSA_SUCCESS) &&
+		(psa_status = multi_aead_update_ad(&operation, additional_data, additional_data_length),
+			psa_status == PSA_SUCCESS) &&
+		(psa_status = multi_aead_update(&operation, plaintext, plaintext_length,
+			aeadtext, aeadtext_size, &bytes_output),
+			psa_status == PSA_SUCCESS))
+	{
+		size_t remaining_aead_len = 0;
+		size_t tag_len = 0;
+
+		psa_status = psa_aead_finish(&operation,
+			NULL, 0, &remaining_aead_len,
+			&aeadtext[bytes_output], aeadtext_size - bytes_output, &tag_len);
+
+		if (psa_status == PSA_SUCCESS) {
+
+			*aeadtext_length = bytes_output + remaining_aead_len + tag_len;
+		}
+	}
+	else {
+
+		psa_aead_abort(&operation);
+	}
+
+	return psa_status;
+}
+
+psa_status_t psa_aead_decrypt(psa_key_id_t key,
+	psa_algorithm_t alg,
+	const uint8_t *nonce,
+	size_t nonce_length,
+	const uint8_t *additional_data,
+	size_t additional_data_length,
+	const uint8_t *aeadtext,
+	size_t aeadtext_length,
+	uint8_t *plaintext,
+	size_t plaintext_size,
+	size_t *plaintext_length)
+{
+	psa_aead_operation_t operation = psa_aead_operation_init();
+	size_t bytes_output = 0;
+	*plaintext_length = 0;
+
+	psa_status_t psa_status = psa_aead_decrypt_setup(&operation, key, alg);
+	if (psa_status != PSA_SUCCESS) return psa_status;
+
+	size_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
+	size_t ciphertext_len = (aeadtext_length > tag_len) ? aeadtext_length - tag_len : 0;
+
+	if ((psa_status = psa_aead_set_lengths(&operation, additional_data_length, ciphertext_len),
+			psa_status == PSA_SUCCESS) &&
+		(psa_status = psa_aead_set_nonce(&operation, nonce, nonce_length),
+			psa_status == PSA_SUCCESS) &&
+		(psa_status = multi_aead_update_ad(&operation, additional_data, additional_data_length),
+			psa_status == PSA_SUCCESS) &&
+		(psa_status = multi_aead_update(&operation, aeadtext, ciphertext_len,
+			plaintext, plaintext_size, &bytes_output),
+			psa_status == PSA_SUCCESS))
+	{
+		size_t remaining_plaintext_len = 0;
+
+		psa_status = psa_aead_verify(&operation,
+			NULL, 0, &remaining_plaintext_len,
+			&aeadtext[bytes_output], aeadtext_length - bytes_output);
+
+		if (psa_status == PSA_SUCCESS) {
+
+			*plaintext_length = bytes_output + remaining_plaintext_len;
+		}
+	}
+	else {
+
+		psa_aead_abort(&operation);
+	}
+
+	return psa_status;
+}
+diff --git a/components/service/crypto/factory/full/crypto_provider_factory.c b/components/service/crypto/factory/full/crypto_provider_factory.c
+index 2d926eb6..ee2b4473 100644
+--- a/components/service/crypto/factory/full/crypto_provider_factory.c
+++ b/components/service/crypto/factory/full/crypto_provider_factory.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  *
+@@ -17,6 +17,8 @@
+ #include <service/crypto/provider/extension/key_derivation/serializer/packed-c/packedc_key_derivation_provider_serializer.h>
+ #include <service/crypto/provider/extension/mac/mac_provider.h>
+ #include <service/crypto/provider/extension/mac/serializer/packed-c/packedc_mac_provider_serializer.h>
+#include <service/crypto/provider/extension/aead/aead_provider.h>
+#include <service/crypto/provider/extension/aead/serializer/packed-c/packedc_aead_provider_serializer.h>
+ #include <service/discovery/provider/discovery_provider.h>
+ #include <service/discovery/provider/serializer/packed-c/packedc_discovery_provider_serializer.h>
+
+@@ -34,6 +36,7 @@ static struct full_crypto_provider
+ 	struct cipher_provider cipher_provider;
+ 	struct key_derivation_provider key_derivation_provider;
+ 	struct mac_provider mac_provider;
+	struct aead_provider aead_provider;
+
+ } instance;
+
+@@ -98,6 +101,17 @@ struct crypto_provider *crypto_provider_factory_create(void)
+ 	crypto_provider_extend(&instance.crypto_provider,
+ 		&instance.mac_provider.base_provider);
+
+	/**
+	 * Extend with aead operations
+	 */
+	aead_provider_init(&instance.aead_provider);
+
+	aead_provider_register_serializer(&instance.aead_provider,
+		TS_RPC_ENCODING_PACKED_C, packedc_aead_provider_serializer_instance());
+
+	crypto_provider_extend(&instance.crypto_provider,
+		&instance.aead_provider.base_provider);
+
+ 	return &instance.crypto_provider;
+ }
+
+diff --git a/deployments/component-test/component-test.cmake b/deployments/component-test/component-test.cmake
+index a0233c34..c3b015ab 100644
+--- a/deployments/component-test/component-test.cmake
+++ b/deployments/component-test/component-test.cmake
+@@ -1,5 +1,5 @@
+ #-------------------------------------------------------------------------------
+-# Copyright (c) 2020-2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2020-2022, Arm Limited and Contributors. All rights reserved.
+ #
+ # SPDX-License-Identifier: BSD-3-Clause
+ #
+@@ -85,6 +85,8 @@ add_components(
+ 		"components/service/crypto/provider/extension/key_derivation/serializer/packed-c"
+ 		"components/service/crypto/provider/extension/mac"
+ 		"components/service/crypto/provider/extension/mac/serializer/packed-c"
+		"components/service/crypto/provider/extension/aead"
+		"components/service/crypto/provider/extension/aead/serializer/packed-c"
+ 		"components/service/crypto/provider/test"
+ 		"components/service/crypto/backend/mbedcrypto"
+ 		"components/service/crypto/factory/full"
+diff --git a/deployments/crypto/opteesp/CMakeLists.txt b/deployments/crypto/opteesp/CMakeLists.txt
+index 8ada74e9..eb5d0847 100644
+--- a/deployments/crypto/opteesp/CMakeLists.txt
+++ b/deployments/crypto/opteesp/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ #-------------------------------------------------------------------------------
+-# Copyright (c) 2020-2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2020-2022, Arm Limited and Contributors. All rights reserved.
+ #
+ # SPDX-License-Identifier: BSD-3-Clause
+ #
+@@ -62,6 +62,8 @@ add_components(TARGET "crypto-sp"
+ 		"components/service/crypto/provider/extension/key_derivation/serializer/packed-c"
+ 		"components/service/crypto/provider/extension/mac"
+ 		"components/service/crypto/provider/extension/mac/serializer/packed-c"
+		"components/service/crypto/provider/extension/aead"
+		"components/service/crypto/provider/extension/aead/serializer/packed-c"
+ 		"components/service/crypto/factory/full"
+ 		"components/service/crypto/backend/mbedcrypto"
+ 		"components/service/crypto/backend/mbedcrypto/trng_adapter/platform"
+diff --git a/deployments/libts/linux-pc/CMakeLists.txt b/deployments/libts/linux-pc/CMakeLists.txt
+index fc98407c..97eaaa73 100644
+--- a/deployments/libts/linux-pc/CMakeLists.txt
+++ b/deployments/libts/linux-pc/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ #-------------------------------------------------------------------------------
+-# Copyright (c) 2020-2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2020-2022, Arm Limited and Contributors. All rights reserved.
