- Document Corstone‑1000 platform architecture based on the Cortex‑A320 core
- Add test specification and guide for Corstone‑1000 with Cortex‑A320
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update Corstone-1000 U-Boot device tree for the Cortex-A320 variant
and enable GICv3/GIC-600, while keeping compatibility with the
existing GIC-400 setup. A single DT image now supports either
configuration via Kconfig guards.
**Device-tree updates (Cortex-A320)**
* Map Ethos-U85 NPU registers at `0x1A050000` (16 KiB) and its SRAM at
`0x02400000` (2 MiB, no-map), plus a 32 MiB DDR carve-out for DMA.
* Add `/ethosu@1a050000` with interrupts, `dma-ranges`, `cs-region`,
and `ethosu-mem-config` for driver probe.
* Guard the NPU node behind `CONFIG_ETHOS_U85`.
* Add a Cortex-A320 compatible string to the Corstone-1000 DTS
downstream.
**GICv3/GIC-600 selection**
* Introduce `CONFIG_GIC_V3` to select the new interrupt controller.
* Add a full GICv3/GIC-600 node guarded by `#ifdef CONFIG_GIC_V3`.
* When GICv3 is enabled, set `cpu@1..3` `reg` to `0x100/0x200/0x300`
(retain `0x1/0x2/0x3` for GIC-400).
* Update the Ethos-U85 interrupt to **SPI 16** to match the interrupt
map.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable Trusted Firmware-A for Corstone-1000 platforms with Cortex-A320 and
switch the interrupt controller from GICv2/GIC-400 to GICv3/GIC-600.
**Platform/feature enablement**
* Map Ethos-U85 NPU registers (`0x1A050000`, 16 KiB) and its SRAM region
(`0x02400000`, 4 MiB) into Normal World
(`MT_DEVICE | MT_RW | MT_NS` / `MT_MEMORY | MT_RW | MT_NS`).
* Force Cortex-A320 feature selection: enable Armv9 features, disable
Cortex-A35 errata, and select the `cortexa320` override in
`trusted-firmware-a-corstone1000.inc`.
* Build TF-A-Tests with `CORSTONE1000_CORTEX_A320=1` to skip non-applicable
FF-A, PSCI, and CPU-extension tests on Cortex-A320.
**GICv3/GIC-600 transition (A320 builds)**
* Update `plat_my_core_pos()` and `plat_arm_calc_core_pos()` to compute the
linear core position using the Cortex-A320 MPIDR_EL1 affinity layout.
* Add an A320-specific core-position routine in assembly, guarded by
`CORSTONE1000_CORTEX_A320`.
* Switch to the GICv3 driver with GIC-600 extensions:
* Update platform GIC base addresses to the GIC-600 layout.
* Use GICv3 APIs; set `USE_GIC_DRIVER=3`, `GICV3_SUPPORT_GIC600=1`,
and `GIC_ENABLE_V4_EXTN=1`.
* Keep conditional GIC versioning so Cortex-A35 continues to use GICv2/GIC-400.
These changes ensure correct GIC configuration and reliable secondary-core
bring-up on Cortex-A320 while preserving existing Cortex-A35 behavior.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable full Corstone‑1000 Cortex‑A320 DSU‑120T platform support in TF‑M:
- Reserve a 4 MiB Host SRAM region at 0x0240_0000 for the
Cortex‑A320 normal world and open it in the CVM firewall
(region 2), gated by `CORSTONE1000_CORTEX_A320``.
- Introduce a DSU‑120T Power-Policy Unit driver plus a
`CORSTONE1000_DSU_120T` CMake option to power on the Cortex‑A320
host cluster with proper secure-enclave firewall and memory-map
setup.
- Add a CMake platform define that auto‑activates when the
`cortexa320` machine feature is present, injecting
DSU‑120T‑specific compile definitions.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the OP-TEE OS build logic to detect `MACHINE_FEATURES` and
append the appropriate `arm64-platform-cpuarch` value to
`EXTRA_OEMAKE`, instead of hard-coding `cortex-a35`.
This change ensures that when `MACHINE_FEATURES` includes
`cortexa320`, the OP-TEE build receives the matching `core-arch` flag,
while maintaining `cortex-a35` as the default.
The new Corstone-1000 variant with Cortex-A320 replaces the original
GIC-400 (v2) interrupt controller with a GIC-600, which is
architecturally compliant with GICv3. Since OP-TEE already provides
a generic GICv3 driver, only minimal platform changes are needed
to expose the updated register map and initialize the GICv3 interface.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable the Corstone‑1000 Cortex‑A320 variant by:
- Introduce `machine/include/corstone1000-a320.inc` to configure the
default Ethos‑U MAC count when `cortexa320` is in MACHINE_FEATURES,
and allow override via `ETHOSU_NUM_MACS`.
- Add a KAS profile at `kas/corstone1000-a320.yml` for Cortex‑A320
FVP-based builds.
- Extend corstone1000.inc to detect MACHINE_FEATURES (cortexa320) and
pull in the matching tune-<core>.inc (default still Cortex-A35).
- Add the `meta-ethos` layer as a dependency of `meta-arm-bsp` for
Cortex‑A320 builds and define a new KMachine override to pull in
the Ethos‑U driver recipe.
- In `conf/machine/corstone1000-fvp.conf`, inspect `MACHINE_FEATURES`
and set `FVP_EXE` to `FVP_Corstone-1000_with_Cortex-A320` when
`cortexa320` is enabled, otherwise fall back to `FVP_Corstone-1000`.
- In `recipes-devtools/fvp/fvp-corstone1000.bb`, add a
`SRC_URI:cortexa320` entry (with checksums) for the Cortex‑A320 FVP
build archive.
- Disable the rootfs CPIO file compression so it is not compressed
twice when bundled with the kernel
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When a recipe uses the externalsrc class, the do_patch task is
skipped entirely as specified in SRCTREECOVEREDTASKS.
Since do_apply_local_src_patches function is registered as a postfuncs,
it would never run in that specific case.
This cause recipes relying on do_apply_local_src_patches to miss the
local source patching when built from external source tree.
To address the issue, schedule a new task after the do_patch and before
the do_configure, ensuring the local patching executes regardless of
whether do_patch was skipped by externalsrc.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Whilst TF-M 2.1.1 doesn't use this, setting the variable doesn't have
any negative effects and consolidates the external module assignments.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We now use Ninja to build TF-M[1], so setting CMAKE_VERBOSE_MAKEFILES
doesn't do anything.
We have arm-none-eabi-gcc 13.3[2], so there's no need to remove options
that <13 don't support.
[1] meta-arm 018fd6aecf ("arm/trusted-firmware-m: use Ninja to build")
[2] meta-arm f646ee4507 ("arm-toolchain: update to 13.3")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As the Poky layer will no longer be updated following
the integration of `bitbake-setup`, developers are advised to
use a combination of the `bitbake` and `openembedded-core`
layers instead of the `poky` layer.
Note that the `poky` layer is a combination of these two
layers glued into a single repository for convenience.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We don't run or package the tests, so there's no point to building them.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We depend on native tools to provide these binaries, so we can delete
them to ensure that our tools are always used and never the prebuilt.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Split configure/compile and invoke ninja directly so that we can
control parallelisation.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
GICC registers are not defined for GICv3. Trusted-Firmware-A throws error when
GICC register address is not defined even for GICv3. Adding patch
to handle this in Trusted-Firmware-A.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
ARMmbed/mbedtls is the old name and redirects to Mbed-TLS/mbedtls, use
the correct name to avoid the redirection.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Introduce new file `corstone1000-extsys.inc` to define variables related
to the external system.
- Ensure this file is included only when MACHINE_FEATURES do contain
corstone1000-extsys.
This change makes external system configuration modular and only applied
when explicitly enabled through machine features.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The image wasn’t autoloading kernel modules even though
`KERNEL_MODULE_AUTOLOAD` populated `/etc/modules-load.d/`. In this
configuration `/etc/init.d/rcS` only executes runlevel scripts from
`/etc/rcS.d` (and `/etc/rc5.d`), and `modutils.sh` was also missing.
This change:
* Includes the loader by adding `modutils-initscripts` to
`CORE_IMAGE_EXTRA_INSTALL`.
* Enables SysV init by appending `sysvinit` to `DISTRO_FEATURES`,
ensuring the `S*` start links in `/etc/rcS.d` (and `/etc/rc5.d`)
call `/etc/init.d/modutils.sh start` during boot.
**Result:** entries in `/etc/modules-load.d/*.conf` now load
automatically at boot.
**Verification**
* Before: `lsmod` empty after boot; manual `modprobe` needed.
* After: `lsmod` shows target modules; `dmesg` contains module init logs.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Switch the *reserved-memory* node from two-cell (64-bit) encoding to
one-cell (32-bit) encoding and adjust the `reg` property accordingly
to make reserved-memory node format compatible with rest of the dts.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Fedora 39 artifacts have been moved to an /archive/ directory, so
update the SRC_URI to match.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
git.trustedfirmware.org is an alias for review.trustedfirmware.org. We
moved the main recipe to use review.trustedfirmware.org last year[1]
but not all other recipes that fetch the source followed, which means
that we have to fetch TF-A multiple times.
This commit ensures that all the recipes are using the same SRC_URI, so
we just fetch TF-A once.
[1] a6a4952e ("arm/trusted-firmware-a: use correct git URL")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
tfm_sign_image.bbclass hard codes the image security counter, which is
generated from the image version x.y.z.
The generated image security counter value is huge if x or y > 0.
Platform security counter store may not support such a huge counter
value.
Introduce a variable RE_WRAPPER_SECURITY_COUNTER to enable platforms to
specify the actual image security counter.
Signed-off-by: David Hu <david.hu2@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This job takes a few minutes and isn't useful unless it's being ran for
master, or is being actively worked on.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Reduce the number of tests being run in CI to reduce the amount of time
it takes to complete, while providing the same code coverage. Internal
CI runs went from 2.5h to 1.5h.
Signed-off-by: Jon Mason <jon.mason@arm.com>
It turns out that the base SRCREV for trusted-services is a tag name,
which meant it was hitting the network on every build. Use the SHA
instead.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The SMAIL_GPL license in oe-core was renamed SMAIL-GPL to match SPDX.
Update the recipe to match this.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This bbappend was _appending_ to FILESEXTRAPATHS but putting the colon
separator _after_, so it actually constructed an invalid path.
Change the assignment to be prepend, so the separator is in the right
place.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
trusted-firmware a has a compile error when building with clang. Since
this platform is EOL'ed and we're not currently building this platform
with clang in CI, the best option is to force GCC for it.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Hopefully this issue can be fixed in a newer release. Move the
toolchain forcing to the versioned so that it can be tracked easier.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that clang is in core, we don't need to use meta-clang anymore.
Also, use PREFERRED_TOOLCHAIN_TARGET to specify the toolchain to use.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The u-boot recipe now uses unique build directories per config that is
being built, to ensure that there is no cross-contamination.
Handle this by moving the do_configure and do_install appends to
uboot_configure_config and uboot_install_config so that we can simply
use $builddir.
[1] oe-core 22e96b32b0b ("u-boot: Make sure the build dir is unique for each UBOOT_CONFIG")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Since TF-M v2.2.1, the new crypto driver used does not support RSA
algorithms, so these tests are no longer valid.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Re-adds a patch aligning the Trusted Services PSA Crypto
structure with its equivalent definition in TF-M v2.1.1.
The patch was previously removed during the upgrade to
Trusted Services v1.2, as it was believed to be included in that
version. However, the alignment is still required to maintain
consistency with TF-M v2.1.1.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
We have 2.2.1, so there's no need for 2.2.0. This removal was accidentally
omitted from the 2.2.1 upgrade.
Signed-off-by: Ross Burton <ross.burton@arm.com>
The OESSHTarget object now has a ignore_ssh_fails keyword argument[1],
so update this subclass to match.
As the implementation of run() here simply forwards the arguments, we
can use *args, **kwargs so that future changes don't cause problems.
[1] oe-core afe118d4f2d ("oeqa: target: ssh: Fail on SSH error even when errors are ignored")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Moving forwards, it's expected that the poky repository will no longer be
updated as the integration of bitbake-setup means that users are
encouraged to use bitbake+oe-core separately instead.
We also need to fetch meta-yocto as our CI is currently explicitly based
on the poky distribution.
This is effectively a no-op change, as poky is simply these component
repositories glued into a single repository for convenience.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Backport a patch from upstream to fix the build of antlr with GCC 15 on
the host.
The build still fails with clang, so update the message with the current
error message.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Backport Trusted Firmware-A patch to re-enable the BL31
console during early boot.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that clang is part of oe-core we can't use meta-clang being present
as an indicator of clang being available.
This does mean we can clean up the logic and just use TOOLCHAIN, as that
is always set now.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream appear to have resolved the libgcc linkage issues as these
variables are not used in upstream nor our patches.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Kernel builds are logging the following issue:
WARNING: linux-yocto-6.16.8+git-r0 do_kernel_configcheck: [kernel config]: specified values did not make it into the kernel's final configuration:
[NOTE]: 'CONFIG_BT_LEDS' last val (y) and .config val (n) do not match
This could be enabled by setting:
CONFIG_LEDS_CLASS=y
CONFIG_NEW_LEDS=y
CONFIG_SND_SOC_HDA=y
But this isn't really useful on the juno platform. So, better to
disable the BT LEDs.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Rename the Corstone-1000 Trusted Services patches so that their
numbering matches the application order, and the remainder of
each patch name matches its corresponding commit message subject.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Corstone-1000 Trusted Services patches removed in this change are no
longer required following the upgrade to Trusted Services v1.2.0.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Trusted Services requires knowledge of the Corstone-1000 platform type to
select the correct set of FWU image UUIDs at compile time.
This change introduces a CORSTONE_1000_TYPE variable in both BitBake
and CMake code to differentiate between Corstone-1000 platform types.
Its value is determined by the selected Corstone-1000 target machine
configuration file:
* `CORSTONE_1000_TYPE_CORTEX_A35_FVP`
* `CORSTONE_1000_TYPE_CORTEX_A35_MPS3`
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update edk2-firmware to the latest release and update edk2-basetools to
match this update (as the previous update did not do this).
Also, fix clang compile issues. This change should fix any clang
compile issues since edk2-stable202108 (completely untested, but that is
when the relevant variables were renamed).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add variables for setting the Major and Minor version of the ARM
Instruction Set Architecture, and add those variables in the various
places needed for the FVP Base virtual machine to run with those
instructions.
Signed-off-by: Jon Mason <jon.mason@arm.com>
oe-selftest is now logging having rm_work enabled as an error, which is
causing the test to fail. Remove this from the selftest.yml file, and
everything works as before.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The move to Trusted-Firmware-M v2.2.1 makes the BL1 code larger,
while the provisioning bundle can be trimmed. At the same time BL2 and
TF-M binary addresses now need to begin on a 0x100-byte boundary for
Cortex-M0+ based platforms.
Key changes
--------------------------------
- Upgrade Trusted-Firmware-M v2.2.1 for Corstone-1000
- New crypto driver supports ECC instead of RSA.
- Rebase patches
- Add new patches to address the following changes for v2.2.1
- Increase `BL1_1_CODE_SIZE` to 58KB to accommodate the v2.2.1 binaries.
- Reduce `PROVISIONING_DATA_SIZE` to 6KB.
- `BL2_CODE_START` and `S_CODE_START` are aligned to 0x100 byte boundary
so both start addresses are an exact multiple of 0x100.
- Adapt ADAC enabled build to the new BL2 build restructure.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Include patch to add relevant checks in GCC linker scripts to validate if the
BL2 and Trusted-Firmware-M binary addresses are aligned to 0x100 byte boundary
for Cortex-M0+ based platforms.
This is required because:
For Cortex-M0+ VTOR: 256-byte vector table is at the offset 0x00 of the image.
To keep that table in one block, the image base must be a multiple of 0x100.
For reference: https://developer.arm.com/documentation/ddi0419/latest/
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Juno board supports Arm CoreSight, so add it to MACHINE_FEATURES.
This is useful because oe-core's perf recipe will now enable coresight
support automatically if this feature is present[1].
[1] oe-core c455bd03910 ("perf: enable coresight if enabled in MACHINE_FEATURES")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The oe-core perf recipe will now enable coresight support automatically
if the coresight MACHINE_FEATURE is set[1], so we can remove the manual
configuration in our CI and let the machines enable it where appropriate.
[1] oe-core c455bd03910 ("perf: enable coresight if enabled in MACHINE_FEATURES")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
wic in oe-core has renamed --extra-space to --extra-filesystem-space[1],
so update the workaround here.
[1] oe-core 39d10137b86 ("wic: rename wks flag --extra-space to --extra-filesystem-space")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The OP-TEE default tests are taking over 30 minutes, which is causing CI
to overall take several hours. For QEMU machines, reduce the tests to
just be the regression tests, which reduces the CI time by over 30%.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Originally we customised the CI build for speed, by switching to ipkg
instead of rpm for the packages and disabling graphical output support
in qemu-system-native.
These are admirable goals, but more admirable is sharing sstate and
people may wish to use the output of this CI without having to make the
same alterations.
Drop these two changes so that our configuration matches poky. I've
verified that with this change, a build of core-image-sato for qemuarm64
can be built almost entirely from the autobuilder's sstate[1].
[1] gator-daemon, opencsd, and perf are built as these are not built on
the AB in this configuration.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
testimage.yml was skipping the opkg tests, but we also need to skip the
dnf tests for when PACKAGE_CLASSES="package_rpm".
These skips are FVP-specific as they are due to the wrong IP being used
by the test suite. This should be fixed in the FVP test harness, but
for now move the exclusions into fvp.yml so they're isolated.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable OF_UPSTREAM support for the corstone1000 platforms in U-Boot.
This patchset enables OF_UPSTREAM device tree support in U-Boot for the
corstone1000 platforms. This allows U-Boot to build using upstream
Linux kernel device tree sources instead of downstream copies.
The following changes are introduced:
- Enable OF_UPSTREAM to support upstream device tree.
- Update DEVICE_TREE naming with "arm/" prefix.
- Add device tree overlay to retain U-Boot specific device tree
nodes.
- Remove legacy device trees for corstone1000.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
OP-TEE version 4.7.0 has been released on 2025-07-11 [1], and includes fixes
that are currently collected as separate patches in the layer collection.
Upgrade OP-TEE recipes to point to version 4.7.0, and drop patches from layers
as they are already present in upstream.
Clang patch in `optee-os` package was completely removed. Upstream logic was
changed in PR #7382 [2], making this patch obsolete.
CVE-2025-46733 in `optee-ftpm` package is now properly tagged and included in
4.7.0 version as well.
One patch that is still kept in the layer is
optee-client/0001-tee-supplicant-update-udev-systemd-install-code.patch, as it
has been merged after 4.7.0 tag was applied, but already present in upstream as
commit 59b90488e93e ("tee-supplicant: update udev & systemd install code").
Further updates shall consider to drop this as well.
In addition, point corestone1000 machine to a new version, as 4.6.0 is dropped
from the layer. TZDRAM patch is also dropped as it is now present in upstream.
Link: [1]: https://github.com/OP-TEE/optee_os/blob/master/CHANGELOG.md#op-tee---version-470-2025-07-11
Link: [2]: https://github.com/OP-TEE/optee_os/pull/7382
Signed-off-by: Andrey Zhizhikin <andrey.z@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
commit a3a2c49b21 corrected a typo that
was preventing arm-branch-protection flags from being enabled. However,
since making this change, fvp-base with trusted services enabled no
longer boots. However, the flag that seems to be the problem on fvp
base is CFG_TA_BTI. Since this is the only use case for
arm-branch-protection machine feature, remove it from the common file
until this issue can be properly sorted.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update gn to the latest SHA (commit from 08 Aug 2025). There are 66
commits between the previous SHA and the new one.
Signed-off-by: Jon Mason <jon.mason@arm.com>
An uninitialized variable warning is occurring when compiling gn.
However, since Wall is being used in gn, this is being logged as an
error. Pass the no-error flag for this case to workaround this issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
These patches upstream status changed to Backport:
0006-platform-CS1000-Add-multicore-support-for-FVP.patch
0009-CC312-ADAC-Add-PSA_WANT_ALG_SHA_256-definition.patch
0010-Platform-CS1000-Add-crypto-configs-for-ADAC.patch
0012-Platform-CS1000-Remove-unused-BL1-files.patch
0013-Platform-CS1000-Fix-compiler-switch-in-BL1.patch
0017-Platform-CS1000-Enable-FWU-partition.patch
0018-Platform-Corstone1000-Implement-Bootloader-Abstracti.patch
0019-Platform-Corstone1000-Increase-buffer-sizes.patch
0023-Platform-CS1000-Remove-duplicate-configuration-parameters.patch
And from the PSA-ADAC,
This patch upstream status changed to Backport:
0002-ADAC-Link-psa_interface-instead-of-tfm_sprt.patch
This patch upstream status changed to Inappropriate:
0003-Fix-psa_key_handle_t-initialization.patch
Reason: mbedcrypto configs have to be fixed to build secure-debug mps3
without this patch
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since OE-core 6fd8af0d, the semicolon delimeter in bb.build_exec_func
variables is not needed. The commit silently removes any stray ';' but
failed to handle ';' when assigning to vardeps.
In meta-arm, this has the effect of changes to FVP_* variables not being
picked up when rebuilding the image recipe since mickledore.
This is ancient history now, so just remove the semicolon to fix the
variable dependency issue when using fvpboot in meta-arm.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This recipe was using EXTREA_OEMAKE to enable BTI, fix the typo.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The OP-TEE suite of packages use lld if the compiler is clang, so now
that the lld recipe has been split out of the clang recipe we need to
depend on both.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Clang is large but this recipe builds on all hosts now, so we don't need
to exclude it.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This doesn't use pkgconfig, or python3native, or need to inherit clang.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The build explicitly uses lld, so now that it has been split out of the
clang recipe we need to also depend on that.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
A test compares the value of the Generic Timer register CNTFRQ visible in
two frames CNTBaseN and CNTCTLBase that are linked in Armv8-A and reflect
the same value.
An issue in Corstone-1000 (errata 2142118) makes the CNTFRQ views
inconsistents and the then test fails. There is no workaround and
the test is skipped.
Errata: https://developer.arm.com/documentation/sden2142076/0002/?lang=en
Signed-off-by: Christophe Thiblot <christophe.thiblot@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Until Corstone1000 can be updated to use 2025.07, keep an older release
of u-boot in meta-arm-bsp for it to use.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The use of 2023.07.02 was removed in meta-arm e29c0ee70a
("arm-bsp/u-boot: corstone1000: Add PSA Firmware Update support (DEN0118
v1.0A)").
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the FVP base u-boot patches to apply cleanly to u-boot v2025.07.
Also, use a config fragment to change the default boot command to boot
virtio image. This works around some changes in
include/configs/vexpress_aemv8.h that change the boot behavior, which is
not something we're using anyway.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the architecture documentation for Corstone-1000 to include
details about the new PSA Firmware Update (FWU) implementation.
The new section describes the bootloader abstraction layer (BAL),
UEFI capsule update flow, FWU metadata handling, and the integration
between TF-M and U-Boot for managing trial and accepted images.
This documentation helps align the platform with PSA FWU requirements
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream has removed the need to explicitly set S = "${WORKDIR}/git",
and now defaults to S = "${UNPACKDIR}". As a result, directly referencing
${WORKDIR}/git will fail when the source is unpacked elsewhere.
Update do_install() to use ${S}/BaseTools instead of the hardcoded path.
This issue was previously unnoticed as EDK2 tools (e.g. GenerateCapsule)
were not being used in the build path at the time of the earlier refactor
(commit eea74860).
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add PSA FWU support on U-Boot v2025.04
Introduce Platform Security Architecture (PSA) Firmware Update (FWU) support to
U-Boot v2025.04 on the Corstone-1000 reference design. This implements the
Arm DEN0118 v1.0A specification and provides a generic, upstreamable FWU
framework for reuse across other Arm platforms.
Design overview:
Client/Runner: U-Boot parses the capsule and executes the FWU state machine.
Update agent: Secure world handles flash writes and metadata updates.
Key features:
- Capsule-based firmware updates with support for multiple payloads
- On-disk capsule handling (ESP-based update)
- Optional image acceptance at ExitBootServices()
- ESRT (EFI System Resource Table) support
- FFA_MEM_SHARE and FFA_MEM_RECLAIM ABI support
- FWU enabled for the Corstone-1000 platform
[1]: Platform Security Firmware Update for the A-profile Arm Architecture,
https://developer.arm.com/documentation/den0118/latest/
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit removes the outdated patches of capsule update implementation for the Corstone-1000
platform targeting Trusted-Firmware-M (TF-M). The changes include the removal of
obsolete out-of-tree patches and the rebase of retained patches to align with the
latest upstream TF-M integration.
Key changes:
- Dropped legacy TF-M patches related to old capsule update flow
- Rebasing of remaining TF-M patches for compatibility with current TF-M baseline
This cleanup streamlines the TF-M integration for Corstone-1000 in preparation for
the updated PSA Firmware Update (FWU) aligned capsule update support.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change removes the obsolete out-of-tree patches and legacy support related
to the old capsule update mechanism for the Corstone-1000 platform.
The Trusted-Services components are now aligned with the upstream implementation,
and outdated patches have been dropped or rebased as necessary.
- Removed deprecated patches targeting old capsule update logic
- Rebasing of remaining patches to ensure compatibility with updated TS interface
This prepares the platform for the new PSA FWU-based capsule update path and
reduces technical debt in Trusted-Services integration.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Add 'CAPSULE_SELECTED_COMPONENTS' to enable filtering of firmware
components during capsule generation. Only components listed in
'CAPSULE_SELECTED_COMPONENTS' will be included in the final capsule
image.
- Introduce CAPSULE_EXTRA_ARGS to allow passing additional arguments.
'--capflag PersistAcrossReset' to retain capsule across reboots.
- Payload selection is now controlled via the KAS YAML configuration
(corstone1000-image-configuration.yml), allowing per-image control
over which firmware components are included.
- With the introduction of multiple payload support, 'CAPSULE_VERSION'
no longer represents the firmware version itself but is instead
used for naming the capsule and assigning a common version to all
payloads to simplify testing.
- Use EDK2 tool to switch from single FMP capsule generation to multiple
FMP capsules using a JSON-based configuration. This removes the need
for manually combining firmware images into a .nopt image.
- Remove legacy nopt image creation logic, as each firmware binary is
now handled individually. Components no longer need to be merged.
Deploy task was removed with nopt logic.
- Generate dummy.bin for EDK2 tool compatibility. EDK2 requires
at least one input file for each payload.
- Added dependency on to to ensure images are signed before capsule
generation.
- Add CAPSULE_LOWEST_SUPPORTED_VERSION to
corstone1000-image-configuration.yml.It in the same file where
the firmware version (FW_VERSION) is defined, ensuring a unified
location for version-related metadata. This value was chosen to
be equal to the firmware version to represent a downgrade
scenario (from version 6 to version 5) during testing.
- CAPSULE_HARDWARE_INSTANCE is set to "1" by default (instead of 0),
indicating the first hardware.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit updates the uefi_capsule.bbclass to use the EDK2
GenerateCapsule tool instead of the mkeficapsule utility from U-Boot.
The switch was necessary because the mkeficapsule utility from U-Boot
does not support generating capsules with multiple payloads, whereas
the EDK2 GenerateCapsule tool provides native support for multi-image
capsule creation.
These changes allow building UEFI capsules with multiple firmware
binaries in one step, making the firmware update process
more flexible.
- Switching dependency from u-boot-tools-native to
edk2-basetools-native
- Updating the actual capsule creation command to GenerateCapsule
with the appropriate flags (including hardware instance, lowest
supported version, and monotonic count)
* CAPSULE_HARDWARE_INSTANCE defines which hardware instance
the capsule update is intended for. This can be set
to "1" or "0" indicating the first hardware module or SoC.
For systems with multiple modules, subsequent instances
could be numbered 2, 3, etc.
* CAPSULE_LOWEST_SUPPORTED_VERSION enables roll-back protection
by specifying the minimum firmware version that the platform
accepts. Any firmware update below this version will be
rejected.It should be set 0, 1, 2, etc according to your
firmware security and versioning requirements.
- Combining certificates into the private key file as required
by GenerateCapsule
- Add support for multiple firmware payloads
This update refactors the capsule generation process to support
multiple firmware binaries instead of a single payload.
Key changes include:
- Integration of a JSON generator script to define multiple payloads
- Add default path for JSON config generator and prepare
test infrastructure.
- Introduction of new variables
* CAPSULE_ALL_COMPONENTS: of all available components
to be included in the capsule generation process.
* CAPSULE_SELECTED_COMPONENTS: Subset of components from
CAPSULE_ALL_COMPONENTS that should actually be included
in the final capsule image.
- Replacement of direct GenerateCapsule arguments with JSON input
- Allow passing custom arguments to GenerateCapsule via
`CAPSULE_EXTRA_ARGS` variable
- Cleanup of temporary files used in the capsule generation process
These changes align with EDK2's flexible capsule format and enable
component level filtering for more advanced firmware update scenarios.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit implement the required changes in Trusted-Services in order
to incorporate PSA FWU implementation. It involves the following changes:
1. Integrate IPC framework for PSA FWU calls between Cortex-A and Cortex-M subsystems.
IPC framework is required to bridge the PSA FWU calls for the platforms which have
both Cortex-A and Cortex-M subsystems. Corstone-1000 falls under this category of
platforms. In these platforms, the PSA FWU client and PSA FWU provider exist on
Cortex-A and all the PSA FWU services are implemented on Cortex-M side. This IPC
framework forwards the PSA FWU calls from Cortex-A to Cortex-M subsystem.
2. Load initial image state in PSA FWU M update agent
Set initial image state based on the image state returned by
psa_fwu_query. This way the update agent has the correct view of images
after reboot and it can accept or reject them.
3. Define PSA FWU image mapping structure.
Define PSA FWU image mapping structure for Corstone-1000.
This structure is responsible to map specific image guid with
component number.
To enable platform-specific handling, service_proxy_factory.c now
conditionally selects the appropriate image mapping
based on PLATFORM_IS_FVP. This ensures that both FVP and MPS3
platforms use the correct GUID and firmware update configuration.
4. Fix PSA FWU IPC psa_fwu_install() return value check
This change adds support to validate if the return type in psa_fwu_install()
is either PSA_SUCCESS or PSA_SUCCESS_REBOOT. Both the return values are expected.
Earlier, only PSA_SUCCESS is validated.
5. Add ESRT support
Add ESRT support for PSA FWU M agent.
ESRT functionality is implemented using unique image dedicated
for ESRT data having its own UUID. In PSA FWU M agent's context,
this image has read only attributes. The ESRT data can be read
using image_read_directory by using ESRT image UUID handle. The
ESRT data is queried from Secure Enclave using psa_fwu_query()
and ESRT data can be read from psa_fwu_impl_info_t structure
object defined in psa_fwu_component_info_t.
This commit includes the following changes:
1. Declare ESRT data structures.
2. Modify image_directory_read() to include ESRT data read support
3. Modify psa_fwu_m_update_agent_init to initialize ESRT image
attributes
6. Enable ESRT support
Enable ESRT support for Corstone-1000.
Introduce ESRT image UUID and its component number and
set TFM_FWU_MAX_DIGEST_SIZE to ESRT data size.
7. Add event provider proxy
Normal world needs to send boot confirmation event
to Secure Enclave and Trusted-Services is responsible
to transfer the event to Secure Enclave.
This commit implements the event handling framework in
SE-proxy-SP and develops event provider proxy which
forwards the event to Secure Enclave via psa calls.
This change is introduced for Corstone-1000
8. Define GUID for each payloads
Define GUID's for all the 4 payloads for FVP and
MPS3.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Imre Kis <imre.kis@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Introduces PLATFORM_IS_FVP to differentiate between FVP and FPGA builds.
Adds platform-specific CMake files for corstone1000-fvp and corstone1000-mps3,
and updates platform.cmake to use this toggle.
This commit also adds the TS_PLATFORM variable to corstone1000-fvp.conf
and corstone1000-mps3.conf, explicitly defining platform identifiers
for Trusted Services. This ensures a consistent and clear distinction
between the FVP and MPS3 builds within the build system.
These changes improve maintainability and platform-specific handling
by making it easier to reference the correct target platform
in configurations and scripts.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Increase `PS_MAX_ASSET_SIZE` and `CRYPTO_IOVEC_BUFFER_SIZE` for the
Corstone-1000 platform to support large EFI variable storage required
by the UEFI firmware update flow and to pass Arm Architecture Compliance
Suite (ACS) tests.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Introduce Bootloader Abstraction Layer (BAL) support for Corstone-1000 to
enable flexible integration of firmware update including partial capsule
update.
This change includes:
- Enable the firmware update partition for Corstone-1000 and create
placeholder bootloader abstraction layer for Corstone-1000.
- Change the insertion logic of TFM_FWU_BOOTLOADER_LIB to select a new
platform-specific bootloader abstraction layer.
- Use the necessary flags to use the service and resolve any linker
issues that may arise.
- Migration of capsule update logic to a new BAL module under
`platform/ext/target/corstone1000/bootloader/mcuboot/`.
- Implementation of BAL APIs in `tfm_mcuboot_fwu.c` as per the PSA FWU
state machine.
- Removal of `uefi_capsule_parser.c` and `uefi_capsule_parser.h` as capsule
parsing is done in U-Boot.
- Enhancement of `uefi_fmp.c` to handle FMP metadata for multiple images.
- Update of `provisioning.c` and `security_cnt_bl2.c` to handle new BAL
return values.
- Addition of `fwu_config.h.in` with default FWU configuration.
- Metadata layout changes to include size and image GUIDs for U-Boot
compatibility during FWU Accept flow.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support to permit FWU calls in RSE-COMMS Trusted-Firmware-M for Corstone-1000
This change is required to allow the transmission of PSA FWU related
calls between Cortex A and Cortex M side on Corstone-1000.
For every PSA call from A side, the RSE-COMMS at M side validates, if the
call is allowed or not.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch has been dropped in the following commit:
f1fc5c53 - arm/hafnium: update to v2.12.0
Unfortunately the original issue is still present and the
patch is required for the successful build. Patch is
restored in this commit.
Signed-off-by: Csaba Szilágyi <csaba.szilagyi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
third_party/linux submodule has been removed from hafnium in the
following commit:
ddeedafa - chore: drop the third_party/linux submodule
Relevant patch can not be applied anymore. Patch is removed
from the recipe.
Signed-off-by: Csaba Szilágyi <csaba.szilagyi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
'qemu_aarch64' is not a valid hafnium platform. Supported platforms are:
* 'secure_rd_v3'
* 'secure_rd_v3_cfg1'
* 'secure_aem_v8a_fvp_vhe'
* 'aem_v8a_fvp_vhe'
* 'aem_v8a_fvp_vhe_ffa_v1_1'
* 'qemu_aarch64_vhe'
* 'secure_qemu_aarch64'
* 'rpi4'
* 'secure_tc'
Previusly selected 'qemu_aarch64' did not cause error because
it was NOT passed to make. It had no effect.
Within this commit, platform 'secure_qemu_aarch64' is selected
and passed to make.
Signed-off-by: Csaba Szilágyi <csaba.szilagyi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
hafnium is built by clang. Dependency is required for successful
build.
Signed-off-by: Csaba Szilágyi <csaba.szilagyi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
According to original commit, clang for other targets
like aarch64 were not available. This condition is not
present anymore therefore check for x86_64 can be removed.
This reverts commit 01a13b11ad.
Signed-off-by: Csaba Szilágyi <csaba.szilagyi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade trusted-firmware-a to 2.13.0 for Corstone-1000
Upgrade tf-a-tests to 2.13.0 for Corstone-1000
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Apply TF-M downstream patches in the main TF-M recipe, rather than doing
it in corstone1000 recipe.
Signed-off-by: Hamideh Izadyar <hamideh.izadyar@arm.com>
Cmake 4.0 dropped compatibility to cmake versions below 3.5. Update the
required version on the cmake file as a workaround.
Also update the component to use git am instead of apply.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Two variables are moved from the meta-arm-bsp layer to the Trusted-Services
Corstone-1000 platform CMake file so the MM communication buffer address and
page count can be configured from the CMake layer.
Signed-off-by: Michael Safwat <michael.safwat@arm.com>
Patch "0003-optee-enable-clang-support" is no longer appropriate as the
feature the patch provides is no longer required.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
The external-system component was marked as a dependency for the
corstone1000-recovery image regardless of whether external-system was
requested or not. This ensures that is no longer the case.
Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Add some basic tunes for the newly added Arm architectures in GCC.
