arm/trusted-firmware-m: add CVE_PRODUCT

Per https://nvd.nist.gov/products/cpe/detail/C0F7CF14-9ACD-42C5-A1F8-839937F8C4DC
add CVE_PRODUCT entry.  Since there wasn't one existing, there is no
need to remove anything.

(cherry picked from commit d0b93e582c)

Signed-off-by: Javier Tia <javier@peridio.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

.gitlab-ci.yml

@@ -255,6 +255,11 @@ n1sdp:
 
 pending-updates:
   extends: .setup
+  # Only run this job for the default branch (master), or if forced with
+  # BUILD_FORCE_PENDING_UPDATES.
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $BUILD_FORCE_PENDING_UPDATES != null
   artifacts:
     paths:
       - update-report

0001-procps-fix-build-with-new-glibc-but-old-kernel-heade.patch

@@ -1,79 +0,0 @@
-From 42358d889ed652a8c386862f8c65e5fbe7484de2 Mon Sep 17 00:00:00 2001
-From: Ross Burton <ross.burton@arm.com>
-Date: Fri, 26 Apr 2024 10:38:28 +0000
-Subject: [PATCH] procps: fix build with new glibc but old kernel headers
-
-If you're building procps with a newer glibc (with pidfd_open()) but
-older kernel headers (say 4.x, before __NR_pidfd_open) then procps will
-fail to build because of a typo in configure.ac.
-
-Signed-off-by: Ross Burton <ross.burton@arm.com>
----
- .../procps/procps/pidfd.patch                 | 42 +++++++++++++++++++
- meta/recipes-extended/procps/procps_4.0.4.bb  |  1 +
- 2 files changed, 43 insertions(+)
- create mode 100644 meta/recipes-extended/procps/procps/pidfd.patch
-
-diff --git a/meta/recipes-extended/procps/procps/pidfd.patch b/meta/recipes-extended/procps/procps/pidfd.patch
-new file mode 100644
-index 00000000000..f5e8183e547
---- /dev/null
-+++ b/meta/recipes-extended/procps/procps/pidfd.patch
-@@ -0,0 +1,42 @@
-+From c8f625e085b8249cc009e8b19c3a19100217eb35 Mon Sep 17 00:00:00 2001
-+From: Ross Burton <ross.burton@arm.com>
-+Date: Thu, 25 Apr 2024 13:33:15 +0000
-+Subject: [PATCH] Fix pidfd_open detection
-+
-+This check for pidfd_open uses AC_CHECK_FUNC which just runs the specified code, but 
-+src/pgrep.c checks HAVE_PIDFD_OPEN which will only be defined by AC_CHECK_FUNCS.
-+
-+Also pidfd_open is defined in sys/pidfd.h so that needs including.
-+
-+Upstream-Status: Pending
-+Signed-off-by: Ross Burton <ross.burton@arm.com>
-+---
-+
-+diff --git a/configure.ac b/configure.ac
-+index fec27e3f..024731c7 100644
-+--- a/configure.ac
-++++ b/configure.ac
-+@@ -170,7 +170,7 @@ AC_TRY_COMPILE([#include <errno.h>],
-+ 		AC_MSG_RESULT(yes),
-+ 		AC_MSG_RESULT(no))
-+ 
-+-AC_CHECK_FUNC([pidfd_open], [enable_pidwait=yes], [
-++AC_CHECK_FUNCS([pidfd_open], [enable_pidwait=yes], [
-+   AC_MSG_CHECKING([for __NR_pidfd_open])
-+   AC_COMPILE_IFELSE([AC_LANG_SOURCE([
-+ #include <sys/syscall.h>
-+diff --git a/src/pgrep.c b/src/pgrep.c
-+index d8e57dff..c5211aec 100644
-+--- a/src/pgrep.c
-++++ b/src/pgrep.c
-+@@ -44,7 +44,9 @@
-+
-+ #ifdef ENABLE_PIDWAIT
-+ #include <sys/epoll.h>
-+-#ifndef HAVE_PIDFD_OPEN
-++#ifdef HAVE_PIDFD_OPEN
-++#include <sys/pidfd.h>
-++#else
-+ #include <sys/syscall.h>
-+ #endif /* !HAVE_PIDFD_OPEN */
-+ #endif
-diff --git a/meta/recipes-extended/procps/procps_4.0.4.bb b/meta/recipes-extended/procps/procps_4.0.4.bb
-index 800384f22f7..ec8c4b0261b 100644
---- a/meta/recipes-extended/procps/procps_4.0.4.bb
-+++ b/meta/recipes-extended/procps/procps_4.0.4.bb
-@@ -14,6 +14,7 @@ inherit autotools gettext pkgconfig update-alternatives
- 
- SRC_URI = "git://gitlab.com/procps-ng/procps.git;protocol=https;branch=master \
-            file://sysctl.conf \
-+           file://pidfd.patch \
-            "
- SRCREV = "4ddcef2fd843170c8e2d59a83042978f41037a2b"
- 
--- 
-2.34.1
-

ci/base.yml

@@ -17,14 +17,10 @@ repos:
       meta-arm-toolchain:
 
   poky:
-    url: https://git.yoctoproject.org/git/poky
+    url: https://git.yoctoproject.org/poky
     layers:
       meta:
       meta-poky:
-    patches:
-      procps:
-        path: 0001-procps-fix-build-with-new-glibc-but-old-kernel-heade.patch
-        repo: meta-arm
 
 env:
   BB_LOGCONFIG: ""

ci/update-repos

@@ -20,9 +20,9 @@ def repo_shortname(url):
             .replace('*', '.'))
 
 repositories = (
-    "https://git.yoctoproject.org/git/poky",
+    "https://git.yoctoproject.org/poky",
     "https://git.openembedded.org/meta-openembedded",
-    "https://git.yoctoproject.org/git/meta-virtualization",
+    "https://git.yoctoproject.org/meta-virtualization",
     "https://github.com/kraj/meta-clang",
 )
 

kas/arm-systemready-linux-distros-opensuse.yml

@@ -2,6 +2,7 @@ header:
   version: 13
   includes:
     - kas/arm-systemready-firmware.yml
+    - kas/arm-systemready-linux-distros-unattended-installation.yml
 
 target:
   - arm-systemready-linux-distros-opensuse

kas/arm-systemready-linux-distros-unattended-installation.yml

@@ -0,0 +1,11 @@
+header:
+  version: 16
+
+env:
+  DISTRO_UNATTENDED_INST_TESTS:
+  # The full testimage run typically takes around 12-24h on fvp-base.
+  TEST_OVERALL_TIMEOUT: "${@ 24*60*60}"
+  
+local_conf_header:
+  systemready-unattended-inst: |
+    TESTIMAGE_AUTO = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "1", "", d)}"

kas/corstone1000-extsys.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+
+local_conf_header:
+  extsys: |
+    MACHINE_FEATURES += "corstone1000-extsys"

kas/fvp-base.yml

@@ -14,7 +14,7 @@ machine: fvp-base
 
 defaults:
   repos:
-    refspec: master
+    refspec: scarthgap
 
 repos:
   meta-arm:

meta-arm-bsp/documentation/corstone1000/release-notes.rst

@@ -38,6 +38,16 @@ Platform Support
  - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.23_25
    https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
 
+SystemReady IR v2.0 Certification Milestone
+-------------------------------------------
+
+As of this release, Corstone-1000 has achieved `SystemReady IR v2.0 certification <https://www.arm.com/architecture/system-architectures/systemready-certification-program/ve>`__.
+This milestone confirms compliance with the SystemReady IR requirements, ensuring broader compatibility and reliability for deployment.
+
+Applied patch `313ad2a0e600 <https://git.yoctoproject.org/meta-arm/commit/?h=scarthgap&id=313ad2a0e600655d9bfbe53646e356372ff02644>`__ to address compatibility requirements for SystemReady IR v2.0.
+
+This update is included in tag `CORSTONE1000-2024.06-systemready-ir-v2.0 <https://git.yoctoproject.org/meta-arm/tag/?h=CORSTONE1000-2024.06-systemready-ir-v2.0>`__ and builds on the `CORSTONE1000-2024.06` release.
+
 ***********************
 Release notes - 2023.11
 ***********************

meta-arm-bsp/documentation/corstone1000/user-guide.rst

@@ -180,6 +180,12 @@ then run:
 
     kas build meta-arm/kas/corstone1000-fvp.yml:meta-arm/ci/debug.yml
 
+By default, the external system is disabled. To build the Corstone-1000 image with external system enabled, run:
+
+::
+
+    kas build meta-arm/kas/corstone1000-<fvp,mps3>.yml:meta-arm/ci/debug.yml:meta-arm/kas/corstone1000-extsys.yml
+
 The initial clean build will be lengthy, given that all host utilities are to
 be built as well as the target images. This includes host executables (python,
 cmake, etc.) and the required toolchain(s).
@@ -1444,6 +1450,7 @@ The above commands will delete the Platform key (PK) and allow the normal system
 
 Testing the External System
 ---------------------------
+Before testing the external system, please make sure to build the Corstone-1000 image with external system enabled as mentioned in section `Building the software stack`_.
 