+ #
+ # SPDX-License-Identifier: BSD-3-Clause
+ #
+@@ -71,6 +71,8 @@ add_components(
+ 		"components/service/crypto/provider/extension/key_derivation/serializer/packed-c"
+ 		"components/service/crypto/provider/extension/mac"
+ 		"components/service/crypto/provider/extension/mac/serializer/packed-c"
+		"components/service/crypto/provider/extension/aead"
+		"components/service/crypto/provider/extension/aead/serializer/packed-c"
+ 		"components/service/crypto/factory/full"
+ 		"components/service/crypto/backend/mbedcrypto"
+ 		"components/service/crypto/backend/mbedcrypto/trng_adapter/linux"
+diff --git a/deployments/se-proxy/opteesp/CMakeLists.txt b/deployments/se-proxy/opteesp/CMakeLists.txt
+index 953bb716..24a8ca65 100644
+--- a/deployments/se-proxy/opteesp/CMakeLists.txt
+++ b/deployments/se-proxy/opteesp/CMakeLists.txt
+@@ -1,5 +1,5 @@
+ #-------------------------------------------------------------------------------
+-# Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+ #
+ # SPDX-License-Identifier: BSD-3-Clause
+ #
+@@ -70,6 +70,8 @@ add_components(TARGET "se-proxy"
+ 		"components/service/crypto/provider/extension/key_derivation/serializer/packed-c"
+ 		"components/service/crypto/provider/extension/mac"
+ 		"components/service/crypto/provider/extension/mac/serializer/packed-c"
+		"components/service/crypto/provider/extension/aead"
+		"components/service/crypto/provider/extension/aead/serializer/packed-c"
+ 		"components/service/crypto/factory/full"
+ 		"components/service/secure_storage/include"
+ 		"components/service/secure_storage/frontend/secure_storage_provider"
+--
+2.25.1
@@ -0,0 +1,96 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 0e743c9e00249b0fe50b1b2d28d06a8568569736 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Tue, 15 Feb 2022 15:46:58 +0000
+Subject: [PATCH 07/15] Add IV generation to one-shot cipher operation
+
+The functions psa_cipher_encrypt and psa_cipher_decrypt are
+one-shot operations that can take an arbitrary sized input.
+These operations are implemented as client-side functions
+that use multi-part cipher operations to allow large inputs
+to be handled. The existing implementations were missing the
+generation and setting of the IV at the start of the data.
+This was leading to PSA Arch test failures (248 & 249). This
+commit adds the missing IV handling and resolves the test
+failures.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: I4afb555ee7062ebb387e5bb27fb1e082288ad8c7
+---
+ .../service/crypto/client/psa/psa_cipher.c    | 40 +++++++++++++++----
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+diff --git a/components/service/crypto/client/psa/psa_cipher.c b/components/service/crypto/client/psa/psa_cipher.c
+index 3ab8ea21..111af829 100644
+--- a/components/service/crypto/client/psa/psa_cipher.c
+++ b/components/service/crypto/client/psa/psa_cipher.c
+@@ -8,7 +8,6 @@
+ #include "psa_crypto_client.h"
+ #include "crypto_caller_selector.h"
+
+-
+ psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
+ 	psa_key_id_t key,
+ 	psa_algorithm_t alg)
+@@ -171,9 +170,16 @@ psa_status_t psa_cipher_encrypt(psa_key_id_t key,
+
+ 	if (psa_status == PSA_SUCCESS) {
+
+		size_t ciphertext_len = 0;
+		size_t iv_len = 0;
+
+		psa_cipher_generate_iv(&operation, output, output_size, &iv_len);
+
+ 		psa_status = multi_cipher_update(&operation,
+ 			input, input_length,
+-			output, output_size, output_length);
+			&output[iv_len], output_size - iv_len, &ciphertext_len);
+
+		*output_length = iv_len + ciphertext_len;
+ 	}
+
+ 	return psa_status;
+@@ -187,14 +193,34 @@ psa_status_t psa_cipher_decrypt(psa_key_id_t key,
+ 	size_t output_size,
+ 	size_t *output_length)
+ {
+-	psa_cipher_operation_t operation = psa_cipher_operation_init();
+-	psa_status_t psa_status = psa_cipher_decrypt_setup(&operation, key, alg);
+	psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+	psa_status_t psa_status = psa_get_key_attributes(key, &attributes);
+
+ 	if (psa_status == PSA_SUCCESS) {
+
+-		psa_status = multi_cipher_update(&operation,
+-			input, input_length,
+-			output, output_size, output_length);
+		psa_cipher_operation_t operation = psa_cipher_operation_init();
+		psa_status = psa_cipher_decrypt_setup(&operation, key, alg);
+
+		if (psa_status == PSA_SUCCESS) {
+
+			size_t iv_len = PSA_CIPHER_IV_LENGTH(psa_get_key_type(&attributes), alg);
+
+			if (input_length >= iv_len) {
+
+				psa_cipher_set_iv(&operation, input, iv_len);
+
+				psa_status = multi_cipher_update(&operation,
+					&input[iv_len], input_length - iv_len,
+					output, output_size, output_length);
+			}
+			else {
+
+				psa_cipher_abort(&operation);
+				psa_status = PSA_ERROR_INVALID_ARGUMENT;
+			}
+		}
+
+		psa_reset_key_attributes(&attributes);
+ 	}
+
+ 	return psa_status;
+--
+2.25.1
@@ -0,0 +1,241 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 51563497958036271a23de8ae28f174db1296689 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Wed, 16 Feb 2022 10:37:04 +0000
+Subject: [PATCH 08/15] Fix multi-part termination on error
+
+For multi-part operations, the PSA Crypto API specifies that if
+the final operation does not return PSA_SUCCESS, the abort
+operaion must be called by a client to clean-up the operation.
+This change modifies behaviour in-line with the API definition.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: Ia3d3ec004164647a7ab5988cac45c39c22e76e9a
+---
+ components/service/crypto/client/psa/psa_aead.c       |  8 ++++++++
+ components/service/crypto/client/psa/psa_cipher.c     |  4 ++++
+ components/service/crypto/client/psa/psa_hash.c       | 10 ++++++++++
+ components/service/crypto/client/psa/psa_mac.c        | 10 ++++++++++
+ .../crypto/provider/extension/aead/aead_provider.c    | 10 +++++-----
+ .../provider/extension/cipher/cipher_provider.c       |  6 +++---
+ .../crypto/provider/extension/hash/hash_provider.c    |  6 +++---
+ .../crypto/provider/extension/mac/mac_provider.c      | 11 +++++++----
+ 8 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/components/service/crypto/client/psa/psa_aead.c b/components/service/crypto/client/psa/psa_aead.c
+index e4579e63..559eb6a3 100644
+--- a/components/service/crypto/client/psa/psa_aead.c
+++ b/components/service/crypto/client/psa/psa_aead.c
+@@ -241,6 +241,10 @@ psa_status_t psa_aead_encrypt(psa_key_id_t key,
+
+ 			*aeadtext_length = bytes_output + remaining_aead_len + tag_len;
+ 		}
+		else {
+
+			psa_aead_abort(&operation);
+		}
+ 	}
+ 	else {
+
+@@ -292,6 +296,10 @@ psa_status_t psa_aead_decrypt(psa_key_id_t key,
+
+ 			*plaintext_length = bytes_output + remaining_plaintext_len;
+ 		}
+		else {
+
+			psa_aead_abort(&operation);
+		}
+ 	}
+ 	else {
+
+diff --git a/components/service/crypto/client/psa/psa_cipher.c b/components/service/crypto/client/psa/psa_cipher.c
+index 111af829..4e4264b6 100644
+--- a/components/service/crypto/client/psa/psa_cipher.c
+++ b/components/service/crypto/client/psa/psa_cipher.c
+@@ -146,6 +146,10 @@ static psa_status_t multi_cipher_update(psa_cipher_operation_t *operation,
+
+ 				*output_length = bytes_output + finish_output_len;
+ 			}
+			else {
+
+				psa_cipher_abort(operation);
+			}
+ 		}
+ 		else {
+
+diff --git a/components/service/crypto/client/psa/psa_hash.c b/components/service/crypto/client/psa/psa_hash.c
+index 83278de6..e5dd0030 100644
+--- a/components/service/crypto/client/psa/psa_hash.c
+++ b/components/service/crypto/client/psa/psa_hash.c
+@@ -137,6 +137,11 @@ psa_status_t psa_hash_compare(psa_algorithm_t alg,
+ 	if (psa_status == PSA_SUCCESS) {
+
+ 		psa_status = psa_hash_verify(&operation, hash, hash_length);
+
+		if (psa_status != PSA_SUCCESS) {
+
+			psa_hash_abort(&operation);
+		}
+ 	}
+
+ 	return psa_status;
+@@ -155,6 +160,11 @@ psa_status_t psa_hash_compute(psa_algorithm_t alg,
+ 	if (psa_status == PSA_SUCCESS) {
+
+ 		psa_status = psa_hash_finish(&operation, hash, hash_size, hash_length);
+
+		if (psa_status != PSA_SUCCESS) {
+
+			psa_hash_abort(&operation);
+		}
+ 	}
+
+ 	return psa_status;
+diff --git a/components/service/crypto/client/psa/psa_mac.c b/components/service/crypto/client/psa/psa_mac.c
+index 5c5eb32a..a3db8644 100644
+--- a/components/service/crypto/client/psa/psa_mac.c
+++ b/components/service/crypto/client/psa/psa_mac.c
+@@ -129,6 +129,11 @@ psa_status_t psa_mac_verify(psa_key_id_t key,
+ 	if (psa_status == PSA_SUCCESS) {
+
+ 		psa_status = psa_mac_verify_finish(&operation, mac, mac_length);
+
+		if (psa_status != PSA_SUCCESS) {
+
+			psa_mac_abort(&operation);
+		}
+ 	}
+
+ 	return psa_status;
+@@ -153,6 +158,11 @@ psa_status_t psa_mac_compute(psa_key_id_t key,
+ 	if (psa_status == PSA_SUCCESS) {
+