These will need to be further fleshed out before submitting this to OE
Core, but should be sufficient to use for machines that need them in the
interim.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This CVE is fixed in optee 4.7, so backport for 4.6
For optee-ftpm, the change is submitted right after
the 4.6 tag, so update the SHA instead of holding an
out-of-tree patch.
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use Linaro's optee-ftpm fork instead of historical sample in
Microsoft's TPM reference.
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This recipe has a second copy of QCBOR in SRC_URI, correct the reference
to its location in EXTRA_OECMAKE to fix builds with network isolation.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use UNPACKDIR directly instead of constructing it manually from WORKDIR.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The sources are not under WORKDIR/git, use UNPACKDIR.
Also use B instead of WORKDIR/build in case B changes.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The sources are not under WORKDIR/git anymore, use UNPACKDIR. This
most likely isn't entirely correct but does remove build paths from the
binaries.
Also use TARGET_DBGSRC_DIR instead of constructing the target path
manually.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The caller should (and does) use ci/testimage.yml explicitly instead.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add recipes for OP-TEE v4.6.0
Upgrade Corstone-1000 OP-TEE revision from 4.4.0 to 4.6.0
Add patch to fix compilation issue with musl and optee-test 4.6.0.
Signed-off-by: Clement Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream has removed the need for setting S to WORKDIR, and is throwing
an error if still doing so. Make the necessary changes.
From the upstream commit, much of the changes where made via:
sed -i "/^S = \"\${WORKDIR}\/git\"/d" `find . -name *.bb -o -name *.inc -o -name *.bbclass`
sed -i "s/^S = \"\${WORKDIR}\//S = \"\${UNPACKDIR}\//g" `find . -name *.bb -o -name *.inc -o -name *.bbclass`
Suggested-by: Marcin Juszkiewicz <marcin-oe@juszkiewicz.com.pl>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The network device and pflash can be modified to more correctly emulate
an actual system.
Suggested-by: Marcin Juszkiewicz <marcin-oe@juszkiewicz.com.pl>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The PS_NUM_ASSET is duplicated in the cmake.config and the config_tfm_target.h file
under Corstone-1000. The commit removes the one from the cmake.config and keeps the
one in the header file.
The whole rationale behind this is for the vendor to be able to override the
configuration using the cmake file.
Signed-off-by: Yogesh Wani <yogesh.wani@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
FILESEXTRAPATHS that have a prepend should have a trailing ':' to allow
for the follow-on modifications to the string. Add it here where
necessary.
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The original patch was inadvertently removed by a subsequent commit.
This change restores the patch to fix failures in the PSA Crypto
Suite test on Corstone-1000.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The github URL where the image was located has gone away on the master
branch. Update the URL to point to the legacy branch, which should stay
around (according to the documentation).
Fixes: aebe535aa8 ("arm-systemready: Introduce the Arm SystemReady layer")
Signed-off-by: Jon Mason <jon.mason@arm.com>
Modify the upstream status of the patch to align a PSA crypto struct with
TF-M from Pending to Backport as it is included in TS v1.2.0 release candidate.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
BUILD_CC and friends are only needed for the build of BaseTools, so move
the assignments to that specific make call.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
GCC15 changed the behavior with how unions are initalized, which is
causing an issue with mbedtls in TS. Change the behavior to the
previous way of doing things until the fix has been released.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The test cases for fvp-base will not fully run because the trusted
servies ones are the only ones (instead of being appended to the list).
Correcting this issue so that all the tests can be run.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of edk2-firmware. The sgi issue has been
corrected upstream, so the patch can now be dropped. Also, no longer
seeing the RELEASE issue on qemuarm/qemuarm64, and removing that
workaround.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of SBSA ACS. Since 7.1.4, BSA things were
put in a separate git repo and it now has a dependency on that.
Also, address an issue with BSA, GCC15, and incompatible pointer type
errors.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Yocto project changed the server name for sstate, though the
previous one does still appear to work. Update here to the one matching
the YP documentation.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove TF-A 2.11.0 Yocto recipe.
Remove patches that are now upstreamed in TF-A 2.12
Signed-off-by: Clément Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade trusted-firmware-a to 2.12.1 for Corstone-1000
When GENERATE_COT is enabled, use the Yocto dependency cot-dt2c instead
of installing it with Poetry.
Signed-off-by: Clément Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Backport patch to fix the following compilation issue:
| In file included from tftf/tests/runtime_services/realm_payload/host_realm_payload_simd_tests.c:21:
| tftf/tests/runtime_services/realm_payload/host_realm_simd_common.h:6: error: header guard 'HOST_REALM_COMMON_H' followed by '#define' of a different macro [-Werror=header-guard]
| 6 | #ifndef HOST_REALM_COMMON_H
| tftf/tests/runtime_services/realm_payload/host_realm_simd_common.h:7: note: 'HOST_REALM_COMMON_h' is defined here; did you mean 'HOST_REALM_COMMON_H'?
| 7 | #define HOST_REALM_COMMON_h
| In file included from tftf/tests/runtime_services/realm_payload/host_realm_simd_common.c:13:
| tftf/tests/runtime_services/realm_payload/host_realm_simd_common.h:6: error: header guard 'HOST_REALM_COMMON_H' followed by '#define' of a different macro [-Werror=header-guard]
| 6 | #ifndef HOST_REALM_COMMON_H
| tftf/tests/runtime_services/realm_payload/host_realm_simd_common.h:7: note: 'HOST_REALM_COMMON_h' is defined here; did you mean 'HOST_REALM_COMMON_H'?
| 7 | #define HOST_REALM_COMMON_h
| CC tftf/tests/runtime_services/secure_service/spm_test_helpers.c
| In file included from tftf/tests/runtime_services/realm_payload/host_realm_spm.c:20:
| tftf/tests/runtime_services/realm_payload/host_realm_simd_common.h:6: error: header guard 'HOST_REALM_COMMON_H' followed by '#define' of a different macro [-Werror=header-guard]
| 6 | #ifndef HOST_REALM_COMMON_H
| tftf/tests/runtime_services/realm_payload/host_realm_simd_common.h:7: note: 'HOST_REALM_COMMON_h' is defined here; did you mean 'HOST_REALM_COMMON_H'?
| 7 | #define HOST_REALM_COMMON_h
| cc1: all warnings being treated as errors
| make: *** [Makefile:605: workspace/corstone1000/build/tmp/work/cortexa35-poky-linux-musl/tf-a-tests/2.12.0/build/corstone1000/release/tftf/host_realm_simd_common.o] Error 1
| make: *** Waiting for unfinished jobs....
| cc1: all warnings being treated as errors
| make: *** [Makefile:605: workspace/corstone1000/build/tmp/work/cortexa35-poky-linux-musl/tf-a-tests/2.12.0/build/corstone1000/release/tftf/host_realm_spm.o] Error 1
| cc1: all warnings being treated as errors
| make: *** [Makefile:605: workspace/corstone1000/build/tmp/work/cortexa35-poky-linux-musl/tf-a-tests/2.12.0/build/corstone1000/release/tftf/host_realm_payload_simd_tests.o] Error 1
| make: Leaving directory 'workspace/corstone1000/build/tmp/work/cortexa35-poky-linux-musl/tf-a-tests/2.12.0/git'
Signed-off-by: Clément Faure <clement.faure@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add recipe for the latest version of TF-A, which needs a newer version
of mbedtls as well. The license checksum updated due to hob code being
imported from edk2, which is BSD 2 Clause, which is already in the
license field for the recipe.
Updating the git recipe to use the latest version, and keeping LTS
versions.
sgi575 was removed from 2.13.0. So, pointing that to 2.12
Signed-off-by: Jon Mason <jon.mason@arm.com>
Seeing the following warnings:
WARNING: /builds/jonmason00/meta-arm/work/build/../../meta-arm-bsp/conf/machine/include/corstone1000.inc:72 has a lack of whitespace around the assignment: 'SMMGW_AUTH_VAR="1"'
WARNING: /builds/jonmason00/meta-arm/work/build/../../meta-arm-bsp/conf/machine/include/corstone1000.inc:74 has a lack of whitespace around the assignment: 'SMMGW_INTERNAL_CRYPTO="1"'
Add the necessary white space to address the issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Seeing warnings of:
WARNING: /builds/jonmason00/meta-arm/work/build/../../meta-arm/recipes-security/trusted-services/libpsats_git.bb: /builds/jonmason00/meta-arm/work/build/../../meta-arm/recipes-security/trusted-services/libpsats_git.bb:8 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/libpsats/${TS_ENV}"'
WARNING: /builds/jonmason00/meta-arm/work/build/../../meta-arm/recipes-security/trusted-services/ts-sp-logging_git.bb: /builds/jonmason00/meta-arm/work/build/../../meta-arm/recipes-security/trusted-services/ts-sp-logging_git.bb:8 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/logging/config/${TS_SP_LOGGING_CONFIG}-${TS_ENV}"'
Clean-up the white space to address the issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This switches CI back to using the master branches.
Currently there are two known failures:
- sbsa-ref
- perf on musl
This reverts commit e0c1f0f94a.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We currently archive all of the task logs on every job, but this ends up
being between 2-10MB per job and our pipelines have ~100 jobs.
To save space and time, change the log collection to only happen if the
job fails, and explicitly expire them after a week.
This reverts meta-arm 60abe46, but in two years we've not really needed
successful logs, and they can be easily toggled back on if needed in a
branch.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Three commits had to be removed in order to make the inappropriate
capsule update implementation work with the new Trusted Services
version.
The "Make variable index usage robust with redundancy" commit needs to
be reverted because the FMP support only works if the
SMM_VARIABLE_INDEX_STORAGE_UID is 0x787.
The "Load and store UEFI variable index in chunks" commit needs to
be reverted because the optional create() and set_extended() APIs are
not supported for Corstone-1000.
The "Make constraints of NV UEFI variables persistent" commit needs to
be reverted because the FMP support is not compatible with these
changes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The patches needed rebasing to the latest Trusted Services version so
they can be applied cleanly.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The logging service provides an SPMC agonistic to create log messages.
The current version will simply dump the incoming log messages to a
setial line. Future versions could provide access to log messages from
the NWd, could encrypt the essages and perform more efficient when
logging large messages.
This change enables the logging SP on the fvp_base platform. All log
messages made by SPs after the boot phase will be sent to UART3.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Introduce a new machine feature called "arm-branch-protection". When set
TF-A, optee and Trusted Services SPs will be configured to enable PAC
and BTI. In addition the fvp-is configured to emulate arm-v8.5 and
PAC+BTI.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bound Authenticated Variable configuration related settings to yocto
variables. The aim is easier configuration by hiding SmmGW build system
internals at the yocto recipe level.
For details please see documentation/trusted-services.md
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TS upstream introduced a new library which carries PSA clients. This
library is to be used by linux user-space applications interfacing to
PSA providers running in the SWd.
Modify dependee to use the new library.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Trusted Services introduced its own libc implementation and has no
dependency on newlib anymore. Remove TS specific newlib recipes and
patch files.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump the TS SHA to latest integration.
Set the version of TS dependencies as required.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
New version moved from integrated version of t_cose to upstream git
tree. Doing so necessitates adding a path to the build command, which
is only being done in the 2.2.0 src inc file to prevent any potential
issues with older versions that might be using the
trusted-firmware-m.inc file. t_cose is using BSD, so no need to modify
the recipe licenses.
Also, the 3.6.3 tagged SHA for mbedtls (specified in the 2.2 tf-m
source) is broken. It references an non-existent SHA for
mbedtls-framework, which is corrected in the mbedtls-3.6 branch 2
commits later. Using that corrected commit to work around that issue.
Keeping 2.1.1 around as it is the LTS.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The TF-M was upgraded to v2.1.1 for the Corstone-1000. The TS had to be
aligned with it, to keep the Secure Enclave Proxy Secure Partition
compatible with TF-M.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Unfortunately, new gcc-15 nonstring attribute has just recently been
merged to clang and hasn't made into a release yet - will be part of
clang-21.
For now backport the commit making -Werror conditional and disabled
by default.
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The tfm_sign_image.bbclass was updated so now the used signing key is
passed by the caller. This is needed because there can be cases where
different images have to be signed with different keys.
If no key is passed to the script, then use a default one to keep the
backward compatibility.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Related commit information is given below for reference.
[1/1] arm/classes: add support to configure fvp-bindir
commit: 42390742b1
Signed-off-by: Mohammed Javith Akthar M <mohammedjavitham@ami.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Seeing the warning:
lack of whitespace around the assignment: 'TS_ENV="sp"'
Add the spaces to address the issue
Signed-off-by: Jon Mason <jon.mason@arm.com>
Seeing the warning:
lack of whitespace around the assignment: 'TCLIBC="musl"'
Add spaces to address the issue
Signed-off-by: Jon Mason <jon.mason@arm.com>
Seeing the following warning:
WARNING: /builds/jonmason00/meta-arm/work/build/../../meta-arm-bsp/recipes-bsp/external-system/external-system_0.1.0.bb: /builds/jonmason00/meta-arm/work/build/../../meta-arm-bsp/recipes-bsp/external-system/external-system_0.1.0.bb:6 has a lack of whitespace around the assignment: 'INHIBIT_DEFAULT_DEPS="1"'
Adding spaces addresses the issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
`devtool check-upgrade-status` reports the new version as "20151030.",
which is the last tagged release. Given that there are a number of
commits since that tag and the tree doesn't appear to be using tagged
released, treat this as a git tree and check the updates appropriately.
Signed-off-by: Jon Mason <jon.mason@arm.com>
With the change to webpages for the FVPs, it is not possible to detect
new versions anymore. Add UPSTREAM_VERSION_UNKNOWN to avoid the
"UNKNOWN_BORKEN" when running `devtool check-upgrade-status`
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently, fvp-bindir is configured to use the build path. This commit
allows customization of this path by defining a new variable FVP_BINDIR
in fvpconf. This change enables the runfvp script to execute without
BitBake initialization.
Testing:
- Tested using OpenBMC FVP build.
- Defined FVP_BINDIR variable with a custom path in fvp-config.inc and
observed the changes after the build.
Before changes:
$ jq . ~/openbmc/build/fvp/tmp/deploy/images/fvp/obmc-phosphor-image-fvp.fvpconf | grep
fvp-bindir
"fvp-bindir": "/home/javith/build/openbmc/build/fvp/tmp/sysroots
-components/x86_64/fvp-base-a-aem-native/usr/bin",
After changes:
$ jq . ~/openbmc/build/fvp/tmp/deploy/images/fvp/obmc-phosphor-image-fvp.fvpconf | grep
fvp-bindir
"fvp-bindir": "utilities/fvp/usr/bin",
Signed-off-by: Mohammed Javith Akthar M <mohammedjavitham@ami.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
edk2 isn't booting on qemuarm64-secureboot, and hasn't for some time.
Also, it's not being tested as part of CI. Remove until it is working
again.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest tagged version of edk2-firmware. This requires
rebasing the sbsa-acs patches. Also, sgi575 works with the latest
version but requires a patch to compile cleanly.
There is an issue with qemuarm/qemuarm64 where the boot device is not
found in edk2 if 'RELEASE' is set as the build mode. Temporarily
changing that to DEBUG while the issue is being worked on (in
https://github.com/tianocore/edk2/issues/10942).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently, the version number is not being specified, which is causing
the version to be printed as an empty string. Such as:
UEFI firmware (version built at 00:50:36 on Feb 21 2025)
and
Tianocore/EDK2 firmware version
Add the package version as the version to be printed out, which results
in:
UEFI firmware (version 202502 built at 00:50:36 on Feb 21 2025)
and
Tianocore/EDK2 firmware version 202502
An intermediate variable was used instead of PV to allow for the
variable to be overridden if necessary.
Also, minor white space clean-up to match the style in the rest of the
file.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Corstone-1000 read the docs had some small typos in the
Design Overview section. Commit addresses these.
Copyright information now updated.
Signed-off-by: Yogesh Wani <yogesh.wani@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are some objects in the FVP binary that are assembler source and
fail to declare what permissions the stack needs to have, so GCC falls
back to assuming that the final binary needs an executable stack.
glibc 2.41 (as now used in uninative) introduces changes here[1]: whether
to have an executable stack or not when the binary doesn't specify a
need (defaults to executable, but this is a tunable), and any binaries
that are dlopen()ed that require an executable stack will fail.
Thus, some FVPs on some platforms (notable, fvp-base-a-aem on x86-64)
now fail on startup:
libarmctmodel.so: cannot enable executable stack as shared object requires: Invalid argument
Luckily the solution here is to simply clear the executable bit, as
an executable stack is not actually needed. Until a new release of the
FVP is made we can fix the binary in our package using execstack.
[1] https://lists.gnu.org/archive/html/info-gnu/2025-01/msg00014.html
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a recipe for the execstack binary from prelink-cross. This tool is
used to manipulate the GNU_STACK segment in ELF binaries, specifically
to control whether the binary requests an executable stack or not.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With:
https://lists.openembedded.org/g/bitbake-devel/message/17508
there are WARNINGs like:
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb:3 has a lack of whitespace around the assignment: 'SP_INDEX="1"'
WARNING: meta-arm/meta-arm-toolchain/recipes-devtools/external-arm-toolchain/gcc-aarch64-none-elf_13.3.rel1.bb: meta-arm/meta-arm-toolchain/recipes-devtools/external-arm-toolchain/arm-binary-toolchain.inc:31 has a lack of whitespace around the assignment: 'SKIP_FILEDEPS="1"'
WARNING: meta-arm/meta-arm-toolchain/recipes-devtools/external-arm-toolchain/gcc-arm-none-eabi_13.3.rel1.bb: meta-arm/meta-arm-toolchain/recipes-devtools/external-arm-toolchain/arm-binary-toolchain.inc:31 has a lack of whitespace around the assignment: 'SKIP_FILEDEPS="1"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.10.3.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.10.3.bb:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.12.0.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/tf-a-tests_2.12.0.bb:38 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.12.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc:80 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.12.1.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc:80 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_git.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc:80 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_2.1.1.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m.inc:89 has a lack of whitespace around the assignment: 'export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"'
WARNING: meta-arm/meta-arm/recipes-bsp/trusted-firmware-rmm/trusted-firmware-rmm_0.6.0.bb: meta-arm/meta-arm/recipes-bsp/trusted-firmware-rmm/trusted-firmware-rmm_0.6.0.bb:34 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-devtools/fvp/fvp-base-a-aem_11.28.23.bb: meta-arm/meta-arm/recipes-devtools/fvp/fvp-common.inc:42 has a lack of whitespace around the assignment: 'PV_URL_SHORT="${@get_fm_short_pv_url(d)}"'
WARNING: meta-arm/meta-arm/recipes-devtools/fvp/fvp-corstone1000.bb: meta-arm/meta-arm/recipes-devtools/fvp/fvp-common.inc:42 has a lack of whitespace around the assignment: 'PV_URL_SHORT="${@get_fm_short_pv_url(d)}"'
WARNING: meta-arm/meta-arm/recipes-devtools/fvp/fvp-library.bb: meta-arm/meta-arm/recipes-devtools/fvp/fvp-common.inc:42 has a lack of whitespace around the assignment: 'PV_URL_SHORT="${@get_fm_short_pv_url(d)}"'
WARNING: meta-arm/meta-arm/recipes-devtools/fvp/fvp-n1-edge.bb: meta-arm/meta-arm/recipes-devtools/fvp/fvp-common.inc:42 has a lack of whitespace around the assignment: 'PV_URL_SHORT="${@get_fm_short_pv_url(d)}"'
WARNING: meta-arm/meta-arm/recipes-devtools/fvp/fvp-sgi575.bb: meta-arm/meta-arm/recipes-devtools/fvp/fvp-common.inc:42 has a lack of whitespace around the assignment: 'PV_URL_SHORT="${@get_fm_short_pv_url(d)}"'
WARNING: meta-arm/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb: meta-arm/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb:21 has a lack of whitespace around the assignment: 'FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896"'
WARNING: meta-arm/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb: meta-arm/meta-arm/recipes-security/optee-ftpm/optee-ftpm_git.bb:53 has a lack of whitespace around the assignment: 'export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"'
WARNING: meta-arm/meta-arm/recipes-security/optee/optee-examples_4.3.0.bb: meta-arm/meta-arm/recipes-security/optee/optee.inc:34 has a lack of whitespace around the assignment: 'export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"'
WARNING: meta-arm/meta-arm/recipes-security/optee/optee-os-tadevkit_4.3.0.bb: meta-arm/meta-arm/recipes-security/optee/optee.inc:34 has a lack of whitespace around the assignment: 'export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"'
WARNING: meta-arm/meta-arm/recipes-security/optee/optee-os_4.3.0.bb: meta-arm/meta-arm/recipes-security/optee-ftpm/optee-os_%.bbappend:1 has a lack of whitespace around the assignment: 'FTPM_UUID="bc50d971-d4c9-42c4-82cb-343fb7f37896"'
WARNING: meta-arm/meta-arm/recipes-security/optee/optee-os_4.3.0.bb: meta-arm/meta-arm/recipes-security/optee/optee-os-ts.inc:11 has a lack of whitespace around the assignment: 'TS_BIN_SPM_TEST= "${RECIPE_SYSROOT}/usr/opteesp/bin"'
WARNING: meta-arm/meta-arm/recipes-security/optee/optee-os_4.3.0.bb: meta-arm/meta-arm/recipes-security/optee/optee.inc:34 has a lack of whitespace around the assignment: 'export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"'
WARNING: meta-arm/meta-arm/recipes-security/optee/optee-test_4.3.0.bb: meta-arm/meta-arm/recipes-security/optee/optee.inc:34 has a lack of whitespace around the assignment: 'export OPENSSL_MODULES="${STAGING_LIBDIR_NATIVE}/ossl-modules"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/libts_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/libts_git.bb:12 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/libts/${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/libts_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-demo_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-demo_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-demo_git.bb:13 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/ts-demo/${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-crypto-api-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-iat-api-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-its-api-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-ps-api-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-remote-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-service-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-attestation_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-attestation_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-attestation_git.bb:8 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/attestation/config/${TS_SP_IAT_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-attestation_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-block-storage_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-block-storage_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-block-storage_git.bb:13 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/block-storage/config/${TS_SP_BLOCK_STORAGE_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-block-storage_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-crypto_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-crypto_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-crypto_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-crypto_git.bb:10 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/crypto/config/${TS_SP_CRYPTO_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-fwu_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-fwu_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-fwu_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-fwu_git.bb:14 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/fwu/config/${TS_SP_FWU_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-its_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-its_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-its_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-its_git.bb:8 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/internal-trusted-storage/config/${TS_SP_ITS_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-se-proxy_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-se-proxy_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-se-proxy_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-se-proxy_git.bb:10 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/se-proxy/config/${TS_SP_SE_PROXY_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-smm-gateway_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-smm-gateway_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-smm-gateway_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-smm-gateway_git.bb:8 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/smm-gateway/config/${TS_SP_SMM_GATEWAY_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test-common.inc:10 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/spm-test${SP_INDEX}/${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test1_git.bb:3 has a lack of whitespace around the assignment: 'SP_INDEX="1"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test2_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test2_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test2_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test-common.inc:10 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/spm-test${SP_INDEX}/${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test2_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test2_git.bb:3 has a lack of whitespace around the assignment: 'SP_INDEX="2"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test3_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test3_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test3_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test-common.inc:10 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/spm-test${SP_INDEX}/${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test3_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test3_git.bb:3 has a lack of whitespace around the assignment: 'SP_INDEX="3"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test4_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test4_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test4_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test-common.inc:10 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/spm-test${SP_INDEX}/${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test4_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-spm-test4_git.bb:3 has a lack of whitespace around the assignment: 'SP_INDEX="4"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-storage_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-storage_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-common.inc:42 has a lack of whitespace around the assignment: 'OECMAKE_ARGS:remove="-DCMAKE_TOOLCHAIN_FILE:FILEPATH=${WORKDIR}/toolchain.cmake"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-storage_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-storage_git.bb:8 has a lack of whitespace around the assignment: 'OECMAKE_SOURCEPATH="${S}/deployments/protected-storage/config/${TS_SP_PS_CONFIG}-${TS_ENV}"'
WARNING: meta-arm/meta-arm/recipes-security/trusted-services/ts-uefi-test_git.bb: meta-arm/meta-arm/recipes-security/trusted-services/trusted-services.inc:37 has a lack of whitespace around the assignment: 'export CROSS_COMPILE="${TARGET_PREFIX}"'
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enables building latest bleeding edge tf-a and mbedtls with
local.conf setup:
INHERIT += "poky-bleeding"
POKY_AUTOREV_RECIPES += "trusted-firmware-a"
SRCREV_mbedtls:pn-trusted-firmware-a = "AUTOINC"
SRCREV_tfa:pn-trusted-firmware-a = "AUTOINC"
SRCBRANCH:pn-trusted-firmware-a = "master"
SRCBRANCH_MBEDTLS:pn-trusted-firmware-a = "master"
LIC_FILES_CHKSUM:pn-trusted-firmware-a = "file://docs/license.rst;md5=1118e32884721c0be33267bd7ae11130"
BBMASK += "meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.12.bb"
BBMASK += "meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.11.0.bb"
This includes workarounds for poky-bleeding.bbclass which doesn't
work with multiple SRCREV variables, masking away
tf-a 2.10 and 2.11 recipes which cause recipe parsing problems
and only one recipe needed to build latest upstream master
branch to avoid 503 error codes from remote git server.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Change libts to stop making udev related configuration if optee-client
is deployed to the target to avoid conflicts.
- Remove the executable permission from installed tee-udev.rules file.
- Remove teepriv device from udev file as this device is op-tee specific.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Change optee-client to use the same bitbake variable to configure the
group name used for controlling access to /dev/tee* devices on the
target. The aim is to simplify system configuration by aligning the
two recipes.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Stop the tee-supplicant being run with root privileges when the system
is not using systemd.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Eliminate the systemd specific install content fix-up commands appended
to do_install.
- patch optee-client to allow controlling installation of systemd and
udev specific configuration files.
- pass driver group names to optee-client build
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add recipes to allow building OP-TEE v4.4. This is the first version
carrying an SPMC implementation which supports branch protection.
Update corstone1000:
- to use the new op-tee version
- `CFG_TZDRAM_SIZE` is increased further from `0x340000` to `0x360000`
as version 4.4.0 of OP-TEE OS requires more memory
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
optee-os: corestone1000: udpate to op-tee v4.4
Update OP-TEE version and add a patch to increase TZDRAM size to add
more memory to OP-TEE.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use backported upstream patch for udev rule and systemd service file.
sysvinit script is still used from meta-arm. Don't install systemd
service without systemd distro feature, other way round for
sysvinit script.
tee-supplicant started by systemd service runs as non-root teesuppl
user with teepriv group. sysvinit still runs as root since busybox
start-stop-daemon doesn't support -g group parameter and -u teesuppl
doesn't seem to change the effective user.
udev rules allow non-root /dev/tee* access from tee and
/dev/teepriv* access from teepriv groups.
Tested sysvinit changes with:
$ kas build ci/qemuarm64-secureboot.yml:ci/poky.yml:ci/testimage.yml
and systemd changes with:
$ kas build ci/qemuarm64-secureboot.yml:ci/poky.yml:ci/testimage.yml:ci/uefi-secureboot.yml
Cc: tom.hochstein@nxp.com
Cc: sahil.malhotra@nxp.com
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
edk2-firmware build scripts use printenv to print SOURCE_DATE_EPOCH
but that is not in HOSTTOOLS and thus fails with configurations
which use VirtualRealTimeClockLib. Change to using SOURCE_DATE_EPOCH
environment variable directly to fix builds. I think this is OE
specific build config change but filed a bug report upstream
https://github.com/tianocore/edk2/issues/10910
since the fallback mechanism is not working.
Applying patch in 202411 recipe and not .inc since 202408 recipe
from meta-arm-bsp does not find the patch file from meta-arm
side.
[Jon Mason: corrected issues with email patch mangling for edk2]
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Print all of the environment variables in the update-repos task for
introspection, instead of a subset.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Having local repo caches is a little fiddly to manage, and by definition
we're running CI inside GitLab which supports mirroring repositories
automatically.
As these mirrors are always available and update automatically, make
Kas reference directories opt-in and instead expect that the site is
either fine with full fetches, or is using KAS_PREMIRRORS.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The update-repos job can "fail with warnings" if the reference repository
fetch fails. This is intentionally a warning as the CI may have set
KAS_PREMIRRORS and a stale cache is fine.
However, by default artifacts are only saved on successful jobs, so if
this happens the lockfile.yml isn't saved. Ensure the artifacts are
always saved so the rest of the pipeline is successful.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add FVP support to sgi575 and run a boot test as part of CI. Networking
is not currently working and seems to require an older version of edk2
to boot the kernel. Also, the unique files for grub and wks do not seem
to be necessary.
Signed-off-by: Jon Mason <jon.mason@arm.com>
In the SRC_URI, the branch name variables are switched for edk2 and
edk2-platforms. Switch them as appropriate.
Fixes: bf204866e8 ("arm: Use SRC* variables consistently")
Signed-off-by: Jon Mason <jon.mason@arm.com>
Instead of assuming that the repository was created with the latest URL,
fetch the repository explicitly when fetching.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If update-repos fails with status 128 then that means it failed to fetch
the remote repositories. This should result in a warning not a failure
but flock was just returning status 1.
Save the exit code and if it returns 128 continue but exit with it
later, so the lockfile generation still occurs but the job doesn't fail.
Also, only call the update-repos script if KAS_REPO_REF_DIR has been set.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
qemuarm64-secureboot directory in path to 0001-Add-spmc_manifest-for-qemu.patch
hides the patch from machines with different names and thus break builds
unless overrides are set to include "qemuarm64-secureboot".
Move patch to plain "files" directory to avoid build failures
and this cumbersome workaround.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The download filename wasn't versioned so multiple versions would write
to the same file on disk and conflict, causing repeated downloads and
fetch failures.
Add the PV to the filename on disk to resolve this.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This stops the job being stuck if the runners will only take jobs that
have been tagged.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the lts-v2.12.1 tag. Changes include a number of CVE fixes
and mbedtls minor version bump:
8cf9edba5cc3 docs(changelog): changelog for lts-v2.12.1 release
f5d048108bf3 Merge changes from topic "for-lts-v2.12.1" into lts-v2.12
56472775f96d docs(maintainers): update LTS maintainers
baab55315c7f docs: updates to LTS
f00f71efc410 docs: add inital lts doc
1a8ee82c6d77 Merge changes from topic "for-lts-v2.12.1" into lts-v2.12
b19ce90a908c fix(rd1ae): fix rd1-ae device tree
34f10e7d9fc7 feat(rd1ae): add Generic Timer in device tree
551dc4c09f57 docs(rd1ae): update documentation to include BL32
8e4240779867 feat(rd1ae): add support for OP-TEE SPMC
8e4bb69c747e feat(mbedtls): mbedtls config update for v3.6.2
a46d6a1320d7 docs(prerequisites): update mbedtls to version 3.6.2
2ffe181a3982 refactor(mbedtls): rename default mbedtls confs
3809359e2124 fix(cpus): workaround for Neoverse-V3 erratum 3701767
4a9ff092c9b4 fix(cpus): workaround for Neoverse-N3 erratum 3699563
7e41b706e97c fix(cpus): workaround for Neoverse-N2 erratum 3701773
15300ac30c55 fix(cpus): workaround for Cortex-X925 erratum 3701747
6e0efc7fe739 fix(cpus): workaround for Cortex-X4 erratum 3701758
8299c1274617 fix(cpus): workaround for Cortex-X3 erratum 3701769
fa6c9874485b fix(cpus): workaround for Cortex-X2 erratum 3701772
4e78288fd2bc fix(cpus): workaround for Cortex-A725 erratum 3699564
ae6edfd5b543 fix(cpus): workaround for Cortex-A720-AE erratum 3699562
24526273fc50 fix(cpus): workaround for Cortex-A720 erratum 3699561
a7b322706435 fix(cpus): workaround for Cortex-A715 erratum 3699560
d4826882210b fix(cpus): workaround for Cortex-A710 erratum 3701772
9d6143ec8ffb fix(cpus): workaround for accessing ICH_VMCR_EL2
7e4bf042a0dd chore(cpus): fix incorrect header macro
9427c061eb8d fix(security): apply SMCCC_ARCH_WORKAROUND_4 to affected cpus
bea64fd5272d fix(security): add support in cpu_ops for CVE-2024-7881
16b87247ed03 fix(security): add CVE-2024-7881 mitigation to Cortex-X3
427c33bc0c0b fix(security): add CVE-2024-7881 mitigation to Neoverse-V3
192a152448ae fix(security): add CVE-2024-7881 mitigation to Neoverse-V2
3e4d94c43b64 fix(security): add CVE-2024-7881 mitigation to Cortex-X925
41a52efd6f38 fix(security): add CVE-2024-7881 mitigation to Cortex-X4
2f09b9f3c2af fix(security): enable WORKAROUND_CVE_2024_7881 build option
70a7d3f2d030 fix(cpus): workaround for CVE-2024-5660 for Cortex-X925
41b64fe36f42 fix(cpus): workaround for CVE-2024-5660 for Cortex-X2
0b2d22097c96 fix(cpus): workaround for CVE-2024-5660 for Cortex-A77
193370e1c6a2 fix(cpus): workaround for CVE-2024-5660 for Neoverse-V1
d52c52a5fa8c fix(cpus): workaround for CVE-2024-5660 for Cortex-A78_AE
3bd6531a55a4 fix(cpus): workaround for CVE-2024-5660 for Cortex-A78C
eda09acd1b22 fix(cpus): workaround for CVE-2024-5660 for Cortex-A78
b9766da96365 fix(cpus): workaround for CVE-2024-5660 for Cortex-X1
6324220805b1 fix(cpus): workaround for CVE-2024-5660 for Neoverse-N2
6041f0723994 fix(cpus): workaround for CVE-2024-5660 for Cortex-A710
b23f5da614e6 fix(cpus): workaround for CVE-2024-5660 for Neoverse-V2
ef378713fa4b fix(cpus): workaround for CVE-2024-5660 for Cortex-X3
2898088f8ba6 fix(cpus): workaround for CVE-2024-5660 for Neoverse-V3
b8e111c72619 fix(cpus): workaround for CVE-2024-5660 for Cortex-X4
a6f6396313ea fix(cpus): workaround for Cortex-X4 erratum 2923985
d1c3a5d8b9d8 fix(build): do not force PLAT in plat_helpers.mk
ea1b816b1763 chore(deps): update pytest for cot-dt2c
65762d7b4cfc chore(deps): bump jinja2
87f3125a0e45 chore(deps): bump jinja2 in the pip group across 1 directory
b4530565c030 chore(deps): bump the pip group across 2 directories with 1 update
11e5f92d3d43 build(deps): bump setuptools in the pip group across 1 directory
850389f4acfe chore(deps): bump micromatch
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of edk2. Unfortunately, sbsa-ref has a
kernel warning due to the CPU topology that was added. So, hold this
platform back to 202408 and move those recipes to meta-arm-bsp.
Signed-off-by: Jon Mason <jon.mason@arm.com>
It's not clear why this happens but this error is visible
in CI builds too often. Root cause needs analysis but
ignore the error for now.
https://autobuilder.yoctoproject.org/valkyrie/#/builders/75/builds/1190/steps/23/logs/stdio
Traceback (most recent call last):
File "/srv/pokybuild/yocto-worker/meta-arm/build/meta/lib/oeqa/core/decorator/__init__.py", line 35, in wrapped_f
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/srv/pokybuild/yocto-worker/meta-arm/build/meta/lib/oeqa/runtime/cases/parselogs.py", line 185, in test_parselogs
self.assertEqual(errcount, 0, msg=self.msg)
AssertionError: 1 != 0 : Log: /srv/pokybuild/yocto-worker/meta-arm/build/build/tmp/work/sbsa_ref-poky-linux/core-image-sato/1.0/target_logs/Xorg.0.log
-----------------------
Central error: [ 103.173] failed to find screen to remove
***********************
[ 101.955] (**) QEMU QEMU USB Tablet: (accel) selected scheme none/0
[ 101.955] (**) QEMU QEMU USB Tablet: (accel) acceleration factor: 2.000
[ 101.958] (**) QEMU QEMU USB Tablet: (accel) acceleration threshold: 4
[ 102.144] (II) event0 - QEMU QEMU USB Tablet: is tagged by udev as: Mouse
[ 102.169] (II) event0 - QEMU QEMU USB Tablet: device is a pointer
[ 102.228] (II) config/udev: Adding input device QEMU QEMU USB Keyboard (/dev/input/event1)
[ 102.228] (**) QEMU QEMU USB Keyboard: Applying InputClass "libinput keyboard catchall"
[ 102.229] (II) Using input driver 'libinput' for 'QEMU QEMU USB Keyboard'
[ 102.229] (**) QEMU QEMU USB Keyboard: always reports core events
[ 102.229] (**) Option "Device" "/dev/input/event1"
[ 102.318] (II) event1 - QEMU QEMU USB Keyboard: is tagged by udev as: Keyboard
[ 102.326] (II) event1 - QEMU QEMU USB Keyboard: device is a keyboard
[ 102.345] (II) event1 - QEMU QEMU USB Keyboard: device removed
[ 102.385] (**) Option "config_info" "udev:/sys/devices/platform/PNP0D10:00/usb1/1-2/1-2:1.0/0003:0627:0001.0002/input/input1/event1"
[ 102.386] (II) XINPUT: Adding extended input device "QEMU QEMU USB Keyboard" (type: KEYBOARD, id 7)
[ 102.519] (II) event1 - QEMU QEMU USB Keyboard: is tagged by udev as: Keyboard
[ 102.527] (II) event1 - QEMU QEMU USB Keyboard: device is a keyboard
[ 103.105] (II) modeset(0): Disabling kernel dirty updates, not required.