 During Linux boot the remoteproc subsystem automatically starts
 the external system.

meta-arm-bsp/recipes-bsp/images/firmware-image-juno.bb

@@ -12,18 +12,26 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 COMPATIBLE_MACHINE = "juno"
 
-LINARO_RELEASE = "19.06"
-
-SRC_URI = "http://releases.linaro.org/members/arm/platforms/${LINARO_RELEASE}/juno-latest-oe-uboot.zip;subdir=${UNPACK_DIR} \
-    file://images-r0.txt \
-    file://images-r1.txt \
-    file://images-r2.txt \
+SRC_URI = " \
+    file://mbb_v151.ebf \
+    file://io_b118.bit \
+    file://tapid.arm \
+    file://pms_v103.bin \
+    file://pms_v104.bin \
+    file://pms_v105.bin \
+    file://mb-board.txt \
+    file://site1-HBI0262B-board.txt \
+    file://site1-HBI0262C-board.txt \
+    file://site1-HBI0262D-board.txt \
+    file://site1-images.txt \
+    file://hdlcdclk.dat \
+    file://startup.nsh \
+    file://selftest \
+    file://config.txt \
     file://uEnv.txt \
 "
-SRC_URI[md5sum] = "01b662b81fa409d55ff298238ad24003"
-SRC_URI[sha256sum] = "b8a3909bb3bc4350a8771b863193a3e33b358e2a727624a77c9ecf13516cec82"
 
-UNPACK_DIR = "juno-firmware-${LINARO_RELEASE}"
+FIRMWARE_DIR = "juno-firmware"
 
 inherit deploy nopackages
 
@@ -33,23 +41,63 @@ do_compile[noexec] = "1"
 # The ${D} is used as a temporary directory and we don't generate any
 # packages for this recipe.
 do_install() {
-    cp -a ${WORKDIR}/${UNPACK_DIR} ${D}
-    cp -f ${RECIPE_SYSROOT}/firmware/bl1-juno.bin \
-        ${D}/${UNPACK_DIR}/SOFTWARE/bl1.bin
+    install -d ${D}/${FIRMWARE_DIR}/
+    cp -f ${WORKDIR}/config.txt ${D}/${FIRMWARE_DIR}/
 
-    cp -f ${RECIPE_SYSROOT}/firmware/fip-juno.bin \
-        ${D}/${UNPACK_DIR}/SOFTWARE/fip.bin
+    # Files in the MB directory are mostly the same, except for the PMS file and references to the PMS file by name
+    install -d ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${WORKDIR}/mbb_v151.ebf ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${WORKDIR}/io_b118.bit ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${WORKDIR}/tapid.arm  ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${WORKDIR}/pms_v103.bin ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${WORKDIR}/mb-board.txt ${D}/${FIRMWARE_DIR}/MB/HBI0262B/board.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${WORKDIR}/mbb_v151.ebf ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${WORKDIR}/io_b118.bit ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${WORKDIR}/tapid.arm  ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${WORKDIR}/pms_v104.bin ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    sed 's/pms_v103/pms_v104/g' ${WORKDIR}/mb-board.txt > ${D}/${FIRMWARE_DIR}/MB/HBI0262C/board.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${WORKDIR}/mbb_v151.ebf ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${WORKDIR}/io_b118.bit ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${WORKDIR}/tapid.arm  ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${WORKDIR}/pms_v105.bin ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    sed 's/pms_v103/pms_v105/g' ${WORKDIR}/mb-board.txt > ${D}/${FIRMWARE_DIR}/MB/HBI0262D/board.txt
+
+    # The SITE1 image files are mostly the same except for the DTB they reference
+    install -d ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/
+    cp -f ${WORKDIR}/site1-HBI0262B-board.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/board.txt
+    cp -f ${WORKDIR}/site1-images.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/images.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/
+    cp -f ${WORKDIR}/site1-HBI0262C-board.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/board.txt
+    sed 's/juno\.dtb/juno-r1.dtb/g' ${WORKDIR}/site1-images.txt > ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/images.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/
+    cp -f ${WORKDIR}/site1-HBI0262D-board.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/board.txt
+    sed 's/juno\.dtb/juno-r2.dtb/g' ${WORKDIR}/site1-images.txt > ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/images.txt
+
+    # The files in SOFTWARE are listed in the SITE1 board.txt file by name
+    install -d ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    cp -f ${RECIPE_SYSROOT}/firmware/fip.bin \
+        ${D}/${FIRMWARE_DIR}/SOFTWARE/fip.bin
+
+    cp -f ${RECIPE_SYSROOT}/firmware/bl1.bin \
+        ${D}/${FIRMWARE_DIR}/SOFTWARE/bl1.bin
+
+    cp -f ${WORKDIR}/hdlcdclk.dat ${D}/${FIRMWARE_DIR}/SOFTWARE/
 
     cp -f ${RECIPE_SYSROOT}/firmware/scp_romfw_bypass.bin \
-        ${D}/${UNPACK_DIR}/SOFTWARE/scp_bl1.bin
+        ${D}/${FIRMWARE_DIR}/SOFTWARE/scp_bl1.bin
+
+    cp -f ${WORKDIR}/startup.nsh ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    cp -f ${WORKDIR}/selftest ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    dd if=/dev/zero of="${D}/${FIRMWARE_DIR}/SOFTWARE/blank.img" bs=1024 count=192 status=none
 
     # u-boot environment file
-    cp -f ${WORKDIR}/uEnv.txt ${D}/${UNPACK_DIR}/SOFTWARE/
-
-    # Juno images list file
-    cp -f ${WORKDIR}/images-r0.txt ${D}/${UNPACK_DIR}/SITE1/HBI0262B/images.txt
-    cp -f ${WORKDIR}/images-r1.txt ${D}/${UNPACK_DIR}/SITE1/HBI0262C/images.txt
-    cp -f ${WORKDIR}/images-r2.txt ${D}/${UNPACK_DIR}/SITE1/HBI0262D/images.txt
+    cp -f ${WORKDIR}/uEnv.txt ${D}/${FIRMWARE_DIR}/SOFTWARE/
 }
 
 do_deploy() {
@@ -59,18 +107,18 @@ do_deploy() {
     # task.
     for f in ${KERNEL_DEVICETREE}; do
         install -m 755 -c ${DEPLOY_DIR_IMAGE}/$(basename $f) \
-            ${D}/${UNPACK_DIR}/SOFTWARE/.
+            ${D}/${FIRMWARE_DIR}/SOFTWARE/.
     done
 
     if [ "${INITRAMFS_IMAGE_BUNDLE}" -eq 1 ]; then
         cp -L -f ${DEPLOY_DIR_IMAGE}/Image.gz-initramfs-juno.bin \
-            ${D}/${UNPACK_DIR}/SOFTWARE/Image
+            ${D}/${FIRMWARE_DIR}/SOFTWARE/Image
     else
-        cp -L -f ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE} ${D}/${UNPACK_DIR}/SOFTWARE/
+        cp -L -f ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE} ${D}/${FIRMWARE_DIR}/SOFTWARE/
     fi
 
     # Compress the files
-    tar -C ${D}/${UNPACK_DIR} -zcvf ${WORKDIR}/${PN}.tar.gz ./
+    tar -C ${D}/${FIRMWARE_DIR} -zcvf ${WORKDIR}/${PN}.tar.gz ./
 
     # Deploy the compressed archive to the deploy folder
     install -D -p -m0644 ${WORKDIR}/${PN}.tar.gz ${DEPLOYDIR}/${PN}.tar.gz

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/config.txt

@@ -0,0 +1,28 @@
+TITLE: V2M-Juno Configuration File
+
+[CONFIGURATION]
+AUTORUN: TRUE                    ;Auto Run from power on
+TESTMENU: FALSE                  ;MB Peripheral Test Menu
+
+UPDATE: FALSE                    ;Force JTAG and FPGA update to DBs
+VERIFY: FALSE                    ;Force FPGA verify to DBs
+
+DVIMODE: VGA                     ;VGA or SVGA or XGA or SXGA or UXGA
+
+MBLOG: FALSE                     ;LOG MB MICRO in run mode FALSE/UART0/UART1
+DBLOG: FALSE                     ;LOG DB MICRO in run mode FALSE/UART1 (when MBLOG is not UART1)
+
+USERSWITCH: 00000000             ;UserSwitch[7:0] in binary
+CONFSWITCH: 00000000             ;Configuration Switch[7:0] in binary, Core[0:1] Cluster[2]
+ASSERTNPOR: TRUE                 ;External resets assert nPOR
+WDTRESET: RESETMB                ;Watchdog reset options NONE/RESETMB/RESETDB
+
+PCIMASTER: DB1                   ;Port Failover DB1/SL3
+MASTERSITE: DB1                  ;Boot Master DB1/SL3
+
+REMOTE: NONE                     ;Selects remote command via USB or FTP NONE/USB/FTP
+
+MCCMACADDRESS: 0xFFFFFFFFFFFF    ;MCC MAC Address (must be even MAC address)
+SMCMACADDRESS: 0xFFFFFFFFFFFF    ;SMC MAC Address
+
+HOSTNAME: V2M-JUNO-A2		 ;Host name for FTP [15 characters max]