+ 		psa_status = psa_mac_sign_finish(&operation, mac, mac_size, mac_length);
+
+		if (psa_status != PSA_SUCCESS) {
+
+			psa_mac_abort(&operation);
+		}
+ 	}
+
+ 	return psa_status;
+diff --git a/components/service/crypto/provider/extension/aead/aead_provider.c b/components/service/crypto/provider/extension/aead/aead_provider.c
+index f4e81a03..14a25436 100644
+--- a/components/service/crypto/provider/extension/aead/aead_provider.c
+++ b/components/service/crypto/provider/extension/aead/aead_provider.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -369,9 +369,9 @@ static rpc_status_t aead_finish_handler(void *context, struct call_req *req)
+ 				rpc_status = serializer->serialize_aead_finish_resp(resp_buf,
+ 					ciphertext, ciphertext_len,
+ 					tag, tag_len);
+-			}
+
+-			crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+				crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			}
+ 		}
+
+ 		call_req_set_opstatus(req, psa_status);
+@@ -418,9 +418,9 @@ static rpc_status_t aead_verify_handler(void *context, struct call_req *req)
+ 				struct call_param_buf *resp_buf = call_req_get_resp_buf(req);
+ 				rpc_status = serializer->serialize_aead_verify_resp(resp_buf,
+ 					plaintext, plaintext_len);
+-			}
+
+-			crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+				crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			}
+ 		}
+
+ 		call_req_set_opstatus(req, psa_status);
+diff --git a/components/service/crypto/provider/extension/cipher/cipher_provider.c b/components/service/crypto/provider/extension/cipher/cipher_provider.c
+index 8e7a86de..a5dd0371 100644
+--- a/components/service/crypto/provider/extension/cipher/cipher_provider.c
+++ b/components/service/crypto/provider/extension/cipher/cipher_provider.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -283,9 +283,9 @@ static rpc_status_t cipher_finish_handler(void *context, struct call_req* req)
+
+ 				struct call_param_buf *resp_buf = call_req_get_resp_buf(req);
+ 				rpc_status = serializer->serialize_cipher_finish_resp(resp_buf, output, output_len);
+-			}
+
+-			crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+				crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			}
+ 		}
+
+ 		call_req_set_opstatus(req, psa_status);
+diff --git a/components/service/crypto/provider/extension/hash/hash_provider.c b/components/service/crypto/provider/extension/hash/hash_provider.c
+index 2c560513..fd39d440 100644
+--- a/components/service/crypto/provider/extension/hash/hash_provider.c
+++ b/components/service/crypto/provider/extension/hash/hash_provider.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -179,9 +179,9 @@ static rpc_status_t hash_finish_handler(void *context, struct call_req* req)
+
+ 				struct call_param_buf *resp_buf = call_req_get_resp_buf(req);
+ 				rpc_status = serializer->serialize_hash_finish_resp(resp_buf, hash, hash_len);
+-			}
+
+-			crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+				crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			}
+ 		}
+
+ 		call_req_set_opstatus(req, psa_status);
+diff --git a/components/service/crypto/provider/extension/mac/mac_provider.c b/components/service/crypto/provider/extension/mac/mac_provider.c
+index 96fe4cf3..eef55586 100644
+--- a/components/service/crypto/provider/extension/mac/mac_provider.c
+++ b/components/service/crypto/provider/extension/mac/mac_provider.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ * Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  */
+@@ -181,9 +181,9 @@ static rpc_status_t mac_sign_finish_handler(void *context, struct call_req* req)
+
+ 				struct call_param_buf *resp_buf = call_req_get_resp_buf(req);
+ 				rpc_status = serializer->serialize_mac_sign_finish_resp(resp_buf, mac, mac_len);
+-			}
+
+-			crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+				crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			}
+ 		}
+
+ 		call_req_set_opstatus(req, psa_status);
+@@ -220,7 +220,10 @@ static rpc_status_t mac_verify_finish_handler(void *context, struct call_req* re
+
+ 			psa_status = psa_mac_verify_finish(&crypto_context->op.mac, mac, mac_len);
+
+-			crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			if (psa_status == PSA_SUCCESS) {
+
+				crypto_context_pool_free(&this_instance->context_pool, crypto_context);
+			}
+ 		}
+
+ 		call_req_set_opstatus(req, psa_status);
+--
+2.25.1
@@ -0,0 +1,50 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From c0549d9949d9c19a120b7bde3409201a5db8f2b2 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Wed, 16 Feb 2022 11:36:09 +0000
+Subject: [PATCH 09/15] Abort AEAD operation if client provided buffer is too
+ small
+
+To enable PSA Arch test c258 to pass, handling is added in the
+PSA API client adaptor for AEAD (psa_aead.c) to abort an AEAD
+operation if an update operation is performed but the client
+provided buffer for the output is too small.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: Ib4b26ebc0a83a8928e1b643fba4becd935f6deb0
+---
+ components/service/crypto/client/psa/psa_aead.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/components/service/crypto/client/psa/psa_aead.c b/components/service/crypto/client/psa/psa_aead.c
+index 559eb6a3..c820d222 100644
+--- a/components/service/crypto/client/psa/psa_aead.c
+++ b/components/service/crypto/client/psa/psa_aead.c
+@@ -74,10 +74,22 @@ psa_status_t psa_aead_update(psa_aead_operation_t *operation,
+ 	size_t output_size,
+ 	size_t *output_length)
+ {
+-	return crypto_caller_aead_update(&psa_crypto_client_instance.base,
+	psa_status_t status = crypto_caller_aead_update(&psa_crypto_client_instance.base,
+ 		operation->handle,
+ 		input, input_length,
+ 		output, output_size, output_length);
+
+	/*
+	 * If too small a buffer has been provided for the output, the operation
+	 * state will have been updated but the result can't be put anywhere. This
+	 * is an unrecoveral condition so abort the operation.
+	 */
+	if (status == PSA_ERROR_BUFFER_TOO_SMALL) {
+
+		psa_aead_abort(operation);
+	}
+
+	return status;
+ }
+
+ psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
+--
+2.25.1
@@ -0,0 +1,95 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 9fb18f0cfba8f97fa71a5e7e7e3e31a43692a8e0 Mon Sep 17 00:00:00 2001
+From: Julian Hall <julian.hall@arm.com>
+Date: Tue, 11 Jan 2022 09:43:52 +0000
+Subject: [PATCH 10/15] Peg to updated t_cose version fc3a4b2c
+
+The current version of TS fails to build due to a regression introduced
+by a new t_cose version in the upstream project.
+The issue is caused by the t_cose external component incorrectly using
+tip of master as the upstream version id, which makes strict dependency
+control impossible. Change the upstream version id to an SHA, to enable
+controlling compatibility issues introduced by future upstream updates.
+
+At the same time update the dependency to the current latest version.
+The upstream project is now compatile with mbedtls 3.0.0 API changes
+so the previously required compatibility patch has been removed.
+
+Signed-off-by: Julian Hall <julian.hall@arm.com>
+Change-Id: I9491a5210904cc369846da2af45b0f7e5913bed8
+---
+ .../0002-add-tls3_0_0-compatibility.patch     | 31 -------------------
+ external/t_cose/t_cose.cmake                  |  5 ++-
+ 2 files changed, 2 insertions(+), 34 deletions(-)
+ delete mode 100644 external/t_cose/0002-add-tls3_0_0-compatibility.patch
+
+diff --git a/external/t_cose/0002-add-tls3_0_0-compatibility.patch b/external/t_cose/0002-add-tls3_0_0-compatibility.patch
+deleted file mode 100644
+index 20a7d131..00000000
+--- a/external/t_cose/0002-add-tls3_0_0-compatibility.patch
+++ /dev/null
+@@ -1,31 +0,0 @@
+-diff --git a/crypto_adapters/t_cose_psa_crypto.c b/crypto_adapters/t_cose_psa_crypto.c
+-index 49c5b60..3aa7b58 100644
+---- a/crypto_adapters/t_cose_psa_crypto.c
+-+++ b/crypto_adapters/t_cose_psa_crypto.c
+-@@ -99,7 +99,7 @@ static enum t_cose_err_t psa_status_to_t_cose_error_signing(psa_status_t err)
+-            err == PSA_ERROR_INVALID_SIGNATURE   ? T_COSE_ERR_SIG_VERIFY :
+-            err == PSA_ERROR_NOT_SUPPORTED       ? T_COSE_ERR_UNSUPPORTED_SIGNING_ALG:
+-            err == PSA_ERROR_INSUFFICIENT_MEMORY ? T_COSE_ERR_INSUFFICIENT_MEMORY :
+--           err == PSA_ERROR_TAMPERING_DETECTED  ? T_COSE_ERR_TAMPERING_DETECTED :
+-+           err == PSA_ERROR_CORRUPTION_DETECTED ? T_COSE_ERR_TAMPERING_DETECTED :
+-                                                   T_COSE_ERR_SIG_FAIL;
+- }
+- 
+-@@ -152,7 +152,7 @@ t_cose_crypto_pub_key_verify(int32_t               cose_algorithm_id,
+-      * Crypto ceases providing backwards compatibility then this code
+-      * has to be changed to use psa_verify_hash().
