CI: Remove ts-smm-gateway from N1SDP

Installing SMM Gateway SP on the N1SDP may stop the platform from booting
for on-device testing in CI.

In n1sdp.yml, remove `ts-smm-gateway` if it has been added

Keep `ts-smm-gateway` in default SP set so it can still be tested with
`qemu-secureboot`

Signed-off-by: Adam Johnston <adam.johnston@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

ci/n1sdp.yml

@@ -4,3 +4,7 @@ header:
     - ci/base.yml
 
 machine: n1sdp
+
+local_conf_header:
+  unsupported_trusted_services: |
+    MACHINE_FEATURES:remove = "ts-smm-gateway"

meta-arm-bsp/recipes-bsp/external-system/external-system_0.1.0.bb

@@ -8,7 +8,8 @@ LICENSE = "BSD-3-Clause & Apache-2.0"
 LIC_FILES_CHKSUM = "file://license.md;md5=e44b2531cd6ffe9dece394dbe988d9a0 \
                     file://cmsis/LICENSE.txt;md5=e3fc50a88d0a364313df4b21ef20c29e"
 
-SRC_URI = "gitsm://git.gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx.git;protocol=https;branch=master"
+SRC_URI = "gitsm://git.gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx.git;protocol=https;branch=master \
+           file://race.patch"
 SRCREV = "8c9dca74b104ff6c9722fb0738ba93dd3719c080"
 PV .= "+git${SRCPV}"
 

meta-arm-bsp/recipes-bsp/external-system/files/race.patch

@@ -0,0 +1,66 @@
+Upstream-Status: Submitted [https://gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx/-/issues/1]
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+From 34e1c04534607f5605255f39fb46e26261fc9c4e Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Tue, 8 Sep 2020 11:49:08 +0100
+Subject: [PATCH] tools/gen_module_code: atomically rewrite the generated files
+
+The gen_module rule in rules.mk is marked as .PHONY, so make will
+execute it whenever it is mentioned. This results in gen_module_code
+being executed 64 times for a Juno build.
+
+However in heavily parallel builds there's a good chance that
+gen_module_code is writing a file whilst the compiler is reading it
+because make also doesn't know what files are generated by
+gen_module_code.
+
+The correct fix is to adjust the Makefiles so that the dependencies are
+correct but this isn't trivial, so band-aid the problem by atomically
+writing the generated files.
+
+Change-Id: I82d44f9ea6537a91002e1f80de8861d208571630
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ tools/gen_module_code.py | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/tools/gen_module_code.py b/tools/gen_module_code.py
+index 7b3953845..ee099b713 100755
+--- a/tools/gen_module_code.py
++++ b/tools/gen_module_code.py
+@@ -17,6 +17,7 @@
+ import argparse
+ import os
+ import sys
++import tempfile
+ 
+ DEFAULT_PATH = 'build/'
+ 
+@@ -53,13 +54,21 @@
+ 
+ def generate_file(path, filename, content):
+     full_filename = os.path.join(path, filename)
+-    with open(full_filename, 'a+') as f:
+-        f.seek(0)
+-        if f.read() != content:
++
++    try:
++        with open(full_filename) as f:
++            rewrite = f.read() != content
++    except FileNotFoundError:
++        rewrite = True
++
++    if rewrite:
++        with tempfile.NamedTemporaryFile(prefix="gen-module-code",
++                                         dir=path,
++                                         delete=False,
++                                         mode="wt") as f:
+             print("[GEN] {}...".format(full_filename))
+-            f.seek(0)
+-            f.truncate()
+             f.write(content)
++        os.replace(f.name, full_filename)
+ 
+ 
+ def generate_header(path, modules):

meta-arm-bsp/recipes-bsp/images/corstone1000-image.bb

@@ -7,10 +7,15 @@ COMPATIBLE_MACHINE = "corstone1000"
 
 inherit image
 inherit wic_nopt tfm_sign_image
+inherit  uefi_capsule
 
 PACKAGE_INSTALL = ""
 
-IMAGE_FSTYPES += "wic wic.nopt"
+IMAGE_FSTYPES += "wic wic.nopt uefi_capsule"
+
+UEFI_FIRMWARE_BINARY = "${PN}-${MACHINE}.${CAPSULE_IMGTYPE}"
+UEFI_CAPSULE_CONFIG = "${THISDIR}/files/${PN}-capsule-update-image.json"
+CAPSULE_IMGTYPE = "wic.nopt"
 
 do_sign_images() {
     # Sign TF-A BL2

meta-arm-bsp/recipes-bsp/images/files/corstone1000-image-capsule-update-image.json