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/images-r1.txt

@@ -1,71 +0,0 @@
-TITLE: Versatile Express Images Configuration File
-
-[IMAGES]
-TOTALIMAGES: 10                  ;Number of Images (Max: 32)
-
-NOR0UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR0ADDRESS: 0x00000000          ;Image Flash Address
-NOR0FILE: \SOFTWARE\fip.bin      ;Image File Name
-NOR0LOAD: 00000000               ;Image Load Address
-NOR0ENTRY: 00000000              ;Image Entry Point
-
-NOR1UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR1ADDRESS: 0x03EC0000          ;Image Flash Address
-NOR1FILE: \SOFTWARE\bl1.bin      ;Image File Name
-NOR1LOAD: 00000000               ;Image Load Address
-NOR1ENTRY: 00000000              ;Image Entry Point
-
-NOR2UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR2ADDRESS: 0x00500000          ;Image Flash Address
-NOR2FILE: \SOFTWARE\Image        ;Image File Name
-NOR2NAME: norkern                ;Rename kernel to norkern
-NOR2LOAD: 00000000               ;Image Load Address
-NOR2ENTRY: 00000000              ;Image Entry Point
-
-NOR3UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR3ADDRESS: 0x03000000          ;Image Flash Address
-NOR3FILE: \SOFTWARE\juno-r1.dtb  ;Image File Name
-NOR3NAME: board.dtb              ;Specify target filename to preserve file extension
-NOR3LOAD: 00000000               ;Image Load Address
-NOR3ENTRY: 00000000              ;Image Entry Point
-
-NOR4UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR4ADDRESS: 0x030C0000          ;Image Flash Address
-NOR4FILE: \SOFTWARE\hdlcdclk.dat ;Image File Name
-NOR4LOAD: 00000000               ;Image Load Address
-NOR4ENTRY: 00000000              ;Image Entry Point
-
-NOR5UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR5ADDRESS: 0x03E40000          ;Image Flash Address
-NOR5FILE: \SOFTWARE\scp_bl1.bin  ;Image File Name
-NOR5LOAD: 00000000               ;Image Load Address
-NOR5ENTRY: 00000000              ;Image Entry Point
-
-NOR6UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR6ADDRESS: 0x0BF00000          ;Image Flash Address
-NOR6FILE: \SOFTWARE\startup.nsh  ;Image File Name
-NOR6NAME: startup.nsh
-NOR6LOAD: 00000000               ;Image Load Address
-NOR6ENTRY: 00000000              ;Image Entry Point
-
-NOR7UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR7ADDRESS: 0x0BFC0000          ;Image Flash Address
-NOR7FILE: \SOFTWARE\blank.img    ;Image File Name
-NOR7NAME: BOOTENV
-NOR7LOAD: 00000000               ;Image Load Address
-NOR7ENTRY: 00000000              ;Image Entry Point
-
-NOR8UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR8ADDRESS: 0x03100000          ;Image Flash Address
-NOR8FILE: \SOFTWARE\selftest     ;Image File Name
-NOR8LOAD: 00000000               ;Image Load Address
-NOR8ENTRY: 00000000              ;Image Entry Point
-
-NOR9UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR9ADDRESS: 0x03180000          ;Image Flash Address
-NOR9NAME: uEnv.txt
-NOR9FILE: \SOFTWARE\uEnv.txt     ;Image File Name
-NOR9LOAD: 00000000               ;Image Load Address
-NOR9ENTRY: 00000000              ;Image Entry Point
-
-

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/images-r2.txt

@@ -1,71 +0,0 @@
-TITLE: Versatile Express Images Configuration File
-
-[IMAGES]
-TOTALIMAGES: 10                  ;Number of Images (Max: 32)
-
-NOR0UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR0ADDRESS: 0x00000000          ;Image Flash Address
-NOR0FILE: \SOFTWARE\fip.bin      ;Image File Name
-NOR0LOAD: 00000000               ;Image Load Address
-NOR0ENTRY: 00000000              ;Image Entry Point
-
-NOR1UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR1ADDRESS: 0x03EC0000          ;Image Flash Address
-NOR1FILE: \SOFTWARE\bl1.bin      ;Image File Name
-NOR1LOAD: 00000000               ;Image Load Address
-NOR1ENTRY: 00000000              ;Image Entry Point
-
-NOR2UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR2ADDRESS: 0x00500000          ;Image Flash Address
-NOR2FILE: \SOFTWARE\Image        ;Image File Name
-NOR2NAME: norkern                ;Rename kernel to norkern
-NOR2LOAD: 00000000               ;Image Load Address
-NOR2ENTRY: 00000000              ;Image Entry Point
-
-NOR3UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR3ADDRESS: 0x03000000          ;Image Flash Address
-NOR3FILE: \SOFTWARE\juno-r2.dtb  ;Image File Name
-NOR3NAME: board.dtb              ;Specify target filename to preserve file extension
-NOR3LOAD: 00000000               ;Image Load Address
-NOR3ENTRY: 00000000              ;Image Entry Point
-
-NOR4UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR4ADDRESS: 0x030C0000          ;Image Flash Address
-NOR4FILE: \SOFTWARE\hdlcdclk.dat ;Image File Name
-NOR4LOAD: 00000000               ;Image Load Address
-NOR4ENTRY: 00000000              ;Image Entry Point
-
-NOR5UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR5ADDRESS: 0x03E40000          ;Image Flash Address
-NOR5FILE: \SOFTWARE\scp_bl1.bin  ;Image File Name
-NOR5LOAD: 00000000               ;Image Load Address
-NOR5ENTRY: 00000000              ;Image Entry Point
-
-NOR6UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR6ADDRESS: 0x0BF00000          ;Image Flash Address
-NOR6FILE: \SOFTWARE\startup.nsh  ;Image File Name
-NOR6NAME: startup.nsh
-NOR6LOAD: 00000000               ;Image Load Address
-NOR6ENTRY: 00000000              ;Image Entry Point
-
-NOR7UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR7ADDRESS: 0x0BFC0000          ;Image Flash Address
-NOR7FILE: \SOFTWARE\blank.img    ;Image File Name
-NOR7NAME: BOOTENV
-NOR7LOAD: 00000000               ;Image Load Address
-NOR7ENTRY: 00000000              ;Image Entry Point
-
-NOR8UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR8ADDRESS: 0x03100000          ;Image Flash Address
-NOR8FILE: \SOFTWARE\selftest     ;Image File Name
-NOR8LOAD: 00000000               ;Image Load Address
-NOR8ENTRY: 00000000              ;Image Entry Point
-
-NOR9UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR9ADDRESS: 0x03180000          ;Image Flash Address
-NOR9NAME: uEnv.txt
-NOR9FILE: \SOFTWARE\uEnv.txt     ;Image File Name
-NOR9LOAD: 00000000               ;Image Load Address
-NOR9ENTRY: 00000000              ;Image Entry Point
-
-

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/mb-board.txt

@@ -0,0 +1,26 @@
+BOARD: HBI0262
+TITLE: MotherBoard Configuration File
+
+[MCCS]
+MBBIOS: mbb_v151.ebf        ;MB BIOS IMAGE
+
+[FPGAS]
+MBIOFPGA: io_b118.bit       ;MB IOFPGA
+
+[PMIC]
+MBPMIC: pms_v103.bin        ;MB PMIC
+
+[OSCCLKS]
+TOTALOSCCLKS: 11
+OSC0: 50.0                  ;OSC0 Juno SYSREFCLK    (System clock)
+OSC1: 50.0                  ;OSC1 Juno AONREFCLK    (Always On)
+OSC2: 50.0                  ;OSC2 Juno PXLREFCLK    (HS pixel clock)
+OSC3: 47.5                  ;OSC3 Juno PXCLKIN      (LS pixel clock)
+OSC4: 2.11                  ;OSC4 Juno I2SCLK       (Audio)
+OSC5: 50.0                  ;OSC5 Juno SMCMCLK      (Static memory)
+OSC6: 50.0                  ;OSC6 Juno CA53 REF_CLK (RSVD)
+OSC7: 50.0                  ;OSC7 Juno CA57 REF_CLK (RSVD)
+OSC8: 50.0                  ;OSC8 Juno GPU  REF_CLK (RSVD)
+OSC9: 30.0                  ;OSC9  IOFPGA BOOT      (RSVD)
+OSC10: 24.0                 ;OSC10 IOFPGA UART      (RSVD)
+OSC11: 7.37                 ;OSC11 Juno UARTCLK     (UART clock)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/site1-HBI0262B-board.txt

@@ -0,0 +1,22 @@
+BOARD: HBI0262
+TITLE: V2M-Juno DevChip Configuration File
+
+[SCC REGISTERS]
+TOTALSCCS: 12                   ;Total Number of SCC registers
+SCC: 0x054 0x0007FFFE           ;Enable non-secure DMA operations
+SCC: 0x05C 0x00FE001E           ;Enable default GPU Texture Formats
+SCC: 0x100 0x003F1000           ;A57 PLL Register 0 (800MHz)
+SCC: 0x104 0x0001F300           ;A57 PLL Register 1
+SCC: 0x108 0x00371000           ;A53 PLL Register 0 (700MHz)
+SCC: 0x10C 0x0001B300           ;A53 PLL Register 1
+SCC: 0x118 0x003F1000           ;SYS PLL Register 0 (1600MHz)
+SCC: 0x11C 0x0001F100           ;SYS PLL Register 1
+SCC: 0x0F8 0x0BEC0000           ;BL1 entry point
+SCC: 0x0FC 0xABE40000           ;BL0 entry point
+
+SCC: 0x00C 0x000000C2           ;Clock Control, TMIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)
+SCC: 0x010 0x000000C2           ;Clock Control, TSIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/site1-HBI0262C-board.txt

@@ -0,0 +1,24 @@
+BOARD: HBI0262
+TITLE: V2M-Juno DevChip Configuration File
+
+[SCC REGISTERS]
+TOTALSCCS: 13                   ;Total Number of SCC registers
+SCC: 0x054 0x0007FFFE           ;Enable non-secure DMA operations
+SCC: 0x05C 0x00FE001E           ;Enable default GPU Texture Formats
+SCC: 0x100 0x003F1000           ;A57 PLL Register 0 (800MHz)
+SCC: 0x104 0x0001F300           ;A57 PLL Register 1
+SCC: 0x108 0x00331000           ;A53 PLL Register 0 (650MHz)
+SCC: 0x10C 0x00019300           ;A53 PLL Register 1
+SCC: 0x118 0x003F1000           ;SYS PLL Register 0 (1600MHz)
+SCC: 0x11C 0x0001F100           ;SYS PLL Register 1
+SCC: 0x0F8 0x0BEC0000           ;BL1 entry point
+SCC: 0x0FC 0xABE40000           ;BL0 entry point
+
+SCC: 0xA14 0x00000000           ;PCLKDBG_CONTROL DIV=1
+
+SCC: 0x00C 0x000000C2           ;Clock Control, TMIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)
+SCC: 0x010 0x000000C2           ;Clock Control, TSIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/site1-HBI0262D-board.txt