[ 103.165] (II) config/udev: removing GPU device /sys/devices/pci0000:00/0000:00:01.0/drm/card0 /dev/dri/card0
[ 103.173] xf86: remove device 0 /sys/devices/pci0000:00/0000:00:01.0/drm/card0
[ 103.173] failed to find screen to remove
***********************
1 errors found in logs.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
I accidentally created two variables sections, resulting in our build
jobs running on very limited containers.
Signed-off-by: Ross Burton <ross.burton@arm.com>
We were only setting the k8s CPU request in .build jobs not .setup. This
was intentional initially so that only the build jobs get more resources,
but some of the non-.build jobs are resource-heavy. For example, the
pending-updates job has to parse the entire metadata from scratch, and
that sometimes takes longer than usual when we only have two cores to
use.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
genericarm64 machines may have firmware with optee support
and thus also optee-ftpm may be compiled and used there.
tee-supplicant will load TAs at runtime if support is
detected.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-client/tee-supplicant, optee-os-tadevkit and optee-test can be
compiled for genericarm64 and these detect firmware optee support at
runtime. Using qemuarm64 compatible config for them.
optee-os itself may need HW specific config for different boards
and SoCs but these components work with same config on multiple boards.
Tested on qemu and AMD kv260 with Linaro Trusted Substrate firmware
(https://gitlab.com/Linaro/trustedsubstrate/meta-ts).
Note: optee-test version in userspace and optee-os version in firmware
must match for tests to pass.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
mbedtls pushes to both master and main, but main is preferred.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Pointer Authentication (PAC) instructions are part of v8.3, and BTI
(Branch Target Indentification) instructions are mandatory in v8.5.
As we want to use PAC/BTI everywhere in this BSP, bump the cores to
v8.5.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Do so for the usual reason of avoiding network access during recipe
parsing. Occasionally parsing will stall for me as it seems connectivity
to trustedfirmware.org can be flaky.
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest commit.
Changes in gn between 5e3760073454c72f3458805a1b7a89ecf80353cb and ac6742520ded1da30d500f74e8affe86e27cabd5
ac6742520ded aarch64: Start Xen on Armv8-R at EL2
ba899d1d7227 aarch64: Implement PSCI for Armv8-R
476a0b6451d7 aarch64: Enable Armv8-R EL2 boot
0f00cf4cb8b2 Introduce --with-bw-arch for boot-wrapper compile arch
aafb5958eb9d Boot CPUs sequentially
d62de19c8661 Add printing functions
1ab497ed6c38 Simplify spin logic
1e576e54d0a4 Unify assembly setup paths
19ffbec99cf5 aarch32: Always enter kernel via exception return
e8e6f797bafa aarch32: Implement cpu_init_arch()
8745a2cd8e0a aarch32: Refactor inital entry
77c3316737fc aarch64: Always enter kernel via exception return
308d25f908a8 aarch64: Implement cpu_init_arch()
4dcb17f55300 aarch64: Remove redundant EL1 entry logic
400f0a86dcc8 Revert "configure: allow the use of bare-metal toolchains"
1fea854771f9 configure: allow the use of bare-metal toolchains
784feb9b0753 Makefile: suppress RWX segment warnings
e1d7651f3c2f Makefile: rework test-dtc-option
cd7fe8a88e82 aarch64: Enable access into RCW[S]MASK_EL1 registers from EL2 and below
1ac203146003 aarch64: Enable access into 128 bit system registers from EL2 and below
b13b3bdcb2a1 aarch64: Enable access into SCTLR2_ELx registers from EL2 and below
61b84b4a1c02 aarch64: Remove TSCXT bit set from SCTLR_EL2_RESET
3bac221638c4 configure: make --with-kernel-dir optional
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update trusted-firmware-m to the latest LTS (TF-Mv2.1.1)
Changes between 0c4c99ba33b3e66deea070e149279278dc7647f4 and 02bf279913439a07082dd581df033f370a8fbb92
02bf27991343 docs: Release notes for v2.1.1
7264a32e84a0 docs: rp2350: Minor docs & script improvements
4bad159af017 Docs: Release dates update
a5e02ec0c6a2 Align .gitignore contents to main branch
8fe944a652f5 Platform: RP2350: Fix NV counters in ITS
66bc1fa8eed9 Build: Fix patch formatting for 0001-iar-Add-missing-v8.1m-check.patch
895d44a4eb52 Platform: RP2350: Add NV counters to ITS
e81b741aa6cc tf-m-tests: Step version for rp2350 psa-arch-tests
2be65a027c86 Platform: rp2350: Add rwx linker flag conditionally for GNUARM
a85425417696 Platform: RP2350: Add RP2350 porting
9ed2e7c7f52b Platform/TFM/ITS/Config: Commits required for new platform porting
f12db7c872d5 cc3xx/low-level/pka: SRAM size depends on CC3XX version
c7e0192fab6f cc3xx/low-level/hash: wait for hash engine to be idle
42a4041bdff4 Crypto: Update to Mbed TLS 3.6.2
471c127e7755 Crypto: Add option to enforce ABI compatibility
7da71fd05445 tfm_spe_mailbox: Fix NULL pointer checks
974bc101e0b2 cc3xx/low-level/pka: wait for sw reset to be done before proceeding
89b9c4889c60 Crypto: Enforce MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS on Mbed TLS config
62b1300557c5 Crypto: Additional checks for writes to avoid out-of-bound access
a2cead6a9ef4 tfm_spe_mailbox: Use local vars for local_copy_vects
15afe61d1194 TFMV-8: Fix unchecked user-supplied pointer via mailbox message
22e8e89c8f56 tfm_spe_mailbox: Do not write-back on input vectors checks failure
12a4c5342965 tfm_spe_mailbox: Validate vectors from NSPE
75bbe3fc0240 CC3XX: Relax assert condition in aead_crypt for input
0db7ebf32ba3 Crypto: Protect writes to avoid out-of-bound access
2ecea430fbb4 Crypto: Prevent the scratch allocator from overflowing
fbcdc69b794d SPM: mailbox_agent_api: Free connection if params association fails
2a59580b5809 Crypto: Update to Mbed TLS 3.6.1
6a54ec89f22f Platform: STM32: script all_stm_platfrom
66596b4dae57 Platform: corstone1000: Fix isolation L2 memory protection
7045675209ca stm : fix error on b_u585i_iot02a with TF-Mv2.1.0
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update trusted-firmware-a to lts-v2.10.12
Changes between 7e63213601425c7a6d83e47dc936b264deb9df2b and 408ba4ddfe9a8d55e3e2488bea89c39adef07981
408ba4ddfe9a docs(changelog): changelog for lts-v2.10.12 release
7bdf51628eab Merge "docs(maintainers): update LTS maintainers" into lts-v2.10
8355ef7728ec docs(maintainers): update LTS maintainers
faceedf4e5c2 Merge changes from topic "for-lts-v2.10.12" into lts-v2.10
9007a3344e12 Merge changes from topic "gr/lts-doc-2.10" into lts-v2.10
924c7f42ce4a chore(deps): bump cross-spawn
7c8c034e5fed chore(deps): bump jinja2 in the pip group across 1 directory
3d85a19f2f54 docs: updates to LTS
13657a3f3f2a docs: add inital lts doc
a4c57c122407 Merge changes from topic "lts-v2.10.12" into lts-v2.10
564922601397 feat(mbedtls): mbedtls config update for v3.6.2
44161dcb10ab docs(prerequisites): update mbedtls to version 3.6.2
0ac65e7aa5ec refactor(mbedtls): rename default mbedtls confs
8b2c885739dd fix(arm): add extra hash config to validate ROTPK
832b92b7f615 docs(changelog): changelog for lts-v2.10.11 release
a3fc7c18c461 Merge changes from topic "for-lts-2.10.11" into lts-v2.10
196984e65da0 fix(cpus): workaround for Cortex-X4 erratum 2923985
0eed05ee70aa chore(cpus): optimise runtime errata applications
34e6d7cb8ce1 Merge changes from topic "sm/fix_erratum" into lts-v2.10
ad9dfdc5800c fix(cpus): workaround for CVE-2024-5660 for Cortex-X2
5673d345aaa3 fix(cpus): workaround for CVE-2024-5660 for Cortex-A77
4fd2a6702dd1 fix(cpus): workaround for CVE-2024-5660 for Neoverse-V1
a02a863d3156 fix(cpus): workaround for CVE-2024-5660 for Cortex-A78_AE
87250d2bb1ea fix(cpus): workaround for CVE-2024-5660 for Cortex-A78C
30c57c58abe3 fix(cpus): workaround for CVE-2024-5660 for Cortex-A78
c7d3c9eb2d81 fix(cpus): workaround for CVE-2024-5660 for Cortex-X1
282e63544d26 fix(cpus): workaround for CVE-2024-5660 for Neoverse-N2
f7ae819f03ae fix(cpus): workaround for CVE-2024-5660 for Cortex-A710
3efc9e13011d fix(cpus): workaround for CVE-2024-5660 for Neoverse-V2
17e17ed3f1e6 fix(cpus): workaround for CVE-2024-5660 for Cortex-X3
a6375e1feb42 fix(cpus): workaround for CVE-2024-5660 for Neoverse-V3
e42abf298321 fix(cpus): workaround for CVE-2024-5660 for Cortex-X4
698e68fe1fe9 fix(cpus): workaround for CVE-2024-5660 for Cortex-X925
b229b47bd86c chore: rename Blackhawk to Cortex-X925
96498991d1ce chore: rename Chaberton to Cortex-A725
b28aa38e28cf docs(changelog): changelog for lts-v2.10.10 release
8e74814ce52f Merge changes from topic "for-lts-v2.10.10" into lts-v2.10
c9f3fb5822dc build(deps): bump setuptools in the pip group across 1 directory
395ef3534cf1 chore(deps): bump micromatch
6c6e986bffb3 build(npm): update Node.js and all packages
c5d2a030a35f build(deps): bump braces
ebf6430a01c5 build(deps): bump idna from 3.4 to 3.7
93ad43e79ef7 build(deps): bump jinja2 from 3.1.2 to 3.1.4
f8a06a0f82ce build(deps): bump urllib3 from 2.0.2 to 2.2.2
3ea256c36a4b build(deps): bump pip from 23.1.2 to 23.3
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest gn commit.
Changes in gn between 95b0f8fe31a992a33c040bbe3867901335c12762 and ab638bd7cbb9ac8468bf2fbe60c74ed4706a14a7
ab638bd7cbb9 Revert "Speed-up GN with custom OutputStream interface."
2dd9331a7041 Speed-up GN with custom OutputStream interface.
ed1abc107815 Add `exec_script_allowlist` to replace `exec_script_whitelist`.
c97a86a72105 Retry ReplaceFile in case of failure
7296b601ea80 Fix crash when NinjaBuildWriter::RunAndWriteFile fails
468c6128db7f fix include for escape.h
5a47a93b9426 fix exit code for gn gen failure
24e92acb8472 misc: Use html.escape instead of cgi.escape
feafd1012a32 Do not copy parent build_dependency_files_ in Scope constructors.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest stable version (1.5.5), comprised of the following
commits:
742d60ed7dc7 opencsd: Update version info and README for 1.5.5
7ca491c516b8 build: Update docs for MacOS support
cac83e59666e build: Add MacOS development makefile
e56eff270ca2 build: Use .dylib shared library suffix for MacOS
35f957d2a97a build: Create initial MacOS makefile
44dff5b22a26 build: Restore Linux build support
a0e13010e1d6 build: Rename build folders as 'unix_common' for upcoming MacOS support
ecdde9f69307 tests: Add option to suppress elapsed processing time in test program.
821632be920c tests: update mem_buff_demo test to add options.
70e472c9387f opencsd: Memacc object cleanup fix
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of halfnium
Changes between 2bef7ab3895c48d39b84ab58179b2d0de5156b8b and 2cf2ca7c4b81ab18e9cd363d9a5c8288e2a94fda
2cf2ca7c4b81 docs: the change log for the v2.12 release
69e18eb52d63 docs: update the threat model for IPI threats
c9866ab33c7a docs: add description of single service IPI support
b17856caec30 test: interrupt targeting blocked vcpu is queued
0ee13d9cc510 test: add helpers to share page for coordination btw endpoints
eda971da9f4c fix: queue interrupt targeting blocked vcpu
0a69718c6298 fix(docs): fixes to the docs to fix build errors
4b3d26803b56 test(ipi): IPI to invalid vCPU fails
2f579f93c1d9 test: multiple SPs periodic deadlines on multiple cores
8157b6897a8f test: multiple SPs with periodic deadline
b390a0d12967 test(ipi): set target vCPU in VCPU_STATE_BLOCKED
2affbc7a7bbb test(ipi): target vCPU set in VCPU_STATE_PREEMPTED
180a65a7be5f feat(ipi): handle in VCPU_STATE_BLOCKED/PREEMPTED
84d49b67d2d9 fix(ipi): small fixes to the ipi implementation
0136b2bf3f35 test: migrate blocked vcpu with pending timer
da42b544504b test: timer expired while vcpu is in PREEMPTED state
7c9702280c62 chore: reduce verbosity of console messages for SPs
9243e772b209 docs: support for arch timer in secure world
c0110997e1f8 chore: add doc comment on Pauth fault tests
a067dc1d77f8 test: add unit tests for timer management
872742eec217 test: use watchdog timer as source of non secure interrupt
febcb625856e test: add driver for normal world watchdog timer
b9dd51451e46 test: introduce driver for sp805 peripheral
65827d703535 test: migrate vCPU of SP with pending timer deadline
593b8addcbdc test: multiple SPs programmed with timer deadlines
fe10878b1e1c test: SP reprograms the arch timer deadline
b2429b49c524 test: SP handles timer with short deadline
34c050a04357 test: commands for SP services to configure timer
64ae5a8d6a18 test: add SP helper utilities for arch timer
6b8cf4f361f6 feat(arch timer): handle spurious host timer interrupt
106bfc364d64 feat(arch timer): migrate vCPU with pending timer to another CPU
cf069a65988e feat(arch timer): resume SP if deadline expires in NWd
2efb3e103382 feat(arch timer): handle host timer interrupt tracking live deadline
32424db1d5d6 feat(arch timer): inject timer virtual interrupt before resuming vCPU
a3787c91a96c feat(arch timer): track pending timer configured by SP vCPU
28e988f3bb56 chore: exclude physical timer source file from static checks
f684d196422b feat(arch timer): trap and emulate physical timer access from SPs
d3ac7383c10f feat(arch timer): helpers to configure EL1 physical timer
f658f5e1a6e1 feat(arch timer): initialize timer list and host physical timer
def48d0365b3 feat(arch timer): introduce host timer driver
c31708afa85c feat(arch timer): helper utilities to add and remove from timer list
eed861e514ba feat(arch timer): data structure to track pending timers
08200fe0f2e2 test: physical interrupt preempts virtual interrupt handling
75331b3ee028 test: SPMC call chain not preemptible
179f567f17fe test: helpers commands to mimic secure interrupt scenarios
94946a1451e3 fix(interrupts): SPMC scheduled call chain shall not be preempted
025a451a9275 fix: simplify secure interrupt handling
c3fd9756a53e feat(memory share): handle GPF in FFA_MEM_FRAG_RX
e06384d55458 docs: document VM availability messages
50ef91174b38 refactor: api_ffa_msg_send_direct_resp
13f09815b474 refactor: don't pass sender/receiver ID
79504ff11a86 refactor: remove unused functions
a1a0235181b3 test: VM availability messaging tests
06e8b732abc2 feat: forward VM availability messages from SPMC to SP
d0356f85a2a2 refactor: `spmd_handler` refactorings
520bcc86451b test: VM created/destroyed partition properties
a603e0842531 feat: VM created/destroyed partition properties
18694027d10d feat: parse `vm-availability-messages`
1308a63f4851 test(ipi): FFA_NOTIFICATION_INFO_GET reports pending IPI
d270b869c989 test(ipi): target waiting vCPU whilst in SWd
537165559733 test(ipi): target waiting vCPU whilst in NWd
3a9510e81960 test(ipi): handling SRI in the NWd
377defd58730 test(ipi): send IPI to running vCPU
d2efb134495d test(ipi): state machine to help testing IPI
8be2651ff463 test(ipi): add unit tests for fetching pending IPIs
1f2babf02fd8 feat(ipi): report IPIs in FFA_NOTIFICATION_INFO_GET
960be20fecdc feat(ipi): handle IPI for waiting case
f3cf28cf7d4b feat(ipi): introduce IPI paravirtualised interface
18485946304c refactor: use bitfields for interrupt_descriptor struct
e44e18e5702b fix: increase stack size in primary VM
cc9d11383413 ci: increase timeout for long running tests
b8f9a899f0be test: if SPs wake up with eret FFA_RUN
4dbf4d95c63f fix: only normal world VMs need FFA_RUN
478faac95b69 refactor: always eret FFA_RUN to the caller
8ddb0e2d11e6 chore: drop the FFA_RUN tests
3190f5401e09 chore: specify updated submodule commit hash
baaf9e5bd0c5 docs: update FFA_PARTITION_INFO_GET(_REGS)
0ffce75f8244 refactor(notifications): verbose validity check
3e55c4d8e3de fix: check ff-a version for functionality support
d96c931b233d test(ff-a): report features in partition info get
7fb0fdb7ab97 fix: report indirect message and direct message 2
11f50e5ff10b chore: drop linux/driver project checks
d5d6c381e69c chore: drop the driver/linux submodule
8018929656f3 doc: refer the checkpatch.pl setup
d8e61447a1b5 ci: add script download checkpatch.pl
94b0fa111104 chore: drop rule to update linux binary
ddeedafa09d0 chore: drop the third_party/linux submodule
6b756a10770a ci: drop the setup with the hafnium driver
15e302616540 chore: drop hf_interrupt_inject
da6b099e5dfb chore: drop mailbox waiting list
9a9ed227a137 test(ff-a): FFA_MSG_WAIT called with pending message
ccbf26c078c7 docs: add FFA_MSG_WAIT description
ea8ccfe752cb refactor(notifications): drop the SRI state
ac0cb263714c chore: drop legacy timer support in hypervisor
9acc62973951 chore: remove legacy timer support tests
a74c97c4c184 test: interrupt targets blocked SP
23a7e58b6494 fix(interrupts): resume blocked vCPU and pend vIRQ line
3e749afb2d9b test(pauth): test PAuth usage from S-EL0
70c6ca0e0cb9 fix(pauth): use prng to generate S-EL0 pauth keys
9478e32bb811 refactor: UUID packing/unpacking
cca64d765bf0 refactor: `get_ffa_partition_info`
fb9c2a27a319 refactor: `api_ffa_fill_partition_info`
45abeebfd2b4 feat: report error if too many UUIDs in manifest
6053297ef775 refactor(manifest): UUID parsing
8c5de22b6b6a test: fork 'preempted_by_secure_interrupt'
bd32c97bdb07 refactor: simplify interception of FF-A calls
67f5ba3d10d3 refactor: boot order list to use list.h
8e02186908e0 refactor: rename list functions
3bfc36eab652 test(ff-a): cannot send indirect message when RX buffer full
3d5a9609bf43 test(ff-a): add RX retention tests to S-EL0 setup
a2103eb08381 feat(code-coverage): check elf files for folder include/exclude
c7270b752e5f fix(memory share): hypervisor retrieve request check
7640451f68fc fix(build): fix out of tree build specifying $OUT
36fcf881497b fix: detect pauth algorithm in cpu
483686441714 refactor: `memcpy` refactors
5d5f27972dbb fix: use correct load-address while adding offset
3bb825946fed fix(indirect message): set framework notifications
8ccd2d0f0552 fix: rename load address relative offset node name
67196c7ad3bc docs: document new `FFA_VERSION` behaviour
c4d9ae80b40b fix(ff-a): don't report ME interrupt to EL0
41c5da385103 fix(notifications): delay SRI flag use from NWd
d9e7c8fd3cf9 fix: in case the mailbox is FULL return FFA_RUN
77b4eef0071d fix(hftest): clear NPI when polling for notifications
486ffdce7223 test(ff-a): FFA_MSG_WAIT multicore RX buffer test
337dbdfa04ee test(ff-a): test FFA_MSG_WAIT with retain RX buffer flag
7253bd5c43fc feat(ff-a): add retain RX buffer flag to ffa_msg_wait
bc854180a4bb test(ff-a): verify FFA_MSG_WAIT releases RX buffer
be1a0b7a4d43 fix(ffa): add RX buffer release to FFA_MSG_WAIT
b8730e9f7263 refactor: moved api_interrupt_clear_decrement to vcpu
cfc8174a3a22 refactor: added ffa_msg_wait_complete
472f66a344c9 refactor: use vm_id_is_current_world
ac9407556eca refactor: rename implicit_completion_signal
3b31f09c4e80 refactor: create vcpu_secure_interrupt_complete
9a4b9c0b9592 fix(notifications): per-vCPU for MP only
318e90a733de feat: queue interrupt targeting blocked vcpu
c023e39839c0 test: new setup with S-EL1 UP SP as Service2
538b688a0865 test: register secondary entrypoint only for MP S-EL1
ec3bf2223df0 test: queue interrupt targeting a migrated vcpu in blocked state
97fa216c6ae9 test: queue interrupt targeting a migrated vcpu in running state
ce6baae61eee test: queue interrupt targeting a migrated vcpu in waiting state
4fff340ea012 test: queue multiple pending virtual interrupts
e1bec84e69f1 test: handle secure interrupt triggered by Generic Timer
95bb8fe60145 test: leverage build define to identify an S-EL0 SP
75a1ab7b9c3c test: update manifests to accommodate AP REFCLK timer device region
76fe642c630f test: add SP helper commands to manage generic timer
ad3fb6698931 test: add driver for AP REFCLK Generic timer
92b404ecffd6 test: driver for generic memory mapped system timer
ae519e184f12 test: map MMIO regions from device region nodes
7945bb578a0f refactor: reduce fields tracking interrupt handling for vcpus
93d3d7015108 feat(interrupts): target migratable S-EL1 UP vCPU
42e56c11d90e feat(interrupts): target migratable S-EL0 UP vCPU
48dc41c3890c feat(interrupts): queue if unable to signal virtual interrupt
c64d0645a4c4 feat(interrupts): prioritize servicing queued virtual interrupts
32913cb081cf feat(interrupts): data structures, helpers for queueing
b7c2558e1bbd fix(interrupts): drop the running priority before resuming vcpu
6acc53703857 fix(hftest): logs from different setups would override
ff651e335032 feat: hftest to disable_visualisation
6f6bf8a117f9 refactor: simplify functions to pend VI
33172403a44a fix: moved unsupported function log
3e9f605eba42 test: interrupt to be pended before boot
cc542042dbbd feat(interrupts): physical interrupt enabled
d533859d7826 chore: add venv to gitignore
1c56a252a966 fix(hftest): service set-up functions in core 0
65deaa433730 refactor: drop hypervisor-specific tests
6045881f4fe2 fix(notifications): vCPU ID check in get ABI
a2c79226b56b docs: redirect to a common ff-a binding document in TF-A
296ee70c7af7 refactor(memory share): split check of hyp retrieve request
058ddee34d02 fix: remove memory region's device attribute
71704804400a secure_tc: enable branch protection
9c5b1d3708f8 refactor: split `api_ffa_features`
650cb148d610 refactor: report FFA_YIELD
1a8c0cdb812c refactor: report secondary EP register supported
5a222641c137 refactor: permission get/set supported at S-EL0 partitions
4271ff9734fe refactor: remove arch/platform specific ffa_features
4e8e479805bb refactor: reduce log level of some log statements
be12343e0ceb fix(hftest): interrupt enable/disable
94f9a7303d06 fix(docs): refactor poetry dependency group
734981e83008 fix(memory share): dont change the PAS for device memory
9a444adfee0b refactor(hftest): update iris options
fd374b8c9227 fix(memory share): v1.1 emad reserved field check
5ebf4bf2c364 feat: parallelize `clang-tidy`
2ad6b66ef5f6 chore: fix `clang-tidy` warnings
a4d4a2b00cf2 fix: check `.h` files with `clang-tidy`
20acb0118db9 refactor: remove `make check`
ca9234c8510c refactor: reformat `.clang-tidy`
67a7926ce341 fix: first vCPU runs in the VCPU_STATE_RUNNING
77f39c21e52a fix(docs): point poetry readthedocs virtual env
bd43209c3d7f refactor: console log verbosity
052fa62be451 fix(docs): design doc typo fails the build
a33eca997600 fix(qemu): memory barriers to operate DMA
66a38bd5184d fix: fix build with clang-18
a5ea909bfc61 fix: fix build with clang-17
74ee3ab8bb56 fix: fix build with clang-16
6f1f1210152d feat: print vCPU ID
920362870c0d test: tests for printing sequentially and concurrently
31e5c95fd1c7 fix(hftest): define stacks for all secondary cores
7cdb36d7dfa8 test(mem share): RO mem cannot be zeroed during send
72d53a15d7b7 fix(boot): remove limit all partition memory is RW
c7a3848c7cc0 refactor: improve hftest error message
133ae6e2e48b feat(dlog): adopt FF-A in `stdout_putchar`
c5cebbc0e8d0 refactor: move log buffer from VM to vCPU
99fe2434f9d9 refactor: add documentation for interrupt controller in DT
1c26ae7ec65a fix(gic): add support for passing GIC data from DT in boot flow
99c5eff25b84 test: add unit tests to validate dma properties
718afa9ca629 refactor: create a helper function to obtain common fields
9c764b3e5437 refactor: use dma device properties struct within device node
7de26958d155 refactor: extract VM's log buffer into separate struct
6027b4f0bd7a fix: fix signature of `memcpy`
8f046e4873ea refactor: remove `CHECK_OR_ZERO` macro from `std.h`
2b56fc163c19 refactor: replace some uses of `uintptr_t` with `cpu_id_t`
b4ef4320e1d0 refactor: use typedef for CPU entry point functions
71d887b7cad0 refactor(memory share): improve naming of sender_orig_mode
c8e6e85d7f72 test(memory share): device as normal through descritor mem types
3b65a25f2642 test(memory share): lend device memory as normal
6e2613628196 fix(memory share): add precedence check for memory type
2268412d6968 test(memory share): normal memory lent as device
91052c3eb749 fix(memory share): log for invalid instruction access
3f295b18c75c feat(manifest): add overlap checks for SPMC memory
889cbf1e6e82 refactor: use enums for PSCI constants
5e99699970bc refactor: add helper function to check if VM is primary
8204182ee3d2 refactor: add helper functions for checking if VM is UP/MP
0a824e972474 chore: fix log strings
bd060340445e fix(memory share): relinquish from VM
9bbcb87d8873 fix(memory share): assert pointer before dereferencing
a39a84497eda feat(memory share): relinquish use `memcpy_trapped`
3f6527cd56f9 feat(memory share): revert memory retrieve
69cdfd9531f8 feat(memory share): avoid updating PTs
7b9cc432ce38 feat(memory share): memcpy_trapped to copy retrieve resp
8f2150d1d4c6 feat(memory share): `memcpy_trapped` to read from tx
f220d57a4102 fix(memory share): retrieve request validation
c9227c849e62 fix(memory share): multiple borrower with NWd VM
540cddfcb118 feat: introduce gicd_set_ctrl helper utility
cde596402559 test(ff-a): add tests for changing version through `FFA_VERSION`
64d930ee6c33 fix: check that calls to FFA_VERSION actually succeed
e9921275a326 fix: memory sharing tests
08befddc43c0 refactor: move `update_mm_security_state` to `common/ffa.c`
2909e54cf230 refactor: port tests due to new restrictions
d319fbbb5b9b fix: remove log statement that caused `FFA_VERSION` to fail
6eeec8e85a5f feat: restrict `FFA_VERSION` calls
0e617d9d2245 refactor(ff-a): `FFA_VERSION` related refactorings
4b846eb871c0 fix(mem share): zeroing RO memory during memory send
8fc1b5054cb2 fix: error codes need to be uint32_t
6fd6c1d6ecad fix: fix input validation in FFA_FEATURES
49ec1e42e218 refactor: refactor `api_ffa_features`
88851f90b88e feat: add macros to check bits
d1c34b5edee1 feat(mte): add error log for sync tag fault in EL2
95fbb31760eb feat(memory share): add memory share 64-bit ABIs
b9ae416a7d55 refactor: use `GET_ESR_EC` macro
5a13355b0802 refactor: add `GET_ESR_FNV`
9f7ce018c967 test(dlog): unit tests for `dlog` with binary format specifier
7efc8377234e feat(dlog): support binary unsigned integer format specifiers
e8937d9c2a05 chore(dlog): fix uses of `dlog` to use new format strings
544549064bb2 feat(dlog): check arguments to `dlog` at compile-time
50af30574657 test(dlog): unit tests for `dlog` with length modifiers
70894da99ab1 feat(dlog): handle length modifiers
e980e611ed8a refactor(dlog): miscellaneous changes related to logging
705b56e94b38 refactor(dlog): move `dlog_flush_buffer` to `api.c`
e8fdaed4c376 refactor(dlog): replace macros with enums
93157d09e78f test(dlog): unit tests for `dlog`
c9df08b45438 feat(hftest): assertion macros for strings
d2ef618a680c refactor(dlog): return number of characters written
222d9fbb3dee fix: enable `-Wsign-compare` in `ASSERT_EQ`
1064a9c8d3c3 refactor: use `enum ffa_error` for errors
824b63d9b256 feat: enable `-Wsign-compare`
b090762d1c4d fix: disable `-Wsign-compare` for dtc
4a88b9625897 feat: enable `-Wextra` flag
df099becb672 refactor(init): use memory pool for boot params
dc759f53ddbe refactor: use an enum for FF-A error codes
d38270c14fe8 refactor: use enum for SP commands
6a7c95926233 feat(hftest): rewrite error messages for failed assertions
76766e61e230 refactor: use `typeof` in `HFTEST_ASSERT_OP`
871b41e33565 refactor: always expand `assert` macro
3a3e08dbd653 fix: check for illegal values of gic related build flags
346a09cfce7f fix: check for illegal branch protection feature
0549849def41 fix: propagate enable_mte build flag to cflags
00d3b632aeda fix: incorrect calculation for number of boot info desc
b886d4930571 fix(memory share): drop check to instruction access
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version.
License SHA changed due to the addition of "Artistic License 2.0" and
was missing entries for a few others that were there previously.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The same tee-supplicant is available in the meta-arm layer
along with the recipe.
| meta-arm/recipes-security/optee/optee-client
| meta-arm/recipes-security/optee/optee-client/tee-supplicant.sh
| meta-arm/recipes-security/optee/optee-client/tee-supplicant@.service
| meta-arm/recipes-security/optee/optee-client.inc
| meta-arm/recipes-security/optee/optee-client_4.1.0.bb
Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the TF-A git recipe to the latest commit (as it was older than
the 2.12 release previously). Also, update mbedtls to 3.6.2 (per the
tf-a docs in the master branch).
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-A Patches were erroneously moved to meta-arm-bsp, despite still being
needed by the recipes in meta-arm. Copy them back and make copious
apologies.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Move v2.11 to meta-arm-bsp so that corstone1000 can still use it (though
2.12 does appear to work). Move all the other platforms in meta-arm-bsp
to use 2.12.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Platforms with GENERATE_COT need to either have COT_DESC_IN_DTB set or
use cot-dt2c to generate it. Add cot-dt2c from trusted-firmware-a
sources and its python dependencies to enable this for those that need
it.
Also, move all the relevant platforms in meta-arm-bsp to use 2.12
Signed-off-by: Jon Mason <jon.mason@arm.com>
This memory was used by OpenAMP to establish communication between
the Secure Enclave and Trusted Services. After transitioning from
OpenAMP to RSE_COMMS, this shared memory is now configured for the
pointer access protocol in RSE_COMMS.
Since this memory may be still used by a user-space application
in linux as U-Boot is passing an EFI memory map starting from
0x80000000, this memory range should be reserved as the
pointer access protocol may be enabled on corstone1000 in the future.
Signed-off-by: Philip Puk <philip.puk@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
poky updated systemd from 256 to 257 which changed
the build time path.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Integrating the binary Arm GCC toolchain into OE is quite complicated
because the binary release and oe-core's toolchain are arranged slightly
differently, which makes it quite fragile.
As it's obviously a binary release we cannot patch it to fix issues.
Also it has some fairly sizable limitations: for example the kernel
headers are old (from linux 4.19) and the locale packaging is different
so locale package dependencies don't work.
The main historic users of the external toolchain no longer use it, so
remove it. The recipes will remain in the LTS branches for users who
are using it currently, but will not be part of the next release.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Acked-by: Romain Naour <romain.naour@smile.fr>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The oe-core commit "classes/recipes: Switch virtual/XXX-gcc to
virtual/cross-cc (and c++/binutils)"[1] changes the virtual names that
the toolchain components use, so external-arm-toolchain needs updating
to use these new names.
[1] 4ccc3bc8266c327bcc18c9a3faf7536210dfb9f0
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Implement unattended installation for Debian
- Upgrade Debian version to 12.8.0
Signed-off-by: Musa Antike <musa.antike@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Replace THISDIR with UNPACKDIR by adding unattended conf to SRC_URI
Signed-off-by: Musa Antike <musa.antike@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Replace THISDIR with UNPACKDIR by adding unattended conf to SRC_URI
Signed-off-by: Musa Antike <musa.antike@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
tf-a 2.10.9 uses mbedtls 3.6.1 from 3.6 branch which
has the same checksum as in tf-a 2.11 recipe. Found when
downgrading tf-a from 2.12 to 2.10 to debug hangs on zcu102
board:
ERROR: trusted-firmware-a-2.10.9-r0 do_populate_lic: QA Issue: trusted-firmware-a: The LIC_FILES_CHKSUM does not match for file://mbedtls/LICENSE;
md5=3b83ef96387f14655fc854ddc3c6bd57
trusted-firmware-a: The new md5 checksum is 379d5819937a6c2f1ef1630d341e026d
trusted-firmware-a: Here is the selected license text:
vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
Mbed TLS files are provided under a dual [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html)
OR [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) license.
This means that users may choose which of these licenses they take the code
under.
The full text of each of these licenses is given below.
Apache License
Version 2.0, January 2004
...
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
trusted-firmware-a: Check if the license information has changed in /home/builder/src/base/repo/build/tmp_zynqmp-zcu102/work/zynqmp_zcu102-poky-linux/trusted-firmware-a/2.10.9/git/mbedtls/LICENSE to verify that the LICENSE value "BSD-2-Clause & BSD-3-Clause & MIT & Apache-2.0 & Apache-2.0" r
emains valid [license-checksum]
ERROR: trusted-firmware-a-2.10.9-r0 do_populate_lic: Fatal QA errors were found, failing task.
ERROR: Logfile of failure stored in: /home/builder/src/base/repo/build/tmp_zynqmp-zcu102/work/zynqmp_zcu102-poky-linux/trusted-firmware-a/2.10.9/temp/log.do_populate_lic.4070974
NOTE: recipe trusted-firmware-a-2.10.9-r0: task do_populate_lic: Failed
ERROR: Task (/home/builder/src/base/repo/build/../meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.9.bb:do_populate_lic) f
ailed with exit code '1'
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With backported patch from upstream. Error was:
| build.py...
| /home/builder/src/base/repo/build/tmp_rockpi4b/work/rockpi4b-poky-linux/edk2-firmware/202408/edk2/edk2-platforms/Platform/StandaloneMm/PlatformS
tandaloneMmPkg/PlatformStandaloneMmRpmb.dsc(...): error 4000: Instance of library class [HobPrintLib] is not found
| in [/home/builder/src/base/repo/build/tmp_rockpi4b/work/rockpi4b-poky-linux/edk2-firmware/202408/edk2/StandaloneMmPkg/Core/StandaloneMmCor
e.inf] [AARCH64]
| consumed by module [/home/builder/src/base/repo/build/tmp_rockpi4b/work/rockpi4b-poky-linux/edk2-firmware/202408/edk2/StandaloneMmPkg/Core
/StandaloneMmCore.inf]
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Adds protobuf interface to se-proxy-sp as the main crypto-sp uses it and
parsec service 1.4 also switch using protobuf interface.