+-      */
+--    psa_result = psa_asymmetric_verify(verification_key_psa,
+-+    psa_result = psa_verify_hash(verification_key_psa,
+-                                        psa_alg_id,
+-                                        hash_to_verify.ptr,
+-                                        hash_to_verify.len,
+-@@ -212,7 +212,7 @@ t_cose_crypto_pub_key_sign(int32_t                cose_algorithm_id,
+-      * providing backwards compatibility then this code has to be
+-      * changed to use psa_sign_hash().
+-      */
+--    psa_result = psa_asymmetric_sign(signing_key_psa,
+-+    psa_result = psa_sign_hash(signing_key_psa,
+-                                      psa_alg_id,
+-                                      hash_to_sign.ptr,
+-                                      hash_to_sign.len,
+diff --git a/external/t_cose/t_cose.cmake b/external/t_cose/t_cose.cmake
+index 660824bd..9321466f 100644
+--- a/external/t_cose/t_cose.cmake
+++ b/external/t_cose/t_cose.cmake
+@@ -1,5 +1,5 @@
+ #-------------------------------------------------------------------------------
+-# Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2021-2022, Arm Limited and Contributors. All rights reserved.
+ #
+ # SPDX-License-Identifier: BSD-3-Clause
+ #
+@@ -16,7 +16,7 @@ endif()
+ 
+ # External component details
+ set(T_COSE_URL "https://github.com/laurencelundblade/t_cose.git" CACHE STRING "t_cose repository URL")
+-set(T_COSE_REFSPEC "master" CACHE STRING "t_cose git refspec")
+set(T_COSE_REFSPEC "fc3a4b2c7196ff582e8242de8bd4a1bc4eec577f" CACHE STRING "t_cose git refspec")
+ set(T_COSE_INSTALL_PATH "${CMAKE_CURRENT_BINARY_DIR}/t_cose_install" CACHE PATH "t_cose installation directory")
+ set(T_COSE_PACKAGE_PATH "${T_COSE_INSTALL_PATH}/libt_cose/cmake" CACHE PATH "t_cose CMake package directory")
+ 
+@@ -37,7 +37,6 @@ FetchContent_Declare(
+ 
+ 	PATCH_COMMAND git stash
+ 		COMMAND git am ${CMAKE_CURRENT_LIST_DIR}/0001-add-install-definition.patch
+-		COMMAND git apply ${CMAKE_CURRENT_LIST_DIR}/0002-add-tls3_0_0-compatibility.patch
+ 		COMMAND git reset HEAD~1
+ 
+ )
+-- 
+2.25.1
+
@@ -0,0 +1,111 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 386a086debf70f739a7dfc0bdce9c4f1053ba8d5 Mon Sep 17 00:00:00 2001
+From: Vishnu Banavath <vishnu.banavath@arm.com>
+Date: Wed, 16 Feb 2022 15:55:55 +0000
+Subject: [PATCH 11/15] pass sysroot_yocto
+
+---
+ deployments/libts/libts-import.cmake         |  3 +++
+ external/MbedTLS/MbedTLS.cmake               |  1 +
+ external/psa_arch_tests/psa_arch_tests.cmake | 25 +++++++++++++-------
+ 3 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/deployments/libts/libts-import.cmake b/deployments/libts/libts-import.cmake
+index 792ba86c..b900ce3f 100644
+--- a/deployments/libts/libts-import.cmake
+++ b/deployments/libts/libts-import.cmake
+@@ -27,9 +27,12 @@ set(LIBTS_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/libts-build" CACHE PATH
+
+ file(MAKE_DIRECTORY ${LIBTS_BINARY_DIR})
+
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} --sysroot=${SYSROOT_YOCTO}")
+
+ #Configure the library
+ execute_process(COMMAND
+ 	${CMAKE_COMMAND}
+                -DCMAKE_SYSROOT=${SYSROOT_YOCTO}
+ 		-DCMAKE_INSTALL_PREFIX=${LIBTS_INSTALL_PATH}
+ 		-GUnix\ Makefiles
+ 		${LIBTS_SOURCE_DIR}
+diff --git a/external/MbedTLS/MbedTLS.cmake b/external/MbedTLS/MbedTLS.cmake
+index 3350d8a0..33467cf0 100644
+--- a/external/MbedTLS/MbedTLS.cmake
+++ b/external/MbedTLS/MbedTLS.cmake
+@@ -103,6 +103,7 @@ if (NOT MBEDCRYPTO_LIB_FILE)
+ 	execute_process(COMMAND
+ 		${CMAKE_COMMAND} -E env CROSS_COMPILE=${CROSS_COMPILE}
+ 			${CMAKE_COMMAND}
+                                -DCMAKE_SYSROOT=${SYSROOT_YOCTO}
+ 				-DENABLE_PROGRAMS=OFF
+ 				-DENABLE_TESTING=OFF
+ 				-DUNSAFE_BUILD=ON
+diff --git a/external/psa_arch_tests/psa_arch_tests.cmake b/external/psa_arch_tests/psa_arch_tests.cmake
+index f6d2fb9f..42f73a37 100644
+--- a/external/psa_arch_tests/psa_arch_tests.cmake
+++ b/external/psa_arch_tests/psa_arch_tests.cmake
+@@ -5,30 +5,33 @@
+ #
+ #-------------------------------------------------------------------------------
+
+-# Temporarily using modified tests used for tf-m verification
+# Determine the number of processes to run while running parallel builds.
+# Pass -DPROCESSOR_COUNT=<n> to cmake to override.
+if(NOT DEFINED PROCESSOR_COUNT)
+	include(ProcessorCount)
+	ProcessorCount(PROCESSOR_COUNT)
+	set(PROCESSOR_COUNT ${PROCESSOR_COUNT} CACHE STRING "Number of cores to use for parallel builds.")
+endif()
+
+ set(PSA_ARCH_TESTS_URL "https://github.com/bensze01/psa-arch-tests.git" CACHE STRING "psa-arch-tests repository URL")
+ set(PSA_ARCH_TESTS_REFSPEC "fix-multipart-aead" CACHE STRING "psa-arch-tests git refspec")
+-
+-#set(PSA_ARCH_TESTS_URL "https://github.com/ARM-software/psa-arch-tests.git" CACHE STRING "psa-arch-tests repository URL")
+-#set(PSA_ARCH_TESTS_REFSPEC "2a1852252a9b9af655cbe02d5d3c930952d0d798" CACHE STRING "psa-arch-tests v22.01_API1.4_ADAC_BETA")
+ set(PSA_ARCH_TESTS_INSTALL_PATH "${CMAKE_CURRENT_BINARY_DIR}/psa-arch-tests_install" CACHE PATH "psa-arch-tests installation directory")
+ set(PSA_ARCH_TESTS_PACKAGE_PATH "${PSA_ARCH_TESTS_INSTALL_PATH}/libpsa-arch-tests/cmake" CACHE PATH "psa-arch-tests CMake package directory")
+-set(PSA_ARCH_TESTS_SOURCE_DIR "${CMAKE_CURRENT_BINARY_DIR}/_deps/psa_arch_tests-src" CACHE PATH "psa-arch-tests source.")