@@ -0,0 +1,24 @@
+BOARD: HBI0262
+TITLE: V2M-Juno DevChip Configuration File
+
+[SCC REGISTERS]
+TOTALSCCS: 13                   ;Total Number of SCC registers
+SCC: 0x054 0x0007FFFE           ;Enable non-secure DMA operations
+SCC: 0x05C 0x00FE001E           ;Enable default GPU Texture Formats
+SCC: 0x100 0x00271000           ;A72 PLL Register 0 (1000MHz)
+SCC: 0x104 0x00013100           ;A72 PLL Register 1
+SCC: 0x108 0x003F1000           ;A53 PLL Register 0 (800MHz)
+SCC: 0x10C 0x0001F300           ;A53 PLL Register 1
+SCC: 0x118 0x003F1000           ;SYS PLL Register 0 (1600MHz)
+SCC: 0x11C 0x0001F100           ;SYS PLL Register 1
+SCC: 0x0F8 0x0BEC0000           ;BL1 entry point
+SCC: 0x0FC 0xABE40000           ;BL0 entry point
+
+SCC: 0xA14 0x00000000           ;PCLKDBG_CONTROL DIV=1
+
+SCC: 0x00C 0x000000C2           ;Clock Control, TMIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)
+SCC: 0x010 0x000000C2           ;Clock Control, TSIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/startup.nsh

@@ -0,0 +1,4 @@
+echo -off
+echo Juno startup.nsh from NOR flash
+echo Example command to start the kernel:
+echo norkern dtb=board.dtb initrd=ramdisk.img console=ttyAMA0,115200n8 root=/dev/sda2 rw rootwait earlyprintk=pl011,0x7ff80000 debug user_debug=31 androidboot.hardware=juno loglevel=9 sky2.mac_address=0xAA,0xBB,0xCC,0xDD,0xEE,0xFF

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/tapid.arm

@@ -0,0 +1,97 @@
+# ARM TAP controller IR register lengths file
+#
+# Copyright (C) 2008 ARM Limited.  All rights reserved.
+#
+# This file contains a definition of the devices names, ID codes, ID code mask
+# and IR lengths for devices used on ARM boards. This file is read by the
+# progcards_usb.exe program and used to determine if a device ID is valid and
+# the corresponding IR length. A device that is not recognized will be display
+# as 'UNKOWN' and device details should be added to this file.
+#
+# DEVICE NAME    ID CODE     ID MASK     IR LENGTH
+# -------------  ----------  ----------  ---------
+
+# XILINX PLDs
+
+XC9572           0x09504093  0x0FFFFFFF  8
+XC9536XL         0x29602093  0x0FFFFFFF  8
+XC9572XL         0x09604093  0x0FFFFFFF  8
+XC95288XL        0x09616093  0x0FFFFFFF  8
+XCR3256XL        0xF494FFFF  0x0FFF8001  4
+XC4036XLA        0x00224093  0x00FFFFFF  3
+XC4062XLA        0x00230093  0x00FFFFFF  3
+XC4085XLA        0x00238093  0x00FFFFFF  3
+XC2C32A          0x06E1C093  0x0FFF0FFF  8
+XC2C64A          0x06E5D093  0x0FFF0FFF  8
+XC2C128          0x06D8A093  0x0FFF0FFF  8
+XC2C256          0x16D4c093  0x0FFF0FFF  8
+XC2C384          0x06D5C093  0x0FFF0FFF  8
+
+# XILINX FPGAs
+
+XCV600           0x10630093  0x00FFFFFF  5
+XCV600E          0x90A30093  0x00FFFFFF  5
+XCV1000          0x40640093  0x0FFFFFFF  5
+XCV2000E         0xF0A50093  0x0FFFFFFF  5
+XC2V2000         0x01038093  0x0FFFFFFF  6
+XC2V6000         0x31060093  0x0FFFFFFF  6
+XC2V8000         0x01070093  0x0FFFFFFF  6
+XC4VLX40         0x316A4093  0x0FFFFFFF  10
+XC4VLX160        0x01718093  0x0FFFFFFF  10
+XC4VLX200        0x01734093  0x0FFFFFFF  10
+XC5VLX50T        0x02A96093  0x0FFFFFFF  10
+XC5VLX110        0x228D6093  0x0FFFFFFF  10
+XC5VLX330        0x2295C093  0x0FFFFFFF  10
+XC2S200E         0x20A1C093  0x0FFFFFFF  5
+XC2S300E         0x90A20093  0x0FFFFFFF  5
+XC3S200A         0x02218093  0x0FFFFFFF  6
+XC3S4000         0x01448093  0x0FFFFFFF  6
+XC6SLX45         0x04008093  0x0FFFFFFF  6
+
+# ARM
+
+ARM7TDMI         0x3F0F0F0F  0xFFFFFFFF  4
+ARM7TDMI-r4      0x40700F0F  0xFFFFFFFF  4
+ARM720T          0x0F0F0F0F  0xFFFFFFFF  4
+ARM920T          0x10920F0F  0xFFFFFFFF  4
+ARM926EJ-S       0x07926F0F  0xFFFFFFFF  4
+ARM940T          0x1F0F0F0F  0xFFFFFFFF  4
+ARM10200         0x00A20F0F  0xFFFFFFFF  4
+ARMFLASH         0x0F0E5F2F  0xFFFFFFFF  5
+ARMDBT           0x00000F0F  0xFFFFFFFF  5
+PWP926EJ-S_BS2   0x0F21FF0F  0xFFFFFFFF  2
+ARM_BS2_         0x0F203F0F  0xFFFFFFFF  2
+ARM1136J-Sr0_BS2 0x0F21DF0F  0xFFFFFFFF  2
+ARM11MPCore_BS5  0x17536021  0xFFFFFFFF  5
+PXP1176JZF_BS2   0x0F2258EF  0xFFFFFFFF  2
+CORTEXA8         0x0F423477  0xFFFFFFFF  4
+CORTEXA9         0x08226021  0xFFFFFFFF  4
+
+# ALTERA
+
+EPM3032A         0x170320DD  0xFFFFFFFF  10
+EPM7256AE        0x172560DD  0xFFFFFFFF  10
+EPM7512AE        0x175120DD  0xFFFFFFFF  10
+EPM1270          0x020A30DD  0xFFFFFFFF  10
+EP20K1000E       0x090000DD  0xFFFFFFFF  10
+EP2S180F         0x020960DD  0xFFFFFFFF  10
+
+# Misc
+
+ispClock5520     0x00150043  0xFFFFFFFF  8
+ispClock5620     0x00160043  0xFFFFFFFF  8
+ispClock5610V    0x00161043  0xFFFFFFFF  8
+ispClock5610AV   0x00166043  0xFFFFFFFF  8
+ISSP             0x0F0F0F0F  0x0FFFFFFF  5
+Mali200          0x10400477  0xFFFFFFFF  2
+PLX6520          0x3197839B  0xFFFFFFFF  5
+PLX8114          0x21FB239B  0xFFFFFFFF  5
+PLX8518          0x1214639B  0xFFFFFFFF  5
+PLX8518          0x4214639B  0xFFFFFFFF  5
+
+STM32TMC         0x16410041  0x0FFF0FFF  5
+STM32CM3         0x3BA00477  0x0FFFFFFF  4
+IDT89HPES32H8    0x08035067  0xFFFFFFFF  6
+IDT89H16NT16     0x28090067  0xFFFFFFFF  6
+NX5000_BYPASS    0x14951185  0xFFFFFFFF  4
+NX5000_FC1152    0x03387589  0xFFFFFFFF  4

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0013-Platform-corstone1000-Fix-isolation-L2-memory-protection.patch