Signed-off-by: Philip Puk <philip.puk@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump fip and tf-a tests to use the 2.12 sources
Note: change to license is for CoT device tree python application (which
is Apache licensed).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for TF-A version v2.12.0 and mbedtls 3.6.1.
GCC-compiled boot tested on RK3588 Tiger, RK3399 Puma and PX30 Ringneck.
0001-fix-zynqmp-handle-secure-SGI-at-EL1-for-OP-TEE.patch is merged in
2.12.0 so no need to have it in SRC_URI as for 2.11.0 and earlier
recipes.
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update TF-A LTS to 2.10.9 (which includes an mbedtls bump to 3.6.1, per
docs). Also, bump the TF-A tests to the latest version.
Signed-off-by: Jon Mason <jon.mason@arm.com>
* Set Linux kernel preferred version for Corstone-1000 to 6.12.
* Update version listed in Corstone-1000 user guide documentation.
* Remove Linux kernel version 6.10 recipe as was only used by Corstone-1000.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
A new section was added for the host level authentication which
explains how the FIP content is verified at TF-A level.
Signed-off-by: Abdellatif El Khlifi abdellatif.elkhlifi@arm.com
Signed-off-by: Bence Balogh bence.balogh@arm.com
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use flyout menu enabled via the `flyout_display`
parameter to show the flyout in the bottom of the sidebar.
The default Read the Docs (RtD) flyout needs to be disabled in order
to not have 2 flyouts showing. It is done by disabling it in the
RtD project settings.
Additionally, the Sphinx theme needs to be upgraded from version
2.0.0 to version 3.0.0. The sphinx and docutils modules also need
to be update for compatibility reason.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Newer versions of the FVP now contain a full log entry for the
"Listening for serial connection on port" regex of the form:
INFO: FVP_NAME: terminal_uart: Listening for serial connection...
Relax the regex to support this new logging format and change from
re.match to re.search as the regex may not appear at the start of the
line.
This change is backwards-compatible with older versions of the FVP.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
oe-core has removed 6.10, so until corstone1000 has upgraded to 6.12 add
it temporarily to meta-arm-bsp.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The DesignWare platform driver is hidden behind a DesignWare Core option
now, so enable that too.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When images are repacked IMAGE_ROOTFS_EXTRA_SPACE is ignored.
This is not necessarily a bug but an undocumented quirk of how wic
works.
Evaluate IMAGE_ROOTFS_EXTRA_SPACE and use the value with the
--extra-space option. Note that, since IMAGE_ROOTFS_EXTRA_SPACE is in
Kb, the value for `--extra-space` requires the explicit 'K' suffix (the
default is 'M')
Signed-off-by: Adam Johnston <adam.johnston@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Set the Upstream-Status to Denied because the community suggests a different design
The external system implementation in Corstone-1000 is user-defined.
In the implementation provided by he FPGA board and by the FVP, the
Cortex-A35 (Linux) can not access the memory of the external system (Cortex-M3).
So, Linux can not load the external system firmware and can not communicate
with the external system using Rpmsg over remoteproc subsystem. The reason is Rpmsg
needs vrings memory buffers to be shared between both cores.
The community prefers that the HW is updated with memory sharing before they
consider merging the remoteproc driver.
We reached the agreement that we will split the work in two parts:
Part 1: Writing an SSE-710 reset controller driver
Part 2: Corstone-1000 remoteproc driver
Part 1 is doable and we will be working on it.
Part 2 is waiting for the FPGA upgrade with the memory sharing feature.
For more details [1].
[1]: https://lore.kernel.org/all/20241009094635.GA14639@e130802.arm.com/
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently, terminal title is %title, which is populated with the
component name by the FVP. This commit prepends it with {name},
which is already a mandatory parameter for terminals to be launched.
E.g. FVP_TERMINALS[terminal_uart] ?= "My Name" will launch a terminal
with a title "My Name - terminal_uart".
Signed-off-by: Gabor Abonyi <gabor.abonyi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The SHA of the dependent community layers are commented out and set to
the tested SHA from the `styhead` branch of each layer.
The set SHAs are to be uncommented in the `styhead` branch which is
to be used to create the `CORSTONE1000-2024.11` tag.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
* Fix typographical error in documentation.
* Add missing instructions.
* Create paragraphs where necessary to improve readability.
* Change `note` box to `important` box
* Remove verification of arm_tstee driver presence:
arm-tstee driver has been integrated in Linux v6.10.14 which is
the one used in the software stack. It is built as part of Linux and
is no longer a loadable module.
The steps to verify the driver presence are no longer applicable.
* Standardise naming of the target platform:
Consistently use the name `Corstone-1000` to refer to the target platform.
* Update Debian OS version from 12.4 to 12.7
Debian version 12.4 has a bug in Shim 15.7.
This bug causes a fatal error when attempting to boot media installer
for Debian,and resets the platform before installation starts.
A patch to skip the Shim was applied to Corstone-1000 to avoid
the error.
Debian version 12.7 no longer has the bug in the Shim thus making
the usage of the patch redundant.
Bump Debian installer to version 12.7 and remove usage of the patch
for the Debian installation test.
* Replace xterm with tmux:
Update the user guide to specify tmux instead of xterm.
Using tmux as opposed to xterm provides a better user experience
when running the commands listed on the user guide.
* Use ACS image for FVP SystemReady test:
Due to fixed timeout values in the meta-arm-systemready the ACS time
test do not complete successfully.
Instead, specify commands to use the pre-built ACS image.
* List Trusted Services as a host component:
Add Trusted Services to the list of components used on the Host processor
of the Corstone-1000. The various BitBake recipes and append files used to
build Trusted Services are listed for the component.
* Update release version to CORSTONE1000-2024.11:
All references to the version of the Corstone-1000 software reference
stack have been updated from CORSTONE1000-2024.06 to CORSTONE1000-2024.11.
Add to the changelog the 2024.11 release information.
Add the 2024.11 release notes.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove secure boot signature from kernel image.
It's signed as part of uki image now which signs
kernel, initramfs etc.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Unified Kernel Image includes kernel and initrd which
both are signed with UEFI secure boot. This brings secure
boot closer to userspace.
Use core-image-initramfs-boot to find the real
rootfs and boot systemd init there. No need to hard code
rootfs via qemuboot/runqemu variables.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Setting INIT_MANAGER to "systemd" already sets needed
feature flags. Appending to them only causes sstate
cache invalidation and recompilations.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
xen-image-minimal now requires systemd. Add poky-altcfg (which has
systemd amongst other things) as an includes in the xen.yml file to work
around this. Also, xen requires openssh instead of dropbear. So,
override that entry.
Signed-off-by: Jon Mason <jon.mason@arm.com>
On some architectures (namely Aarch64), glibc may provide a libmvec
library since glibc 2.22, which programs built with gcc OpenMP
support might get linked to.
In order for these programs to work on the target, we need to copy this
library to the target filesystem.
Make sure that libmvec.so symlink is correct with or without usermerge
enabled otherwise libmvec.so symlink is broken.
For more details on libmvec, see
https://sourceware.org/glibc/wiki/libmvec.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
usrmerge nowaday required by systemd [1] but it broke
external-arm-toolchain in several ways...
When usrmerge is enabled, /lib is no longer part of SYSROOT_DIRS list
while the prebuilt toolchain expect the dynamic loader to be placed in
/lib not /usr/lib.
There is no /lib directory in the per-package sysroot directory
generated to build each package:
[...]/build/tmp/sysroots-components/<target>/<package>/
sysroot-providers/ usr/
But the cross-compiler still generate binaries with dynamic loarder
path set to "/lib/ld-linux-<target>.so*"
strings sanitycheckc_cross.exe | grep ld
/lib/ld-linux-aarch64.so.1
A symlink /lib -> /usr/lib is crated in the final rootfs image.
But this broke the meson-qemuwrapper used when "qemu-usermode"
(MACHINE_FEATURES) is available:
See [2]:
do_write_config:append:class-target() {
# Write out a qemu wrapper that will be used as exe_wrapper so that meson
# can run target helper binaries through that.
qemu_binary="${@qemu_wrapper_cmdline(d, '$STAGING_DIR_HOST', ['$STAGING_DIR_HOST/${libdir}','$STAGING_DIR_HOST/${base_libdir}'])}"
It produce a runtime issue while running a meson sanity check:
meson-qemuwrapper [...]/build/meson-private/sanitycheckc_cross.exe
qemu-aarch64: Could not open '/lib/ld-linux-aarch64.so.1': No such file or directory
Note: The binaries build by the Yocto internal toolchain seems be "patched" [3]
to look at /usr/lib instead of /lib.
We use -Wl,--dynamic-linker to make sure that the cross-compiler
generate binaries using the dynamic loader path defined by usrmerge
for all packages build by Yocto.
[1] https://git.openembedded.org/openembedded-core/commit/?id=802e853eeddf16d73db1900546cc5f045d1fb7ed
[2] https://git.openembedded.org/openembedded-core/tree/meta/classes-recipe/meson.bbclass?h=2024-04.3-scarthgap#n130
[3] https://github.com/openembedded/openembedded-core/blob/scarthgap/meta/recipes-devtools/gcc/gcc/0007-Define-GLIBC_DYNAMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When `usrmerge` distro feature is not enabled, then `${base_libdir}`
resolves to `/lib` and `/lib/libpthread*.so` does not match any files.
But, with `usrmerge` distro feature, `${base_libdir}` is `/usr/lib`, so
removed line leads to `/usr/lib/libpthread.so` symlink included in
`${PN}` which causes QA check failure.
Signed-off-by: Vasyl Vavrychuk <vvavrychuk@gmail.com>
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With `usrmerge` disto feature `base_libdir` and `libdir` are the same,
so it does not make sense to:
* removing "duplicates" between them
* move files from `base_libdir` to `libdir`
This fixes build error
| mv: '.../tmp/work/cortexa15t2hf-neon-poky-linux-gnueabi/external-arm-toolchain/12.2.Rel1/image/usr/lib/libasan.a' and '.../tmp/work/cortexa15t2hf-neon-poky-linux-gnueabi/external-arm-toolchain/12.2.Rel1/image/usr/lib/libasan.a' are the same file
in case of `usrmerge` feature enabled.
Signed-off-by: Vasyl Vavrychuk <vvavrychuk@gmail.com>
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The tc files were removed some time ago, but there are still entries
in the bbappends trying to reference those files. Remove them.
Fixes: 0af53c6453 ("arm-bsp: Remove tc1")
Signed-off-by: Jon Mason <jon.mason@arm.com>
With the recent update of u-boot to 2024.10, these patches are no longer
needed (as they are in this release). Remove them and everything is
happy again.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update edk2 to the latest stable release tag, and update edk2-platforms
to the last SHA that seems to work.
Signed-off-by: Jon Mason <jon.mason@arm.com>
UEFI capsule update is a mechanism that allows firmware updates to be
delivered and applied in a standardized way. It is part of the UEFI
specification and provides a way to update system firmware components
like the BIOS, UEFI drivers, or other platform firmware.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
qemuarm64-secureboot is using systemd for uefi-secureboot, which has
warnings with musl (and fails to compile with clang and musl). So,
modify the matrix to keep the coverage of everything else but musl.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable network boot via HTTP protocol. Many embedded and server-class
systems use network boot for booting. Enabling network boot on devices
allows:
- Shipping devices without OS images. When we power up the device, the
firmware can connect to the Internet and download and install suitable
boot images for this specific device. Administrators can centrally
manage the boot images and configuration files on a network server.
This centralization streamlines the management of boot options and
ensures consistency across all devices.
- This is particularly useful in enterprise environments. On mass
deployments, there is a need to install the operating system on
multiple devices simultaneously.
- Ability to maintain a completely diskless system if needed
The plain HTTP protocol lacks encryption. It's intended to be used on
local networks. Secure http protocol support is under review.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Encapsulate all UEFI Secure Boot required settings in one Kas
configuration file.
Introduce SBSIGN_KEYS_DIR variable where UEFI keys will be generated
to sign UEFI binaries.
Introduce uefi-secureboot machine feature, which is being used to
conditionally set the proper UEFI settings in recipes.
Replace Grub bootloader with systemd-boot, which it makes easier to
enable Secure Boot.
Advantages using systemd as Init Manager:
- Extending secure boot to userspace is a lot easier with systemd than
with sysvinit where custom scripts will need to be written for all use
cases.
- systemd supports dm-verity and TPM devices for encryption usecases out
of the box. Enabling them is a lot easier than writing custom scripts
for sysvinit.
- systemd also supports EUFI signing the UKI binaries which merge kernel,
command line and initrd which helps in bringing secure boot towards
rootfs.
- systemd offers a modular structure with unit files that are more
predictable and easier to manage than the complex and varied scripts
used by SysVinit. This modularity allows for better control and
customization of the boot process, which is beneficial in Secure Boot
environments.
- Add CI settings to build and test UEFI Secure Boot.
Add one test to verify Secure Boot using OE Testing infraestructure:
$ kas build ci/qemuarm64-secureboot.yml:ci/meta-secure-core.yml:ci/uefi-secureboot.yml:ci/testimage.yml
...
RESULTS - uefi_secureboot.UEFI_SB_TestSuite.test_uefi_secureboot: PASSED (0.62s)
...
SUMMARY:
core-image-base () - Ran 73 tests in 28.281s
core-image-base - OK - All required tests passed (successes=19, skipped=54, failures=0, errors=0)
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> [yml file include fix]
Signed-off-by: Jon Mason <jon.mason@arm.com>
In the target, Secure Boot starts from the firmware (u-boot), adds the
signing keys, and verifies the bootloader (systemd-boot) and kernel
(Linux).
sbsign bbclass is used to sign the binaries. sbsign is the name of the
tool used to sign these binaries. Hence the name of this class to sbsign
and variables with SBSIGN prefix.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-client 4.3 supports systemd sd-notify to inform
systemd and other services that it has started.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Tests are taking more time now and several devices are
timing out:
https://gitlab.com/jonmason00/meta-arm/-/pipelines/1467809227
qemuarm64-secureboot runs the test in 10 and
qemuarm-secureboot in 13 minutes.
Upstream optee CI shows xtest runs taking around 30 minutes on
slowest qemu machines:
https://github.com/OP-TEE/optee_os/actions/runs/10997530234?pr=7052
Guestimate limit to 45 minutes so that slowest and most loaded
machines could fit there too. optee xtest has internal test
specific timeouts so if something hangs it should be detected
earlier.
If these limits still cause issues, then we could disable some of
the longer running tests with "xtest -l" option. Default for
testing level is 1 but maybe 2 or 3 could be enough.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Cc: Jérôme Forissier <jerome@forissier.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest gn commit.
Changes in gn between b2afae122eeb6ce09c52d63f67dc53fc517dbdc8 and 95b0f8fe31a992a33c040bbe3867901335c12762
95b0f8fe31a9 Improve error message for duplicated items
e30a1fe26e5e [rust-project] Always use forward slashes in sysroot paths
20806f79c6b4 Update all_dependent_configs docs.
f792b9756418 set 'no_stamp_files' by default
60a28b636057 fix a typo
b5ff50936a72 Stop using transitional LFS64 APIs
a737c2849f13 do not use tool prefix for phony rule
e080b4d340c2 [rust] Add sysroot_src to rust-project.json
50ecf4c84d08 Implement and enable 'no_stamp_files'
4e4b8d989499 Add Target::dependency_output_alias()
225e90c5025b Add "outputs" to generated_file documentation.
9e0c7b7cefb2 Update bug database link.
d010e218ca70 remove a trailing space after variable bindings
32f63e70484f fix tool name in error
f190770a69a3 remove unused includes
54f5b539df8c Markdown optimization (follow-up)
e3d088c4b6ac Support link_output, depend_output in Rust linked tools.
fc8172f4a107 Properly verify runtime_outputs in rust tool definitions.
fdb90141934a BugFix: Syntax error in gen.py file
93550dc1701d generated_file: add output to input deps of stamp
449f3e4dfb45 Markdown optimization:
05eed8f6252e Revert "Rust: link_output, depend_output and runtime_outputs for dylibs"
8f2193f70793 hint using nogncheck on disallowed includes
0ee833e823f2 Rust: link_output, depend_output and runtime_outputs for dylibs
1b41f0502f87 Add missing reference section to function_toolchain.cc
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update OP-TEE to version 4.3.0
NOTE: the license file in optee-test changed, but the license is the
same (commit a748f5fcd9ec8a574dc86a5aa56d05bc6ac174e7). They chose to
change the URL of the licenses in question to be "LICENSE-GPL" and
"LICENSE-BSD".
Signed-off-by: Jon Mason <jon.mason@arm.com>
oe-core master now has 6.10.11 which incorporates this patch, so we don't
need to carry it anymore.
This reverts commit 60fd47edd0.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some of the existing patches were submitted and merged to the
upstream TF-M repository.
In this commit, the upstream statuses are updated, and the patches are
reordered so the submitted patches are applied first.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The patch with pending status was submitted to the upstream OP-TEE
repo.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Using resulttool we can transform the oeqa JSON reports into JUnit XML,
which GitLab can display in pipelines and merge requests.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We had two instances of the same job, so consolidate them into one.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Instead of always using KAS_WORK_DIR/build to refer to the build tree,
on the assumption that is where the build tree is, export KAS_BUILD_DIR
and use that variable instead.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The point of this recipe is to allow people to quickly test more recent
commits that aren't yet part of any release just yet.
One should really not use it in any product, but it's nice for CI and
development purposes.
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The added TF-M patches:
- Remove unused files from TF-M's BL1
- Remove unecessary duplications in metadata write functions
- Fix compiler switches in metadata handling functions: the runtime TF-M
uses the GPT to get the offsets for the metadata.
- Validate both metadata replica in the beginning by checking the crc32
checksum. If one of the replicas is corrupted then update it using the
other replica.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
b4[1] is a very nice tool for mail-based contribution. A config[2] file
exists to set up a few defaults. We can use it to set the To recipients
to always add, in our case the mailing list.
This shouldn't be necessary if we had a script that b4 prep --auto-to-cc
could call to find the mail address(es) to send to. Let's start without
it for now.
[1] https://pypi.org/project/b4/
[2] https://b4.docs.kernel.org/en/latest/config.html
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If a /dev/teepriv[0-9]* device is detected, start an instance of
tee-supplicant.service with the device name as parameter.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The current code is waiting 5 seconds to get an EOF on the
console pexpect spawn object, on a particularly slow machine
this timeout was not enough ending up into a TIMEOUT exception.
To solve this, increase the timeout and handle the TIMEOUT exception
by printing an error on the debug console instead of letting the
exception raise up to the stack, force the spawn object close() call
as well, since at this stage we would like the process to terminate
anyway.
Signed-off-by: Luca Fancellu <luca.fancellu@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Modify the upstream status and commit descriptions of Trusted-Services patches.
Few patches have been been upstreamed to external Trusted-Services gerrit repository
for review. So, update upstream status of those patches accordingly.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Re-enable parselogs testing for fvp-base and corstone1000-fvp, and add
an ignore file for the relevant entries. Also, increase the testing
being done on corstone1000-fvp.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the bits to enable poky-altcfg to boot to prompt on fvp-base.
Unfortunately, ssh takes a very long time to come up, which causes the
ssh test to timeout. So, don't enable this by default in CI.
Also, switch to building full-cmdline instead of sato, since we're never
actually testing the graphics on this platform.
Signed-off-by: Jon Mason <jon.mason@arm.com>
util-linux is failing when compiling with:
| configure: error: libmount_mountfd_support selected, but required mount FDs based API not available
Remove this feature when building with the binary toolchain to avoid
this issue.
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Application Root of Trust and the PSA Root of Trust was not
isolated in TF-M Isolation Level 2 beacuse of the misconfiguration of
the MPU. The added patch fixes this issue.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Includes:
* Sentence clarifications
* Usage of list numbering where steps are given
* Usage of code syntax where appropriate
* Usage of RST syntax for notes
* Appropriate capitalization of component names
* Consistently use the term MPS3 to refer to the physical hardware
* Present tests in a clear and consistent manner
* Wrap commands to reduce horizontal scrolling
* Creating paragraphs to improve readability
* Usage of shell variables for placeholders so user can
create their shell variables and use the provided commands
as in the user guide.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The arm-tstee driver was upstreamed to the v6.10 kernel so it doesn't
have to be loaded manually. Updated the related parts in the
Corstone-1000 user guide.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit updates the linux-yocto version to the latest availabe one.
No additional work was needed to make it work in Corstone-1000.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The ts-tee driver was upstreamed into the v6.10 kernel. Remove
arm-tstee driver package, since the upstream one should be used.
optee and arm ffa driver are logging non-fatal errors in dmesg, which is
causing the parselogs test to fail. This is due to arm ffa needing
givc3.
Signed-off-by: Jon Mason <jon.mason@arm.com>
CI test for Trusted Services is failing with the recent musl update.
The issue was bisected to an update in musl modifying the behavior of
PAGE_SIZE. Revert this change in musl while using trusted-services
until a proper solution can be found.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a warning in the Corstone-1000 documentation to indicate to the
end user that a 32 MB QSPI flash PMOD module is required to run
the Corstone-1000 software stack on MPS3-FPGA with the AN550 Application
note programmed.
Signed-off-by: Hugues KAMBA MPIANA <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add new usage details for running the secure boot testing
script located in the `systemready-patch` repository.
This script is used to create UEFI authenticated variables and sign the
Linux kernel image for the MPS3-FPGA and FVP secure boot tests.
Reflect the latest modifications to the script usage in the Corstone-1000 user guide.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Create new yml file "corstone1000-extsys.yml" which adds "corstone1000-extsys" as
new MACHINE_FEATURE.
Based on this, external system components can be enabled or disabled from the
Linux Kernel and U-Boot.
Reason for change:
DT-schema test is failing for the SystemReady-IR v2.0 certification because
device tree binding for remoteproc dts node corresponds to external system has
not been upstreamed in the Linux Kernel yet.
So, it has been decided to make enablement of external system configurable in
order to make Corstone1000 FVP SystemReady-IR v2.0 certifiable.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As pointed out by Denys Dmytriyenko, the LICENSE entry in
trusted-firmware-a is not accurate. docs/license.rst specifies the
licenses to be BSD 3 Clause for the project, with code from other
projects imported as:
libc BSD-3-Clause
libfdt BSD-2-Clause
LLVM BSD-3-Clause
zlib BSD-3-Clause
STMicroelectronics platform source code BSD-3-Clause
Linux source MIT
DICE Apache 2.0
Note: these are the license the code is imported with (according to
license.rst), not a listing of the license(s) of those sources.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Acked-by: Denys Dmytriyenko <denys@konsulko.com>
The new section writes down the steps that are needed for reproducing
the Secure Debug authentication.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Secure Debug functionality can be enabled on MPS3 by using the new
corstone1000-mps3-secure-debug.yml kas file. The kas file adds the new
secure-debug machine feature. The TF-M recipe adds the needed TF-M
build flags and patches in order to make the Secure Debug work.
This way, the Corstone-1000 will only boot fully if a debugger is
connected and a debug authentication is initiated.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
arm-tstee doesn't compile on 6.8 or newer kernels. Temporarily pin the
kernels of machines using this package back to 6.6 while developing a
fix.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adding "rootwait" to bootargs for uniformity with the other wic files,
and this _could_ resolve Yocto Bugzilla Bug 15562 (as the intermittent
inability to find the root disk could be because of a race between
needing the disk and it not being mounted yet).
Signed-off-by: Jon Mason <jon.mason@arm.com>
ts-newlib has a custom do_patch function which is not setting
up git like poky do_patch. Build without working git config
may fail:
| *** Please tell me who you are.
|
| Run
|
| git config --global user.email "you@example.com"
| git config --global user.name "Your Name"
|
| to set your account's default identity.
| Omit --global to set the identity only in this repository.
|
| fatal: unable to auto-detect email address (got 'tuxbake@81d82e1ac791.(none)')
Fix this by calling check_git_config from poky utils
to setup git correctly.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Read the Docs recommends installing the Sphinx theme by listing
it as an enabled extensions prior to setting it as the active theme.
This commit adds it to the enabled extensions list as it was already
set as the active theme.
Signed-off-by: Hugues Kamba-Mpiana <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Read the Docs will stop defining `html_baseurl` Sphinx configuration,
which means that projects will need to define it by themselves to keep the
canonical custom domain properly configured.
The `READTHEDOCS_CANONICAL_URL` environment variable is used to define
`html_baseurl` to keep the previous behavior.
Also inject the `READTHEDOCS` variable into the `html_context`.
Code fragment taken from the blog post here:
https://about.readthedocs.com/blog/2024/07/addons-by-default/
Signed-off-by: Hugues Kamba-Mpiana <hugues.kambampiana@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
A patch was added to fix the address of the bank erasing and flashing
during the capsule update procedure. Previously the BL2 partition was
not erased properly.
The offset in the corstone1000-flash-firmware.wks.in was updated to
be aligned with the changes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There no longer is a platform in meta-arm that uses this version of
TF-M. The last platform that did use it (Corstone-1000) now uses
a later version.
See meta-arm-bsp/conf/machine/include/corstone1000.inc for more info.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The TF-M was upgraded to v2.1.0 for the Corstone-1000. The TS had to be
aligned with it, to keep the Secure Enclave Proxy Secure Partition
compatible with TF-M.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the preferred version of TrustedFirmware-M for Cortsone-1000
from 2.0.x to 2.1.x to benefit from the latest fixes and improvements
as well as to reduce the number of out-of-tree patches.
As a result of updating the version:
* Remove no longer required out-of-tree patches
* Rebase and update the numbering of the remaining out-of-tree patches
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
CONFIG_FB_ARMCLCD is long obsolete, has been replaced with a DRM driver
enabled by CONFIG_DRM_PL111, and was removed in 6.8.
CONFIG_THERMAL_WRITABLE_TRIPS was removed in 6.9.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change moves ts-newlib compilation fix from
meta-arm-bsp to meta-arm, as this compilation failure
is not specific to meta-arm-bsp platforms.
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The patches with Pending status were submitted to the upstream TF-A
repo.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
bl31 interrupt type regression has been fixed in v2.11 of trusted
firmware a. Since qemuarm64-secureboot is using that version, this
patch can be removed.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Move the fvp-base unique u-boot patches to the proper nested directory
and rename them to match convention (devtool style).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Change optee-os build scripts to not use absolute
build time paths in generated header files and scripts.
Two patches are backports from master/4.3.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The .S files compiled by optee-os were including
absolute path of the recipe git tree. Fix this by
applying CFLAGS with correct debug prefix maps to AFLAGS
used by optee makefiles. Fixes optee-os and optee-os-tadevkit
buildpaths QA errors.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently the run_cmd, which is a wrapper for self.target.run()
that uses SSH to spawn commands on the target, can fail spuriously
with error 255 and cause the test to fail on slow systems.
In order to address that, introduce a retry mechanism for the call,
that is able to wait some time for the system to settle and retry
the command when the error code from SSH is 255.
Signed-off-by: Luca Fancellu <luca.fancellu@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Define “DISTRO_UNATTENDED_INST_TESTS” variable in meta-arm-systemready
independently from meta-arm-auto-solutions. This will allow running
the unattended installation without meta-arm-auto-solutions.
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The oeqa test responds to the boot loader prompt error message and
waits till the distro installation is finished.
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the Fedora kickstart configuration file and define a function to
modify the unpacked ISO image to add the kickstart file inside and
modify the grub.cfg file.
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a new inc file to unpack and repack the distro ISO image after
adding the kickstart configuration file inside.
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If SPDX 3.0 has been enabled then it :appends to IMAGE_CLASSES and then
breaks at build time because there are several classes and recipes that
look like but are not images.
Explicitly :remove the relevant class, but this really needs a better
solution in the long term.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Increase the size of PS storage in Secure Flash.
The SecureBoot and Security Interface Extension (SIE) tests for MPS3
are failing when the Secure Flash runs out of memory. The frequency
of the errors is at least 50-60%. The aim of this is to increase
the size of PS storage in Secure Flash, so as to minimize
the possibilities of it to run out of memory.
FLASH_PS_AREA_SIZE is increased.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the changes necessary to get edk2 booting and testimage passing on
fvp-base. All that is really necessary is adding the dtb to the too
partition.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The edk file removed xorg from being tested, which is currently working
on qemuarm and qemuarm64. Also, the section name collies with one in
fvp.yml, which has other things that are removed. Remove this removal
to get things working as expected.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest gn commit. The previous commit was from 23 April 2024.
The commits since that commit are:
Do not cleanup args.gn imports located in the output directory.
Fix expectations in NinjaRustBinaryTargetWriterTest.SwiftModule
Do not add native dependencies to the library search path
Support linking frameworks and swiftmodules in Rust targets
[desc] Silence print() statements when outputing json
infra: Move CI/try builds to Ubuntu-22.04
[MinGW] Fix mingw building issues
[gn] Fix "link" in the //examples/simple_build/build/toolchain/BUILD.gn
[template] Fix "rule alink_thin" in the //build/build_linux.ninja.template
Allow multiple --ide switches
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest commit. The previous top commit was from 27 July 2021.
The commits since that commit are:
aarch64: Enable access to MDSELR_EL1 from EL2 and below
aarch64: enable Permission Indirection Extension
aarch64: enable access to TCR2_ELx
model.lds.S: Quote file paths
Makefile: Change COUNTER_FREQ to 100 MHz
sme: Fix sign-extension bug in SMCR_EL3 write
fix array boundary check in find_logical_id
aarch64: enable access to HCRX_EL2
aarch64: Enable use of SME by EL2 and below
aarch64: Document what we're doing when setting ZCR_EL3.LEN
aarch64: Recognize PAuth QARMA3
Makefile: avoid dtc warnings on re-compiling DTB
Unify start_el3 & start_no_el3
Rework bootmethod initialization
Announce locations of memory objects
aarch32: move the bulk of Secure PL1 initialization to C
aarch64: move the bulk of EL3 initialization to C
Announce boot-wrapper mode / exception level
Rework common init C code
aarch64: initialize SCTLR_ELx for the boot-wrapper
aarch64: add mov_64 macro
aarch32: add coprocessor accessors
aarch64: add system register accessors
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest opencsd commit. The previous commit was from 28 March 2024.
The commits since that commit are:
opencsd: Update Version info and README for v1.5.3
build: Minor adjustments to improve clang compatibility
build: vs2022: Fix minor git tracking issues.
opencsd: test: update tests for memacc cache api
opencsd: Add external memacc cache interface.
opencsd: memory accessor - update caching.
opencsd: docs: Update man files
opencsd: etm4: Fix packet print typo.
opencsd: Fix error handling in snapshot loader
opencsd: Fix error string ordering.
opencsd: memacc: Add logging for cache pages and size.
opencsd: Add timing to trc_packet_lister
docs: Minor document corrections.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update README.md file to add "ARM_FVP_EULA_ACCEPT=1"
with kas build commands.
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With the resolution of meta-clang issue 766 and
OE-Core 15d09b02b2632ab1cabc3b1bd9f521e6d3d3b83f
many of the settings are no longer necessary to be set as part of our
CI. Remove them, as it is causing other issues with CI.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Arm Binary toolchain to version 13.3-rel1. The upper to
lowercase 'r' in rel was intentional, as the exact match is needed for
devtool to properly determine the correct version.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The mdata structure was modified to use the v2 and did the minimal
necessarry changes to make it build without errors. This way the
U-Boot metadata is aligned with the TF-A and TF-M structs.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrades metadata structs in secure-enclave from v1 to v2 as described
in psa-fwu spec: https://developer.arm.com/documentation/den0118/latest/
The TrustedFirmware-A v2.11 release supports only the metadata v2. The
structs in TF-M side had to be aligned to keep the compatibility.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the preferred version of TrustedFirmware-A for Cortsone-1000
from 2.10.x to 2.11.x to benefit from the latest fixes and improvements
as well as to reduce the number of out-of-tree patches.
As a result of updating the version:
* Remove no longer required out-of-tree patches
* Update the numbering of the remaining out-of-tree patches
Additionally remove unnecessary white spaces in modified BitBake files.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There no longer is a platform in meta-arm that uses this version of
OP-TEE OS. The last platform that did use it (Corstone-1000) now uses
a later version.
See `meta-arm-bsp/conf/machine/include/corstone1000.inc` for more info.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the preferred version of OP-TEE OS for Cortsone-1000 from
4.1.x to 4.2.x to benefit from the latest fixes and improvements.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 user guide with the new instructions on how to
rebuild the platform to enable multicore support and run a test to
verify this.
Signed-off-by: Delane Brandy <delane.brandy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
uefi-test is failing on qemuarm64-secureboot with TS enabled with a "Bus
Error". This regression is caused by the update of QEMU from v8.2.1 to
v9.0.0. Temporarily disable this test (via disabling ts-smm-gateway) to
get CI green until it can be root caused.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Include platform header file in order to remove compiler warnings.
Due to GCC upgrades to 14.1, some warnings are being treated as errors.
This change resolves TF-A compilation issue when FVP multicore
is enabled.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Recent upstream changes to what is acceptable use of WORKDIR have broken
where the meta-arm-systemready recipes are expecting things to be. Fix
them to point to the correct location.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Fast Models 11.26 now print the following warning if the env var
FASTSIM_DISABLE_TA is set:
Warning: /ARM/FastModels/deprecated: the use of FASTSIM_DISABLE_TA
environment variable is deprecated and will beremoved in a future
release.
Remove the env var from the default env passthrough vars in the fvpboot
bbclass.
This reverts commit 735f560aeb.
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Fix compilation issues with newer GCC version 14.1 for ts-newlib package
by disabling GCC flags for now.
This is just to unblock meta-arm master compilation issues.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Fix compilation issues with newer GCC version 14.1 for Trusted-Services
patches by disabling some GCC flags for now.
This is just to unblock the meta-arm master compilation issues.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch enables logging with timestamps for individual pexpect
assertions to ease the debugging of failed tests and the tuning of
timeouts. It measures the execution time of all pexpect calls and logs
the actual duration for each.
Only "callable" pexpect calls are timed (e.g. expect, sendline, but not
before or after).
Signed-off-by: Divin Raj <divin.raj@arm.com>
Signed-off-by: Ziad Elhanafy <ziad.elhanafy@arm.com>
Signed-off-by: Peter Hoyes <peter.hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Kas 4.4 image includes the websocket module, needed to use the
public hashserv/sstate.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Fallout from the upstream WORKDIR changes. do_copy_locale expects
SUPPORTED to be in WORKDIR, but recent changes have made it so that the
source/unpack location is no longer WORKDIR and cannot be pointed to
be such. So, do this copy manually here.
Signed-off-by: Jon Mason <jon.mason@arm.com>
QEMU has deprecated the no-acpi parameter, in favor of "acpi=off" machine
setting. Modify the machine conf to use the new method.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of fvp-base-a-aem. The licence files
changed with an addition of language to add 'Arm License Management
Utilities', but still is licensed under the Arm Proprietary license (and
still requires the EULA to be acknowledged).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the source/fetching for the new S/UNPACKDIR behaviour. This patch
is complicated by the recipe using UNPACK_DIR already, so I changed that
to avoid confusion.
Signed-off-by: Ross Burton <ross.burton@arm.com>
GCC 14.1 is stricter with code validation and the build now fails.
However as upstream appear to be about to remove this source entirely from
upstream[1] I didn't want to spend long investigating this if upstream
changes will obsolete it, so just silence the errors for now.
[1] https://github.com/microsoft/ms-tpm-20-ref/pull/108
Signed-off-by: Ross Burton <ross.burton@arm.com>
Introduce `corstone1000_fvp_smp` as a value of the `MACHINE_FEATURES`
variable to support Corstone-1000 FVP Symmetric Multiprocessing.
A new YAML file is created to add this new machine only for the FVP
variant of the target platform.
The multicore feature is enabled in TrustedFirmware-A,
TrustedFirmware-M, and OP-TEE based on this machine feature.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
This changeset adds the multicore support in trusted-firmware-a for the Corstone-1000
FVP.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
The fvpboot class specifically hooks into the image creation, so it
should use IMAGE_CLASSES instead of INHERIT (which is global in scope).