+
+include(FetchContent)
+
+ # Checking git
+ find_program(GIT_COMMAND "git")
+ if (NOT GIT_COMMAND)
+ 	message(FATAL_ERROR "Please install git")
+ endif()
+-
+if ("${PSA_ARCH_TESTS_PATH}" STREQUAL "DOWNLOAD")
+ # Fetching psa-arch-tests
+ FetchContent_Declare(
+ 	psa-arch-tests
+ 	GIT_REPOSITORY ${PSA_ARCH_TESTS_URL}
+ 	GIT_TAG ${PSA_ARCH_TESTS_REFSPEC}
+ 	GIT_SHALLOW TRUE
+-	PATCH_COMMAND git stash
+-		COMMAND git apply ${CMAKE_CURRENT_LIST_DIR}/modify_attest_config.patch
+ )
+
+ # FetchContent_GetProperties exports psa-arch-tests_SOURCE_DIR and psa-arch-tests_BINARY_DIR variables
+@@ -37,7 +40,10 @@ if(NOT psa-arch-tests_POPULATED)
+ 	message(STATUS "Fetching psa-arch-tests")
+ 	FetchContent_Populate(psa-arch-tests)
+ endif()
+-
+else()
+    set(psa-arch-tests_SOURCE_DIR "${TS_ROOT}/../psa-arch-tests")
+    set(psa-arch-tests_BINARY_DIR "${CMAKE_CURRENT_BINARY_DIR}")
+endif()
+ # Ensure list of include paths is separated correctly
+ string(REPLACE ";" "\\;" PSA_ARCH_TESTS_EXTERNAL_INCLUDE_PATHS "${PSA_ARCH_TESTS_EXTERNAL_INCLUDE_PATHS}")
+
+@@ -47,6 +53,7 @@ string(REPLACE ";" " " PSA_ARCH_TEST_EXTERNAL_DEFS "${PSA_ARCH_TEST_EXTERNAL_DEF
+ # Configure the psa-arch-test library
+ execute_process(COMMAND
+ 	${CMAKE_COMMAND}
+			-DCMAKE_SYSROOT=${SYSROOT_YOCTO}
+ 			-DTOOLCHAIN=INHERIT
+ 			-DCMAKE_TOOLCHAIN_FILE=${TS_EXTERNAL_LIB_TOOLCHAIN_FILE}
+ 			-DPSA_INCLUDE_PATHS=${PSA_ARCH_TESTS_EXTERNAL_INCLUDE_PATHS}
+--
+2.25.1
@@ -0,0 +1,30 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 8bb6a36a36defc9e6cc234404276bf5fea8e8ad4 Mon Sep 17 00:00:00 2001
+From: Satish Kumar <satish.kumar01@arm.com>
+Date: Sun, 13 Feb 2022 09:01:10 +0000
+Subject: [PATCH 12/15] Fix: Crypto interface structure aligned with tf-m
+ change.
+
+NO NEED TO RAISE PR: The PR for this FIX  is raied by Emek.
+---
+ components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h b/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h
+index c13c20e8..ec25eaf8 100644
+--- a/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h
+++ b/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h
+@@ -38,7 +38,8 @@ struct psa_ipc_crypto_pack_iovec {
+ 				      *   multipart operation
+ 				      */
+ 	uint32_t capacity;             /*!< Key derivation capacity */
+-
+	uint32_t ad_length;            /*!< Additional Data length for multipart AEAD */
+	uint32_t plaintext_length;     /*!< Plaintext length for multipart AEAD */
+ 	struct psa_ipc_crypto_aead_pack_input aead_in; /*!< FixMe: Temporarily used for
+ 							    *   AEAD until the API is
+ 							    *   restructured
+--
+2.25.1
@@ -0,0 +1,494 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 0469b4650bb011ec157286dbae0f1cef5cbfbe41 Mon Sep 17 00:00:00 2001
+From: Satish Kumar <satish.kumar01@arm.com>
+Date: Sun, 13 Feb 2022 09:49:51 +0000
+Subject: [PATCH 13/15] Integrate remaining psa-ipc client APIs.
+
+Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
+---
+ .../caller/psa_ipc/crypto_caller_aead.h       | 297 +++++++++++++++++-
+ .../caller/psa_ipc/crypto_caller_sign_hash.h  |  35 +++
+ .../psa_ipc/crypto_caller_verify_hash.h       |  33 +-
+ 3 files changed, 352 insertions(+), 13 deletions(-)
+
+diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h
+index 78517fe3..9c64fe62 100644
+--- a/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h
+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h
+@@ -152,7 +152,27 @@ static inline psa_status_t crypto_caller_aead_encrypt_setup(
+ 					    psa_key_id_t key,
+ 					    psa_algorithm_t alg)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_ENCRYPT_SETUP_SID,
+	    .key_id = key,
+	    .alg = alg,
+	    .op_handle = (*op_handle),
+	};
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)}
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t)}
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_decrypt_setup(
+@@ -161,7 +181,26 @@ static inline psa_status_t crypto_caller_aead_decrypt_setup(
+ 					    psa_key_id_t key,
+ 					    psa_algorithm_t alg)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_DECRYPT_SETUP_SID,
+	    .key_id = key,
+	    .alg = alg,
+	    .op_handle = (*op_handle),
+	};
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)}
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t)}
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_generate_nonce(
+@@ -171,7 +210,27 @@ static inline psa_status_t crypto_caller_aead_generate_nonce(
+ 					     size_t nonce_size,
+ 					     size_t *nonce_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_GENERATE_NONCE_SID,
+	    .op_handle = op_handle,
+	};
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)},
+	    {.base = psa_ptr_to_u32(nonce), .len = nonce_size}
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+
+	*nonce_length = out_vec[1].len;
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_set_nonce(
+@@ -180,7 +239,25 @@ static inline psa_status_t crypto_caller_aead_set_nonce(
+ 						const uint8_t *nonce,
+ 						size_t nonce_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_SET_NONCE_SID,
+	    .op_handle = op_handle,
+	};
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	    {.base = psa_ptr_to_u32(nonce), .len = nonce_length}
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)}
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_set_lengths(
+@@ -189,7 +266,27 @@ static inline psa_status_t crypto_caller_aead_set_lengths(
+ 					  size_t ad_length,
+ 					  size_t plaintext_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_SET_LENGTHS_SID,
+	    .ad_length = ad_length,
+	    .plaintext_length = plaintext_length,
+	    .op_handle = op_handle,
+	};
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)}
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_update_ad(
+@@ -198,7 +295,35 @@ static inline psa_status_t crypto_caller_aead_update_ad(
+ 						const uint8_t *input,
+ 						size_t input_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_UPDATE_AD_SID,
+	    .op_handle = op_handle,
+	};
+
+	/* Sanitize the optional input */
+	if ((input == NULL) && (input_length != 0)) {
+	    return PSA_ERROR_INVALID_ARGUMENT;
+	}
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	    {.base = psa_ptr_const_to_u32(input), .len = input_length}
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)}
+	};
+
+	size_t in_len = IOVEC_LEN(in_vec);
+
+	if (input == NULL) {
+	    in_len--;
+	}
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   in_len, out_vec, IOVEC_LEN(out_vec));
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_update(
+@@ -210,7 +335,38 @@ static inline psa_status_t crypto_caller_aead_update(
+ 					     size_t output_size,
+ 					     size_t *output_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_UPDATE_SID,
+	    .op_handle = op_handle,
+	};
+
+	/* Sanitize the optional input */
+	if ((input == NULL) && (input_length != 0)) {
+	    return PSA_ERROR_INVALID_ARGUMENT;
+	}
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	    {.base = psa_ptr_const_to_u32(input), .len = input_length}
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)},
+	    {.base = psa_ptr_const_to_u32(output), .len = output_size},
+	};
+
+	size_t in_len = IOVEC_LEN(in_vec);
+
+	if (input == NULL) {
+	    in_len--;
+	}
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   in_len, out_vec, IOVEC_LEN(out_vec));
+
+	*output_length = out_vec[1].len;
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_finish(
+@@ -223,7 +379,48 @@ static inline psa_status_t crypto_caller_aead_finish(
+ 					     size_t tag_size,
+ 					     size_t *tag_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_FINISH_SID,
+	    .op_handle = op_handle,
+	};
+
+	/* Sanitize the optional output */
+	if ((aeadtext == NULL) && (aeadtext_size != 0)) {
+	    return PSA_ERROR_INVALID_ARGUMENT;
+	}
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)},
+	    {.base = psa_ptr_const_to_u32(tag), .len = tag_size},
+	    {.base = psa_ptr_const_to_u32(aeadtext), .len = aeadtext_size}
+	};
+
+	size_t out_len = IOVEC_LEN(out_vec);
+
+	if (aeadtext == NULL || aeadtext_size == 0) {
+	    out_len--;
+	}
+	if ((out_len == 3) && (aeadtext_length == NULL)) {
+	    return PSA_ERROR_INVALID_ARGUMENT;
+	}
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, out_len);
+
+	*tag_length = out_vec[1].len;
+
+	if (out_len == 3) {
+	    *aeadtext_length = out_vec[2].len;
+	} else {
+	    *aeadtext_length = 0;
+	}
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_verify(
+@@ -235,14 +432,94 @@ static inline psa_status_t crypto_caller_aead_verify(
+ 					     const uint8_t *tag,
+ 					     size_t tag_length)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_VERIFY_SID,
+	    .op_handle = op_handle,
+	};
+
+	/* Sanitize the optional output */
+	if ((plaintext == NULL) && (plaintext_size != 0)) {
+	    return PSA_ERROR_INVALID_ARGUMENT;
+	}
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	    {.base = psa_ptr_const_to_u32(tag), .len = tag_length}
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)},
+	    {.base = psa_ptr_const_to_u32(plaintext), .len = plaintext_size},
+	};
+
+	size_t out_len = IOVEC_LEN(out_vec);
+
+	if (plaintext == NULL || plaintext_size == 0) {
+	    out_len--;
+	}
+	if ((out_len == 2) && (plaintext_length == NULL)) {
+	    return PSA_ERROR_INVALID_ARGUMENT;
+	}
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, out_len);
+
+	if (out_len == 2) {
+	    *plaintext_length = out_vec[1].len;
+	} else {
+	    *plaintext_length = 0;
+	}
+	return status;
+ }
+
+ static inline psa_status_t crypto_caller_aead_abort(
+ 					    struct service_client *context,
+ 					    uint32_t op_handle)
+ {
+-	return PSA_ERROR_NOT_SUPPORTED;
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+	    .sfn_id = TFM_CRYPTO_AEAD_ABORT_SID,
+	    .op_handle = op_handle,
+	};
+
+	struct psa_invec in_vec[] = {
+	    {.base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec)},
+	};
+	struct psa_outvec out_vec[] = {
+	    {.base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t)},
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+	                   IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+	return status;
+}
+
+static inline size_t crypto_caller_aead_max_update_size(const struct service_client *context)
+{
+       /* Returns the maximum number of bytes that may be
+        * carried as a parameter of the mac_update operation
+        *  using the packed-c encoding.