@@ -0,0 +1,88 @@
+From 4d3ebb03b89b122af490824ca73287954a35bd07 Mon Sep 17 00:00:00 2001
+From: Jamie Fox <jamie.fox@arm.com>
+Date: Thu, 22 Aug 2024 16:54:45 +0100
+Subject: [PATCH] Platform: corstone1000: Fix isolation L2 memory protection
+
+The whole of the SRAM was configured unprivileged on this platform, so
+the memory protection required for isolation level 2 was not present.
+
+This patch changes the S_DATA_START to S_DATA_LIMIT MPU region to be
+configured for privileged access only. It also reorders the MPU regions
+so that the App RoT sub-region overlapping S_DATA has a higher region
+number and so takes priority in the operation of the Armv6-M MPU.
+
+Signed-off-by: Jamie Fox <jamie.fox@arm.com>
+Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/30951]
+---
+ .../arm/corstone1000/tfm_hal_isolation.c      | 43 +++++++++----------
+ 1 file changed, 21 insertions(+), 22 deletions(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c b/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+index 39b19c535..498f14ed2 100644
+--- a/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
++++ b/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2020-2023, Arm Limited. All rights reserved.
++ * Copyright (c) 2020-2024, Arm Limited. All rights reserved.
+  * Copyright (c) 2022 Cypress Semiconductor Corporation (an Infineon
+  * company) or an affiliate of Cypress Semiconductor Corporation. All rights
+  * reserved.
+@@ -99,6 +99,26 @@ enum tfm_hal_status_t tfm_hal_set_up_static_boundaries(
+         return ret;
+     }
+ 
++    /* Set the RAM attributes. It is needed because the first region overlaps the whole
++     * SRAM and it has to be overridden.
++     * The RAM_MPU_REGION_BLOCK_1_SIZE and RAM_MPU_REGION_BLOCK_2_SIZE are calculated manually
++     * and added to the platform_region_defs compile definitions.
++     */
++    base = S_DATA_START;
++    limit = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE;
++    ret = configure_mpu(rnr++, base, limit,
++                            XN_EXEC_NOT_OK, AP_RW_PRIV_ONLY);
++    if (ret != TFM_HAL_SUCCESS) {
++        return ret;
++    }
++
++    base = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE;
++    limit = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE + RAM_MPU_REGION_BLOCK_2_SIZE;
++    ret = configure_mpu(rnr++, base, limit,
++                            XN_EXEC_NOT_OK, AP_RW_PRIV_ONLY);
++    if (ret != TFM_HAL_SUCCESS) {
++        return ret;
++    }
+ 
+     /* RW, ZI and stack as one region */
+     base = (uint32_t)&REGION_NAME(Image$$, TFM_APP_RW_STACK_START, $$Base);
+@@ -133,27 +153,6 @@ enum tfm_hal_status_t tfm_hal_set_up_static_boundaries(
+ 
+ #endif
+ 
+-    /* Set the RAM attributes. It is needed because the first region overlaps the whole
+-     * SRAM and it has to be overridden.
+-     * The RAM_MPU_REGION_BLOCK_1_SIZE and RAM_MPU_REGION_BLOCK_2_SIZE are calculated manually
+-     * and added to the platform_region_defs compile definitions.
+-     */
+-    base = S_DATA_START;
+-    limit = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE;
+-    ret = configure_mpu(rnr++, base, limit,
+-                            XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+-    if (ret != TFM_HAL_SUCCESS) {
+-        return ret;
+-    }
+-
+-    base = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE;
+-    limit = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE + RAM_MPU_REGION_BLOCK_2_SIZE;
+-    ret = configure_mpu(rnr++, base, limit,
+-                            XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+-    if (ret != TFM_HAL_SUCCESS) {
+-        return ret;
+-    }
+-
+     arm_mpu_enable();
+ 
+ #endif /* CONFIG_TFM_ENABLE_MEMORY_PROTECT */
+-- 
+2.25.1
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m-corstone1000.inc

@@ -29,6 +29,7 @@ SRC_URI:append:corstone1000 = " \
     file://0010-CC312-alignment-of-cc312-differences-between-fvp-and.patch \
     file://0011-Platform-corstone1000-Increase-buffers-for-EFI-vars.patch \
     file://0012-corstone1000-Remove-reset-after-capsule-update.patch \
+    file://0013-Platform-corstone1000-Fix-isolation-L2-memory-protection.patch \
     "
 
 # TF-M ships patches for external dependencies that needs to be applied

meta-arm-bsp/recipes-bsp/u-boot/u-boot-corstone1000.inc

@@ -64,6 +64,8 @@ SRC_URI:append = " \
     file://0046-Corstone1000-Change-MMCOMM-buffer-location.patch		  \
     file://0047-corstone1000-dts-add-external-system-node.patch \
     file://0048-corstone1000-Enable-UEFI-Secure-boot.patch 			  \
+    ${@bb.utils.contains('MACHINE_FEATURES', 'corstone1000-extsys', \
+                         '', 'file://0049-corstone1000-purge-remoteproc-dts-node.patch' , d)} \
     "
 
 do_configure:append() {

meta-arm-bsp/recipes-bsp/u-boot/u-boot/corstone1000/0049-corstone1000-purge-remoteproc-dts-node.patch

@@ -0,0 +1,34 @@
+From 4e0ab7af882fcf498fd8beb4024ea024e6464cef Mon Sep 17 00:00:00 2001
+From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+Date: Wed, 14 Aug 2024 14:33:50 +0000
+Subject: [PATCH] corstone1000: purge remoteproc DTS node
+
+Purge remoteproc DTS node
+This is done to remove the remote proc node from the DTS passed
+to Linux from U-Boot because the device tree binding for remoteproc
+has not been upstreamed yet. Existence of remoteproc DTS node in Linux 
+is causing dt-schema test for SystemReady-IR v2.0 certification to fail.
+
+Upstream-Status: Pending
+Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+---
+ board/armltd/corstone1000/corstone1000.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/board/armltd/corstone1000/corstone1000.c b/board/armltd/corstone1000/corstone1000.c
+index ef74dc9032..d474fce1b2 100644
+--- a/board/armltd/corstone1000/corstone1000.c
++++ b/board/armltd/corstone1000/corstone1000.c
+@@ -30,8 +30,7 @@ DT_NON_COMPLIANT_PURGE_LIST(foo) = {
+ 	{ .node_path = "/soc/mhu@1b010000" },
+ 	{ .node_path = "/soc/mhu@1b020000" },
+ 	{ .node_path = "/soc/mhu@1b030000" },
+-	{ .node_path = "/soc/client" },
+-	{ .node_path = "/soc/extsys@1A010310" },
++	{ .node_path = "/soc/remoteproc@1a010310" },
+ };
+ 
+ #define CORSTONE1000_KERNEL_PARTS 2
+-- 
+2.34.1
+

meta-arm-bsp/recipes-kernel/linux/files/no-fsl-ifc-nand.cfg

@@ -0,0 +1 @@
+CONFIG_MTD_NAND_FSL_IFC=n

meta-arm-bsp/recipes-kernel/linux/linux-arm-platforms.inc

@@ -36,13 +36,21 @@ SRC_URI:append:corstone1000 = " ${@bb.utils.contains('MACHINE_FEATURES', \
                                                             'file://corstone1000_kernel_debug.cfg', \
                                                             '', \
                                                              d)}"
-
 SRC_URI:append:corstone1000 = " \
-    file://extsys.cfg \
-    file://0001-remoteproc-Add-Arm-remoteproc-driver.patch \
-    file://0002-arm64-dts-Add-corstone1000-external-system-device-no.patch \
-    file://0003-dt-bindings-remoteproc-Add-Arm-remoteproc.patch \
-    "
+    ${@bb.utils.contains( \
+              'MACHINE_FEATURES', \
+              'corstone1000-extsys', \
+              ' \
+		  file://extsys.cfg \
+		  file://0001-remoteproc-Add-Arm-remoteproc-driver.patch \
+		  file://0002-arm64-dts-Add-corstone1000-external-system-device-no.patch \
+		  file://0003-dt-bindings-remoteproc-Add-Arm-remoteproc.patch \
+              ', \
+              '', \
+              d \
+        ) \
+    } \
+"
 
 # Default kernel features not needed for corstone1000
 # otherwise the extra kernel modules will increase the rootfs size
@@ -69,6 +77,9 @@ SRC_URI:append:fvp-base = " \
 #
 COMPATIBLE_MACHINE:juno = "juno"
 FILESEXTRAPATHS:prepend:juno := "${ARMBSPFILESPATHS}"
+SRC_URI:append:juno = " \
+    file://no-fsl-ifc-nand.cfg \
+    "
 
 #
 # Musca B1/S2 can't run Linux
@@ -95,6 +106,7 @@ SRC_URI:append:n1sdp = " \
     file://enable-realtek-R8169.cfg \
     file://enable-usb_conn_gpio.cfg \
     file://usb_xhci_pci_renesas.cfg \
+    file://no-fsl-ifc-nand.cfg \
     "
 # Since we use the intree defconfig and the preempt-rt turns off some configs
 # do_kernel_configcheck will display warnings. So, lets disable it.

meta-arm-bsp/recipes-security/optee/optee-client/tee-supplicant.sh

@@ -1,46 +0,0 @@
-#!/bin/sh
-
-# Source function library
-. /etc/init.d/functions
-
-NAME=tee-supplicant
-PATH=/sbin:/bin:/usr/sbin:/usr/bin
-DESC="OP-TEE Supplicant"
-
-DAEMON=@sbindir@/$NAME
-
-test -f $DAEMON || exit 0
-
-test -f @sysconfdir@/default/$NAME && . @sysconfdir@/default/$NAME
-test -f @sysconfdir@/default/rcS && . @sysconfdir@/default/rcS
-
-SSD_OPTIONS="--oknodo --quiet --exec $DAEMON -- -d $OPTARGS"
-
-set -e
-
-case $1 in
-    start)
-	    echo -n "Starting $DESC: "
-	    start-stop-daemon --start $SSD_OPTIONS
-        echo "${DAEMON##*/}."
-        ;;
-    stop)
-	    echo -n "Stopping $DESC: "
-	    start-stop-daemon --stop $SSD_OPTIONS
-        echo "${DAEMON##*/}."
-        ;;
-    restart|force-reload)
-	    $0 stop
-	    sleep 1
-	    $0 start
-        ;;
-    status)
-        status ${DAEMON} || exit $?
-        ;;
-    *)
-        echo "Usage: $0 {start|stop|restart|force-reload|status}" >&2
-        exit 1
-        ;;
-esac
-
-exit 0

meta-arm-bsp/recipes-security/optee/optee-client/tee-supplicant@.service

@@ -1,10 +0,0 @@
-[Unit]
-Description=TEE Supplicant on %i
-
-[Service]
-User=root
-EnvironmentFile=-@sysconfdir@/default/tee-supplicant
-ExecStart=@sbindir@/tee-supplicant $OPTARGS
-
-[Install]
-WantedBy=basic.target

meta-arm-systemready/lib/oeqa/runtime/cases/arm_systemready_opensuse_unattended.py