Signed-off-by: Ross Burton <ross.burton@arm.com>
Since switching to master, EDK2 is doing an unaligned access to memory
when drawing the boot logo which causes qemu 9.0.0 (since 728b923f54) to
raise an exception.
There is upstream discussion about where and what the underling bug here
actually is, but until that is resolved we can simply align the logo.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Improve the documentation in the user guide of the following tests:
- SystemReady-IR tests
- Manual capsule update and ESRT checks
- Linux distros tests
- UEFI Secureboot (SB) test
- PSA API tests
In addition, we moved the tests in one section for better readability.
Signed-off-by: Delane Brandy <delane.brandy@arm.com>
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since OE-Core commit 32cba1cc916a ("insane: Error for S == WORKDIR")
usage of WORKDIR in tasks is fatal, and shall be replaced with UNPACKDIR.
Similar change is introduced in OE-Core commit d9328e3b0b06 ("recipes:
Switch away from S = WORKDIR"), follow the same pattern for OP-TEE client.
Signed-off-by: Andrey Zhizhikin <andrey.z@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We boot genericarm64 inside a qemu, so add the pregenerated keys to speed
up testing. This isn't a risk because we don't publish the images.
Signed-off-by: Ross Burton <ross.burton@arm.com>
NOWERROR=1 has been made obsolete by commit beb065df6ee5 ("Do not set
-Werror by default"). Remove it.
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adding UPSTREAM_CHECK_GITTAGREGEX to properly check the upstream
version, and modify the recipe name to follow the version in the git
tree.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update hafnium to the latest version
Changes in hafnium between 946fde92bedc95e1320684b0bc2dc752bc1e1bc7 and 2bef7ab3895c48d39b84ab58179b2d0de5156b8b
2bef7ab3895c docs: the change log for the v2.11 release
2aea748eb344 docs: add SIMD support section
dac0ae1bf74a docs: threat model GPF with memory share
9dbe17a3fc60 docs: threat model to NWd rxtx buffer
0b45a2e28f65 docs: fix FFA_CONSOLE_LOG description
c28ee3eda25d docs: device regions in SPMC manifest
d547d6df4228 docs(memory management): rme integration
963a5d73abb5 docs: document `FFA_FEATURES`
d40979fd9974 docs: document `FFA_CONSOLE_LOG` ABI
dfc312e2a965 docs: add description of device memory lending
ce8526ecac0f docs: update threat model for static dma isolation
17c9ad327bfa fix(ff-a): report NPI and MEI unsupported to normal world
27a4df506d83 refactor(simd): cosmetic rename sm local variable
4695ce892967 fix(simd): fix SME-only save/restore conditions
4fd8f364ff43 fix(simd): omit setting SVE VL in SIMD restore
034a31970f4e fix(simd): cosmetic comments
79dbd6f9ab99 fix(simd): mask out SMCCC SVE hint bit
96ffeee3175b fix(simd): use SMCCC SVE hint bit mask
ca92fb0d303a refactor(simd): FPU save/restore convert to C
42a5262ebd4a fix: SVE/SME unsupported in processor feature regs
731f40b91e39 fix(test): reorder log before sync call in echo_mp
9b579d365a2d chore: remove extra lines from echo_mp test log
8a5fd9d9163a feat(indirect message): use 'memcpy_trapped'
0a21db13d12d feat(ff-a): use memcpy that is trapped GPF
a2d1c3b9c94a feat: add implementation of `memcpy_trapped`
7388c18ef222 refactor: exception handling macros for reuse at EL2
568f2a7b8fb9 feat(aarch64): define macros to process GPF
462ad8d90796 chore(hftest): use common secondary stack definition
491ff30f1ac4 test(dir_msg): demo MP test with direct message
0c029c2719cd feat: prepare for MP tests
b186fecfdf78 feat: added macro SERVICE_SELECT_MP
592ede3c7b95 test(memory share): NWd to SWd device memory sharing
63af1fab1656 feat(memory share): enable NWd to SWd device memory lending
4339edcf0bb0 feat(memory share): validate sp device mem ranges
6dff8271fbdc test(memory share): check limits on device mem sharing
a4de8a56b211 test(memory share): device lend SP to SP
a56ec8eff0f5 refactor(memory share): attributes in test helpers
9764ff6bd861 feat(memory share): allow device memory lend SP to SP
941ef34e5741 test(manifest): device memory for overlaps
4d16572b89ac feat(manifest): check device memory region for overlap
163e1a95a253 fix: ensure device regions are mapped as nGnRnE
899c4f28ab00 docs: drop unnecessary build option
03ba75fe13c3 refactor: set vcpu of the NWd in preempted state
0247fe68743e refactor: use `vcpu_set_running` function
874737a43d64 docs: mte build option in TF-A integration
2d570d1ef339 ci: increasing timeout
6976541fcc9e fix: update docs to use correct MTE build flag
b1dbca99bae7 docs: update docs with new RXTX_MAP/UNMAP behavior
738bee137e1d feat(ff-a): validate FFA_RXTX_MAP/UNMAP against NWd page tables
41e8d5b1f805 refactor: set vcpu in preempted state
e143080baf9b feat: add `vm_lock_both_in_order`
587cd29b5d3a test: FFA_CONSOLE_LOG with extended registers
740f74fc95c6 feat: support extended register set for `FFA_CONSOLE_LOG`
b9705e2bd383 fix(ff-a): check that hypervisor's TX buffer is set-up
95f0e6033ad9 fix: fix typo in static_assert
f98b2aa1d407 feat: add helpers for names of various enums
84710f315ae7 refactor(ff-a): use bitfields for memory access bitmaps
2fc6dcfa97e0 feat: update BL31 binary to optimize NS context management
5386559b386a feat: save and restore non-secure peripheral registers
80a7b7fe9abe feat: save and restore non-secure MTE context
0ec38247a973 feat: save and restore non-secure system reg context
c70bacdd5054 refactor: create helpers to save and restore sys reg context
3956b2e6074a fix(direct message): tests to look for FFA_BUSY
7ea3f7ec8cb9 fix(direct message): reorder checks for FFA_BUSY
e5262378c5d7 fix(memory share): missing flag if permissions RO
c972cc6de311 fix(memory share): data access permissions
7de61af932d1 fix(memory share): sender and receiver are the same
f779fb7ed4eb fix: ffa_msg_wait shall not change the mailbox state
dc8cf3b899e6 test(ff-a): NPI not supported on EL0 partition
f1ed5f16cd59 fix(ff-a): report NPI unsupported on EL0 partition
76f1c8f03c27 test(ff-a): SRI is unsupported on secure world
cb6642c1cd6a fix(ff-a): report SRI unsupported to secure partitions
f7861301c512 test(ff-a): FFA_FEATURES returns max RXTX buffer size
0fd672906e61 feat(ff-a): report RXTX buffer size in FFA_FEATURES
f2b6fd1e8e7d test(ff-a): fix counts for ffa_info_get with multiple uuids
a1de3c5f69f6 feat(ff-a): add multiple uuids to partition info desc
3bbed8f554d2 fix: allow code coverage tests to run despite fails
6e3abcff0f1b docs: add FFA_MSG_SEND_DIRECT_REQ2/RESP2 support
364400e8d91b refactor: linux driver statically allocate vms
e0ca9a07de7b refactor(memory share): introduce ffa_memory_access_impdef_init
f1dd1e1375a8 fix: partition message total size check
37b75119ed18 fix: partition message offset check
0abd88768e9a test: FFA_MSG_SEND_DIRECT_RESP2 intercepted
4847e3bdd837 test(dir_msg): cyclic dependency with two ABIs
9375a292b992 test(smccc): test register integrity across FF-A versions
bed1dae8b4c1 test(dir_msg): extend multiple uuids test
f06b52366f40 fix(mem sharing): return error if receiver count is 0
5e425040abf4 test(memory share): multiple borrowers from v1.1 SP
a76fd9165b4b fix(memory share): broken assert in send from SP to multiple
d50411214cb8 docs: update memory sharing to reflect recent changes
607c724cbda3 chore: increase timeout for sp_route_interrupt_to_secondary_vcpu
106c8cec1662 fix: reduce verbosity on passing tf-a-tests
9ae48e998450 test: intercept direct response between two SPs
ca2f92d3adf1 test: enable specifying options for sp_fwd_sleep command
0a704e559d7e fix: unwind call chain after intercepting direct response
5a0991746afa fix: error return in FFA_MEM_PERM_GET/SET
f06ee9df186d fix(memory share): drop assertion sender ID
89c221317513 fix: per-vCPU/global bind/set mismatch
30ac91dc9c78 fix: global notifications shall use vCPU ID 0
6b754a188dca fix: flags that mbz are checked
f020814b4105 chore: improve log message in notification set
7333dcfaf21a fix: notification set error code
1512acc0a69c chore: print bitmap on FFA_NOTIFICATION_BIND
7ccaccf2ab18 fix: invalid ID in bitmap create/destroy
2a500071f224 fix: spmc test script didn't capture failures
37e559da0f07 refactor(tc): remap console logs
a3905006b590 test(dir_msg): add FF-A version based tests
382e0c622a79 test(ff-a): registers preserved after dir_resp
352388760d18 feat(ff-a): preserve extended registers in dir_resp
81237694db4d test: exercise interrupt handling while processing indirect message
8922671489d9 test: support for services to parse device regions
93978b038e4d test: add twdog helpers to primary_with_secondaries
9a1b9c0bff6b test: make sp805 driver common across test setups
ba2488560be8 fix(interrupts): intercept ffa_msg_wait to signal virtual interrupt
ba22a72b8866 refactor: add helpers to intercept and resume ffa calls
7182163a2245 docs: update ff-a bindings for static dma isolation
555f8882f437 docs: add support for static dma isolation
7c7b1a7764ef feat: demonstrate specifying dma device count per partition
0715f32ba515 feat(smmuv3): restrict access of streams to limited memory regions
0e57d3d35892 feat(iommu): map memory regions into dma page tables
070f49ebfb4a feat: initialize page tables for enforcing dma isolation
8a3644777dc1 feat: allow platforms to specify dma device count per partition
e032af5e6a37 feat: track dma devices and map to stream ids
3c2b7911e6ee feat: retrieve dma properties for each memory region node
1ced4cb719ff feat(sme): add NS SME save/restore operations
ffdeb23a067b feat(sme): introduce an SME module
52bbdee7487c feat(sme): add SME related definitions
5b5883351c94 feat(simd): SIMD NS save/restore convert to C
dc112d50c258 refactor: make is_arch_feat_sve_supported inlined
d71c83aa8f44 feat(sve): introduce an SVE module
b0faf45a6c4a fix: ensure SVE traps are enabled when running SPs
063ad835b5bd feat(memory share): revert protect action
fd2060536fee feat(memory share): unprotect memory on reclaim
460d36c1fc58 feat(memory share): protect on memory lend/donate
cf6253e3abec feat(memory share): protect/unprotect memory
a2ff04126675 feat(rme): add protect/unprotect memory functions
0a83dc2bf94c feat(memory share): define ffa_map_actions
dad6003e1fcd feat: add build options for memory protect
cb4dc90811b6 feat: arch helpers to check RME support
2e14ebe8b6e3 fix(memory share): fix behaviour of relinquish clear flag
3d0a462034c0 ci: separate static checks in a script
674e4de6bb3a refactor: mailbox doesn't need size and sender
44e9b3b7bebb fix(memory share): hypervisor retrieve request
7b6ab6195d84 fix(memory share): set size of access descriptor
4f0d9c1843cf refactor(memory share): split memory retrieve req
d61246b6c5e1 fix(ff-a): do not report FFA_EL3_INTR_HANDLE to VM
40d09d2ce60c docs: added section for building a single platform
f90f1f12de0a feat(build): check platforms exist before building
41ef8baba363 refactor(memory share): use receiver_offsets to find receiver array
39bc21b07309 test(dir_msg): test direct message abi pairs
e468c1168124 fix(dir_msg): enforce direct message ABI pairs
cf7cc68012d3 test(ff-a): add FF-A v1.2 ffa_features test
58fe07d70fea test(dir_msg): end-to-end direct msg test with multiple uuids
422b10bc6991 feat(uuids): add support for multiple UUIDs per partition
036cc592731b test(ff-a v1.2): ffa_run to zero extended registers
434bea9652a1 test(dir_msg): add tests for FFA_MSG_SEND_DIRECT_REQ2
de0b0da535a1 test(dir_msg): extend registers in dir_msg tests
087e50241881 feat(dir_msg): add FFA_MSG_SEND_DIRECT_RESP2
db6a08b7cc6c feat(dir_msg) extend FFA_MSG_SEND_DIRECT_REQ2 registers
734ddc4e7cfb test(dir_msg) test FFA_MSG_SEND_DIRECT_REQ2
41fea93fe85b feat(dir msg): add FFA_MSG_SEND_DIRECT_REQ2
86d9fa741b86 feat(prebuilts): add SPMD support for ff-a v1.2 dir msg
c0e7dc20f2a9 docs: update messaging method ff-a binding
f71dee4c7bab feat(manifest): support FF-A v1.2 direct messages
9681574575c0 test(memory share): add test for FF-A v1.1 endpoints
63130e572dbe refactor(memory share): correct names of versioned share tests
909d3bbeca84 test(memory share): check memory access invalid values
59ffee9ba6bd test(memory share): introduce impdef value check
de974ca9b936 feat(memory share): add impdef field to ffa_memory_access
c7dc932e9a15 feat(memory share): check memory region desc values
d5ae44bed0c1 refactor(memory share): add helper for accessing receivers
36e0bdbf58e6 refactor(memory share): make ffa_memory_region update common
64400234fe31 refactor: make is_arch_feat_bti_supported inlined
109c6d4c0e5b fix: restrict HF_INTERRUPT_INJECT to Hypervisor
0926addea321 feat(amu): enable traps
0a1a9f861e6d feat(ff-a): update el0 services to v1.2
78788f863ca5 fix: ignore spurious interrupt and resume preempted vcpu
c5b20e7e0d6b chore: remove clang toolchain from prebuilts
6b351bc82c92 feat: build multiple targets at once
fdd59f75403f refactor: remove plat_ffa_other_world_mem_retrive function
ed7dee80b329 test: exercise interrupt handling with interrupts masked
3aafcb620cf4 test: add helpers and extend command args to mask interrupts
151c2e7f0bf3 fix(interrupts): intercept direct response to signal virtual interrupt
09e086a7dbcf fix(interrupts): reset implicit completion signal
e1562a1488c3 feat(rd): secure hafnium build for rdfremontcfg1 platform
e4fe29698285 feat(ff-a): update FF-A version to v1.2
ad7451b1faee feat(prebuilts): update TF-A prebuilt binary to FF-A v1.2
ed508c80a039 chore: make function private to ffa_memory
b56aac880e08 fix: explicit boolean for `share_state` pointer
639ddfc0193e fix(memory share): read-only memory can't clear memory
41d4fef0f044 fix(memory share): error code in retrieve request
03f08d3dc4b8 feat(gicv3): ensure implementation supports two security states
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for tf-a version v2.11.0 and mbedtls 3.6.0. Modifications
to the license checksum were necessary due to the addition to that file
for DICE (which is Apache 2.0 licensed) for TF-A and the dual license of
mbedtls (Apache 2.0 and addition of GPLv2).
NOTE: FVP base is having (more of) an issue with CI on the newest TF-A,
with SSH tests timing out. Holding that back to the LTS version until
it cane be resolved.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adding CMSIS support, as it is now required. Also, the SHA being
referenced by tf-m for cmsis is an intermediate SHA (between the v6.0.0
and v6.1.0 release tags). Finally, mbedtls is now using git submodules.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This flag should not be set here and the ARM_FVP_EULA_ACCEPT
should be set to True manually before building for the FVP, as it is
mentioned in the Corstone-1000 User guide:
export ARM_FVP_EULA_ACCEPT="True"
Fixes: 6e2a54748 ("kas: Corstone-1000 kas files updated")
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The reset has to be removed from the TF-M side after capsule update
because it caused data abort exceptions on the host side.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
The buffer size has to be increased to fit the EFI variables which got
increased metadata sizes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The increased EFI variable metadata need bigger buffer so it can
be transfered to the Secure Enclave without memory overflow
issues. The heap and buffer sizes had to be aligned with the.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The private authenticated variable changes increased the variables
metadata. The PS max asset size and related buffer sizes have to be
increased because of this.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The fvp-timer.cfg enables two modules for the SP804 and SP810 devices.
These are older pieces of hardware that predate the architectural timer
in modern systems, so even if the drivers are built they will not be used
by the kernel.
Whilst this is a good reason to remove them, another reason is that the
SP804 driver is incorrectly defined in the Kconfig so it can only be
built if a machine selects it explicitly (for arm64, only ARCH_BCM2835
and ARCH_HISI do this) or if COMPILE_TEST is enabled.
This led to COMPILE_TEST being enabled so that this driver can be built.
However, COMPILE_TEST does more, notably it turns on COMPILE_WERROR which
then makes any compile warnings fatal. This is inconvenient, especially
when compiler upgrades happen.
Remove the timer configuration entirely: the architectural timer is used
so this is entirely redundant.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The BB_HASHSERVE_UPSTREAM has issues which cause significantly less of a
match than expected. Update with the correct values to get the expected
behavior.
Fixes: 6e9525115b ("CI: add Yocto Project SSTATE Mirror")
Signed-off-by: Jon Mason <jon.mason@arm.com>
OPTEE and ftpm tests are failing in CI on slower systems due to timing
out, but actually finish when given enough time to complete. Increase
the timeout value to be roughly 100 seconds longer than the time it is
currently taking to finish on the slower systems.
Fixes: d450786667 ("oeqa runtime: add optee.py test")
Fixes: ba315f7242 ("oeqa runtime: add ftpm.py test")
Signed-off-by: Jon Mason <jon.mason@arm.com>
This changeset updates the user guide to test the secureboot for both the
FVP and FPGA.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The psa-iat-api-test was failing because the PLATFORM_HAS_ATTEST_PK
flag was added to the build for Corstone1000.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Crypto-AEAD-APIs tests fails on mps3. Configures CC312 mps3 model
same as predefined cc312 FVP configuration while keeping debug
ports closed.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone1000 does not properly clean the cache and disable gic interrupts
before the reset. This causes a race condition especially in FVP after reset.
This adds proper sequence before resetting the platform.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
openSUSE upgraded to 15.5
openSUSE Licenses updated to reflect update from 15.4 to 15.5
License now includes: Apache-1.1, BSL-1.0, IPL-1.0, Sleepycat, Zlib
Signed-off-by: Ben Cownley <ben.cownley@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Move the pexpect import inside the test method so that on machines without
pexpect installed we can still parse the test cases, even if this one
won't be pass.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As of oe-core b040597, the ssh-pregen-hostkeys recipe is limited to the
qemu* machines only, so that it can only be used in development or
emulation and not in production.
We have some virtual machines in meta-arm-bsp which don't match the
COMPATIBLE_MACHINE in the recipe but still benefit from this recipe, so
add a bbappend to enable it.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
On some CI systems, the bitbake server is timing out at 1 mins.
Increase to 5 mins, which hopefully should give enough time without
letting it run forever.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest gn commit and remove unnecessary patches and build
parameters
Changes in gn between 4bd1a77e67958fb7f6739bd4542641646f264e5d and f284b6b47039a2d7edfcbfc51f52664f82b5a789
f284b6b47039 [src] Add "#include <limits>" in the //src/base/files/file_enumerator_win.cc
155c53952ec2 Get updates to infra/recipes.py from upstream
d823fd85da3f Revert "Teach gn to handle systems with > 64 processors"
f07499aebcf5 [apple] Rename the code-signing properties of create_bundle
415b3b19e094 Fix a typo in "gn help refs" output
93ee9b91423c Revert "[bundle] Use "phony" builtin tool for create_bundle targets"
cfddfffb7913 [bundle] Use "phony" builtin tool for create_bundle targets
06cdcc8e1fa8 [ios] Simplify handling of assets catalog
22581fb46c0c [swift] List all outputs as deps of "source_set" stamp file
59c4bb920542 [swift] Update `gn check ...` to consider the generated header
dd0927eb34bb [swift] Set `restat = 1` to swift build rules
88e8054aff7b Fix build with gcc12
e05c0aa00938 [label_matches] Add new functions label_matches(), filter_labels_include() and filter_labels_exclude()
f19d5817e7ba [swift] Remove problematic use of "stamp" tool
6253a39dbc43 Implement new --ninja-outputs-file option.
5787e994aa4c Add NinjaOutputsWriter class
03d10f1657b4 Move InvokePython() function to its own source file.
0cdb7dd27f5c zos: build with -DZOSLIB_OVERRIDE_CLIB to override creat
d4f94f9a6c25 Enable C++ runtime assertions in debug mode.
0a2b8eac80f1 Fix regression in MakeRelativePath()
8b973aa51d02 fix: Fix Windows MakeRelativePath.
a3dcd7a7ad86 Add long path support for windows
a2e2717ea670 Ensure read_file() files are considered by "gn analyze"
fc722252439e apply 2to3 to for some Python scripts
5110a7f03e86 Add rustflags to desc and help output
f99e015ac35f strings: support case insensitive check only in StartsWith/EndsWith
b5adfe5f574d add .git-blame-ignore-revs
d6085ac6a95b use std::{string,string_view}::{starts_with,ends_with}
8bd36a27c076 apply clang-format to all C++ sources
5d76868385b8 add forward declaration in rust_values.h
b8562a4abd95 Add `root_patterns` list to build configuration.
5fd939de8a66 Use c++20 in GN build
d4be45bb28fb update windows sdk to 2024-01-11
71305b07d708 update windows sdk
85944ebc24a9 Add linux-riscv64.
7367b0df0a0a Update OWNERS list.
92e63272dc04 remove unused function
c7b223bfb225 Ignore build warning -Werror=redundant-move
bc5744174d9e Fix --as=buildfile `gn desc deps` output.
9a45b6123831 Update recipe engine to 9dea1246.
85bd0a62938b treewide: Fix spelling mistakes
e4702d740906 Optimize base::EscapeJSONString for ASCII inputs.
5d8727f3fbf4 [docs]: Mention implicit names in style guide
182a6eb05d15 Use magenta for warnings
991530ce394e Avoid unnecessary "Regenerating ninja files" step after running "gn gen"
c1fc04434c8e Fix variable use tracking for scope subscript accesses.
cc56a0f98bb3 [infra] Link to jemalloc instead of rpmalloc
811d332bd905 Move WriteSourceSetStamp to NinjaCBinaryTargetWriter
3fccef9033b9 [action][data deps] Make data-deps order-only deps of the action outputs
62ac86a938c3 [action] Add test for data_deps of an action target
1029a3b50873 Ninja: Always pass linker flags to rlib-generating command.
fae280eabe5d [serenity] Add SerenityOS port
11e12b0ef870 Remove obsolete comment
1de45d1a11cc Generate a StaticLibrary for rlibs and DynamicLibrary for proc macros
2a92efd396d3 Include library search paths when compiling rlibs
da5fe01bce4a Avoid unused and incorrect linker args in {{rustdeps}}
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add entry for how to get patches backported. Also, do some syntax
cleanups to make the README visualize better.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some networks limit outgoing git: traffic, so use https:.
Fixes: 0cec3e5 ("arm/gem5/boot-wrapper-aarch64: Move main recipe to meta-arm")
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Initial checking providing support for RMM on QEMU's "virt" machine.
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Includes TS and PSA dependency for firmware image build.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Recent changes to the FVP Base homepage have caused it to no longer be
searchable with the current Yocto tooling. Disable it to prevent issues
with `devtool check-upgrade-status`.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add corstone1000-recovery-image image based on core-image-minimal
while disabling the testimage task which is irrelevant in case of
an initramfs bundle.
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Corstone-1000 no longer uses OpenAMP, and it was the only platform
which needed this library.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone-1000 no longer uses OpenAMP, and it was the only platform
which needed this library.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The OpenAMP is replaced by the RSE Communication Protocol and
the documentation had to by updated to reflect this change.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Added the Corstone-1000 FVP platform to the ACS test build as well as
adding the arm-systemready-firmware variant to the Corstone-1000 FVP
build.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Corstone-1000 user guide with the new instructions on how to
build/use an ESP image and how to use the meta-arm-systemready layer to
run the ACS tests.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The SystemReady IR ACS test suite require that there is a valid ESP
partition available to the system. This change creates a new image that
only contains a ESP partition and ensures it's mounted on the second MMC
card so it's available when the SystemReady tests run.
The diagnostic level of the 2 MMC cards have also been lowered to
improve the ACS test duration.
Corrected a spelling mistake in the corstone1000-flash-firmware-image.bb
file.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Added the missing meta-arm-systemready required variable to enable its
use with the corstone1000-fvp machine. Also explicitly set all the
consoles.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The nodistro settings in poky set the TMPDIR variable to include the
TCLIBC value so we need to spot that and swap the TCLIBC for the musl
one used in the firmware multiconfig.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The regex used to validate compatible machines is incorrect as it's only
checking the machine name starts with "fvp" not "fvp-" as intended.
It's also been modified to allow FVPs called xxx-fvp to be compatible
with Corstone-1000.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
After enabling additional features in Trusted Services, the size of BL32
image (OP-TEE + Trusted Services SPs) is larger now. To create more space
in secure RAM for BL32 image, this patch removes NS_SHARED_RAM region which
is not currently used by corstone1000 platform.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change enables the UEFI secure boot and its related configurations
for corstone1000
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The .nopt and capsule are generated during the yocto build. Sync the
documentation with the changes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently, only the Corstone-1000 platform uses the capsule generation
class. Corstone-1000 uses U-Boot instead of EDK2. With this change,
the dependency on EDK2 was removed.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The .nopt image is used during the UEFI Update Capsule generation.
This .nopt image was generated manually when it was needed.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-os test xtest needs additional test trusted applications (TA) from
optee-os-ta package to pass. Execution time for ftpm test is around 21
seconds and 596 seconds for optee-test/xtest on an x86_64 build machine.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-os test xtest needs additional test trusted applications (TA) from
optee-os-ta package to pass. Execution time for ftpm test is around 18
seconds and 430 seconds for optee-test/xtest on an x86_64 build machine.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Test checks that ftpm kernel driver interfaces are available.
If fTPM optee TA is missing or crashes, the kernel driver does not
show the interfaces. A more functional tests would be to use tpm2-tools
from meta-security/meta-tpm but those require additional layer
dependencies which are maybe too much for now. tpm2-tools also depend
on starting tpm2-abrmd before the tools work. The ftpm kernel driver
depends on fully running tee-supplicant in userspace and the optee
side ftpm TA which takes some time. When manually running the tests
some of them failed since ftpm was not yet initialized. The boot
was not complete in those cases so added a workaround for that.
Better would be for all of the tests to start only once boot is
complete, not when ssh is available. Also, the qemuarm64-secureboot
machine includes optee and ftpm TA but does u-boot is not configured
to use the TPM device so boot is not measured.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If firmware TPM TA is compiled into optee, it needs a bit more
heap to pass optee-test/xtest suite.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
All other firmware boot components also continue booting
if TPM is not found. It is up to subsequent SW components
to e.g. fail if rootfs can't be decrypted. Enables policies
like fall back to unencrypted rootfs if TPM device is
not found with qemu and swtpm.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are two recipes in meta-arm-systemready that download ISOs for
testing purposes. Build them in CI to verify that the fetch is
successful.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
These recipes look like images but are not constructed the same way,
specifically there is no WORKDIR/rootfs/ directory. If buildhistory is
enabled this will cause it to abort, so disable image data collection in
buildhistory.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We recently switched the CI to not disable ptest, but this breaks builds
that use the GCC binaries built by Arm (external-arm-toolchain). This is
because the external-arm-toolchain recipe can't build packages for the
target, and the standard oe-core gcc recipes assume that they're being
built with themselves and make assumptions, specifically that libunwind
was enabled and headers can be copied directly from the sysroot.
This is a bigger problem that should be solved somehow, but for now we
can just remove ptest in the external-gccarm CI jobs which removes gcc
from the builds (it comes in via elfutils-ptest RDEPENDS).
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Functions that take 32-bit time_t types are unavoidable in the libc, so
ignore the warnings.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Reviewed-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch will be merged upstream soon, apply it locally to unblock CI.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add YAML language server comments so that IDEs know what schema to use
for the Kas files.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
trusted_services.py:test_15_crypto_service runs ts-service test with
an incorrect argument list. The -g argument does not accept two group
names. This resulted in a silent failure.
Fix this by relying the pattern matching capability of the argument.
Additionaly remove references to OP-TEE from test messages as TS tests
are SPMC agonistic.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update TS and dependencies to latest version of the integration branch.
Remove patches merged upstream.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a recipe to enable building and deploying the FWU service
implemented in the Trusted Services Project. The FWU service can
help vendors to meet PSA certification requirements.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Due to how the timer in u-boot is implemented, it's quite possible for
a two second timeout in the u-boot login to actually take over 15s to
expire.
Take a patch from the mailing list to implement this differently so the
timer runs in an accurate amount of time.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
add support for the remoteproc control feature for the external system
With this feature we can switch on/off the external system on demand:
echo stop > /sys/class/remoteproc/remoteproc0/state
echo start > /sys/class/remoteproc/remoteproc0/state
During Linux boot the remoteproc subsystem automatically start
the external system. The user can use the commands above to
stop then start the remote core.
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
describe the external system as a remoteproc node in the device tree
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
install the external system binaries under /lib/firmware
The kernel's remoteproc subsystem expects the firmware file to be under /lib/firmware
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When trying to replicate a build locally, having the exact list of Kas
files that was used is very useful.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the Yocto Project public SSTATE mirror to its own unique yml file.
This allows for developers to use this to speed up builds, while not
adding in the default case. This "off by default" is because it can add
10s of minutes to each build, which might not be beneficial to those who
are using SSTATE dir locally.
Also, removing the removal ptest distro feature, as this change prevents
an optimal usage of the YP SSTATE mirror (~30% match to ~90% match for
qemuarm64).
Signed-off-by: Jon Mason <jon.mason@arm.com>
These BSPs are now obsolete.
Users of generic-arm64 should use genericarm64 from meta-yocto-bsp.
Users of qemu-generic-arm64 should use sbsa-ref from meta-arm-bsp.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This is mostly based on the existing qemu-generic-arm64 machine, but by
not being based on the genericarm64 and instead being specifically a
machine to run on the qemu sbsa-ref machine we get to tune differently.
Specifically, this configures sbsa-ref to be a Neoverse N2 (v9), and the
tune is set to match. Another notable difference to qemu-generic-arm64
is that the kernel configuration is at present defconfig. We may wish
to change this in the future to be the same fragmented configuration as
genericarm64.
We have to ignore two testimage parselogs failures: one from NUMA which
will be fixed in a future EDK2 release, and one from efifb where we
should be using the bochsdrm driver instead (further investigation is
needed)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the new genericarm64 in meta-yocto-bsp to the CI.
This new BSP is heavily based on the meta-arm generic-arm64 machine, but
with an all-new fragmented kernel configuration.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some BSPs use a proper initramfs and putting a SSH server into them
via this :append isn't ideal. Adding using += should be sufficient.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Every platform should have the chance to try the -rt patches.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This class is no longer used by any machines, so remove it.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- The Secure Enclave Proxy Secure Partition fails at psa_call()
because wrong parameter was passed.
- The SMM Gateway initialization failed because a malloc()
returned a NULL pointer. The SMM_GATEWAY_MAX_UEFI_VARIABLES
had to be decreased to avoid this.
- Increase shared memory buffer size and add buildtime check
- Use __packed for the variable_metadata struct
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Trusted Services v1.0 uses new RPC protocol and the message
fields in u-boot had to be synchronized.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add configuration settings to TF-A, OP-TEE and TS SPs needed to get TS
built and run on the fvp-base machine.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Version v11.25 was released and it fixes measured boot. Update the
recipe and integrate the new version.
The pattern of the download URL has changed. Add functionality to
calculate a new URL fragment from the package version.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The current version of the TS recipes fails to build if the TS
environment is not set to opteesp. Change the recipes to allow building
the sp environment.
This environment targets "generic" secure partitions and produces SPMC
agnostic SP binaries which should be able to boot under any FF-A v1.0
compliant SPMC implementation.
Signed-off-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
MbedTLS fails to build when FORTIFY_SOURCE is enabled and the NWd
configuration is used. Disable the compilation option temporary till
the root cause can be fund and a proper fix be made.
The build only fails when building from yocto. The OP-TEE integration
works fine with gcc v13.2_rel1.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Update Trusted Services to v1.0.0.
- Update TS "external components" references to fetch the version
dictated by the TS repo.
- Remove patches merged up-stream.
- Update the TS nanopb integration fix (see 210a6ace83)
- Update TS test integration.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
- Update driver version to v2.0.0
- Follow up the name change. The driver has been renamed from
arm_ffa_tee to arm_tstee.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The .nopt and capsule are generated during the yocto build. Sync the
documentation with the changes.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently, only the Corstone-1000 platform uses the capsule generation
class. Corstone-1000 uses U-Boot instead of EDK2. With this change,
the dependency on EDK2 was removed.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The .nopt image is used during the UEFI Update Capsule generation.
This .nopt image was generated manually when it was needed.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
A SRCREV for arm-platforms-kmeta was added years ago to get
yocto-check-layer working at the time, but was never removed (and never
updated). Removing now, since it is not necessary.
Signed-off-by: Jon Mason <jon.mason@arm.com>
A patch was dropped when trusted-firmware-m was updated to 2.0 but it
had not yet been merged upstream (2.0 or master).
Restore the patch to fix regression on Corstone-1000
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade the Debian distribution from version 11.7 to version 12.4 in the distribution installation.
Signed-off-by: Amr Mohamed <amr.mohamed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream master and scarthgap have now diverged, so use scarthgap whilst
we prepare for release. At the time of writing there is no scarthgap
branch for meta-clang, so leave that on master.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Increase the number of TLB entries from 0x80 to 0x400 and disable the
checking of memory attributes. In our CI, this makes testimage run in
576s instead of 803s.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Multiconfig is only needed when recovery and the mass storage images
are built together. It is not needed when firmware-only build is used.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enables host firewall and mpu setup for FVP. It also fixes secure-ram
configuration and disable access rights to secure ram from both normal world
for both mps3 and fvp.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
MM Communicate buffer is accessed by normal world but at the moment so it
should be located in DDR instead of secure-ram. This moves mm communicate
buffer to the DDR for trusted-service components.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
MM Communicate buffer is accessed by normal world but at the moment
it's allocated in the secure ram. This moves mm communicate buffer
to the DDR and also fixes the capsule buffer size since it cannot be
more than the bank size.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove the preferred version so that we track the latest release.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some of the corstone u-boot patches are not properly formatted, causing
scripting issues. Regenerate them via:
devtool modify u-boot
git format-patch -N --no-signature devtool-base..HEAD
mv *.patch ~/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot/corstone1000/
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest stable version (1.5.2), comprised of the following
commits:
5d86f27a8c0a opencsd: Update version info and README for 1.5.2
71c50dda716f build: win: Fix name for ocsd-perr utility in windows build
599551d3ea09 opencsd: docs: Update docs for test programs
769faaa6368a opencsd: docs: Update trc_pkt_lister man file
b957577e71bf tests: Fix typo in trc_pkt_lister help output
dca84a74a0d5 build: Fix clean of mem_acc_test
85fd025eed35 opencsd: stm: Fix build warning in 64 bit build of STM
2145b81b4b61 opencsd: etmv4: Fix build warning on decoder
169cc07d3625 docs: Fix formatting in README.md
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest stable version (2.10.3), comprised of the following
commits:
fc93d0edfc52 docs(changelog): changelog for lts-v2.10.3 release
4a10950a8538 docs(changelog): display all sections
bafc27c8d7cf chore: rename Poseidon to Neoverse V3
a6256d7a2638 feat(cpu): add support for Poseidon V CPU
ef393a3f9fa2 fix(cpu): correct variant name for default Poseidon CPU
81931a13a835 fix(cpus): workaround for Cortex-A715 erratum 2413290
baf14745f117 fix(cpus): workaround for Cortex-A720 erratum 2926083
635c83eb456a chore: update status of Cortex-X3 erratum 2615812
03636f2c3d60 fix(cpus): workaround for Cortex-A720 erratum 2940794
e86990d0911d fix(cpus): fix a defect in Cortex-A715 erratum 2561034
b59307ef8efd fix(cpus): workaround for Cortex-A715 erratum 2413290
44f36c48f280 docs(sdei): provide security guidelines when using SDEI
11cb0962f7ac docs(threat_model): mark power analysis threats out-of-scope
3e3ff298a614 fix(cpus): workaround for Cortex-A715 erratum 2344187
d466c5d4d27b fix(cpus): workaround for Cortex-X4 erratum 2701112
940ebbe2d1d0 fix(cpus): workaround for Cortex-A715 erratum 2331818
04c60d5ef31c fix(cpus): workaround for Cortex-A715 erratum 2420947
b7ed781eea74 fix(gic600): workaround for Part 1 of GIC600 erratum 2384374
58646309aedf chore: rearrange the fvp_cpu_errata.mk file
a234f540b727 fix(cpus): add erratum 2701951 to Cortex-X3's list
a24c8006ea39 refactor(errata-abi): workaround platforms non-arm interconnect
9fe65073d442 refactor(errata-abi): optimize errata ABI using errata framework
301698e15bc8 fix(cpus): workaround for Cortex-A715 erratum 2429384
5f8f745c7e99 fix(cpus): workaround for Cortex-X3 erratum 2372204
Signed-off-by: Jon Mason <jon.mason@arm.com>
The get_testimage_json_result_dir helper in OE core was deleted in
commit 01b1a6a5a4e7cede4d23a981b5144ae9c8306274 in preference for a
common utility. Change the reference within the Arm SystemReady ACS
log handler utlity.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change upgrades the tftf version to v2.10 for the Corstone-1000.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since sbsa-acs requires edk2-firmware, it bases its SRC_URI on that.