+        */
+       size_t payload_space = context->service_info.max_payload;
+       size_t overhead = iov_size;
+
+       return (payload_space > overhead) ? payload_space - overhead : 0;
+}
+
+static inline size_t crypto_caller_aead_max_update_ad_size(const struct service_client *context)
+{
+	/* Returns the maximum number of bytes that may be
+	 * carried as a parameter of the mac_update operation
+	 *  using the packed-c encoding.
+	 */
+	size_t payload_space = context->service_info.max_payload;
+	size_t overhead = iov_size;
+
+	return (payload_space > overhead) ? payload_space - overhead : 0;
+ }
+
+ #ifdef __cplusplus
+diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h
+index 71d88ced..e4a2b167 100644
+--- a/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h
+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h
+@@ -57,6 +57,41 @@ static inline psa_status_t crypto_caller_sign_hash(struct service_client *contex
+ 	return status;
+ }
+
+static inline psa_status_t crypto_caller_sign_message(struct service_client *context,
+						   psa_key_id_t id,
+						   psa_algorithm_t alg,
+						   const uint8_t *hash,
+						   size_t hash_length,
+						   uint8_t *signature,
+						   size_t signature_size,
+						   size_t *signature_length)
+{
+	struct service_client *ipc = context;
+	struct rpc_caller *caller = ipc->caller;
+	psa_status_t status;
+	struct psa_ipc_crypto_pack_iovec iov = {
+		.sfn_id = TFM_CRYPTO_SIGN_MESSAGE_SID,
+		.key_id = id,
+		.alg = alg,
+	};
+	struct psa_invec in_vec[] = {
+		{ .base = psa_ptr_to_u32(&iov), .len = iov_size },
+		{ .base = psa_ptr_const_to_u32(hash), .len = hash_length },
+	};
+	struct psa_outvec out_vec[] = {
+		{ .base = psa_ptr_to_u32(signature), .len = signature_size },
+	};
+
+	status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
+			  IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
+
+	*signature_length = out_vec[0].len;
+
+	return status;
+}
+
+
+
+ #ifdef __cplusplus
+ }
+ #endif
+diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h
+index e16f6e54..cc9279ee 100644
+--- a/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h
+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h
+@@ -24,19 +24,20 @@
+ extern "C" {
+ #endif
+
+-static inline psa_status_t crypto_caller_verify_hash(struct service_client *context,
+static inline psa_status_t crypto_caller_common(struct service_client *context,
+ 						     psa_key_id_t id,
+ 						     psa_algorithm_t alg,
+ 						     const uint8_t *hash,
+ 						     size_t hash_length,
+ 						     const uint8_t *signature,
+-						     size_t signature_length)
+						     size_t signature_length,
+						     uint32_t sfn_id)
+ {
+ 	struct service_client *ipc = context;
+ 	struct rpc_caller *caller = ipc->caller;
+ 	psa_status_t status;
+ 	struct psa_ipc_crypto_pack_iovec iov = {
+-		.sfn_id = TFM_CRYPTO_VERIFY_HASH_SID,
+		.sfn_id = sfn_id,
+ 		.key_id = id,
+ 		.alg = alg,
+ 	};
+@@ -52,6 +53,32 @@ static inline psa_status_t crypto_caller_verify_hash(struct service_client *cont
+ 	return status;
+ }
+
+static inline psa_status_t crypto_caller_verify_hash(struct service_client *context,
+						     psa_key_id_t id,
+						     psa_algorithm_t alg,
+						     const uint8_t *hash,
+						     size_t hash_length,
+						     const uint8_t *signature,
+						     size_t signature_length)
+{
+
+	return crypto_caller_common(context,id,alg,hash,hash_length,
+			signature,signature_length, TFM_CRYPTO_VERIFY_HASH_SID);
+}
+
+static inline psa_status_t crypto_caller_verify_message(struct service_client *context,
+						     psa_key_id_t id,
+						     psa_algorithm_t alg,
+						     const uint8_t *hash,
+						     size_t hash_length,
+						     const uint8_t *signature,
+						     size_t signature_length)
+{
+
+	return crypto_caller_common(context,id,alg,hash,hash_length,
+			signature,signature_length, TFM_CRYPTO_VERIFY_MESSAGE_SID);
+}
+
+ #ifdef __cplusplus
+ }
+ #endif
+--
+2.25.1
@@ -0,0 +1,40 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From b3529f7a5bc1cff193fd0887c0f78348ef6043a4 Mon Sep 17 00:00:00 2001
+From: Satish Kumar <satish.kumar01@arm.com>
+Date: Mon, 14 Feb 2022 17:52:00 +0000
+Subject: [PATCH 14/15] Fix : update psa_set_key_usage_flags definition to the
+ latest from the tf-m
+
+Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
+---
+ components/service/crypto/include/psa/crypto_struct.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/components/service/crypto/include/psa/crypto_struct.h b/components/service/crypto/include/psa/crypto_struct.h
+index 1bc55e37..b4a7ed4b 100644
+--- a/components/service/crypto/include/psa/crypto_struct.h
+++ b/components/service/crypto/include/psa/crypto_struct.h
+@@ -155,9 +155,19 @@ static inline psa_key_lifetime_t psa_get_key_lifetime(
+     return( attributes->lifetime );
+ }
+
+static inline void psa_extend_key_usage_flags( psa_key_usage_t *usage_flags )
+{
+    if( *usage_flags & PSA_KEY_USAGE_SIGN_HASH )
+        *usage_flags |= PSA_KEY_USAGE_SIGN_MESSAGE;
+
+    if( *usage_flags & PSA_KEY_USAGE_VERIFY_HASH )
+        *usage_flags |= PSA_KEY_USAGE_VERIFY_MESSAGE;
+}
+
+ static inline void psa_set_key_usage_flags(psa_key_attributes_t *attributes,
+                                            psa_key_usage_t usage_flags)
+ {
+    psa_extend_key_usage_flags( &usage_flags );
+     attributes->usage = usage_flags;
+ }
+
+--
+2.25.1
@@ -0,0 +1,120 @@
+Upstream-Status: Pending [Not submitted to upstream yet]
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+
+From 500a359b65398d0a272a474566659fd5a21f44ff Mon Sep 17 00:00:00 2001
+From: Satish Kumar <satish.kumar01@arm.com>
+Date: Mon, 14 Feb 2022 08:22:25 +0000
+Subject: [PATCH 15/15] Fixes in AEAD for psa-arch test 54 and 58.