@@ -0,0 +1,42 @@
+from oeqa.runtime.case import OERuntimeTestCase
+
+class SystemReadyOpenSUSEUnattendedTest(OERuntimeTestCase):
+    def setUp(self):
+        super().setUp()
+        self.console = self.target.DEFAULT_CONSOLE
+
+    def test_opensuse_unattended(self):
+        # Turn on the FVP.
+        self.target.transition('on')
+
+        # Timeout value = elapsed time * 2; where elapsed time was collected
+        # from the elapsed time in the log.do_testimage for each function after
+        # the build is finished on the development machine.
+        self.target.expect(self.console,
+                           'Booting `Installation\'',
+                           timeout=(2 * 60))
+        bb.plain('Installation status: Loading the kernel, initrd and basic drivers...')
+
+        self.target.expect(self.console,
+                           'Starting hardware detection...',
+                           timeout=(40 * 60))
+        bb.plain('Installation status: Starting hardware detection...')
+
+        self.target.expect(self.console,
+                           'Loading Installation System',
+                           timeout=(60 * 60))
+        bb.plain('Installation status: Loading Installation System...')
+
+        self.target.expect(self.console,
+                           'Starting Installer',
+                           timeout=(40 * 60))
+        bb.plain('Installation status: Performing Installation...')
+
+        self.target.expect(self.console,
+                           'Finishing Configuration',
+                           timeout=(15 * 60 * 60))
+        bb.plain('Installation status: Finishing Configuration...')
+
+        # Waiting till the installation is finished.
+        self.target.expect(self.console, r'.*login: ', timeout=(6 * 60 * 60))
+        bb.plain('Installation status: openSUSE installation finished successfully.')

meta-arm-systemready/recipes-test/arm-systemready-acs/arm-systemready-ir-acs.bb

@@ -48,10 +48,10 @@ TEST_SUITES = "arm_systemready_ir_acs"
 PV = "2.0.0"
 PV_DATE = "23.03"
 FULL_PV = "v${PV_DATE}_${PV}"
-ARM_SYSTEMREADY_IR_ACS_BRANCH ?= "main"
-IMAGE_FILENAME = "ir-acs-live-image-generic-arm64.wic"
+ARM_SYSTEMREADY_IR_ACS_BRANCH ?= "legacy_systemready"
+IMAGE_FILENAME = "ir-acs-live-image-generic-arm64-${PV}.wic"
 SRC_URI = " \
-    https://github.com/ARM-software/arm-systemready/raw/${ARM_SYSTEMREADY_IR_ACS_BRANCH}/IR/prebuilt_images/${FULL_PV}/${IMAGE_FILENAME}.xz;name=acs-img \
+    https://github.com/ARM-software/arm-systemready/raw/${ARM_SYSTEMREADY_IR_ACS_BRANCH}/IR/prebuilt_images/${FULL_PV}/ir-acs-live-image-generic-arm64.wic.xz;name=acs-img;downloadfilename=${IMAGE_FILENAME}.xz \
     git://git.gitlab.arm.com/systemready/systemready-ir-template.git;protocol=https;nobranch=1;destsuffix=systemready-ir-template;name=sr-ir-template \
 "
 SRC_URI[acs-img.sha256sum] = "ea52f84dab44bde97de3e2d2224d883acaae35724dd8e2bdfb125de49040f9b3"

meta-arm-systemready/recipes-test/arm-systemready-linux-distros/arm-systemready-linux-distros-opensuse.bb

@@ -72,3 +72,18 @@ ISO_TYPE = "DVD"
 BUILD_NO = "491.1"
 SRC_URI = "https://download.opensuse.org/distribution/leap/${PV}/iso/openSUSE-Leap-${PV}-${ISO_TYPE}-aarch64-Build${BUILD_NO}-Media.iso;unpack=0;downloadfilename=${ISO_IMAGE_NAME}.iso"
 SRC_URI[sha256sum] = "456cc4f99b044429d8a89bd302c06e9e382d6ac4dc590139a7096ebb54f5357b"
+
+TEST_SUITES = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "arm_systemready_opensuse_unattended", "", d)}"
+
+ISO_LABEL = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "OEMDRV", "", d)}"
+BOOT_CATALOG = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "boot.catalog", "", d)}"
+BOOT_IMAGE = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "EFI/BOOT/bootaa64.efi", "", d)}"
+EFI_IMAGE = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "boot/aarch64/efi", "", d)}"
+
+modifyiso() {
+    UNATTENDED_CONF_DIR="${THISDIR}/unattended-boot-conf/openSUSE"
+
+    #create installation configuration files, remove grub timeout, setup network
+    cp "${UNATTENDED_CONF_DIR}/autoinst.xml" ${EXTRACTED_ISO_TEMP_DIR}
+    sed -i 's/timeout=60/timeout=0/g' "${EXTRACTED_ISO_TEMP_DIR}/EFI/BOOT/grub.cfg"
+}

meta-arm-systemready/recipes-test/arm-systemready-linux-distros/arm-systemready-linux-distros-unattended.inc

@@ -0,0 +1,45 @@
+SUMMARY = "Arm SystemReady Linux distros unattended requirements"
+DESCRIPTION = "Arm SystemReady Linux distro unattended configurations \
+               and ISO image modification"
+
+EXTRACTED_ISO_TEMP_DIR = "${WORKDIR}/extracted_iso_temp_dir"
+NEW_ISO_TEMP_DIR = "${WORKDIR}/new_iso_temp_dir"
+
+# oeqa test case must be added to TEST_SUITES to acknowledge that the unattended
+# installation was successful.
+inherit testimage
+
+python () {
+    unattended_required_vars = ['ISO_LABEL', 'BOOT_CATALOG', 'BOOT_IMAGE', 'EFI_IMAGE']
+
+    for var in unattended_required_vars:
+        if not d.getVar(var):
+            raise bb.parse.SkipRecipe(f'{var} variable is not set')
+}
+
+unpackiso() {
+    # Unpack the ISO image
+    bsdtar -xf ${WORKDIR}/${ISO_IMAGE_NAME}.iso -C ${EXTRACTED_ISO_TEMP_DIR}
+    chmod -R u+rw ${EXTRACTED_ISO_TEMP_DIR}
+}
+
+modifyiso() {
+
+}
+
+repackiso() {
+    # Repack the ISO image
+    mkisofs -o ${NEW_ISO_TEMP_DIR}/${ISO_IMAGE_NAME}.iso -U -r -v -T -J -joliet-long -V ${ISO_LABEL} \
+            -volset ${ISO_LABEL} -A ${ISO_LABEL} -b ${BOOT_IMAGE} -c ${BOOT_CATALOG} -no-emul-boot \
+            -boot-load-size 4 -boot-info-table -J -R -V ${ISO_LABEL} -eltorito-alt-boot \
+            -eltorito-boot ${EFI_IMAGE} -no-emul-boot ${EXTRACTED_ISO_TEMP_DIR}
+
+    mv -f ${NEW_ISO_TEMP_DIR}/${ISO_IMAGE_NAME}.iso ${WORKDIR}
+}
+
+# Write the test data in IMAGE_POSTPROCESS_COMMAND
+IMAGE_POSTPROCESS_COMMAND += "write_image_test_data; "
+
+do_unpack[depends] += "cdrtools-native:do_populate_sysroot libarchive-native:do_populate_sysroot"
+do_unpack[postfuncs] += "unpackiso modifyiso repackiso"
+do_unpack[cleandirs] += "${EXTRACTED_ISO_TEMP_DIR} ${NEW_ISO_TEMP_DIR}"

meta-arm-systemready/recipes-test/arm-systemready-linux-distros/arm-systemready-linux-distros.inc

@@ -2,7 +2,12 @@ SUMMARY = "Arm SystemReady Linux distros installation"
 DESCRIPTION = "Arm SystemReady Linux distro CD/DVD images and installation \
                target disk image"
 
-IMAGE_CLASSES:remove = "license_image testimage"
+DISTRO_UNATTENDED_INST_TESTS ?= "0"
+
+require ${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "arm-systemready-linux-distros-unattended.inc", "", d)}
+
+IMAGE_CLASSES:remove = "license_image"
+IMAGE_CLASSES:remove = "${@oe.utils.vartrue("DISTRO_UNATTENDED_INST_TESTS", "", "testimage", d)}"
 BUILDHISTORY_FEATURES:remove = "image"
 
 INHIBIT_DEFAULT_DEPS = "1"
@@ -15,7 +20,7 @@ do_configure[noexec] = "1"
 do_compile[noexec] = "1"
 
 ISO_IMAGE_NAME = "${PN}-${PV}"
-IMAGE_LINK_NAME = "${PN}-${PV}-${MACHINE}"
+IMAGE_LINK_NAME = "${PN}-${MACHINE}"
 
 ARM_SYSTEMREADY_LINUX_DISTRO_ISO_IMAGE = \
     "${DEPLOY_DIR_IMAGE}/${ISO_IMAGE_NAME}.iso"
@@ -44,7 +49,13 @@ python do_image_complete() {
     from oe.utils import execute_pre_post_process
     post_process_cmds = d.getVar("IMAGE_POSTPROCESS_COMMAND")
     execute_pre_post_process(d, post_process_cmds)
+
+    if d.getVar('DISTRO_UNATTENDED_INST_TESTS') == "1":
+        # Ensure an empty rootfs manifest exists (required by testimage)
+        fname = os.path.join(d.getVar('IMGDEPLOYDIR'), d.getVar('IMAGE_LINK_NAME') + ".manifest")
+        open(fname, 'w').close()
 }
+
 do_image_complete[nostamp] = "1"
 addtask image_complete after do_deploy before do_build
 

meta-arm-systemready/recipes-test/arm-systemready-linux-distros/unattended-boot-conf/openSUSE/autoinst.xml