The first entry of SRC_URI is what is used to determine the latest
version. So, specify an alternative URI to determine the correct
version.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change upgrades the trusted-firmware-m version to 2.10
for n1sdp.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As of oe-core ba391d3, hashserv lookups will use authentication from the
.netrc file. However, Kas will write invalid netrc files with comments,
which causes bitbake to emit warnings.
This has been fixed in Kas in e700729 but until Kas 4.3.2 is released we
can ignore this warning specifically when checking the logs.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When the URL and names of the toolchain tarballs changed, the
UPSTREAM_CHECKs were not modified with the proper values. This causes
the tooling to not show when new versions are available. Modify to get
it working again.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Initial checking providing support for RMM on QEMU's "virt" machine.
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To reduce build and test times in CI, move the dev kernel outside the
standard matrix. This results in it still being built and tested for
the platform, but only with gcc/glibc (and not against clang and musl).
This greatly reduces the number of permutations that need to be
verified.
Signed-off-by: Jon Mason <jon.mason@arm.com>
gcc-arm-none-eabi v11.2 is no longer needed by tf-m. Remove this
version, as there is a newer one available.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of SCP. In this release, some of the
platforms were grouped into common family directories, which
necessitated adding a variable to specify which one.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version. Also, remove the gcc12 workaround, as
that was added in edk2 commit 206168e83f090, which has been included
since the 202305 release.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the TF-A recipe to the latest stable version (2.10.2).
NOTE: tf-a-tests did not have a corresponding stable release. So,
keeping back at 2.10.0.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds a recipe (ts-sp-block-storage) to build the Block Storage
secure partition to enable feature development for downstream users.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove scp-firmware sha for intermediate version
to update to v2.13 according to the Arm Reference solutions
Feb-2024 manifest.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With clang 18, optee-os no longer compiles cleanly. It is now seeing:
| In file included from core/arch/arm/kernel/vfp.c:6:
| In file included from core/arch/arm/include/arm.h:131:
| core/arch/arm/include/arm64.h:436:1: error: expected readable system
register
| 436 | DEFINE_U32_REG_READWRITE_FUNCS(fpcr)
| | ^
| core/arch/arm/include/arm64.h:417:3: note: expanded from macro
'DEFINE_U32_REG_READWRITE_FUNCS'
| 417 | DEFINE_U32_REG_READ_FUNC(reg) \
| | ^
| core/arch/arm/include/arm64.h:411:3: note: expanded from macro
'DEFINE_U32_REG_READ_FUNC'
| 411 | DEFINE_REG_READ_FUNC_(reg, uint32_t, reg)
| | ^
| core/arch/arm/include/arm64.h:398:15: note: expanded from macro
'DEFINE_REG_READ_FUNC_'
| 398 | asm volatile("mrs %0, " #asmreg : "=r" (val64));
\
| | ^
| <inline asm>:1:10: note: instantiated into assembly here
| 1 | mrs x8, fpcr
| | ^
Issues are also seen on optee-examples and optee-test.
Forcing GCC for all optee recipes until this issue can be resolved.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The workaround is no longer needed because with the
0043-firmware-psci-Fix-bind_smccc_features-psci-check.patch file the
u-boot PSCI driver is compliant with the PSCI specifications.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The u-boot PSCI driver was not compliant with the PSCI specifications so
this patch had to be added.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
GNU Arm compiler version greater and equal than *11.3.Rel1*
has a linker issue in syscall for TF-M 1.8.0. Let's bump to
TF-M 2.0 which contains the fix for the issue.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone-1000 uses trusted-firmware-m as secure enclave software
component. Due to the changes in TF-M 2.0, psa services requires
a seperate client_id now. This commit adds smm-gateway-sp client id to
the FMP services since FMP structure accessed by u-boot via
smm-gateway-sp.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enable the patch-status warning for meta-arm and meta-arm-bsp.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The user guide document for Corstone-1000 has been updated to reflect
the changes required following the multiconfig changes as well as now
running the fvp within the kas shell to ensure all environment variables
are picked up correctly.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The 2 Corstone-1000 kas files files are updated following the
multiconfig changes. The pinned commits have been commented out and
the default branch changed to master to allow the file to build valid
images.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Fix the build with DISTRO_FEATURES containing "usrmerge":
make: *** No rule to make target '/.../optee-os/4.1.0/recipe-sysroot/lib/optee_armtz/bc50d971-d4c9-42c4-82cb-343fb7f37896.stripped.elf', needed by '/.../optee-os/4.1.0/build/core/early_ta_bc50d971-d4c9-42c4-82cb-343fb7f37896.c'. Stop.
Fixes: 6a105f47b9 ("optee-ftpm: Install artifacts into nonarch_base_libdir")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To ensure the psa and optee tests are included in the initramsfs based
rootfs included within the flash image so the tests can be run.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
To allow us to continue to ship Corstone-1000 releases that only include
the firmware with the built in Linux image we need a way to build it
outside of the multiconfig builds.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
By building the Corstone-1000 firmware under the firmware multiconfig we
can also build a minimal standard core image to be mounted in the fvp as
a mass storage device.
To do this we had to enable the MMC card interface in the Corstone-1000
kernel configuration.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
To enable building rescue or bootstrap images that can be included into
firmware a "firmware" multiconfig option is required to allow the
building with different options to any mass storage image they may also
be built.
As this multiconfig build will occur under a different TMPDIR, we also
provide a deployment image to allow easy copying of the firmware into
another deploy dir.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
The TF-M configuration step can fail if the doxygen executable is found.
This commit disables the doc generation until this is fixed in the
upstream repos.
Signed-off-by: Bence Balogh <bence.balogh@arm.com>
Bumped kernel version to v6.6 and rebased N1SDP kernel PCIe quirk patches on top of this new version.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Since there are no platforms using this version, the related files can
be removed.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
As we intend to build 2 Corstone-1000 disk images, one for the firmware
in flash and an external mass storage image the existing
corstone1000-image.bb file has been renamed to
corstone1000-flash-firmware-image.bb to make it clear what it's for.
The wks file for specifing the image layout has also been renamed to
make its purpose clearer.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
We can now use the standard poky distro configured to be small by
switching distrobution and using the standard minimal image
from poky.
To do this we also remove and image configuration options from the
machine config and apply them in the kas files.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Moves a number of setting from the machine definition to the actual
recipes they apply too.
Added image configuration and dependancies to the flash image definition
file.
Reordered the settings in the machine definition to group them by
component that are related to.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Moved the U-Boot configuration items from the machine definition to the
Corstone-1000 specific U-Boot append file as it makes it easier to the
U-Boot configuration for a machine in one place and to make it more
consistant with other platforms.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
The capsule_cert and capsule_key file generated by u-boot for
corstone1000 do not get deployed correctly since writingh the output directly
to ${DEPLOY_DIR_IMAGE} causes the sstate mechanism to malfunction
especially in the CI builds. This patch fixes the issue and deploy the
generated files correctly.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Setting an API key means we get higher rate limits. Because keys are
private, the key must be set in the environment of the runner.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This changeset fix the tftf tests issue on n1sdp. Before this change, the tftf tests were getting stuck on n1sdp.
The following changes have been done:
1. There were some tftf tests based on multicore which involve powering up the other cores. These tests were creating
issues and the same thing has already been mentioned in the tests-to-skip.txt file for n1sdp platform in tftf source.
Those tests are skipped while executing tftf and patch has been created.
2. The TFTF_MODE variable added for tftf v2.10 recipe file, as did earlier for tftf v2.9. With the help of this, we can
enable debug or relase mode. The configuration based on this has been added for n1sdp in the corresponding bbappend file.
3. Add PREFERRED_VERSION_tf-a-tests for v2.10.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a Kas fragment to enable the CVE checker. Disable warnings by
default but show them for the layers in meta-arm, because we only care
about meta-arm issues in this CI.
Explicitly hide kernel warnings as the kernel typically has tens of open
CVEs, and if we're carrying a kernel explicitly then it's typically an
interim kernel between releases.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Extend jobs-to-kas so the first argument is still the GitLab job name,
but allow further arguments to specify extra Kas files to use in
addition.
Then add a variable EXTRA_KAS_FILES to the CI configuration that
defaults to the empty string and pass this to jobs-to-kas.
This lets specific pipeline runs add extra Kas files, for example to use
experimental branches or enable extra features without touching the CI
directly.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Linux 6.1 will be removed from oe-core master shortly, so whilst we
still have BSPs that use it (specifically, n1sdp) carry a 6.1 recipe in
meta-arm-bsp.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since there are no platforms using this version, this reciepe can
be removed.
Signed-off-by: Vikas Katariya <vikas.katariya@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since linux yocto kernel 6.5 is EOL and other layers like
meta-virtualization dropping support for it, it would be
sensible to downgrade the kernel to 6.1 which is a LTS.
This is a temporary change and later we would move to 6.6 when its
officially supported on N1SDP.
This revert the following commits:
* 1fe76c893c
* 21df60b921
Signed-off-by: Jon Mason <jon.mason@arm.com>
Updated to the latest version. Corstone1000 doesn't seem to boot. So,
pull back the old version to meta-arm-bsp for it to use temporarily.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Changes were needed due to the 2.0.0 version not being available for
download at pypi (though listed as the latest version there).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Scripts processing data for the patch ages need correct information in
the relevant fields to determine the age. Create/correct this
information where missing/incorrect.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The SHAs for both libmetal and open-amp are intermediate SHAs, which are
only a few patches behind the v2021.04.0 tags. Update to those tags and make
the necessary changes to get them working.
Signed-off-by: Jon Mason <jon.mason@arm.com>
oe-core master has upgraded from 6.5 to 6.6, but as we have BSPs that
still use 6.5 (corstone1000, n1sdp) we need to carry the recipe. This
should be a short-term measure as 6.5 was EOL in December 2023.
Also, drop the unused 6.4 linux-yocto which was no longer needed since
N1SDP moved to 6.5 with 21df60b.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The tftf tests were getting crashed on the MPS3 and two issues were found
during investigation. This change set provide fix for those issues:
1. The tftf tests were getting crashed on the MPS3 when compiled with
LOG_LEVEL=50. So, reducing the log level and aligning it with the TF-A
allows us to get rid of the crash.
2. Once the above crash got resolved, it has been found that tftf tests
were getting asserted while reading the value of the register
GICD_ITARGETSR. The reason for the crash is that the value of this register
is zero. As per the GIC documentation, this register is RAZ/WI for uniprocessor
implementation and corstone1000 is uniprocessor implementation for FPGA.
So, this change compiles the tftf tests in release mode which allows us
to compile out the assert definitions.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add CI builds for Arm SystemReady Firmware within the fvp-base CI job and a new
Arm SystemReady IR ACS build job. Add the CI kas config for each of these
builds.
The ACS build can be controlled by the ACS_TEST GitLab variable to specify
whether or not to run the testimage. If this variable is not set, the
testimage step will not run. The job tag can be controlled by the ACS_TAG GitLab
variable.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the parted-native dependency explicitly which is needed to
use wic commands.
Also explicitly inherit testimage. This means that the kas config
is no longer required to include it in IMAGE_CLASSES.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update tf-a and mbedtls to the latest versions. Also, migrate the
previous version to meta-arm-bsp for corstone1000.
NOTE: in v2.10, the fiptool makefile was changed to reference LDOPTS
instead of LDLIBS.
NOTE: commit 408cde8a59080ac2caa11c4d99474b2ef09f90df in tf-a modifies
the qemu_sbsa starting offset, and per the commit comment, it requires
the edk2 same change. This is why the edk-platforms SHA has been
changed. There are only 19 patches between the previous SHA and this
one (most of which are adding a single platform). So, it shouldn't be
too impactful to bump the SHA (instead of making it a patch to apply
on top of the existing SHA).
NOTE: tf-a-tests added LDFLAGS to the makefile, causing the need for it
to be removed in the recipe.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that we've released 4.3 and branched, we can switch master CI back
to master.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We enable PAC/BTI out of the box, but all of the pieces (such as gcc and
glibc) need to support it for the final binary to be protected.
Add a minimal test recipe to verify that the "Hello, World" binary is
using PAC/BTI, and add it to oe-selftest.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Readthedocs server requires an absolute path from project's root
directory to find correct requirements.txt and conf.py.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Upgrade the Corstone-1000 YMLs as follows:
- Set the layers SHAs
- Align with Kas v4
- Update the layers list
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Add a note for Capsule update negative test scenario and fixes instructions
regarding distro-boot in Corstone-1000 user guide.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Delane Brandy <delane.brandy@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Adds creating an EFI System Partition for Corstone-1000.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
align the release note with the upcoming CORSTONE1000-2023.11 release
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Use Ethernet over VirtIO on FVP due to lan91c111 Ethernet driver support dropped from U-Boot.
This patch enables virtio-net device in u-boot to pass ACS tests related to
NIC and PXE. The current ethernet device still works in linux kernel and
corstone1000-mps3 Ethernet device is supported by u-boot, so no change is
required regarding existing Ethernet device.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Adds virtio-net configuration to use virtio-net in corstone1000-fvp.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Update the user guide to include Linux distro installation on fvp
Signed-off-by: Delane Brandy <delane.brandy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This fixes a race that is observed rarely in the FVP. It occurs in FVP
when tfm sends the notication ack in openamp, and then reset the access
request which resets the mhu registers before received by the host
processor. It implements the fix both in SE and the host processor openamp
wrapper. This solution enables polling on the status register of mhu until
the notificaiton is read by the host processor. (Inspired by
signal_and_wait_for_signal function in mhu_wrapper_v2_x.c in trusted-firmware-m
https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/platform/ext/target/arm/rss/common/native_drivers/mhu_wrapper_v2_x.c#n61)
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade the Arm binary toolchains to the latest version. Of note, the
untarred directory has camelcased the "R" in Rel (which was "rel" in the
previous versions).
Signed-off-by: Jon Mason <jon.mason@arm.com>
The fvp-base machine uses a v8.4 tune and the FVP itself is configured
to be v8.4, so also tell TF-A to use v8.4.
This is normally done in the TF-A board configuration, but the fvp board
is configurable.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We already tell the FVP to be v8.4 cores, so tell the compiler to
tune for that instruction set too.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This CVE is specific to NXP i.MX boards which are documented as being
shipped unsecure, as they're meant for development.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Changes ns-interrupt-action for corstone1000. This will enable
preemption in the SPs which is the default way to handle interrupts in
trusted-firmware and optee documentation.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When booting, the tee driver from kernel side
invokes a yielding call to OP-TEE, which gets
stuck because OP-TEE never sends Done response:
OPTEE_FFA_YIELDING_CALL_RETURN_DONE
This issue was previously resolved by introducing
an inappropriate patch to the kernel with 1 ms delay
in ffa_msg_send_direct_req.
Further investigation proved that OP-TEE doesn't
get enough processing time and is constantly interrupted
by the kernel requests. To remove this patch, TF-A logging
level is lowered to default (40 in debug builds and
20 in release builds), which eliminates the time consumed
previously by TF-A VERBOSE logs (giving OP-TEE more
processing time).
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Corstone1000 capsule update implementation does not support use of
scatter_gather_list. This workaround passes 1 as scatter_gather_list value
to pass the NULL checks for scatter_gather_list while
CAPSULE_FLAGS_PERSIST_ACROSS_RESET flag is set (which is introduced lately to
align with UEFI specs). Since these flag checks are not implemented in u-boot
properly and corstone1000 does not support scatter_gather_list during capsule
update, this patch will skip the check only for on-disk capsule update.
This will be fixed with new capsule update design.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add an optional env argument to the run_fvp() function, and check that
DISPLAY is preserved.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The __main__ body used the return value of runfvp() as the exit code,
but this was never set.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Don't pass "" as the cwd as that fails, use None so the cwd doesn't get
changed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
add debug.yml to the build command so the debug-tweaks image feature
is enabled
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This is no longer needed as Nanbield uses ttyrun to avoid re-spawning
gettys.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
corstone1000's uboot uses efitools-native from meta-efi-secure-boot, so
add the layer dependency to make this clear.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use IMAGE_CLASSES rather than a direct INHERIT for fvpboot.
This is Yocto best practice as it is used to enable
functionality across all image recipes.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add systemready firmware, systemready ACS, systemready distros, and
fvp-base kas configurations. Update the README file with
instructions on how to build and run using them.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
1. Configure FVP base to allow Arm SystemReady IR ACS console access.
2. Configure FVP base Arm SystemReady IR ACS firmware build.
3. Add the machine-specific report.txt for FVP base.
4. Patch the check-sr-results.yaml and format-sr-results.yaml files
to handle the known differences between FVP base and the
expected ACS functionality.
5. Add a README with instructions of how to use the meta-arm-systemready
layer with fvp-base.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the meta-arm-systemready layer. This provides the infrastructure to
load and run the Arm SystemReady IR ACS v2.0.0 prebuilt image and
analyze the results.
The recipes included are as follows:
1. arm-systemready-firmware: Enables the ARM_SYSTEMREADY_FIRMWARE machine
conf variable to be used to specify which firmware packages to deploy.
2. arm-systemready-ir-acs: Runs the Arm SystemReady IR ACS tests from
the pre-built images and checks the results adhere to the specification.
3. arm-systemready-linux-distros-[debian|opensuse]: Install the distro of
choice from CD/DVD image to target disk image.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Diego Sueiro <diego.sueiro@arm.com>
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Qi Feng <qi.feng@arm.com>
Signed-off-by: Robbie Cao <robbie.cao@arm.com>
Signed-off-by: Tomás González <tomasagustin.gonzalezorlando@arm.com>
Signed-off-by: Vineeth Raveendran <vineeth.raveendran@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
For fvp-base, update the DEFAULT_TEST_SUITES to include
fvp_boot and fvp_devices. This is only the default behaviour;
individual recipes can override this using the TEST_SUITES
variable.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Comments were made after previous optee changes were committed.
Addressing those comments here.
Suggested-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update capsule document procedure and ACS image in user guide.
Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the recipes and patches for OP-TEE 4.0.0. Migrate the 3.22.0
recipe to meta-arm-bsp for corstone1000 and n1sdp.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Updating to the latest version of hafnium. Also, dropping tc patches,
as they are either experimental or a similar feature has been added.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Updates the status of the patches on the trusted-firmware-m for
corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
U-boot mkefitool creates capsule image without packed and byte-aligned structs.
This patch aligns the capsule-update structures and avoids crashes in case of
unaligned pointer access.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Platform-specific capsule-update feature in u-boot does not check the
capsule-update flags properly (as stated in UEFI specs). This patch fixes the
capsule flags checks in u-boot for corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enables on-disk capsule update feature for corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump kernel version to v6.5 and rebased N1SDP kernel PCIe quirk patches top of this new version.
Signed-off-by: Xueliang Zhong <xueliang.zhong@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some FVPs are available as x86-64 and aarch64 binaries, so build target
(qemuarm64) and nativesdk (x86-64) packages for these to verify the
checksums are correct.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that there's a FVP for aarch64, we don't need to pin the CI pipeline
to x86-64.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that the FVP supports both aarch64 and x86-64, this inherit doesn't
need to be conditional.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade to the 11.22.35 release of the FVP.
Also add the aarch64 binaries as these are now available.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Configure grub as the EFI provider and remove the U-boot boot
args.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Configure FVP base to use vexpress_fvp_defconfig as the U-boot machine.
Configure U-boot:
1. Drop the patch to pick the DRAM size from the devicetree since
the FVP now specifies a devicetree.
2. Enable sysreset to reset by PSCI and patch the vexpress U-boot
machine to leave the reset to PSCI in this case.
3. Enable Virtio RNG and patch the U-boot Virtio RNG driver to
workaround an issue with the FVP that results in RNG calls
hanging.
4. Enable the Arm64 CRC-32 instruction by default and remove the now
redundant config setting.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Set the Trusted Firmware devicetree to fvp-base-gicv3-psci-1t. Patch the
devicetree to include: the stdout path for console access, a virtio net
node and a virtio rng node. This is necessary in the case that the
Trusted Firmware devicetree is passed to Linux from U-boot (rather than
sideloading).
Also rename the include file to change the suffix from "fvp" to "fvp-base".
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Merge the common FVP configuration in fvp-common.inc into
fvp-base.conf since that is the only place it is inherited.
Drop setting MACHINE_FEATURES to "optee" because there is no
optee machine feature.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Have separate machine include files rather than multiple
machine-specific settings in the same file.
Signed-off-by: Debbie Martin <Debbie.Martin@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
meta-clang and meta-virtualisation don't yet have nanbield branches, so
we need to use master for those at the moment.
Signed-off-by: Ross Burton <ross.burton@arm.com>
To allow running the TF-A TFTF tests we need to ensure the images for
N1SDP and Corstone-1000 MPS3 boards build
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To allow running of the TF-A tests we need to be able to build the TF-A
test recipe for the N1SDP machine.
Signed-off-by: Drew Reed <Drew.Reed@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change enables N1SDP cache to improve performance
by removing this patch:
HACK-disable-instruction-cache-and-data-cache.patch
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since the original location of OP-TEE in DDR3 observes
a HW issue when cache is enabled, this change moves OP-TEE
to run from DDR4. Patches are added to TF-A to reflect that
change and the used region is also reserved in UEFI (EDK2)
to protect against allocations by UEFI applications.
OP-TEE size is modified for consistency across all patches
to be 32 MB (0x02000000) instead of (0x02008000).
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
the configuration options corresponding to external system are removed
from the kernel and the defconfig is generated with with savedefconfig
bitbake task
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove the External system patches in uboot as they are not upstreamable.
Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This support is for Cassini distro using Corstone-1000 platform.
When running parsec test, it reports an error
`PSA_ERROR_DATA_INVALID (-153)`.
This is related to `ITS_MAX_ASSET_SIZE` configuration which is been
set to 512 on the secure enclave (TF-M), which defines the max asset
size and it overflows when running the parsec tests.
The key is generated, but when it is asked to store via `psa_its_set`
it returns `PSA_ERROR_INVALID_ARGUMENT (-135)`, which then propagates
to `PSA_ERROR_DATA_INVALID (-153)`
Increasing the `ITS_MAX_ASSET_SIZE` to 2048 solves this issue.
Signed-off-by: Vikas Katariya <vikas.katariya@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The terribly named qemutiny test case tries to login to the target over
the serial console. It's designed for poky-tiny, so add it to the tests
we run in poky-tiny builds.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Just execute all tests with the meta-arm tag, instead of hardcoding the
list of tests.
Also run two tests in parallel as there's no reason to limit it to one.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Tag all of the tests in meta-arm so that they can be selectively ran
without needing to explicitly list them.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Patch was accepted upstream and has been pulled back the 6.5 and 6.1
kernels. So, it is no longer needed here.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The v6.4 kernel is needed for some platforms in meta-arm-bsp.
Temporarily add it here to give those machines enough time to
update to the latest version. Also, add the patch to the
defconfig.
Signed-off-by: Jon Mason <jon.mason@arm.com>
When ccache is enabled trusted-firmware-a recipe fails with this
error message:
make: *** No rule to make target 'aarch64-poky-linux-gcc'. Stop.
ccache prefix CC variable with 'ccache' word before compiler. Because
there are no quotes assigned to CC, only 'ccache' is assigned. The
compiler becomes a make target, producing the build error.
Add single quotes to LD is a good measure to prevent this kind of error.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Multiple machines in meta-arm-bsp have need of the 2023.07.02 version of
u-boot. Temporarily add it here to give those machines enough time to
update to the latest version.
NOTE: MTD changes in u-boot require changes to the qemuarm config.
Specifically, not disabling it.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enables authenticated capsule update and makes necessary changes to
align with new capsule generation tool (mkeficapsule in u-boot).
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds signature to device-tree overlay and enables authenticated capsule
update in u-boot for corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds meta-secure-core to enable capsule update feature.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds meta-secure-core to corstone1000.yml to enable signed capsule
update feature.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Meta-secure-core is used to create signed capsule (firmware update
images). This adds meta-secure-core.yml file and since it depends on meta-perl
from oe-core, it adds that layer to meta-openembedded.yml
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Kas binary is identical, but the container has been rebuilt using
Debian 12 (Bookworm).
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The Kas container in version 4 onwards is based on Debian 12, which
forbids pip from installing files into /usr or ~/.local/.
We want to install the arbitrary dependencies for the documentation
build, so these should be installed in a venv.
The kas container doesn't currently install python3-venv, so we have to
install that manually (patch sent upstream).
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade nanopb, clean up how it is build, and hopefully fix the build
races. This patch isn't quite ready to be upstreamed but discussion
with the TS maintainer is ongoing.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that the apply_local_src_patches class supports being used with
multiple directories, use that instead of reimplementing the logic.
Also remove redundant patchdir assignments as these patches are against
the trusted-services repository, which is ${S}. I suspect these are
exposing a subtle bug in the core patching logic which meant the local
patches were not applying correctly.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This test needs the TF-A sources available to build. When the test is
needed, this commit can be reverted to bring it back.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This recipe won't pass configure without the jsonschema and jinja2
Python modules.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As with ts-service-test, manually move the binary to $bindir.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The configure log warns that it couldn't find pkgconfig, so add this so
it can.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Pass through the choice of CMake Generator when starting sub-cmakes for
the external components, so that they use Ninja instead of Make.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Pull out the patch application logic so the postfunc by default scans
for patches in LOCAL_SRC_PATCHES_INPUT_DIR and applies them to
LOCAL_SRC_PATCHES_DEST_DIR as before.
This allows recipes to inherit the class and directly call
apply_local_src_patches as needed to process patches in multiple
directories.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The fvp-baser-aemv8r64 machine will not be actively maintained.
Signed-off-by: Divin Raj <divin.raj@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove U-Boot specific DT nodes before passing the DT to Linux
This is needed to pass SystemReady IR 2.0 dt-schema tests
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The optee recipe installs the tee image using `${nonarch_base_libdir}`
If usrmerge is enabled this is `/usr/lib`, otherwise it is `/lib`
Several platforms (corstone1000, n1sdp, tc) look for tee-pager_v2.bin in
the hard-coded `/lib/firmware`, hence if usrmerge is enabled it won't be
found.
Fix these platforms by using `${nonarch_base_libdir}` instead of `/lib`
as per the qemu platform code in the generic recipe.
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump kernel version to v6.4 and rebase the patches on
top of this new version.
Signed-off-by: Xueliang Zhong <xueliang.zhong@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TFM updated to 1.8.1. Note, TF-Mv1.8.1 tags point to the same SHA as
the TF-Mv1.8.0 tag for tf-m-tests and tf-m-extras.
Signed-off-by: Jon Mason <jon.mason@arm.com>
tee and teeclnt are there to avoid running client applications (CAs) and
tee-supplicant as root.
- The teeclnt group stands for "TEE client" and is for CAs (CAs need
access to /dev/tee[0-9]* but not /dev/teepriv[0-9]*).
- tee is just for tee-supplicant to open its device /dev/teepriv[0-9]*.
No other process is supposed to open that one.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Rationalise the port forwarding to be the same as the runqemu defaults,
so change the SSH port forward to be 2222=22 instead of 8022=22.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
QEMU_USE_SLIRP is no longer needed[1] as adding slirp to
TEST_RUNQEMUPARAMS is sufficient, so remove that.
Setting TEST_SERVER_IP also isn't needed as there's a default value now,
and we disable the package management tests that would use the server
IP. When they work the correct IP can be set.
[1] As of oe-core f4e8650
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest versions of edk2 and edk2-platforms. This
necessitates updating the patches in sbsa-acs to apply cleanly to the
latest version of edk2.
Signed-off-by: Jon Mason <jon.mason@arm.com>
It's expected to exist multiple /dev/teepriv[0-9]* devices, and the
tee-supplicant service depends on them, which should be activated only
when the device is detected by the kernel using a udev rule.
Improve commit f02d065dce, where it's only considering a path creation
and not a device detection by the kernel.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The update-repos script currently exits immediately if one of the
underlying Git commands fails (e.g. because of a network issue). If the
repo already exists, then catch this error inside the loop and
carrying on attempting to update other repos, as the network error may
be upstream.
KAS_REPO_REF_DIR is ultimately an optimization and subsequent build
stages should be able to continue if one of the updates fail. Therefore,
ensure the script returns a special error code if at least of the Git
commands fail, and use this to set the allow_failure property of the
job.
If a repo does not exist, fail immediately as before.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To make the pipeline slightly more resilient to external networking
issues, allow a local container registry mirror to be specified in the
GitLab settings. If not specified, the upstream container registry is
used automatically.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since optee-os for N1SDP has been updated to 3.22,
this patch updates optee-os-tadevkit and optee-test
to match the same version.
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump kernel version to v6.4 and rebased N1SDP kernel PCIe quirk patches
top of this new version.
Signed-off-by: Xueliang Zhong <xueliang.zhong@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The default XSERVER only pulls in the framebuffer driver, which is
pretty broken with modern kernels and the modesetting driver is a lot
more functional.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The sbsa-ref machine can't use KVM because it's an entire emulated
machine, not a virtual machine.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The consoles to use isn't specific to the qemu machine, and without a
value results in no serial consoles when running on real hardware under
sysvinit.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Patches (and recipe support) were added for qemuarm64-secureboot
support, but that is not present in meta-arm-bsp. Remove it.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Without /dev/teepriv[0-9]*, tee-supplicant.service will fail. Prevent
a failure with a condition to check if /dev/teepriv[0-9]* path exists.
Signed-off-by: Javier Tia <javier.tia@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
ARM Reference Solutions' N1SDP 2023.06.22 manifest
uses edk2-firmware version 202305. This patch
aligns with the manifest.
The RemoteDdrSize cast patch is now upstreamed,
hence removed from the patches list
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Enables the support of a second mmc card, which enables distro installation.
Signed-off-by: Delane Brandy <delane.brandy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Build a custom N1SDP image with only optee-xtests as part of the image. A fresh custom image build is necessary to include the relevant test suite for running the xtests.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the config needed to run the embedded tests with pseudo trusted application. Without this config, the optee-xtests with pseudo TA get skipped with “skip test, pseudo TA not found” message.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Clean up various patches by
* Create email headers for those not present using the s-o-b as author and date
applied to the tree as the patch date
* regenerating the patch name via git rebase and format-patch
* replacing patch with backported version
* moving patch location to be more accurate
Signed-off-by: Jon Mason <jon.mason@arm.com>
Rebase the corstone500 u-boot patches to 2023.07.02. Some defined
variables changed names, and had to be updated.
Signed-off-by: Jon Mason <jon.mason@arm.com>
As of oe-core a8e7b0f, PV doesn't need to contain SRCPV explicitly as
base.bbclass will append it to PKGV if there is a + in the version. So,
remove the redundant assignments.
Also change the boot-wrapper-aarch64 PV to 0+git as it's possible that
some point they'll tag a release and we want to be able to upgrade to it.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
u-boot patches rebase cleanly to u-boot v2023.01. Update to that and
get rid of the legacy version of u-boot that existed only for this
machine.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Updates optee-os and aligns with changes in v3.22 for Corstone-1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
With 6.1.46, the gimple patch has been backported as part of the
release, and is no longer needed as a patch applied here.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update hafnium to v2.8, which allows updating tc1 to that version and
remove the intermediate SHA. It also allows for the removal of some
backported patches.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Updates trusted-firmware-a and aligns with changes in v2.9 for Corstone-1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update TF-A version for N1SDP to align with
N1SDP 2023.06.22 manifest
Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use the patch that Mikko Rapeli is trying to upstream to work around the
Nuvoton defconfig issue instead of reverting the patch that added the
platform to the kernel.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The scp-firmware version in the Arm Reference Solutions N1SDP-2023.06.22 Release has now updated to a beta version beyond v2.12.
Add the SHA override for N1SDP to align to scp-firmware version used in the release.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add new Corstone-1000 firmware GUID and remove previous u-boot GUID to be updated into ESRT table.
SR-IR 2.0 requires the capsule GUID to be unique.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add new Corstone-1000 firmware GUID and remove previous u-boot GUID to be updated into ESRT table.
SR-IR 2.0 requires the capsule GUID to be unique.
Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the trusted-firmware-a recipes to 2.9.0
Moving legacy recipes (2.8) for tc1 and corestone1000 to meta-arm-bsp
Signed-off-by: Jon Mason <jon.mason@arm.com>
use filesize environment variable to read the size of the unzipped initramfs bundle
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If a user does eg "kas shell kas/corstone1000-base.yml" and then calls
runfvp, the spawned xterms don't have a valid DISPLAY set.
Add DISPLAY to the preserved environment variables and DISPLAY will be
passed into the shell, and the xterms will start correctly.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add kernel configuration necessary to build an image with preempt-rt
support for generic-arm64.
And tweak kernel configuration for preempt-rt kernel.
Signed-off-by: Robbie Cao <robbie.cao@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
202211 is only used in meta-arm-bsp, and all other users should be using
the latest version. Move it there until n1sdp can be updated to the
latest.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add back the 11.2 release of GCC, because TF-M has code generation
problems with 11.3 onwards.
This recipe has the major version embedded in the recipe name so that it
has to be specifically asked for in a per-recipe basis.
Signed-off-by: Ross Burton <ross.burton@arm.com>
So that it's obvious which version of GCC is being used, install the
files into a versioned directory under $libexecdir.
Signed-off-by: Ross Burton <ross.burton@arm.com>
This was added to build an Android Common Kernel with the Android
compiler, but we don't need to build that anymore.
Signed-off-by: Ross Burton <ross.burton@arm.com>
The unzipped kernel size increased due to recent changes in oe master.
Since corstone1000 sets a fixed kernel size, this should be increased to
boot the platform correctly.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
The physical memory which is used to run OP-TEE on the N1SDP is known
to the secure world via TOS_FW_CONFIG, but it may not be known to the
normal world.
As a precaution, explicitly reserve this memory via NT_FW_CONFIG to
prevent the normal world from using it. This is not required on most
platforms as the Trusted OS is run from secure RAM.
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The upstream u-boot recipe did a minor version update, which is causing
a "preferred version not available" warning. Add a '%' to resolve this
issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Temporary workaround for a number binaries in the toolchains that are
using 32bit timer API. This must be done in the CI yml file instead of
the recipe because of all the libraries in the toolchain have the issue.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Pre-populate the standard values of get-binary-toolchains so that it
will work without variables in a standard kas container. This will aid
in ease-of-use for development and testing of binary toolchains.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Port Corstone-1000 patches to U-Boot v2023.07
Include the latest FF-A patchset sent to the mailing list (v15).
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
add SMCCC_ARCH_FEATURES discovery
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Upstream-Status: Inappropriate [A U-Boot patch will be released to fix an issue in the PSCI driver]
Signed-off-by: Jon Mason <jon.mason@arm.com>
Move the 3 patches only needed by the 6.1 kernel into a unique bbappend
The defconfig changes cannot be moved into a config fragment because
they only exist in the defconfig file (because the patches that
integrated their functionality into the kernel were not merged).
Signed-off-by: Jon Mason <jon.mason@arm.com>
The optee-os.inc was including patches which really should've been in
the versioned .bb file. Move those references there and update the
FILESEXTRAPATHS to be more intelligent. While there, rebase the files
via devtool and update the file names as necessary.
Also, remove unreferenced patches.
Signed-off-by: Jon Mason <jon.mason@arm.com>
1- Replace FVP_BASE_R_ARM_EULA_ACCEPT with ARM_FVP_EULA_ACCEPT
in fvp-baser-aemv8r64.md
2- Add instructions to corstone1000/user-guide.rst to set
ARM_FVP_EULA_ACCEPT to "1".