+
+Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
+---
+ .../crypto/client/caller/packed-c/crypto_caller_aead.h    | 1 +
+ components/service/crypto/include/psa/crypto_sizes.h      | 2 +-
+ .../crypto/provider/extension/aead/aead_provider.c        | 8 ++++++--
+ .../extension/aead/serializer/aead_provider_serializer.h  | 1 +
+ .../packed-c/packedc_aead_provider_serializer.c           | 2 ++
+ protocols/service/crypto/packed-c/aead.h                  | 1 +
+ 6 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h b/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h
+index c4ffb20c..a91f66c1 100644
+--- a/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h
+++ b/components/service/crypto/client/caller/packed-c/crypto_caller_aead.h
+@@ -309,6 +309,7 @@ static inline psa_status_t crypto_caller_aead_update(struct service_client *cont
+ 	size_t req_len = req_fixed_len;
+
+ 	*output_length = 0;
+        req_msg.output_size = output_size;
+ 	req_msg.op_handle = op_handle;
+
+ 	/* Mandatory input data parameter */
+diff --git a/components/service/crypto/include/psa/crypto_sizes.h b/components/service/crypto/include/psa/crypto_sizes.h
+index 4d7bf6e9..e3c4df29 100644
+--- a/components/service/crypto/include/psa/crypto_sizes.h
+++ b/components/service/crypto/include/psa/crypto_sizes.h
+@@ -351,7 +351,7 @@
+  *       just the largest size that may be generated by
+  *       #psa_aead_generate_nonce().
+  */
+-#define PSA_AEAD_NONCE_MAX_SIZE 12
+#define PSA_AEAD_NONCE_MAX_SIZE 16
+
+ /** A sufficient output buffer size for psa_aead_update().
+  *
+diff --git a/components/service/crypto/provider/extension/aead/aead_provider.c b/components/service/crypto/provider/extension/aead/aead_provider.c
+index 14a25436..6b144db8 100644
+--- a/components/service/crypto/provider/extension/aead/aead_provider.c
+++ b/components/service/crypto/provider/extension/aead/aead_provider.c
+@@ -283,10 +283,11 @@ static rpc_status_t aead_update_handler(void *context, struct call_req *req)
+ 	uint32_t op_handle;
+ 	const uint8_t *input;
+ 	size_t input_len;
+        uint32_t recv_output_size;
+
+ 	if (serializer)
+ 		rpc_status = serializer->deserialize_aead_update_req(req_buf, &op_handle,
+-			&input, &input_len);
+			&recv_output_size, &input, &input_len);
+
+ 	if (rpc_status == TS_RPC_CALL_ACCEPTED) {
+
+@@ -300,9 +301,12 @@ static rpc_status_t aead_update_handler(void *context, struct call_req *req)
+ 		if (crypto_context) {
+
+ 			size_t output_len = 0;
+-			size_t output_size = PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(input_len);
+			size_t output_size = PSA_AEAD_UPDATE_OUTPUT_MAX_SIZE(24);
+ 			uint8_t *output = malloc(output_size);
+
+                        if (recv_output_size < output_size) {
+                            output_size = recv_output_size;
+                        }
+ 			if (output) {
+
+ 				psa_status = psa_aead_update(&crypto_context->op.aead,
+diff --git a/components/service/crypto/provider/extension/aead/serializer/aead_provider_serializer.h b/components/service/crypto/provider/extension/aead/serializer/aead_provider_serializer.h
+index bb1a2a97..0156aaba 100644
+--- a/components/service/crypto/provider/extension/aead/serializer/aead_provider_serializer.h
+++ b/components/service/crypto/provider/extension/aead/serializer/aead_provider_serializer.h
+@@ -51,6 +51,7 @@ struct aead_provider_serializer {
+ 	/* Operation: aead_update */
+ 	rpc_status_t (*deserialize_aead_update_req)(const struct call_param_buf *req_buf,
+ 		uint32_t *op_handle,
+                uint32_t *output_size,
+ 		const uint8_t **input, size_t *input_len);
+
+ 	rpc_status_t (*serialize_aead_update_resp)(struct call_param_buf *resp_buf,
+diff --git a/components/service/crypto/provider/extension/aead/serializer/packed-c/packedc_aead_provider_serializer.c b/components/service/crypto/provider/extension/aead/serializer/packed-c/packedc_aead_provider_serializer.c
+index 6f00b3e3..45c739ab 100644
+--- a/components/service/crypto/provider/extension/aead/serializer/packed-c/packedc_aead_provider_serializer.c
+++ b/components/service/crypto/provider/extension/aead/serializer/packed-c/packedc_aead_provider_serializer.c
+@@ -192,6 +192,7 @@ static rpc_status_t deserialize_aead_update_ad_req(const struct call_param_buf *
+ /* Operation: aead_update */
+ static rpc_status_t deserialize_aead_update_req(const struct call_param_buf *req_buf,
+ 	uint32_t *op_handle,
+        uint32_t *output_size,
+ 	const uint8_t **input, size_t *input_len)
+ {
+ 	rpc_status_t rpc_status = TS_RPC_ERROR_INVALID_REQ_BODY;
+@@ -208,6 +209,7 @@ static rpc_status_t deserialize_aead_update_req(const struct call_param_buf *req
+ 		memcpy(&recv_msg, req_buf->data, expected_fixed_len);
+
+ 		*op_handle = recv_msg.op_handle;
+                *output_size = recv_msg.output_size;
+
+ 		tlv_const_iterator_begin(&req_iter,
+ 			(uint8_t*)req_buf->data + expected_fixed_len,
+diff --git a/protocols/service/crypto/packed-c/aead.h b/protocols/service/crypto/packed-c/aead.h
+index 0be266b5..435fd3b5 100644
+--- a/protocols/service/crypto/packed-c/aead.h
+++ b/protocols/service/crypto/packed-c/aead.h
+@@ -98,6 +98,7 @@ enum
+ struct __attribute__ ((__packed__)) ts_crypto_aead_update_in
+ {
+   uint32_t op_handle;
+  uint32_t output_size;
+ };
+
+ /* Variable length input parameter tags */
+--
+2.25.1
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Vishnu Banavath	bca2dbf93f	arm-bsp/u-boot: add SDCard support for corstone1000 FVP This change is to add SDCard support for corstone1000 FVP Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>	2022-04-01 16:47:13 +01:00
Harry Moulton	33bbdc67f2	arm-bsp/corstone1000: Add RDEPENDS to remove unwanted images. Remove unwanted build images that push the binaries size over the size limit for corstone1000. Signed-off-by: Harry Moulton <harry.moulton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-14 13:00:09 -04:00
Harry Moulton	af33b41925	arm-bsp/linux-yocto: backport remove redundant kernel hacking Backport of `7fc51c7c` from master which removes some redundant code to reduce the size of the resulting corstone1000 binary. Signed-off-by: Harry Moulton <harry.moulton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-14 13:00:09 -04:00
Jon Mason	7bc7872930	arm-bsp: update linux-yocto 5.4 to the latest version Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-11 16:44:39 -05:00
Jon Mason	daa9abf065	arm-bsp: fix yylloc kernel build error Backport patch from upstream to address the following error: scripts/dtc/dtc-parser.tab.o:(.bss+0x20): multiple definition of `yylloc'; scripts/dtc/dtc-lexer.lex.o:(.bss+0x0): first defined here Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-11 16:44:39 -05:00
Peter Hoyes	90facd19a6	arm-bsp/docs,kas: Add SSH server to fvp-baser-aemv8r64 image To make it easier for users to test and evaluate the FVP, including testing inbound network connections, enable the openssh SSH server by default and map to port 8022 on the host. Update fvp-baser-aemv8r64 documentation accordingly in new "Networking" section. Issue-Id: SCM-3881 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I88329731418e198e2ef5d3449bfb38fde5ae77bb Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-11 09:17:42 -05:00
Harry Moulton	6dabbf1542	arm/fvp-corstone1000: backport: update to latest version Backport patch from master to update the URL and checksums for the new Corstone1000 FVP version 11.17.23. Signed-off-by: Harry Moulton <harry.moulton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-09 08:43:57 -05:00
Harry Moulton	ed0e6cb0d3	corstone1000: backport: update meta-arm-image for kirkstone support Backport patch from master to update the sha for meta-arm-image in the corstone1000 kas file to add support for kirkstone. Signed-off-by: Harry Moulton <harry.moulton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-08 14:54:05 -05:00
Peter Hoyes	85fb0ee28a	arm-bsp/docs: Minor fvp-baser-aemv8r64 fixes * Include `--upgrade` in pip3 command to ensure latest kas version is installed * Ensure all underscores are either quoted or escaped * Fix P9 example command Issue-Id: SCM-3881 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: Ie460dbd6b1f87f5f9ca2966329341d22da3606d3 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-03-08 10:16:05 -05:00
Peter Hoyes	d64e3e2178	arm-bsp/docs: Add -b honister instruction for fvp-baser-aemv8r64 Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I1874b0bd9dc5e3da9c40b46d9d002b83b41addcc	2022-03-04 09:21:22 +00:00