@@ -0,0 +1,11 @@
+{
+    "Payloads": [
+        {
+            "FwVersion": "5",
+            "Guid": "e2bb9c06-70e9-4b14-97a3-5a7913176e3f",
+            "LowestSupportedVersion": "1",
+            "Payload": "$UEFI_FIRMWARE_BINARY",
+            "UpdateImageIndex": "0"
+        }
+    ]
+}

meta-arm/classes/uefi_capsule.bbclass

@@ -0,0 +1,55 @@
+# This class generates UEFI capsules
+# The current class supports generating a capsule with single firmware binary
+
+DEPENDS += "gettext-native"
+inherit python3native
+
+IMAGE_TYPES += "uefi_capsule"
+
+# edk2 base tools should be installed in the native sysroot directory
+do_image_uefi_capsule[depends] += "edk2-basetools-native:do_populate_sysroot"
+
+# By default the wic image is used to create a capsule
+CAPSULE_IMGTYPE ?= "wic"
+
+# IMGDEPLOYDIR is used as the default location of firmware binary for which the capsule needs to be created
+CAPSULE_IMGLOCATION ?= "${IMGDEPLOYDIR}"
+
+# The generated capsule by default has uefi.capsule extension
+CAPSULE_EXTENSION ?= "uefi.capsule"
+
+# The following variables must be set to be able to generate a capsule update
+UEFI_FIRMWARE_BINARY ?= ""
+UEFI_CAPSULE_CONFIG ?= ""
+
+# Check if the required variables are set
+python() {
+    for var in ["UEFI_FIRMWARE_BINARY", "UEFI_CAPSULE_CONFIG"]:
+        if not d.getVar(var):
+            raise bb.parse.SkipRecipe(f"{var} not set")
+}
+
+IMAGE_CMD:uefi_capsule(){
+
+    # Force the GenerateCapsule script to use python3
+    export PYTHON_COMMAND=${PYTHON}
+
+    # Copy the firmware and the capsule config json to current directory
+    if [ -e ${CAPSULE_IMGLOCATION}/${UEFI_FIRMWARE_BINARY} ]; then
+        cp ${CAPSULE_IMGLOCATION}/${UEFI_FIRMWARE_BINARY} . ;
+    fi
+
+    export UEFI_FIRMWARE_BINARY=${UEFI_FIRMWARE_BINARY}
+    envsubst < ${UEFI_CAPSULE_CONFIG} > ./${MACHINE}-capsule-update-image.json
+
+    ${STAGING_DIR_NATIVE}/usr/bin/edk2-BaseTools/BinWrappers/PosixLike/GenerateCapsule \
+    -e -o ${IMGDEPLOYDIR}/${UEFI_FIRMWARE_BINARY}.${CAPSULE_EXTENSION} -j \
+    ${MACHINE}-capsule-update-image.json
+
+    # Remove the firmware to avoid contamination of IMGDEPLOYDIR
+    rm ${UEFI_FIRMWARE_BINARY}
+
+}
+
+# The firmware binary should be created before generating the capsule
+IMAGE_TYPEDEP:uefi_capsule:append = "${CAPSULE_IMGTYPE}"

meta-arm/recipes-devtools/edk2-basetools/edk2-basetools-native_202211.bb

@@ -0,0 +1,24 @@
+# Install EDK2 Base Tools in native sysroot. Currently the BaseTools are not
+# built, they are just copied to native sysroot. This is sufficient for
+# generating UEFI capsules as it only depends on some python scripts. Other
+# tools need to be built first before adding to sysroot.
+
+SUMMARY = "EDK2 Base Tools"
+LICENSE = "BSD-2-Clause-Patent"
+
+# EDK2
+SRC_URI = "git://github.com/tianocore/edk2.git;branch=master;protocol=https"
+LIC_FILES_CHKSUM = "file://License.txt;md5=2b415520383f7964e96700ae12b4570a"
+
+SRCREV = "fff6d81270b57ee786ea18ad74f43149b9f03494"
+
+S = "${WORKDIR}/git"
+
+inherit native
+
+RDEPENDS:${PN} += "python3-core"
+
+do_install () {
+    mkdir -p ${D}${bindir}/edk2-BaseTools
+    cp -r ${WORKDIR}/git/BaseTools/* ${D}${bindir}/edk2-BaseTools/
+}