Signed-off-by: Ziad Elhanafy <ziad.elhanafy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
1- Add fvp-eula.yml file which introduces ARM_FVP_EULA_ACCEPT
environment variable
2- Remove any license related settings from fvp-baser-aemv8r64-bsp.yml,
corstone500.yml and corstone1000-fvp.yml
Signed-off-by: Ziad Elhanafy <ziad.elhanafy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Set the FVP EULA environment variable details message
to request the user to accept the EULA in case it has
not been accepted.
Signed-off-by: Ziad Elhanafy <Ziad.Elhanafy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The following error is seen:
ERROR: Nothing PROVIDES 'llvm-native' (but virtual:native:/builds/jonmason00/meta-arm/work/build/../poky/meta/recipes-graphics/mesa/mesa_23.1.3.bb DEPENDS on or otherwise requires it). Close matches:
ovmf-native
rust-llvm-native
vim-native
Work around this by using the llvm-native from meta-clang
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream change 26d97acc71379ab6702fa54a23b6542a3f51779c changed the
IMAGE_LINK_NAME to have IMAGE_NAME_SUFFIX and breaks the automatic
finding of the image by name. Work around here until upstream fix can
be added.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove IMAGE_NAME_SUFFIX from image path in
wic_nopt.bblass
Signed-off-by: Ziad Elhanafy <ziad.elhanafy@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The fvp_devices test suite can be used to verify the following
functionality at runtime, common to most FVPs:
* CPU hotplug
* virtio-net device presence and functionality
* virtio-rng device presence and functionality
* PL031 RTC device presence and functionality
* SP805 watchdog device presence
The list of devices to be tested can be configured by a BSP using the
variable TEST_FVP_DEVICES.
Add this test suite for fvp-base and fvp-baser-aemv8r64.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The linuxboot test case is already FVP-specific due to the use of the
OEFVPTarget pexpect interface. Clarify this by renaming to fvp_boot.
So that fvp_boot can be used alongside other OEQA test cases (e.g. those
in OE-core):
* Call self.target.transition("off") at the start of the test to
ensure the model starts from reset
* Call self.target.transition("linux") to reuse the "wait for boot"
logic in OEFVPTarget.
Additionally, minimally validate the firmware boot by checking for
common error patterns in all console logs. Expose the runfvp config in
OEFVPTarget to support this.
Align the list of test cases executed on both fvp-base and
fvp-baser-aemv8r64 by using TEST_CASES:append = " fvp_boot" for both.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To better support firmware testing alongside Linux runtime testing,
introduce model state support to OEFVPTarget. The following states are
supported using self.target.transition(state):
* off
* on
* linux
Instead of assuming a specific state in OEFVPTarget.start,
responsibility is delegated to test cases to lazily put the model in
the required state. But to support OE-core test cases, OEFVPTarget.run
automatically puts the model in the "linux" state for running the
command. Firmware and Linux tests can subsequently run alongside each
other without introducing complex test dependencies.
The concept is inspired by Labgrid strategies [1], albeit simplified.
Tweak log file handling so that output is collected across (possibly)
multiple model processes.
[1] https://labgrid.readthedocs.io/en/latest/overview.html#strategies
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The differences between OEFVPTarget, OEFVPSSHTarget and
OEFVPSerialTarget are not obvious and there is a lot of duplication.
Merge all the logic into one OEFVPTarget (again). This has the following
features:
* Run SSH commands
* Run serial console assertions
* Lazily await a Linux login prompt while running test cases (only when
self.target.run is called).
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Using runfvp without explicitly specifying the fvpconf path currently
fails due to a missing fvp.conffile include.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of OP-TEE, and move the legacy versions
that are still in use by meta-arm-bsp to that directory
Signed-off-by: Jon Mason <jon.mason@arm.com>
By default, optee-test is using an ancient version of openssl (1.2.0o)
in binary form, located in the optee-test build tree. musl is already
working around this. So, use those defaults for everyone.
Signed-off-by: Jon Mason <jon.mason@arm.com>
scp-firmware passes -I/core/include to the compiler which doesn't exist,
and sometimes gcc emits a fatal error. It's unclear why this doesn't
happen for everyone, but this workaround appears to be the correct
solution.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
SCP_COMPILER isn't used anymore, so remove it.
Explicitly set SCP_TOOLCHAIN=GNU for clarity.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that this defaults to MACHINE, explicit SCP_PLATFORM assignments can
be removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Many platform names are the same as the machine name, so this saves
some typing.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
It is more difficult to update optee recipes to bleeding edge
3.21 when patches are added to SRC_URI via :append and thus they
need to be explicitly removed with :remove and name of the patch file.
For our boards we know 3.21 will work without patches but we still want
to keep using meta-arm side base recipe and just update the SRC_URI
to remove patches and update SRCREV and PV.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This tool makes it easy to lock a build to a known good configuration,
for example by locking the SHAs to the last good build of master.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
In the update-repos job, generate a Kas lock file to pin the SHAs of the
repositories being build during the build. This ensures that commits to
the repositories _during_ the build doesn't cause differing builds. All
of the kas calls use this lock file to ensure that their builds are
identical.
This lockfile is also added to the artifacts, so that it can be reused
afterwards to replicate the build: either as a known good base or to
replicate failures.
This lock file is only generated if it doesn't exist, so that
development branches can temporarily add a lockfile.yml if for example
master is too unstable to develop on.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Kas 3.3 uses branch and commit keys instead of a general-purpose
refspec. Change the base to use branch:mickledore and remove the
explicit use of master for meta-virtualization now that a mickledore
branch exists there too now.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Kas 3.3 has the following new features:
- kas: Introduce commit and branch as alternative to refspec key
- kas: Warn if a repo uses legacy refspec
- kas: add support for lock files via dump plugin
- kas: track root repo dir config files of menu plugin
- kas: add support for --log-level argument
- kas: add GIT_CREDENTIAL_USEHTTPPATH environment variable
- kas: improve error reporting
- kas: drop support for Python 3.5
- kas-container: fix invocations with --isar for some layers
- kas-container: Purge tmp* on clean
- kas-container: enable colored logging
4.0 is basically the same but the Kas container uses Debian 12, which is
not yet supported as a tested platform. Until Debian 12 is tested we
should continue to use 3.3.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This will still emit the diagnostic but it wont break the build,
additionally pass it to CXXFLAGS since thats the right subset to
disable it for.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Same as for OP-TEE client, this eases debugging and is required to use
the OP-TEE symbolize.py script.
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The TA builds always create ELF files, add them to the deploy dir to
ease debugging via the OP-TEE symbolize.py script.
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The optee-os compilation provides not only the core files, TAs are also
usually build. Create a separate package which contains them, so they
can be installed.
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-A version 2.8.6 hangs on boot for corstone1000 non-deterministically.
This sets TF-A version to v2.8.0 which is a tested working version for
corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds missing update service definitions for using stateless platform
services and initializes the capsule udpate provider in se-proxy-sp
for corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds missing compilation option to fix psa_raw_key_aggrement test for
corstone1000.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
From: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
These 2 patches causes the secure world to enter into an infinite loop
when the PSA arch tests are triggered. This is a temporary fix and the
issue needs to be investigated before the patches can be enabled.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch is required to handle one of the corner cases of the
GetNextVariableName EFI service as specified in the UEFI spec.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
From: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
This patch adds the required configs to the corstone1000 u-boot
defconfig to enable the EFI services. This is done to fix the SCT
failure reported by the SetTime_Conf and SetTime_Func.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
From: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
The patch fixes the ACS InstallMultipleProtocolInterfaces_Conf failures
in corstone1000 platform by dropping a workaround u-boot patch. The NVMXIP
initialization had some issues during u-boot boot stage which led to the
workaround patch.
Upstream-Status: Pending [Not submitted to upstream yet]
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
It's useful to have known good logs when debugging problems, so always
preserve the logs.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The previous commit fixed the build of GN with GCC 13, but broke it for
any other version.
Remove the patch and simply disable the fatal warning that causes the
breakage. Interestingly, this warning is already disabled for Windows
builds.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
EXTERNAL_TOOLCHAIN variable should provide absolute path to external Arm
toolchain install directory. So make that absolute path check explicit.
Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
CFG_MAP_EXT_DT_SECURE=y should be set per platform, as it requires CFG_DT=y
to also be set, which is not the case for all the platforms out there using
optee-os. Moreover CFG_MAP_EXT_DT_SECURE is already being set conditionally
in optee-os-ts.
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Signed-off-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This recipe is a rebuild from source of the Arm GCC release, with
patches from oe-core added to make it work well in our environment.
Most people are happy with the GCC in oe-core, and this release is often
behind: at the time of writing oe-core has mainline GCC 13.1, but Arm
GCC is 12.2. Users who actually want the improvements in Arm GCC will
likely want to use the binary toolchain so that they can have support
from Arm, and they're welcome to do so via the "external-arm" binary
toolchain.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are not any alternatives for the virtual/arm-non-eabi-gcc provider,
so just use the real recipe name.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The binary Arm compiler is based on GCC 12. Remove this GCC 13-specific
option until the next release.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This recipe uses the binary Arm compiler, which is based on GCC 12.
Remove this GCC 13-specific option until the next release.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This recipe uses the binary Arm compiler, which is based on GCC 12.
Remove this GCC 13-specific option until the next release.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Change from using a patched, intermediate SHA to the latest.
Unfortunately, the latest stable mbedtls doesn't boot on tc1.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update TF-A and fiptool (which is part of tf-a) to the latest stable version.
Also, use the tf-a tests lts branch (which is still at version 2.8.0).
Signed-off-by: Jon Mason <jon.mason@arm.com>
gcc-arm-none-eabi and gcc-aarch64-none-elf both fails when packaged as
RPM for sdk with
nothing provides libcrypt.so.1()(64bit) needed by nativesdk-gcc-arm-none-eabi-12.2.rel1-r0.x86_64_nativesdk
As we don't control the dependencies for prebuilt libraries we create a
workaround by skipping the FILEDEPS
Signed-off-by: Claus Stovgaard <claus.stovgaard@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-A has LTS releases, which are prefixed with lts- for some reason.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add a link to the FVP EULA in LICENSE_FLAGS_DETAILS, so the user has
some context as to what they're agreeing to upfront.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
armcompiler was removed from meta-arm-toolchain (24c4cfa) so this isn't
needed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Even though corstone1000 platform does not support the entire PSCI APIs, it
relys on PSCI reset interface for system reset. The name of this config
changed in the new version of u-boot. This enables PSCI reset, so
the system can be resetted in u-boot again.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Split trusted-services.xml into qemuarm64-secureboot-ts.yml and
n1sdp-ts.yml as collection of Trusted Services which can be tested on
each platform has diverged.
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make sure we setup the new variable for the configuration
of the SE-Proxy service for our machine. This will trigger
the right configuration building trusted services and all
psa-arch test pass as before.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update Trusted Services and backport an OP-TEE update which allows
interrupting the SPs by NWd interrupts. This solves the kernel stall
problems which are due to long cryptographic operations being executed
in the SWd.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The nanopb build step randomly fails in the yocto CI due to a race condition.
This change adds a patch file to disable parallel build for nanopb. This is a
temporary workaround and a proper fix will be up-streamed int he future.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Patch related with the changes to support the in/out_vec modifications
in TF-M v1.7 was merged in upstream trusted-services integration branch.
So, drop this 3 out of tree patches not needed to be applied any more.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-A v2.8 does not support measured boot and FF-A which is mandatory for
PSA Initial Attestation SP to work correctly.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add information related to SPMC tests and fix stale links.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove already merged patches in trusted services integration
branch to avoid clash during apply patch stage and rebase the
remaining patches.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Run the ffa_spmc test group of xtest if the optee-spmc-test machine
feature is enabled.
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add ta-devkit and optee-test. Change configuration to enable building
and deploying OP-TEE SPMC tests.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The ABI used by the arm-ffa-user driver to call into the SWd changed.
The change was driven by the MM over FF-A ABI implementation which is
used by SmmGW SP and uefi-test. uefi-test uses the same arm-ffa-user
driver as xtest hence xtest needs to be updated to use the new driver.
This xtest change is already merged up-stream but after v3.20, which is
used here.
This change adds backported xtest changes as carried patches.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change:
- cherry-picks TF-A changes from master which implement passing
TOS_FW_CONFIG DTB from the FIP package to the trusted OS.
- add an OP-TEE SPMC specific SPMC manifest file
- configures TF-A to build the manifest, add it to the FIP package
and pass it to OP-TEE as a boot argument.
This functionality needs matching changes in OPTEE (OP-TEE v3.21
or v3.20 + carried patches.)
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
OP-TEE SPMC v3.20 and TF-A v2.8 is incompatible on qemu, and OP-TEE
panics during boot because having an SPMC manifest passed to the SPMC is
mandatory since v3.20. TF-A and OP-TEE upstream already fixed this issue
by modifying the ABI between the SPMD and SPMC. Moreover qemu support in
TF-A has been extended to allow building an SPMC manifest DTS file, and
loading it from the FIP package.
This change adds the needed OP-TEE fixes as carried patches. The TF-A
change will be added in the next commit.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Split tests to groups, and enable groups based on machine features set.
This allows limiting tests to testing deployed SPs only.
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To enable up-to date version of Trusted Services op-tee v3.20 or newer
is needed.
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change updates to latest available version of Trusted Services.
List of changes:
- adapt SP recipes to file structure changes and support for
"configurations". In TS each SP can be built in various different
setups to allow adapting to platform and integration specific
differences.
- MbedTLS dependency has been updated to v3.3.0.
- This needs new python dependencies are required in the build
environment.
- psa-acs was updated to a matching version.
- do_patch() has been updated to support the MbedTLS patch added
in TS.
- Update TS dependency patching method to use git instead of patch.
- Downgrade nanopb to match up-stream dependency version.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Gyorgy Szing <Gyorgy.Szing@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Issue when building the kernel on FVP (and probably all aarch64
platforms) with GCC 13 on the 6.1 kernel (and possibly others).
Backport the upstream fix.
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are cases where a developer might want to enable things, like
debug-tweaks, which are useful in their testing but not something we
would want in a production environment. Create a file where these can
be added without affecting other things.
Signed-off-by: Jon Mason <jon.mason@arm.com>
virtual/arm-none-eabi-gcc-native is still at version 12 which
doesn't support it. poky comes with gcc 13 already.
Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add musl testing to have qemuarm-secureboot match qemuarm64-secureboot.
Since the Arm GCC binary toolchain cannot work with musl, move that out
into it's own testing.
Signed-off-by: Jon Mason <jon.mason@arm.com>
debug-tweaks is useful in testing and internal usage, but is a massive
security hole (as it allow password-less root login). Remove the
default enablement on machine files and in kas base yml.
Signed-off-by: Jon Mason <jon.mason@arm.com>
It is only necessary to accept the FVP usage license when using FVPs.
So, move that to the fvp.yml file from the base.yml file to make things
a little cleaner.
Signed-off-by: Jon Mason <jon.mason@arm.com>
The fvp-base machine only has minimal patches, so should be good to
always track the latest release of u-boot.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Using absolute path in fvpconf will leak the host machine path.
This is a bit annoying when the builder and the runner doesn't use
the same filepath hierachy.
Switch to relative path instead of absolute.
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
In Order to be able to have filepath relative to fvpconf, execute the
fvp process in the same working directory.
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
At the moment the config is load and pass to FVPRunner.
Change the ownership to FVPRunner.
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We access the dictionnary element that doesn't exist.
Use the get() method instead that will default the element to None if it
doesn't exist.
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
When running an FVP machine the model executable need to be found
in the PATH environement.
At the moment the script doesn't provide any PATH to the subprocess.
Add PATH to the allowed environement variable to be forwaded.
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
It fixes and limits the partition size to fix capsule update feature
after the GPT changes.
The partitions in the second bank needs to have correct size and
the partitions in first bank should have a fixed size since corstone1000 does
not support partial update and has a limited flash to support variable size.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch aligns capsule update feature in tfm with GPT/BL1 changes.
Adjusts BL2 flash and data size and adds missing CRC checks.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Remove log messages, that would never show up, but clean that
mess. And fix the env script and config so that trigger the
load of kernel from reading the gpt.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The signed kernel image for the android kernel and legacy u-boot is no
longer booting. Remove this to allow for it to work until it can be
fixed.
Signed-off-by: Jon Mason <jon.mason@arm.com>
N1SDP master has now updated to TF-A v2.8.0 so we should do the same.
Remove the SHA override for the N1SDP
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enabling new features on tfm for corstone1000 increases the number of
ITS and PS assets needed. This patch increases the number of PS and ITS
assets and fixes regression on psa-ps-api-tests.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Installing SMM Gateway SP on the N1SDP may stop the platform from booting
for on-device testing in CI.
In n1sdp.yml, remove `ts-smm-gateway` if it has been added
Keep `ts-smm-gateway` in default SP set so it can still be tested with
`qemu-secureboot`
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some platforms install .elf files, so put those into the -dbg package.
This means expanding the buildpaths QA exclusion.
Whilst here, expand the comments for the other INSANE_SKIP statements.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We don't need to unset CFLAGS and LDFLAGS as the CMake file doesn't
respect them anyway.
Add CC to the unexport list for completeness, at least one of these is
needed for now as the build fails without the unexports.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Some machines use components from tf-m-extras, so fetch that too.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add tc1 ecosystem FVP and bits to enable in the tc1 machine config file
Also, do some hacks to speed things up.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Recent changes in upstream u-boot recipes for signed fitimages, have
caused the existing code to no longer boot. Add a newly required
variable to get it working again. Tested using tc1 FVP.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Adds OTP config to run the FVP with the new BL1 changes
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Integrates TF-M BL1 into corstone1000 platform. This needs a large
changeset since it changes how TF-M builds and packs the bl1 image.
It also adds changes to make the new BL1 compatible with GPT parser
changes. And finally it bumps to SHA to include necessary changes and fixes
on TFM master and removes already upstreamed GPT patches.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-M has out-of-tree patches on external projects such as mbedtls and
qcbor. This needs to be applied in an orderly fashion to build TF-M and
other TF-M related binaries correctly.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
SCP-firmware may build components other than the SCP and MCP. Make the
MCP branch of the do_install task more generic to suport this.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The upstream official N1SDP software currently supports edk2-firmware
202211 version. This patch is to align N1SDP Yocto build with upstream
N1SDP software.
Signed-off-by: Xueliang Zhong <xueliang.zhong@arm.com>
optee-os-tadevkit is a variant of optee-os recipe to install TA devkit.
Even though it may not need local build patches, it re-uses SRC_URI and
FILESPATH from corresponding optee-os recipe. This was mistakenly added
in b061104c87.
Signed-off-by: Denys Dmytriyenko <denis@denix.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Our machines have moved to 2.11 so we can remove the 2.10 recipe.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Thanks to Xueliang Zhong for testing that this works on N1SDP.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The install task is subtly different as the ELF binaries are named .elf
now, instead of having no extension.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that we moved in corstone1000 to use a gpt and partitions for
the wic image and flash layout. Setup TF-m to set/get FWU and
Private metadata using the partition information (start and size)
stored in the gpt table instead of fixed flash offsets as before.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As optee-os for the N1SDP has been updated to 3.20 we need to do the
same for optee-os-tavdekit. Otherwise errors will be seen if/when
optee-os-tavdekit is built.
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This config fragment was needed to get the dev kernel working. Since it
in now allowed to fail, it is no longer necessary (and doesn't appear to
be an issue).
Signed-off-by: Jon Mason <jon.mason@arm.com>
The dev kernel can frequently fail, and is not anything that is used in
production. Allow failure to prevent CI issues but still notify that
there are potential issues.
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch adds optee-os 3.20 support on N1SDP, the optee-os 3.20
bbappend file is also added.
Signed-off-by: Xueliang Zhong <xueliang.zhong@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
meta-clang's clang recipe has an irritating interaction with oe-core's
llvm recipe which can result in build warnings, which cause builds to
fail in our pedantic CI.
The current best known workaround is to simply mask out the llvm recipes
if clang is being used.
For more details, see https://github.com/kraj/meta-clang/pull/766.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Instead of a SCP_BUILD_RELEASE boolean, add CMAKE_BUILD_TYPE and default
to RelWithDebInfo which gives us release (optimised) builds with debug
symbols in the matching .elf files.
To ensure that buildpaths don't leak into the debug symbols, pass the
debug prefix maps via CFLAGS and ASMFLAGS.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The text relocations appear to have been fixed and this skip is no
longer needed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We want compile logs to be useful, so enable verbose logs to show what
commands are being invoked.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
For some reason the shell functions are indented an extra character,
reindent to standard four spaces.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Introduce the use of a gpt partition type layout, and use
the firmware metadata as source of the current boot bank
to boot from in the different boot stages.
This needs to be a large changeset, since it touches a lot
of software components to guarantee that everything works
in an atomic way, to not break the build and/or the boot flow
of the corstone1000 platform.
fdisk -o Start,End,Sectors,Size,Type-UUID,Attrs,Name,UUID -l tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.wic
Disk build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.wic: 32 MiB, 33554432 bytes, 65536 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 5BFC084A-9B95-4024-B60B-9748F5332524
Start End Sectors Size Type-UUID Attrs Name UUID
34 39 6 3K EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 reserved_1 B1F2FC8C-A7A3-4485-87CB-16961B8847D7
40 47 8 4K 8A7A84A0-8387-40F6-AB41-A8B9A5A60D23 FWU-Metadata 3FDFFEE1-3223-4C6B-80F9-B0E7D780C21D
48 55 8 4K 8A7A84A0-8387-40F6-AB41-A8B9A5A60D23 Bkup-FWU-Metadata B3068316-5351-4998-823A-3A7B09133EC1
56 63 8 4K ECB55DC3-8AB7-4A84-AB56-EB0A9974DB42 private_metadata_replica_2 3CC3B456-DEC8-4CE3-BC5C-965483CE4828
64 71 8 4K ECB55DC3-8AB7-4A84-AB56-EB0A9974DB42 private_metadata_replica_2 DCE9C503-8DFD-4DCB-8889-647E49641552
72 271 200 100K 64BD8ADB-02C0-4819-8688-03AB4CAB0ED9 bl2_primary 9A3A8FBF-55EF-439C-80C9-A3F728033929
272 1023 752 376K D763C27F-07F6-4FF0-B2F3-060CB465CD4E tfm_primary 07F9616C-1233-439C-ACBA-72D75421BF70
1024 5119 4096 2M B5EB19BD-CF56-45E8-ABA7-7ADB228FFEA7 FIP_A B9C7AC9D-40FF-4675-956B-EEF4DE9DF1C5
5120 15199 10080 4.9M 8197561D-6124-46FC-921E-141CC5745B05 kernel_primary BF7A6142-0662-47FD-9434-6A8811980816
32784 32983 200 100K 64BD8ADB-02C0-4819-8688-03AB4CAB0ED9 bl2_secondary 3F0C49A4-48B7-4D1E-AF59-3E4A3CE1BA9F
32984 32991 8 4K D763C27F-07F6-4FF0-B2F3-060CB465CD4E tfm_secondary 009A6A12-64A6-4F0F-9882-57CD79A34A3D
32992 32999 8 4K B5EB19BD-CF56-45E8-ABA7-7ADB228FFEA7 FIP_B 9424E370-7BC9-43BB-8C23-71EE645E1273
33000 33007 8 4K 8197561D-6124-46FC-921E-141CC5745B05 kernel_secondary A2698A91-F9B1-4629-9188-94E4520808F8
65496 65501 6 3K EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 reserved_2 CCB18569-C0BA-42E0-A429-FE1DC862D660
Add new nvmxip qspi block storage device to u-boot and
the plumbing to boot using the fwu_metadata and gpt
partition information.
Make sure that fwu and fwu-backup have the correct, as defined
in spec, partition type. That will make SW pieces in the stack
identify it correctly.
Update the fvp config to use the new wic image with the gpt scheme
Depends on metadata to decide boot bank in TFA, TFM and u-boot
Using Reading partitions (GPT scheme)
changes needed:
- Rename FIP partition in wic image as defined in TF-A to FIP_A,FIP_B
- Rename metadata partitions to FWU_Metadata and Bkup-FWU-Metadata
- Enable support for GPT and PSA_FWU in TF-A
arm-bsp/corstone-1000: TF-M patch to calculate fwu metadata crc32
It's necessary to calculate the metadata crc for TF-A and U-boot
verify the metadata.
and at last remove the wic.nopt (wic no partition) as target fstype
since we now use the partitions.
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Satish Kumar <satish.kumar01@arm.com>
Signed-off-by: Mohamed Omar Asaker <mohamed.omarasaker@arm.com>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump the preferred corstone1000 to v3.20, drop patch
that is already included in this version.
Create the 3.20 bbappend and remove the entry in 3.18 bbappend.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Poky commit 9ef8cbcdfc85c3ce2ca52d8bee2ab6929f589383 updates
the kernel to 6.1.20 which breaks the PCI quirk patch for the N1SDP.
This change fixes it.
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
If the repository reference directory gets corrupted it's not easy to
wipe it, so add a variable CI_CLEAN_REPOS that if set in the pipeline
will clean the clones and re-fetch them.
Also, stop the fetch from detaching during the garbage collection, just
in case it was a long-running GC that got killed that caused the
corruption in the first place.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Manually check every patch that was marked as Pending and update the
patches which are actually backports.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The infrastructure for edk2 and fvp-base is already present, but not
being used. Make the changes to get it compiling cleanly, and add it to
CI.
Note: testing is not passing because edk2 isn't booting an image
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of EDK2. There is an issue with memory not
being initialized and hanging boot. So revert the patch that is causing
the issue until the proper solution can be found.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version and regenerate the patches via devtool.
This causes some patch renumeration to occur, which causes some other
modifications.
Signed-off-by: Jon Mason <jon.mason@arm.com>
optee-os-3_19.inc duplicates optee-os.inc. Remove that and cleanup
the fallout. Also, remove unused 3.19 bbappend
Signed-off-by: Jon Mason <jon.mason@arm.com>
With the removal of fvp-base-arm32, we no longer have test coverage for
the external Arm toolchain. Add this to qemuarm-secureboot CI so that
there is coverage again. Note: it must be a 32bit machine, since there
are currently no aarch64 host toolchains for aarch64
Signed-off-by: Jon Mason <jon.mason@arm.com>
fvp-base-arm32 isn't a real machine and supporting it has become hacky.
Drop support and remove from meta-arm-bsp
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update to the latest version of u-boot. This requires removing the new
way DRAM is handled, since we don't use dtb the way u-boot is expecting.
Also, change the default bootcmd to make things work (as that expects
env things as well).
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add the various kernels available in oe-core, as well as the poky-tiny
minimal distribution (which has a minimal kernel config). This
necessitated combining some kernel bbappends to have patching coverage
for all the variants.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make things more obvious by adding yml files for the poky defaults
instead of disregarding them in the jobs-to-kas script
Signed-off-by: Jon Mason <jon.mason@arm.com>
This commit includes :
- Rebased and fixed N1SDP kernel PCIe quirk patches to apply on 6.1 kernel
Signed-off-by: Xueliang Zhong <xueliang.zhong@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The UEFI capsule generated is in the incorrect build directory.
This patch copies it to IMGDEPLOYDIR.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Mirrors of meta-arm may focus their development on a small subset of
MACHINEs so provide the option to restrict the boards that are built on
CI using the variable BUILD_ENABLE_REGEX. If set, it conditionally
enables builds; if unset there is no change in behavior.
This variable could be overridden in a scheduled build, to e.g. build
all the MACHINEs weekly.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update tfa version to v2.8. Also, fiptool uses tfa sources. So, keep
it with the rest of tfa to prevent the version from becoming stale.
NOTE: tf-a-tests is being held back for corstone1000 due to compilation
errors.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Defining a task called do_deploy in an image recipe causes the
license_image bbclass in OE-core to think the recipe is not an image
recipe, which causes errors with license information collection if you
have an image recipe which depends on an image recipe using this
bbclass.
To fix this, and to add support for caching the signed binaries, use a
single task, do_sign_images (and its setscene task). The implementation
is based on deploy.bbclass, so the sstate is responsible for installing
the signed binaries in ${DEPLOY_DIR_IMAGE}, but using a different name
so that license information collection still works as expected.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To simplify adding support for new versions of TF-M scripts in the
future, create a common .inc file with the non-version-specific
configuration.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To simplify adding support for new versions of TF-M in the future,
create a common .inc file with the non-version-specific configuration.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To try and prevent trusted-firmware-m and trusted-firmware-m-scripts
from becoming out of sync in the future, create a common
trusted-firmware-m-1.7.0-src.inc which defines all the repositories and
their SHAs for both. Include this file in both recipes.
Add a SUMMARY and DESCRIPTION to trusted-firmware-m-scripts.
Update mbedtls to 3.2.1 (the recommended version for TF-M 1.7.0)
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Factor out the image signing arguments in tfm_image_sign.bbclass into
its own variable, TFM_IMAGE_SIGN_ARGS, so that it can be customized on a
per-machine basis if necessary.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the TF-M image signing scripts to use the TF-M 1.7.0 sources, so
it is in sync with the TF-M recipe itself.
Synchronize the trusted-firmware-m and -scripts Python dependencies
with the in-repo requirements.txt files. This requires a recipe to be
carried for pyhsslms.
1.7.0 introduces the --measured-boot-record argument to the image
signing script, which is required to maintain existing behavior. Add it
to the arguments in the tfm_sign_image bbclass.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-M provides IPC as a SPM backend which gives SPM and each Secure Partition
it's own execution context. And provides higher isolation levels.
corstone1000 isolation level is 2. Hence, switching to IPC backend.
Signed-off-by: Mohamed Omar Asaker <mohamed.omarasaker@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This change adds patches to align psa crypto client of TS with TF-Mv1.7
running on secure enclave of corstone1000
The patches updating
- PSA Crypto SID defines values
- psa_ipc_crypto_pack_iovec structure
- Fix inputs and outputs passed to in/out_vec to match crypto service
expectations
Signed-off-by: Mohamed Omar Asaker <mohamed.omarasaker@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Mirrors of meta-arm may have the persistent cache directory mounted in a
different place. To make it easier to configure, define this location
using a single $CACHE_DIR variable.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This repository doesn't tag releases, so just track the latest SHA.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
IMAGE_TYPES += "wic.nopt" is effective if the bbclass is included
using IMAGE_CLASSES, but not if included directly (using inherit) due to
file parse ordering.
To support applying wic_nopt locally (i.e. for certain image recipes but
not others), change to use :append.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To support using the wic_nopt bbclass from BSP layers other than
meta-arm-bsp, move it to meta-arm.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This patch uses the json config file for UEFI capsule generation
as this is efficient and easily scalable to generate multiple
capsules.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The BBCLASSEXTEND configuration can generate native sdk and target
recipes as well. The cp command used in do_install will
create host contamination issues for these recipes, so this patch
makes the recipe native only.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Inherits the UEFI capsule generation class and configures the capsule
variables for the wic.nopt image
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This class currently supports only a single firmware binary. The
required capsule parameters needs to be set, if not the build fails.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The native recipe installs the UEFI capsule generation tool
along with the other base tools to native sysroot.
Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
TF-M does not use persistent release branches and the release-* branches
have been removed from the repository, so switch the branches to master.
Also update the tf-m-tests SRVREV to the 1.7.0 tag, not the RC2.
99% based on a patch by Peter Hoyes <Peter.Hoyes@arm.com>.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This bbappend is only used by qemuarm*, which now use 6.1, so this can
be removed.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Currently the N1SDP patches haven't been ported to 6.1 and the
port/testing isn't trivial. Until the relevant team has done the port to
6.1, carry a 5.19 kernel in meta-arm-bsp for N1SDP.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Apply the patch from scp-firmware to the third copy of the buggy
Makefiles which fail randomly under parallel builds.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
2 symbols were added to the arm64 kernel defconfig without the
corresponding code. Remove these unnecessary pieces to avoid the
warning.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump kernel version to v6.1 and rebase the patches on
top of this new version.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump corstone500 kernel version to 6.1 and drop the not
longer needed patch regarding the SND_SOC_AC97 config
option in multi_v7.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bump corstone1000 to u-boot version 2023.01, as at it
do some trailing spaces cleanup.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Make sure the master branch track the other masters instead
of being lock to langdale.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
To avoid having always tools that depend on git ls or other
git plumbing to include and spin around the enormous content of
the build directory.
Just add it to the ignore file and make that build content,
that will never get in the repo invisible to git and tools.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
For some reason the kas 3.2.1 container fails:
No such file or directory: '/builds/engineering/yocto/meta-arm/ci/ci/base.yml'
Note the repeated /ci/, which is wrong.
Pin the kas container to 3.2 for now until this is resolved.
Signed-off-by: Ross Burton <ross.burton@arm.com>
The initramfs needs to be very small, but since oe-core d6a62e kmod has
enabled OpenSSL support which doubles the size of the initramfs,
resulting in boot failures.
Signed-off-by: Ross Burton <ross.burton@arm.com>
With the 6.1 kernel, fvp-base logs the warning:
[NOTE]: 'CONFIG_ARM_CPUIDLE' last val (y) and .config val (n) do not match
This is because the kernel idle configs have changed. Remove this
entry, as it is no longer necessary.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update kernel patches and configs for the v6.1 kernel. Previously, it
was using the linux defconfig as a starting point. It is now using the
local kernel metadata.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update qemuarm-secureboot to work with the latest u-boot version and
remove the old, unneeded version from meta-arm
Signed-off-by: Jon Mason <jon.mason@arm.com>
New arm-ffa-tee and arm-ffa-user drivers are compatible with 5.* and 6.1 kernels.
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream has updated u-boot to v2023.01, but the update is causing
problems with some machines. Temporarily add a v2022.10 recipe until
the issues can be resolved.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upstream has updated u-boot to v2023.01, but the update is causing
problems with some machines. Temporarily add a v2022.10 recipe until
the issues can be resolved.
Signed-off-by: Jon Mason <jon.mason@arm.com>
A recent commit compressed the kernel image (to Image.gz) and
by default enabled an initramfs image. In the case for when
such that (initramfs) is not desirable, the deploy step of the
Juno firmware will still try to install the Image file, (not
Image.gz), so this fails:
ERROR: firmware-image-juno-1.0-r0 do_deploy: ExecutionError('/oe/build/tmp-glibc/work/juno-oe-linux/firmware-image-juno/1.0-r0/temp/run.do_deploy.360477', 1, None, None)
ERROR: Logfile of failure stored in: /oe/build/tmp-glibc/work/juno-oe-linux/firmware-image-juno/1.0-r0/temp/log.do_deploy.360477
Log data follows:
| DEBUG: Executing python function sstate_task_prefunc
| DEBUG: Python function sstate_task_prefunc finished
| DEBUG: Executing shell function do_deploy
| cp: cannot stat '/oe/build/tmp-glibc/deploy/images/juno/Image': No such file or directory
| WARNING: /oe/build/tmp-glibc/work/juno-oe-linux/firmware-image-juno/1.0-r0/temp/run.do_deploy.360477:152 exit 1 from 'cp -L -f /oe/build/tmp-glibc/deploy/images/juno/Image /oe/build/tmp-glibc/work/juno-oe-linux/firmware-image-juno/1.0-r0/image/juno-firmware-19.06/SOFTWARE/'
| WARNING: Backtrace (BB generated script):
| #1: do_deploy, /oe/build/tmp-glibc/work/juno-oe-linux/firmware-image-juno/1.0-r0/temp/run.do_deploy.360477, line 152
| #2: main, /oe/build/tmp-glibc/work/juno-oe-linux/firmware-image-juno/1.0-r0/temp/run.do_deploy.360477, line 163
NOTE: recipe firmware-image-juno-1.0-r0: task do_deploy: Failed
ERROR: Task (../meta-arm/meta-arm-bsp/recipes-bsp/images/firmware-image-juno.bb:do_deploy) failed with exit code '1'
This updates the else case for when an initramfs image is not
in use so that the right kernel image is deployed, by using
the KERNEL_IMAGETYPE variable, to use either version of the
kernel image.
Signed-off-by: Daniel Díaz <daniel.diaz@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The SRC_URI, SRCREV AND SRCBRANCH variables are currently used
inconsistently across recipes in meta-arm, leading to difficulties
customizing the configuration in external BSP layers where necessary.
Standardize usage across commonly used recipes so that:
* SRC_URI contains a SRC_URI_PACKAGE_NAME variable per component which
can be used to easily configure a mirror. This variable uses
default assignment so that it can be easily overridden using an
environment variable, e.g. to point to an internal mirror that cannot
be committed externally.
* SRCBRANCH is defined per component.