@@ -0,0 +1,935 @@
+<?xml version="1.0"?>
+<!DOCTYPE profile>
+<profile xmlns="http://www.suse.com/1.0/yast2ns" xmlns:config="http://www.suse.com/1.0/configns">
+  <bootloader t="map">
+    <global t="map">
+      <append>splash=silent preempt=full mitigations=auto quiet security=apparmor</append>
+      <cpu_mitigations>auto</cpu_mitigations>
+      <gfxmode>auto</gfxmode>
+      <hiddenmenu>false</hiddenmenu>
+      <os_prober>true</os_prober>
+      <secure_boot>true</secure_boot>
+      <terminal>gfxterm</terminal>
+      <timeout t="integer">8</timeout>
+      <update_nvram>true</update_nvram>
+    </global>
+    <loader_type>grub2-efi</loader_type>
+  </bootloader>
+  <firewall t="map">
+    <default_zone>public</default_zone>
+    <enable_firewall t="boolean">true</enable_firewall>
+    <log_denied_packets>off</log_denied_packets>
+    <start_firewall t="boolean">true</start_firewall>
+    <zones t="list">
+      <zone t="map">
+        <description>Unsolicited incoming network packets are rejected. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>block</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list"/>
+        <short>Block</short>
+        <target>%%REJECT%%</target>
+      </zone>
+      <zone t="map">
+        <description>For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>dmz</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list">
+          <service>ssh</service>
+        </services>
+        <short>DMZ</short>
+        <target>default</target>
+      </zone>
+      <zone t="map">
+        <description>All network connections are accepted.</description>
+        <interfaces t="list">
+          <interface>docker0</interface>
+        </interfaces>
+        <masquerade t="boolean">false</masquerade>
+        <name>docker</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list"/>
+        <short>docker</short>
+        <target>ACCEPT</target>
+      </zone>
+      <zone t="map">
+        <description>Unsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>drop</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list"/>
+        <short>Drop</short>
+        <target>DROP</target>
+      </zone>
+      <zone t="map">
+        <description>For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">true</masquerade>
+        <name>external</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list">
+          <service>ssh</service>
+        </services>
+        <short>External</short>
+        <target>default</target>
+      </zone>
+      <zone t="map">
+        <description>For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>home</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list">
+          <service>dhcpv6-client</service>
+          <service>mdns</service>
+          <service>samba-client</service>
+          <service>ssh</service>
+        </services>
+        <short>Home</short>
+        <target>default</target>
+      </zone>
+      <zone t="map">
+        <description>For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>internal</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list">
+          <service>dhcpv6-client</service>
+          <service>mdns</service>
+          <service>samba-client</service>
+          <service>ssh</service>
+        </services>
+        <short>Internal</short>
+        <target>default</target>
+      </zone>
+      <zone t="map">
+        <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
+        <interfaces t="list">
+          <interface>eth0</interface>
+        </interfaces>
+        <masquerade t="boolean">false</masquerade>
+        <name>public</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list">
+          <service>dhcpv6-client</service>
+          <service>ssh</service>
+        </services>
+        <short>Public</short>
+        <target>default</target>
+      </zone>
+      <zone t="map">
+        <description>All network connections are accepted.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>trusted</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list"/>
+        <short>Trusted</short>
+        <target>ACCEPT</target>
+      </zone>
+      <zone t="map">
+        <description>For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
+        <interfaces t="list"/>
+        <masquerade t="boolean">false</masquerade>
+        <name>work</name>
+        <ports t="list"/>
+        <protocols t="list"/>
+        <services t="list">
+          <service>dhcpv6-client</service>
+          <service>ssh</service>
+        </services>
+        <short>Work</short>
+        <target>default</target>
+      </zone>
+    </zones>
+  </firewall>
+  <general t="map">
+    <mode t="map">
+      <confirm t="boolean">false</confirm>
+    </mode>
+  </general>
+  <groups t="list">
+    <group t="map">
+      <gid>100</gid>
+      <groupname>users</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>499</gid>
+      <groupname>messagebus</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>1</gid>
+      <groupname>bin</groupname>
+      <userlist>daemon</userlist>
+    </group>
+    <group t="map">
+      <gid>488</gid>
+      <groupname>input</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>495</gid>
+      <groupname>kmem</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>493</gid>
+      <groupname>utmp</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>62</gid>
+      <groupname>man</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>477</gid>
+      <groupname>polkitd</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>479</gid>
+      <groupname>systemd-timesync</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>2</gid>
+      <groupname>daemon</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>480</gid>
+      <groupname>systemd-network</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>71</gid>
+      <groupname>ntadmin</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>490</gid>
+      <groupname>dialout</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>59</gid>
+      <groupname>maildrop</groupname>
+      <userlist>postfix</userlist>
+    </group>
+    <group t="map">
+      <gid>478</gid>
+      <groupname>nscd</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>51</gid>
+      <groupname>postfix</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>485</gid>
+      <groupname>tape</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>487</gid>
+      <groupname>render</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>476</gid>
+      <groupname>sshd</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>491</gid>
+      <groupname>cdrom</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>486</gid>
+      <groupname>sgx</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>0</gid>
+      <groupname>root</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>489</gid>
+      <groupname>disk</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>15</gid>
+      <groupname>shadow</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>484</gid>
+      <groupname>video</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>496</gid>
+      <groupname>wheel</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>483</gid>
+      <groupname>audit</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>498</gid>
+      <groupname>mail</groupname>
+      <userlist>postfix</userlist>
+    </group>
+    <group t="map">
+      <gid>5</gid>
+      <groupname>tty</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>65533</gid>
+      <groupname>nogroup</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>65534</gid>
+      <groupname>nobody</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>497</gid>
+      <groupname>lp</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>482</gid>
+      <groupname>chrony</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>492</gid>
+      <groupname>audio</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>494</gid>
+      <groupname>lock</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>36</gid>
+      <groupname>kvm</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>42</gid>
+      <groupname>trusted</groupname>
+      <userlist/>
+    </group>
+    <group t="map">
+      <gid>481</gid>
+      <groupname>systemd-journal</groupname>
+      <userlist/>
+    </group>
+  </groups>
+  <host t="map">
+    <hosts t="list">
+      <hosts_entry t="map">
+        <host_address>127.0.0.1</host_address>
+        <names t="list">
+          <name>localhost</name>
+        </names>
+      </hosts_entry>
+      <hosts_entry t="map">
+        <host_address>::1</host_address>
+        <names t="list">
+          <name>localhost ipv6-localhost ipv6-loopback</name>
+        </names>
+      </hosts_entry>
+      <hosts_entry t="map">
+        <host_address>fe00::0</host_address>
+        <names t="list">
+          <name>ipv6-localnet</name>
+        </names>
+      </hosts_entry>
+      <hosts_entry t="map">
+        <host_address>ff00::0</host_address>
+        <names t="list">
+          <name>ipv6-mcastprefix</name>
+        </names>
+      </hosts_entry>
+      <hosts_entry t="map">
+        <host_address>ff02::1</host_address>
+        <names t="list">
+          <name>ipv6-allnodes</name>
+        </names>
+      </hosts_entry>
+      <hosts_entry t="map">
+        <host_address>ff02::2</host_address>
+        <names t="list">
+          <name>ipv6-allrouters</name>
+        </names>
+      </hosts_entry>
+      <hosts_entry t="map">
+        <host_address>ff02::3</host_address>
+        <names t="list">
+          <name>ipv6-allhosts</name>
+        </names>
+      </hosts_entry>
+    </hosts>
+  </host>
+  <language t="map">
+    <language>en_GB</language>
+    <languages>en_GB</languages>
+  </language>
+  <networking t="map">
+    <dhcp_options t="map">
+      <dhclient_client_id/>
+      <dhclient_hostname_option>AUTO</dhclient_hostname_option>
+    </dhcp_options>
+    <dns t="map">
+      <dhcp_hostname t="boolean">true</dhcp_hostname>
+      <hostname>localhost</hostname>
+      <resolv_conf_policy>auto</resolv_conf_policy>
+    </dns>
+    <interfaces t="list">
+      <interface t="map">
+        <bootproto>dhcp</bootproto>
+        <name>eth0</name>
+        <startmode>auto</startmode>
+        <zone>public</zone>
+      </interface>
+    </interfaces>
+    <ipv6 t="boolean">true</ipv6>
+    <keep_install_network t="boolean">true</keep_install_network>
+    <managed t="boolean">false</managed>
+    <routing t="map">
+      <ipv4_forward t="boolean">false</ipv4_forward>
+      <ipv6_forward t="boolean">false</ipv6_forward>
+    </routing>
+  </networking>
+  <ntp-client t="map">
+    <ntp_policy>auto</ntp_policy>
+    <ntp_servers t="list"/>
+    <ntp_sync>systemd</ntp_sync>
+  </ntp-client>
+  <partitioning t="list">
+    <drive t="map">
+      <device>/dev/vda</device>
+      <disklabel>gpt</disklabel>
+      <enable_snapshots t="boolean">false</enable_snapshots>