Peter Hoyes	2614c78f3b	arm/fvp-base-r-aem: Update to version 11.17.21 Also update version and download link in meta-arm-bsp fvp-baser-aemv8r64 documentation Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I92ec616d25703ff74ed063918a1e4811bac9ff3f	2022-03-02 12:56:18 +00:00
Peter Hoyes	b9f850fe0e	arm-bsp/docs: Improve fvp-baser-aemv864 limitation Add more details about the cache_state_modelled limitation, which can worked around by setting cci400.force_on_from_start=1 Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: Idde23278a87316dae842c6c3793b9836482e8c3a	2022-03-02 12:56:03 +00:00
Peter Hoyes	cc4fa4a11e	arm-bsp/docs: Minor fvp-baser-aemv8r64 updates * Add clarification on how to mount p9 device * Remove instruction to use ctrl + c to stop FVP * Add cache_state_modelled to Known Issues Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I122c5ae5b3ceee1d106205d93a006f75bdbfa2bf Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	621cc45395	arm-bsp/docs: Update fvp-baser-aemv8r64 docs Document U-Boot addition, add new architecture section and update the change log. Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: Ie0e1ff35ade634f2b523c14bb058c9d775802632 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	c0e651acc8	arm-bsp/conf: Use real-time clock for fvp-baser-aemv8r64 Enable the bp.refcounter.use_real_time option, so that the CNTPCT_EL0 increments in real-time instead of simulator time. Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I197d6de4a7316e5299aee34e64e149cbd3d515a9 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	2c3382d4d6	arm-bsp/kernel: Use 4 Gb of RAM in fvp-baser-aemv8r64 The FVP default configuration has bp.dram_size=4, which is sufficient for development and testing purposes, so remove the FVP_CONFIG override and set to 4 Gb in the device tree. Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I4a96062c9e94d36f5459f33c86aab4d4885bab43 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	8c7c60fb3b	arm-bsp/u-boot: Add U-Boot for fvp-baser-aemv8r64 This patch introduces U-Boot into the fvp-baser-aemv8r64 boot flow, providing EFI services. The fvp-baser-aemv8r64 does not have an EL3, so the system starts at S-EL2. For now, U-Boot is running at S-EL2, alongside boot-wrapper. Enable the --enable-keep-el option in boot-wrapper-aarch64 so that it boots the next stage (U-Boot) at S-EL2. Additionally, tell boot-wrapper-aarch64 to bundle U-Boot instead of the kernel. Linux only supports booting from S-EL1 on the fvp-baser-aemv8r64, so U-Boot is configured with CONFIG_SWITCH_TO_EL1, so that booti or bootefi switch to S-EL1 before booting the EFI payload (unless an enviornment variable - armv8_switch_to_el1 - is set to 'n'). Add patches to U-Boot, which: * Backports 53b40e8d54fcdb834e10e6538084517524b8401b, to disable pointer authentication traps. * Add board support for the fvp-baser-aemv8r64 (with a memory map which is inverted from the fvp-base). * Enable the configuration of U-Boot using the device tree passed from boot-wrapper-aarch64. * Enable virtio-net. * Disable setting the exception vectors at S-EL2 so that the PSCI vectors pass through to Linux. * Set up system registers at S-EL2 for Linux. * Configure the S-EL2 MPU for the EFI services. * Allows bootefi to switch to EL1 before booting Linux. Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I229d14b0717df412c1fe33772230ca779f79b32d Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	b63354017a	arm-bsp/boot-wrapper-aarch64: Update patches for fvp-baser-aemv8r64 Update the SRCREV to a more recent revision for the fvp-baser-aemv8r64. Update the machine-specific patches, which makes the following changes: * Add PSCI services to /memreserve/ in the device tree using libfdt. * Add --enable-keep-el option, which allows boot-wrapper-aarch64 to boot the next stage at the same exception level. * Update the counter frequency to 100 MHz. Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: I41843e958cf629d69de644bb57b660fb542fc8b7 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	69d11b64cb	arm/boot-wrapper-aarch64: Upgrade to newer revision Upgrade boot-wrapper-aarch64 to 1044c77062573985f7c994c3b6cef5695f57e955 Hold back gem5 at 8d5a765251d9113c3c0f9fa14de42a9e7486fe8a in bbappend. Issue-Id: SCM-3871 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: Ia5ccca2234dd117d530970f9f90469dacbb778e3 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Peter Hoyes	db6223090e	arm-bsp/fvp-baser-aemv8r64: Fix PL011 and SP805 register sizes The Linux kernel expects the peripheral ID register to be just below the end of the address range, which for the PL011 and SP805 is at 0xFE0 not 0xFFE0, so set the size to 0x1000. Issue-Id: SCM-3881 Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Change-Id: Iada28e8192d72b1647822c33d13deffe507043b5 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-25 09:09:09 -05:00
Emekcan Aras	6dd18c2a80	arm-bsp/security: move TS patches to corstone1000 directory This commit moves all the trusted-services patches to a new corstone1000 directory. Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-21 10:26:53 -05:00
Emekcan Aras	43e5b037e8	kas/corstone1000-base: update meta-arm-image SHA This commit updates the meta-arm-image SHA to drop psa-arch-test from the build. Signed-off-by: Emekcan Aras <emekcan.aras@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-17 18:15:53 -05:00
Vishnu Banavath	400bd5d5f4	arm-bsp/security: trusted-services to fix psa-arch-tests These changes are to fix failures in psa-arch-tests Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-17 18:15:53 -05:00
Vishnu Banavath	2e388235cb	arm-bsp/security: drop psa-arch-tests recipe This change is to build and install psa-arch-tests using trusted-services code and drop psa-arch-tests recipe. Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-17 18:15:53 -05:00
Vishnu Banavath	8a6b6eb810	arm-bsp/tf-m: update git SHA This change is to update TF-M git SHA to fix psa-arch-tests test case failures. Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-17 18:15:34 -05:00
Vishnu Banavath	68db42ec65	arm-bsp/security: replace mbedcrypto with mbedtls This commit replaces mbedcrpyto with mbedtls on the trusted-service recipe. Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-02-17 18:15:34 -05:00
Ross Burton	51b728a52b	CI: use the latest release of the Kas container If we don't specify a tag name GitLab uses the 'latest' tag, which for Kas is moved whenever an image build is made. Instead explicitly use the latest-release tag, which is only updated when a release is made. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-01-28 19:03:58 -05:00
Diego Sueiro	9653e905bd	meta-arm: Make generic-arm64 kernel cfg based on linux-yocto standard kernel type By having the generic-arm64 machine using the same kernel config as the linux-yocto standard kernel type, application layers can rely on the same base configuration, independently of the target machine. Also, the kernel-yocto.bbclass searches for .scc files in the FILESEXTRAPATHS. Hence, we don't need to list generic-arm64-standard.scc in the SRC_URI. Issue-Id: SCM-3910 Signed-off-by: Diego Sueiro <diego.sueiro@arm.com> Change-Id: I46889ce38b32521d8350534cc590b57b158ad573 Signed-off-by: Jon Mason <jon.mason@arm.com>	2022-01-28 19:03:31 -05:00
Vishnu Banavath	ccf342afe1	arm-bsp/psa-arch-tests: change master to main for psa-arch-tests repo master branch is renamed to main on psa-arch-tests github. Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>	2022-01-18 09:00:08 -05:00
Vishnu Banavath	e15df2738e	arm-bsp/uboot: fix null pointer exception for get_image_info This change is to fix NULL pointer exception for get_image_info API for corstone1000 platform Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>	2022-01-17 14:00:08 -05:00
Vishnu Banavath	c30d90a77d	arm-bsp/tf-m: fix capsule instability issue for corstone1000 This change is to upgrade TF-M to latest git hash which contains fix for capsule instability issue for corstone1000 platform. Latest TF-M would also require v3.1 mbedtls. Also updated git hash for mbedtls repo.	2022-01-17 14:00:08 -05:00
Ross Burton	9542161475	CI: track honister branch for clang and zephyr These layers now have honister branches, so track those instead of master. Signed-off-by: Ross Burton <ross.burton@arm.com>	2022-01-17 13:36:30 +00:00