* SRCREV is defined per component.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
For models that require a license, ARMLMD_LICENSE_FILE is used to define
the location of a license file or server. If the variable is not set in
Bitbake it will not be set in the model environment.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
FVP_ENV_PASSTHROUGH may contain variables that have not been set.
d.getVar returns None in this case. Detect this and skip setting the
variable in the model environment.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Define FVP_ENV_PASSTHROUGH's vardeps to equal itself, so that the
fvpconf is regenerated if any of the defined variables change.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
aa89fe3f ensured environment variables necessary for GUI applications
are passed through to the model despite runfvp env var restrictions. Add
XAUTHORITY to this list. This is useful when doing X-forwarding with
Kas, which creates its own home directory.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Update the Arm GCC source to the latest version. Also, update the GCC
patches to apply cleanly, removing those that are no longer relevant.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Disable fatal warnings for tfm. This removes issues with RWX and others
when using the new binary toolchain versions.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Change u-boot and machine config to default to booting a compressed
initramfs. This allows for easier testing. A compressed image is
needed as the image is too big for the storage, and the error notifying
of such is vague.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Kas 3.2 ships python3-subunit, so we don't need to try to install that
anymore.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Kas 3.2 has a 'dump' plugin, so use that instead of cat in a shell.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This job doesn't use the standard helpers, so needs to pass these
explicitly otherwise it can pick up an old SHA.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrade to v2022.10
This includes Corstone-1000 out of tree patches.
FF-A patches are the latest sent to U-Boot mailing list (v8).
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Rebase corstone500 u-boot patches to 2022.10 version.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Since oe-core 868dfb4 rng-tools is no longer depended on by openssh, so
we don't need to remove it ourself.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
meta-clang now builds pixman with GCC until this is resolved.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now we're using master these workarounds are not needed anymore.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We're now compatible with oe-core master, so update the CI to build
against master branches instead of langdale.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The oe_import() function was removed in oe-core when addpylib was
added[1]. However, meta-arm-toolchain doesn't ship any library code so
this call doesn't do anything useful anyway.
[1] 1f56155e91da2030ee0a5e93037c62e1349ba89f
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
OE-core 4901c9d471cab99d52876842980222ce271b66e4 "base: Switch to use
addpylib directive and BB_GLOBAL_PYMODULES" means that ${LAYERDIR}/lib
is no longer searched by default when loading test controllers.
meta-arm defines some custom test controllers for testing FVPs, so add
an addpylib directive to meta-arm/conf/layer.conf to fix testimage on
FVPs.
testimage.bbclass still has its own test case loading logic based on
BBLAYERS, so other layers that only define test cases (not controllers
or other Python libraries) need no further changes.
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I7fab638b4a1610d30efad2dae214378d096e0fc4
Signed-off-by: Jon Mason <jon.mason@arm.com>
oe-core's master branch is diverging from langdale and meta-arm will be
following this, so drop compatibility with langdale in master so we're
free to diverge too.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The SCP-firmware CMake compile step automatically attempts to execute
cppcheck if both:
* cppcheck can be located using find_program
* DISABLE_CPPCHECK is not defined
cppcheck is not readily available in OE-core and is not an essential
part of the compilation process for end-users, so explicitly disable the
cppcheck step by passing DISABLE_CPPCHECK to CMake.
Additionally, because the OE-core CMake toolchain file cannot be used,
find_program may locate cppcheck on the host machine, which will cause
the build to fail if it is not the recommended version (as it is in
recent Linux distros).
Issue-Id: SCM-5864
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: Ia87a0cbbb67ac1d6f3b26cfb5747a85b46131f81
Signed-off-by: Jon Mason <jon.mason@arm.com>
If CMAKE_BUILD_TYPE=debug (lowercase), SCP-firmware builds with debug
compiler flags but BUILD_MODE_DEBUG is not defined in C code so features
that are conditionally enabled/disabled in debug mode are not active.
Pass capitalized "Debug" and "Release" strings to CMAKE_BUILD_TYPE to
ensure Debug mode is fully enabled when SCP_BUILD_RELEASE = "0".
SCP_BUILD_RELEASE = "1" (the default) for all machines in meta-arm-bsp
so they are unaffected.
Issue-Id: SCM-5864
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I93220420eedd2e3e6c169679efcaf4642dd5bc51
Signed-off-by: Jon Mason <jon.mason@arm.com>
The include file should be pointing to `optee-os-3.19.0` instead of
`optee-os-3_19` (which does not exist).
Fixes: 3259a2a840 ("arm/optee: support optee 3.19")
Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com>
Signed-off-by: Theodore A. Roth <troth@openavr.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
apply_local_src_patches.bbclass was added in a previous patch to handle
the application of patch files located inside the fetched source code.
find is used to collect the patch files which does not guarantee the
order of its output. Pipe the output of find into sort to ensure patch
files are applied in the correct order.
Issue-Id: SCM-5864
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I1082fb7a726a7745289a5aa8bb6447bef57a94b0
Signed-off-by: Jon Mason <jon.mason@arm.com>
Now that the FVP is available for both aarch64 and x86-64, don't set a
tag so this can run on both architectures.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There is now a beta release of the Base-A AEM FVP for aarch64!
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
We can download both x86-64 and aarch64 binaries, so ensure the SRC_URI
entry is named to identify them.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There is a new optee version 3.19. Currently, qemuarm-secureboot cannot boot
optee 3.19 out-of-the-box. This pins optee-os version to 3.18 for
qemuarm-secureboot.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
From: Emekcan <emekcan.aras@arm.com>
Adds build configuration to support optee-os 3.19 for N1SDP.
Also, it patches optee-os to support external DT for N1SDP.
Signed-off-by: Emekcan <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Moves optee-3.18 and optee-tadevkit patches into
related directories.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The libts recipe assumes generated cmake file will be suffixed with
'-noconfig'. This is only true when building with the default type
i.e. "".
Check which target cmake file has been generated before trying to
patch it. This fixes 'no such file' error when building with an
explicit type (Debug, Release, etc).
Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Apply patch to use the stateless platform service calls
Calls to psa_connect is not needed and psa_call can be called
directly with a pre defined handle.
Signed-off-by: Mohamed Omar Asaker <mohamed.omarasaker@arm.com>
The meta-gem5 layer is unmaintained and gem5 is incompatible with Python
3.11, so won't work with master without work that is still ongoing.
Signed-off-by: Ross Burton <ross.burton@arm.com>
The meta-atp layer is unmaintained and gem5 is incompatible with Python
3.11, so won't work with master without work that is still ongoing.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Add set -e so errors are fatal.
Allow HOST_ARCH and VER to be overridden by the environment, for testing.
Pull the tarball basename into a variable to reduce duplication.
Turn the wget call into a function to reduce duplication.
Drop the big-endian binaries as we never use those.
Signed-off-by: Ross Burton <ross.burton@arm.com>
meta-clang has a langdale branch now, so unset the explicit refspec.
linux-yocto needs to use non-clang objcopy, apply the change locally
until the commit has been merged into meta-clang's langdale branch.
perf needs some patches backported, until that has been done use gcc to
build perf.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Timing Annotation is a feature of the model that enables high-level
performance estimations to be made [1]. It is not needed to demonstrate
a functioning software stack so set FASTSIM_DISABLE_TA to 1 in the model
environment to disable this feature. This also improves model
performance.
[1] https://developer.arm.com/documentation/100965/1119/Timing-Annotation
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
DEFAULT_TAG and CPU_REQUEST are being used to help with internal Gitlab
pipeline setups know which type of machines to run on, but has no value
outside of Arm Corp. Gitlab CI allows for variables to be overridden
by default. So, we can give it a default value of NULL/empty and have
everything work internally and externally by default.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Tag all jobs with the DEFAULT_TAG variable so each instance can control
what tags the jobs have, whilst still explicitly tagging the jobs which
need specific tags (such as x86_64 for jobs which need to run x86-only
binaries)
Signed-off-by: Ross Burton <ross.burton@arm.com>
The Kas container needs to use the entrypoint as that is where the user
changes from root to a normal user.
Also set the KUBERNETES_CPU_REQUEST to the variable CPU_REQUEST as this
needs to be tuned per-deployment.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Update version in documentation.
Issue-Id: SCM-4874
Signed-off-by: Robbie Cao <robbie.cao@arm.com>
Change-Id: Ic66bdcdc5c6309331f80faab6eaf2e3e936a5da4
Signed-off-by: Jon Mason <jon.mason@arm.com>
721bec25 "arm/fvp: Join cli arguments in verbose logging" changed the
verbose output of FVPRunner to print the generated arguments using
shlex.join instead of as a list. However, this function is only
available in Python >= 3.8, whereas OE-core currently supports Python
3.6.
To fix this, backport its one-line implementation to a local function
shlex_join and update the call site.
Issue-Id: SCM-5314
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I56cab9dddcd0a91272464be15742a6ee726dad41
Signed-off-by: Jon Mason <jon.mason@arm.com>
Aligning the user guide with the latest Corstone1000 SW updates.
Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Upgrades the Corstone1000 FVP to the latest release
version.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Ensure meta-atp recipes are only performed if a compatible machine is
selected.
Signed-off-by: Adrián Herrera Arcila <adrian.herrera@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Previously, meta-atp extended the original gem5 recipe to add the ATP
Engine models; the .bbappend was complex, because it pulled from two
sources, and it was not possible to make machine-based overrides, as it
is a native recipe.
To solve this, we use the recent EXTRAS feature to add the gem5 models
from a different recipe.
Signed-off-by: Adrián Herrera Arcila <adrian.herrera@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
The m5 readfile recipe provides general utility for gem5 users to
run any script on OS boot. We hence move it to the meta-gem5 layer.
Signed-off-by: Adrian Herrera <adrian.herrera@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
By making m5readfile into its own recipe, we avoid modifications to the
m5ops recipe when using the meta-atp layer, which break the Yocto
compatibility of the layer.
Signed-off-by: Adrian Herrera <adrian.herrera@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Test failed because there was no reference to maintainers in the
meta-atp README.
Following the common structure of other layers in the meta-arm
repository, the README in meta-atp now refers to the top-level README,
and a documentation directory contains the guidance that was present in
the original meta-atp README.
Signed-off-by: Adrián Herrera Arcila <adrian.herrera@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Add support for n1sdp to trusted-services bbappends and rework some
things to make it easier to add more in the future.
Signed-off-by: Jon Mason <jon.mason@arm.com>
As TF-M ships patches that it needs applied to mbedcrypto, we apply them as
part of do_patch by using a postfunc. There is an issue when do_patch is
executed after do_deploy_source_date_epoch_setscene and apply_local_patches
tries to apply the patches already applied.
To fix this, make usage of the apply_local_src_patches bbclass.
Change-Id: Ia115b540b37ad3a2cce30e1e0461abd1f5a6ccc1
Signed-off-by: Diego Sueiro <diego.sueiro@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
This class is to be inherited by recipes where there are patches located inside
the fetched source code which need to be applied.
The following variables need to be set:
LOCAL_SRC_PATCHES_INPUT_DIR is the directory from where the patches are located
LOCAL_SRC_PATCHES_DEST_DIR is the directory where the patches will be applied
Signed-off-by: Diego Sueiro <diego.sueiro@arm.com>
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I8f9c16a5fbc9d5569cba60136560f1951408bd60
Signed-off-by: Jon Mason <jon.mason@arm.com>
In d8e9ee8fd53b7620e72b2dfebb2e8d464b737dbb the finalize method was removed.
Signed-off-by: David Bagonyi <david.bagonyi@gmail.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
World builds are trying to build trusted services, which has a
dependency on meta-python. To avoid having to add a layer dependency
for meta-arm on meta-python, limit the compatible machines to the ones
using it (which already have a meta-python dependency).
Signed-off-by: Jon Mason <jon.mason@arm.com>
"git" is the version and need not be part of the bbappend name. Since
this isn't being done in any other part of meta-arm-bsp (and not
uniformly in the same directory), rename the bbappends to have the %
wild card.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Start a new thread to simultaneously log the output of FVP and the
telnet output if the --verbose flag is passed to runfvp. So that
ConsolePortParser can read the same stream, use itertools.tee to
temporarily duplicate the stream.
Use a custom log format string with an escape character to ensure that
log output always starts at the beginning of a line when interleaved
with console output.
Issue-Id: SCM-5314
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I3e815d9d899425e0d2af619524f09f2eda87562c
Signed-off-by: Jon Mason <jon.mason@arm.com>
It is often useful to inspect the FVP output after running the tests.
Refactor OEFVPSerialTarget._create_logfile into
OEFVPSSHTarget._create_log_filename, so that all FVP test controllers
are able to create secondary log files.
Pass a filehandle to the stdout argument of run_fvp so that the FVP
output is asynchronously logged to a file. Change the port parsing logic
to read back from the same log file instead of reading the stdout
directly.
Issue-Id: SCM-5314
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I2ddb423fa0d896c13d3e96884858c680c4d34555
Signed-off-by: Jon Mason <jon.mason@arm.com>
To simplify the FVPRunner class, create a separate ConsolePortParser
class to handle reading an iterator of lines and parsing port numbers
for FVP consoles. Use this in runfvp and the test targets.
This refactor also allows the stream being monitored to be changed more
easily, e.g. to a log file.
Issue-Id: SCM-5314
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: Iade3a4c803fb355b04af7afa298d0a41fe707d94
Signed-off-by: Jon Mason <jon.mason@arm.com>
FVPRunner relies heavily on asyncio, despite there being very little
concurrent work happening. Additionally, while the runfvp entry point
starts an asyncio runner, it is not practical to have a single asyncio
runtime during testimage, which is fully synchronous.
Refactor to use subprocess.Popen and related functionality. The process
object has a similar interface to its async equivalent.
Cascade the API changes to runfvp and the test target classes.
Issue-Id: SCM-5314
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: I3e7517e8bcbb3b93c41405d43dbd8bd24a9e7eb8
Signed-off-by: Jon Mason <jon.mason@arm.com>
It is sometimes helpful to copy and paste the cli arguments from the
verbose runfvp output (e.g. to test with a development FVP build), but
currently the arguments are printed as a Python list. Use
shlex.join(cli) to safely join the arguments together in form that can
be reused directly in a shell.
Issue-Id: SCM-5314
Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
Change-Id: Ibb5c5ed45d02e241cb3858f68740fb9d4e89357a
Signed-off-by: Jon Mason <jon.mason@arm.com>
Recent changes appear to have fixed clang issues. Unfortunately,
hafnium gn visibility is not done properly. So, a patch to that is
needed to get it working.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Aligning the release notes with the latest Corstone1000 SW updates.
Signed-off-by: Abdellatif El Khlifi <abdellatif.elkhlifi@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Use --prefix instead of --root when installing the Python modules to
ensure that build paths are not embedded in the compiled .pyc files.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Without virtio-rng enabled kernel 5.19 takes ages to finish
random number generator initialisation which causes
issues with ssh and other crypto related services.
Signed-off-by: Anton Antonov <Anton.Antonov@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
GetNextVariableName() should return EFI_BUFFER_TOO_SMALL
when NameSize is smaller than the actual NameSize. It
currently returns EFI_BUFFER_OUT_OF_RESOURCES due to setting
max_name_len incorrectly. This fixes max_name_len error by
replacing it with actual NameSize request by u-boot.
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
As in EDK-2 and EDK-2 test code, setVariable() with 0
attributes means a delete variable requiest. Currently,
smm gateway doesn't handle this scenario. This commit
adds that support
Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Enabling ESRT in trusted services increased the need for more
assets at protected storage level, since we now save FMP data
, capsule update, like Image Info as non volatile EFI
variables.
So, just change the default configuration for the corstone1000
to handle this.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Reorder patch list headers, move psa api test patch that
should be applied to all psa api test from a crypto specific
directory to a more generic "psa-apitest" directory.
Create a inc file for the psa api test to make sure all out of
tree patches from trusted services are applied to all test
source directories, and move mm communicator buffer details to
each SP, and finally set it up differently as it
should/is expected to be at libts.
With this setup all psa-api test for crypto and attestation
passed.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
At the apply ts patch stage, first check if they are patches
to be applied. Because if not, this would break the apply
patch stage with an error.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
There are some cases where PN is not expanded into linux-yocto in the
arm-ffa-transport.inc file required from linux-yocto_%.bbappend,
because of the := usage, in those cases PN gets "defaultpkgname".
To fix the issue, rename "linux-yocto" folder into "files" and adjust
ARMFILESPATHS to point to that in linux-yocto_%.bbappend, prepend
ARMFILESPATHS to FILESEXTRAPATHS in arm-ffa-transport.inc.
Remove ARMFILESPATHS prepend from FILESEXTRAPATHS for corstone1000 in
meta-arm-bsp, because the platform has always the "arm-ffa" in
MACHINE_FEATURES, which causes ARMFILESPATHS to be prepended.
While there, remove the FILESEXTRAPATHS prepend of ARMFILESPATHS for
the n1sdp that will be added by arm-ffa-transport.inc only when
needed.
Signed-off-by: Luca Fancellu <luca.fancellu@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bring fvp-base and fvp-base-arm32 to match what is currently being done
in other fvps, and clean up the fvps to use a single fvp yml file (which
should enable better adding and removing of issues common to fvps, like
xorg test bugs).
Signed-off-by: Jon Mason <jon.mason@arm.com>
opencsd and gator-daemon aren't currently being build. Add them to the
base build so that they can be verified to at least compile.
Signed-off-by: Jon Mason <jon.mason@arm.com>
These changes are to build and install optee test for
N1SDP
Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
N1SDP has 2 DRAM's. This change is to register 2nd DRAM which starts at
0x8080000000. Linux uses 1KB of this memory to share data with optee-os.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Bitbake variables were being set in KAS for the unique Gitlab CI
configuration being used internally. While this should not have been
significantly detrimental for other setups, this shouldn't be necessary
with proper runner setup. Removing them here to all for a more generic
CI experience.
Signed-off-by: Jon Mason <jon.mason@arm.com>
Apply shared patch to trusted services that is used to compile
psa crypto api tests to include change in packed-c request
message in the eaed update structure to be in sync with the
serialize/deserialize in TS side.
As at it, move the other corstone1000 specific patch file to
meta-arm-bsp where it should be.
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
These changes are to add support for readthedocs for
corstone1000 platform. readthedocs server traces
any changes to to corstone1000 documents and will trigger
a build which will generate html file which can will be
rendered by corstone1000.docs.arm.com server
Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
These changes are to pass appropriate MMC card configuration to
corstone1000 FVP.
Signed-off-by: Vishnu Banavath <vishnu.banavath@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>
Port crypto config to psa arch test api suite.This
needs to move to arm-bsp since is corstone1000 specific
configuration
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jon Mason <jon.mason@arm.com>
E-mail meta-arm@lists.yoctoproject.org with patches created using this process. You can configure git-send-email to automatically use this address for the meta-arm repository with the following git command:
E-mail <meta-arm@lists.yoctoproject.org> with patches created using this process. You can configure git-send-email to automatically use this address for the meta-arm repository with the following git command:
All contributions are under the [MIT License](/COPYING.MIT).
For a quick start guide on how to build and use meta-arm, go to [quick-start.md](/documentation/quick-start.md).
For information on the continuous integration done on meta-arm and how to use it, go to [continuous-integration-and-kas.md](/documentation/continuous-integration-and-kas.md).
Backporting
--------------
Backporting patches to older releases may be done upon request, but only after a version of the patch has been accepted into the master branch. This is done by adding the branch name to email subject line. This should be between the square brackets (e.g., "[" and "]"), and before or after the "PATCH". For example,
Automatic backporting will be done to all branches if the "Fixes: <SHA>" wording is added to the patch commit message. This is similar to how the Linux kernel community does their LTS kernel backporting. For more information see the "Fixes" portion of
The Yocto Project has an autobuilder that performs nightly builds and image tests on all of the defined QEMU machines, including qemuarm and qemuarm64 Also, it currently runs builds on the hardware reference platforms including genericarm64 and meta-arm mahines fvp-base and sbsa-ref. More information on the autobuilder can be found at<https://autobuilder.yoctoproject.org/>.
More information on the image tests can be found at<https://wiki.yoctoproject.org/wiki/Image_tests>.
The Yocto Project also has the ability to have individual package tests, ptests. For more information on those, go to<https://wiki.yoctoproject.org/wiki/Ptest>.
# **CI for meta-arm**
meta-arm is using the Gitlab CI infrastructure. This is currently being done internal to Arm, but an external version can be seen at <https://gitlab.com/jonmason00/meta-arm/-/pipelines>.
This CI is constantly being expanded to provide increased coverage of the software and hardware supported in meta-arm. All platforms are required to add a kas file and `.gitlab-ci.yml` entry as part of the initial patch series. More information on kas can be found at <https://github.com/siemens/kas>.
To this end, it would be wise to run kas locally to verify everything works prior to pushing to the CI build system.
## **Running kas locally**
### **Install kas**
kas can be installed with pip, for example:
```
$ pip3 install --user kas
```
See <https://kas.readthedocs.io/en/latest/userguide/getting-started.html> for information on the dependencies and more.
This assumes that the kas path ($HOME/.local/bin) is in $PATH. If not, the user will need to manually add this or the kas command will not be found.
### **Run kas locally**
```
$ cd ~/meta-arm/
$ kas build kas/juno.yml
```
By default kas will create a build directory under meta-arm to contain the checked out layers, build directory, and downloads. You can change this by setting environment variables. DL\_DIR and SSTATE\_DIR are respected so these can point at existing directories, and setting KAS\_WORK\_DIR to the directory where repositories are already cloned will save having to re-fetch. This can look something like:
```
$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/qemuarm64.yml:ci/testimage.yml
```
See the [quick start guide](/documentation/quick-start.md) for more information on how to set this up.
## **Locked Revisions in CI with lockfiles**
The CI in meta-arm will generate a kas "lock file" when it starts to ensure that all of the builds checkout the same revision of the various different layers that are used. If this isn't done then there's a chance that a layer will be modified upstream during the CI, which results in some builds failing and some builds passing.
This lock file is saved as an artefact of the update-repos job by the CI, and only generated if it doesn't already exist in the repository. This can be used to force specific revisions of layers to be used instead of HEAD, which can be useful if upstream changes are causing problems in development.
The lockfile.yml can be downloaded manually, but there's a script in meta-arm to fetch the lock file for the latest successful build of the specified branch:
```
$ ./ci/download-lockfile.py --help
usage: download-lockfile.py [-h] server project refspec
@@ -4,32 +4,36 @@ OE-Core's [oeqa][OEQA] framework provides a method of performing runtime tests o
Tests can be configured to run automatically post-build by setting the variable `TESTIMAGE_AUTO="1"`, e.g. in your Kas file or local.conf.
There are two main methods of testing, using different test "targets".
## OEFVPTarget
This runs test cases on a machine using SSH. It therefore requires that an SSH server is installed in the image.
In test cases, the primary interface with the target is, e.g:
```
(status, output) = self.target.run('uname -a')
```
which runs a single command on the target (using `ssh -c`) and returns the status code and the output. It is therefore useful for running tests in a Linux environment.
For examples of test cases, see meta/lib/oeqa/runtime/cases in OE-Core. The majority of test cases depend on `ssh.SSHTest.test_ssh`, which first validates that the SSH connection is functioning.
Example machine configuration:
meta-arm provides the OEFVPTarget which must be set up in the machine configuration:
The test target also generates a log file with the prefix 'fvp_log' in the image recipe's `${WORKDIR}/testimage` containing the FVP's stdout.
This runs tests against one or more serial consoles on the FVP. It is more flexible than OEFVPTarget, but test cases written for this test target do not support the test cases in OE-core. As it does not require an SSH server, it is suitable for machines with performance or memory limitations.
OEFVPTarget supports two different test interfaces - SSH and pexpect.
## SSH
As in OEQA in OE-core, tests cases can run commands on the machine using SSH. It therefore requires that an SSH server is installed in the image.
This uses the `run` method on the target, e.g:
```
(status, output) = self.target.run('uname -a')
```
which executes a single command on the target (using `ssh -c`) and returns the status code and the output. It is therefore useful for running tests in a Linux environment.
For examples of test cases, see meta/lib/oeqa/runtime/cases in OE-Core. The majority of test cases depend on `ssh.SSHTest.test_ssh`, which first validates that the SSH connection is functioning.
## pexpect
To support firmware and baremetal testing, OEFVPTarget also allows test cases to make assertions against one or more consoles using the pexpect library.
Internally, this test target launches a [Pexpect][PEXPECT] instance for each entry in FVP_CONSOLES which can be used with the provided alias. The whole Pexpect API is exposed on the target, where the alias is always passed as the first argument, e.g.:
For an example of a full test case, see meta-arm/lib/oeqa/runtime/cases/linuxboot.py This test case can be used to minimally verify that a machine boots to a Linux shell. The default timeout is 10 minutes, but this can be configured with the variable TEST_FVP_LINUX_BOOT_TIMEOUT, which expects a value in seconds.
The SSH interface described above is also available on OEFVPSerialTarget to support writing a set of hybrid test suites that use a combination of serial and SSH access. Note however that this test target does not guarantee that Linux has booted to shell prior to running any tests, so the test cases in OE-core are not supported.
> the “--volume” is the directory where your persistent stuff (like downloads and build artifacts) will go to help speed up your builds and can be sharable amongst your builds/containers. If you want to go completely clean-room, feel free to remove it
# **Step 1: clone meta-arm and build meta-arm**
```
$ git clone https://git.yoctoproject.org/meta-arm
$ cd meta-arm/
$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/fvp-base.yml:ci/testimage.yml
```
> **_NOTE:_**
> “ci/testimage.yml” will cause the build to run some basic system tests. If you don’t care about verifying basic functionality, then remove it and it should be faster (a few less programs will be added to the system image and the 2-3mins that it takes to run the test will not happen).
> **_NOTE:_**
> You may wish to add the Yocto Project SSTATE Mirror (especially the first time) to speed up the build by downloading the build fragments (built by the Yocto Project autobuilder) from the internet. This can be done by adding "ci/sstate-mirror.yml" in kas or adding the relevant lines to your local.conf. Using the above example:
```
$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/fvp-base.yml:ci/sstate-mirror.yml
```
> **_NOTE:_**
> This only fetches the parts necessary for your build and may take several minutes depending on your internet connection speed. Also, it only fetches what is available. There may still be a need to build things depending on your configuration.
For more information on kas and various commands, please reference <https://kas.readthedocs.io/en/latest/>.
Depending on what software you are building, fvp-base might not be the machine you want to build for.
The following website provides an EXTREMELY rough way to tell what software is in what machines, and what versions are being run:
If, as an example, we’re wanting to develop trusted-firmware-a; then fvp-base will work for us.
### **Okay, you are done! VICTORY!**
### **Oh, you actually wanted to mess around with the system software source code?**
# **Step 2: use devtool to get your source**
Setup your environment via the (non-kas) Yocto Project tools
```
$ source poky/oe-init-build-env
```
Use devtool to checkout the version of software being used on the machine above (in the above example, this will be trusted-firmware-a for fvp-base).
```
$ devtool modify trusted-firmware-a
```
This will download the source, hopefully in git (depending on how the Yocto Project recipe was written), and should print a path at the end where the source code was checked out. In the trusted-firmware-a example, I got:
Inside of that directory, you should see the relevant source code. In this example, it is a standard git tree. So, you can add remotes, checkout different SHAs, etc
Ok, so you are set with your changes and want to build them.
```
$ devtool build trusted-firmware-a
```
This should build the software in question, but it is not yet integrated into a system image. To do that, run:
```
$ devtool build-image core-image-sato
```
The image should match the image being used on your machine above. Most of them in meta-arm are set to core-image-sato.
Also, if you used testimage above, it will run testimage now
### **Okay, you are done! VICTORY!**
# **Step 3. Testing your patches outside of devtool**
At this point I will assume you have a patch and want to add it to the base recipe. Using the above example, in the devtool directory:
The Yocto Project releases twice a year (April and October): "stable" releases are made every six months and have a lifetime of seven months to allow for migration, while "long term support" (LTS) releases are picked every two years starting from Dunfell in April 2020. The standard practice for all Yocto Compatible layers is to create a "named" branch consistent with the code name of that release. For example, the “dunfell” release of the Yocto Project will have a branch named “dunfell” in the official git repository, and layers compatible with dunfell will have a branch named “dunfell”. Thus, a customer can easily organize a collection of appropriate layers to make a product.
In the Yocto Project, these named branches are “stable”, and only take bug fixes or security-critical upgrades. Active development occurs on the master branch. However, this methodology can be problematic if mimicked with the compatible layers. Companies, like Arm, may not wish to release a snapshot of the relevant “master” branches under active development, due to the amount of testing, fixing, and hardening necessary to make a product from a non-stable release. Also, changes to keep the master branch of a layer working with the upstream master branch of the Yocto Project may result in that branch no longer being compatible with named branches (e.g., it might not be possible to mix and match master and dunfell). So, a decision must be made on the branching policy of meta-arm.
## **Adding new Hardware or Software features**
There are many different ways to resolve this issue. After some discussion, the best solution for us is to allow new hardware enablement (and relevant software features) to be included in LTS named branches (not just bug fixes). This will allow for a more stable software platform for software to be developed, tested, and released. Also, the single branch allows for focused testing (limiting the amount of resources needed for CI/CD), lessens/eliminates code diverging on various branches, and lessens confusion on which branch to use. The risk of making this choice is a potentially non-stable branch which will require more frequent testing to lessen the risk, and not following the “stable” methodology of the core Yocto Project layers (though it is not uncommon for BSP layers to behave this way).
## **Process**
The process for patches intended on being integrated into only the master branch is the normal internal process of pushing for code review and CI, approval and integration into upstream meta-arm master branch.
For patches intended on being included in an LTS named branch, the preferred process is to upstream via the master branch, rebase the patch (or series against the intended LTS branch) and send email with the release name in the subject line after the "PATCH" (e.g., "[PATCH dunfell] Add foo to bar").
If there is a time crunch and the preferred way above cannot be completed in time, upstreaming via the LTS branch can occur. This follows the normal process above but without the master integration step. However, any patches upstreamed in this manner must be pushed to master in a timely fashion (after the time crunch). Nagging emails will be sent and managers will be involved as the time grows.
## **Testing**
See [continuous-integration-and-kas.md](/documentation/continuous-integration-and-kas.md) for information how the layer is tested and what tests are run. It is presumed that all code will be compiled as part of the CI process of the gerrit code review. Also, testing on virtual platforms and code conformity checks will be run when enabled in the process.
## **Branching strategy and releases**
Named branches for meta-arm will be released as close as possible to the release of the YP LTS release. Meta-arm named branches will be created from the meta-arm master branch.
To minimize the additional work of maintaining multiple branches it is assumed that there will only be two active development branches at any given time: master and the most recent Long Term Stable (LTS) as the named branch. All previous named LTS branches will be EOLed when a new LTS has been released. Any branches that are EOLed will still exist in the meta-arm, but bug fix patches will be accepted. Limited to no testing will occur on EOL’ed branches. Exceptions to this can be made, but must be sized appropriately and agreed to by the relevant parties.
Named branch release will coincide with Yocto Project releases. These non-LTS branches will be bug fix only and will be EOLed on the next release (similar to the YP branching behavior).
### **Branch transitions**
When YP is approaching release, meta-arm will attempt to stabilize master so that the releases can coincide.
* T-6 weeks - Email is sent to meta-arm mailing list notifying of upcoming code freeze of features to meta-arm
* T-4 weeks - Code freeze to meta-arm. Only bug fixes are taken at this point.
* T-0 - Official upstream release occurs. With no outstanding critical bugs, a new named branch is created based on the current meta-arm master branch. Previous named branches are now frozen and will not accept new patches (but will continue to be present for reference and legacy usage).
## **Tagging**
### **Branch Tagging**
When each branch is released, a git tag with the Yocto Project version number will be added. For example, `4.3`. Also, this tag version number will be prepended with "yocto" in a duplicate tag (e.g., "yocto-4.3").
Conciding with the Yocto Project release schedule, every branch which has one or more changes added to it in the previous 6 months will get a minor versioned tag (e.g., "4.3.1" and "yocto-4.3.1").
### **BSP Release Tagging**
BSP releases for those boards supported in meta-arm-bsp maybe have an additional tag to denote their software releases. The tag will consist of the board name (in all capital letters), year, and month. For example, "CORSTONE1000-2023.11".
The release schedule for this is outside the standard Yocto Project release candence, but is generally encouraged to be as close to these releases as possible. Similarily, it is recommended the BSP releases be based on the latest LTS branch.
@@ -4,10 +4,10 @@ The `runfvp` tool in meta-arm makes it easy to run Yocto Project disk images ins
## Running images with `runfvp`
To build images with the FVP integration, the `fvpboot` class needs to be inherited. If the machine does not do this explicitly it can be done in `local.conf`:
To build images with the FVP integration, the `fvpboot` image class needs to be inherited. If the machine does not do this explicitly it can be done in `local.conf`:
```
INHERIT += "fvpboot"
IMAGE_CLASSES += "fvpboot"
```
The class will download the correct FVP and write a `.fvpconf` configuration file when an image is built.
@@ -55,16 +55,26 @@ The name of the FVP binary itself, for example `fvp-base` uses `FVP_Base_RevC-2x
The name of the recipe that provides the FVP executable set in `FVP_EXE`, for example `fvp-base` uses `fvp-base-a-aem-native`. This *must* be a `-native` recipe as the binary will be executed on the build host.
There are recipes for common FVPs in meta-arm already, and writing new recipes is trivial. For FVPs which are free to download `fvp-base-a-aem.bb` is a good example. Some FVPs must be downloaded separately as they need an account on Arm's website, `fvp-base-r-aem.bb` is a good example of those.
There are recipes for common FVPs in meta-arm already, and writing new recipes is trivial. For FVPs which are free to download `fvp-base-a-aem.bb` is a good example. Some FVPs must be downloaded separately as they need an account on Arm's website.
If `FVP_PROVIDER` is not set then it is assumed that `FVP_EXE` is installed on the host already.
### `FVP_BINDIR`
Optional parameter to configure the path of the FVP binary. For example, `fvp-base` uses path from the build host by default. This path can be customized by configuring like below.
```
FVP_BINDIR ?= "utilities/fvp/usr/bin"
```
Potential use case for this parameter configuration is to execute `runfvp` script without the need for bitbake environment initialization.
### `FVP_CONFIG`
Parameters passed to the FVP with the `--parameter`/`-C` option. These are expressed as variable flags so individual parameters can be altered easily. For example:
Specify raw data to load at the specified address, passed to the FVP with the `--data` option. This is a space-separated list of parameters in the format `[INST=]FILE@[MEMSPACE:]ADDRESS`. For example:
Applications to load on the cores, passed to the FVP with the `--application` option. These are expressed as variable flags with the flag name being the instance and flag value the filename, for example:
Note that symbols are not allowed in flag names, so if you need to use a wildcard in the instance then you'll need to use `FVP_EXTRA_ARGS` and `--application` directly.
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Hugues KAMBA MPIANA
Frazer Carsley
Michael Safwat
Harsimran Singh Tungal
Clement Faure
Ross Burton
David Hu
Jon Mason
Vyacheslav Yurkov
Khem Raj
Andrey Zhizhikin
Norbert Kocsis
Peter Hoyes
Christophe Thiblot
Ali Can Ozaslan
Abdellatif El Khlifi
Csaba Szilágyi
Hamideh Izadyar
Mariam Elshakfy
Yogesh Wani
Bence Balogh
Gyorgy Szing
Denys Dmytriyenko
Mohammed Javith Akthar M
Richard Purdie
Gergely Kovacs
Martin Jansa
Mikko Rapeli
Andrew Jeffery
Jose Quaresma
Philip Puk
Musa Antike
Quentin Schulz
Adam Johnston
Jamin Lin
Gabor Abonyi
Romain Naour
Vasyl Vavrychuk
Ziad Elhanafy
Ben
Javier Tia
Luca Fancellu
Mariam Elshakfy
Amr Mohamed
Jon Mason
Emekcan Aras
Delane Brandy
Ryan Eatmon
Thomas Perrot
Ben Cownley
Mathieu Poirier
Drew Reed
Adam Johnston
Amr Mohamed
Debbie Martin
Anusmita Dutta Mazumder
Alexander Sverdlin
Vincent Stehlé
Vikas Katariya
Xueliang Zhong
Divin Raj
Robbie Cao
Rouven Czerwinski
Tomás González
Sumit Garg
Denys Dmytriyenko
Claus Stovgaard
Rui Miguel Silva
Anton Antonov
Clément Péron
Satish Kumar
Gowtham Suresh Kumar
Mohamed Omar Asaker
Daniel Díaz
Qi Feng
Theodore A. Roth
Adrián Herrera Arcila
Diego Sueiro
David Bagonyi
Vishnu Banavath