+      <partitions t="list">
+        <partition t="map">
+          <create t="boolean">true</create>
+          <filesystem t="symbol">vfat</filesystem>
+          <format t="boolean">true</format>
+          <fstopt>utf8</fstopt>
+          <mount>/boot/efi</mount>
+          <mountby t="symbol">uuid</mountby>
+          <partition_id t="integer">259</partition_id>
+          <partition_nr t="integer">1</partition_nr>
+          <resize t="boolean">false</resize>
+          <size>134217728</size>
+        </partition>
+        <partition t="map">
+          <create t="boolean">true</create>
+          <create_subvolumes t="boolean">true</create_subvolumes>
+          <filesystem t="symbol">btrfs</filesystem>
+          <format t="boolean">true</format>
+          <mount>/</mount>
+          <mountby t="symbol">uuid</mountby>
+          <partition_id t="integer">131</partition_id>
+          <partition_nr t="integer">2</partition_nr>
+          <quotas t="boolean">false</quotas>
+          <resize t="boolean">false</resize>
+          <size>6307167744</size>
+          <subvolumes t="list">
+            <subvolume t="map">
+              <copy_on_write t="boolean">false</copy_on_write>
+              <path>var</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>usr/local</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>tmp</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>srv</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>root</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>opt</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>home</path>
+            </subvolume>
+            <subvolume t="map">
+              <copy_on_write t="boolean">true</copy_on_write>
+              <path>boot/grub2/arm64-efi</path>
+            </subvolume>
+          </subvolumes>
+          <subvolumes_prefix>@</subvolumes_prefix>
+        </partition>
+      </partitions>
+      <type t="symbol">CT_DISK</type>
+      <use>all</use>
+    </drive>
+  </partitioning>
+  <proxy t="map">
+    <enabled t="boolean">false</enabled>
+  </proxy>
+  <services-manager t="map">
+    <default_target>multi-user</default_target>
+    <services t="map">
+      <enable t="list">
+        <service>YaST2-Firstboot</service>
+        <service>YaST2-Second-Stage</service>
+        <service>apparmor</service>
+        <service>auditd</service>
+        <service>klog</service>
+        <service>chronyd</service>
+        <service>cron</service>
+        <service>cups</service>
+        <service>firewalld</service>
+        <service>wickedd-auto4</service>
+        <service>wickedd-dhcp4</service>
+        <service>wickedd-dhcp6</service>
+        <service>wickedd-nanny</service>
+        <service>irqbalance</service>
+        <service>issue-generator</service>
+        <service>kbdsettings</service>
+        <service>wicked</service>
+        <service>nscd</service>
+        <service>postfix</service>
+        <service>purge-kernels</service>
+        <service>rsyslog</service>
+        <service>smartd</service>
+        <service>sshd</service>
+        <service>systemd-pstore</service>
+        <service>systemd-remount-fs</service>
+      </enable>
+    </services>
+  </services-manager>
+  <software t="map">
+    <install_recommended t="boolean">true</install_recommended>
+    <instsource/>
+    <packages t="list">
+      <package>wicked</package>
+      <package>shim</package>
+      <package>os-prober</package>
+      <package>openssh</package>
+      <package>openSUSE-release</package>
+      <package>mokutil</package>
+      <package>kexec-tools</package>
+      <package>grub2-arm64-efi</package>
+      <package>glibc</package>
+      <package>firewalld</package>
+      <package>e2fsprogs</package>
+      <package>dosfstools</package>
+      <package>chrony</package>
+      <package>btrfsprogs</package>
+      <package>autoyast2</package>
+    </packages>
+    <patterns t="list">
+      <pattern>apparmor</pattern>
+      <pattern>base</pattern>
+      <pattern>documentation</pattern>
+      <pattern>enhanced_base</pattern>
+      <pattern>minimal_base</pattern>
+      <pattern>sw_management</pattern>
+      <pattern>yast2_basis</pattern>
+    </patterns>
+    <products t="list">
+      <product>Leap</product>
+    </products>
+  </software>
+  <ssh_import t="map">
+    <copy_config t="boolean">false</copy_config>
+    <import t="boolean">false</import>
+  </ssh_import>
+  <user_defaults t="map">
+    <expire/>
+    <group>100</group>
+    <home>/home</home>
+    <inactive>-1</inactive>
+    <shell>/bin/bash</shell>
+    <umask>022</umask>
+  </user_defaults>
+  <users t="list">
+    <user t="map">
+      <authorized_keys t="list"/>
+      <encrypted t="boolean">true</encrypted>
+      <fullname>user</fullname>
+      <gid>100</gid>
+      <home>/home/user</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max>99999</max>
+        <min>0</min>
+        <warn>7</warn>
+      </password_settings>
+      <shell>/bin/bash</shell>
+      <uid>1000</uid>
+      <user_password>$6$WV8CB/c6j0zhAi5S$4euhbt4alH7WNfaatS9IJgPiiKDJ48d5Ru1zCZCA0N9GiyOPuefN2PAUWlyYeTgqAInpyvPh1frdp4fFVjvEn0</user_password>
+      <username>user</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>User for nscd</fullname>
+      <gid>478</gid>
+      <home>/run/nscd</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/sbin/nologin</shell>
+      <uid>478</uid>
+      <user_password>!</user_password>
+      <username>nscd</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>systemd Network Management</fullname>
+      <gid>480</gid>
+      <home>/</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>480</uid>
+      <user_password>!*</user_password>
+      <username>systemd-network</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>Daemon</fullname>
+      <gid>2</gid>
+      <home>/sbin</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>2</uid>
+      <user_password>!</user_password>
+      <username>daemon</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>systemd Time Synchronization</fullname>
+      <gid>479</gid>
+      <home>/</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>479</uid>
+      <user_password>!*</user_password>
+      <username>systemd-timesync</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>user for rpcbind</fullname>
+      <gid>65534</gid>
+      <home>/var/lib/empty</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/sbin/nologin</shell>
+      <uid>475</uid>
+      <user_password>!</user_password>
+      <username>rpc</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>SSH daemon</fullname>
+      <gid>476</gid>
+      <home>/var/lib/sshd</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>476</uid>
+      <user_password>!</user_password>
+      <username>sshd</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>Postfix Daemon</fullname>
+      <gid>51</gid>
+      <home>/var/spool/postfix</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>51</uid>
+      <user_password>!</user_password>
+      <username>postfix</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>NFS statd daemon</fullname>
+      <gid>65533</gid>
+      <home>/var/lib/nfs</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/sbin/nologin</shell>
+      <uid>474</uid>
+      <user_password>!</user_password>
+      <username>statd</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>bin</fullname>
+      <gid>1</gid>
+      <home>/bin</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>1</uid>
+      <user_password>!</user_password>
+      <username>bin</username>
+    </user>
+    <user t="map">
+      <authorized_keys t="list"/>
+      <encrypted t="boolean">true</encrypted>
+      <fullname>root</fullname>
+      <gid>0</gid>
+      <home>/root</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/bin/bash</shell>
+      <uid>0</uid>
+      <user_password>$6$zAe5W7gw/kja9aKy$mM.BWtNyjalXrDNig4CUfN3bgfmehUIs8.zvBwWn1XroK104G.rY3lyup3OH8TujieUmgO4J74Df.LktV4A1K1</user_password>
+      <username>root</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>User for D-Bus</fullname>
+      <gid>499</gid>
+      <home>/run/dbus</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/bin/false</shell>
+      <uid>499</uid>
+      <user_password>!</user_password>
+      <username>messagebus</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>Manual pages viewer</fullname>
+      <gid>62</gid>
+      <home>/var/lib/empty</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>13</uid>
+      <user_password>!</user_password>
+      <username>man</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>Printing daemon</fullname>
+      <gid>497</gid>
+      <home>/var/spool/lpd</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>497</uid>
+      <user_password>!</user_password>
+      <username>lp</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>User for polkitd</fullname>
+      <gid>477</gid>
+      <home>/var/lib/polkit</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>477</uid>
+      <user_password>!</user_password>
+      <username>polkitd</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>Chrony Daemon</fullname>
+      <gid>482</gid>
+      <home>/var/lib/chrony</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>496</uid>
+      <user_password>!</user_password>
+      <username>chrony</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>nobody</fullname>
+      <gid>65534</gid>
+      <home>/var/lib/nobody</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/bin/bash</shell>
+      <uid>65534</uid>
+      <user_password>!</user_password>
+      <username>nobody</username>
+    </user>
+    <user t="map">
+      <encrypted t="boolean">true</encrypted>
+      <fullname>Mailer daemon</fullname>
+      <gid>498</gid>
+      <home>/var/spool/clientmqueue</home>
+      <home_btrfs_subvolume t="boolean">false</home_btrfs_subvolume>
+      <password_settings t="map">
+        <expire/>
+        <flag/>
+        <inact/>
+        <max/>
+        <min/>
+        <warn/>
+      </password_settings>
+      <shell>/usr/sbin/nologin</shell>
+      <uid>498</uid>
+      <user_password>!</user_password>
+      <username>mail</username>
+    </user>
+  </users>
+</profile>

meta-arm-toolchain/conf/distro/include/tcmode-external-arm.inc

@@ -15,6 +15,11 @@ EAT_TARGET_SYS:aarch64 ?= "${@ 'aarch64-none-linux-gnu' if os.path.exists('${EXT
 EAT_TARGET_SYS = "${TARGET_SYS}"
 TARGET_PREFIX = "${EAT_TARGET_SYS}-"
 
+EXTERNAL_TOOLCHAIN_LIBDIR = "${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', '/usr/lib', '/lib', d)}"
+EXTERNAL_TOOLCHAIN_DYN_LINKER_PATH:arm ?= " -Wl,--dynamic-linker=${EXTERNAL_TOOLCHAIN_LIBDIR}/ld-linux-armhf.so.3"
+EXTERNAL_TOOLCHAIN_DYN_LINKER_PATH:aarch64 ?= " -Wl,--dynamic-linker=${EXTERNAL_TOOLCHAIN_LIBDIR}/ld-linux-aarch64.so.1"
+TARGET_LDFLAGS:append:class-target = "${EXTERNAL_TOOLCHAIN_DYN_LINKER_PATH}"
+
 EAT_LIBDIR:arm = "lib"
 EAT_LIBDIR:aarch64 = "lib64"
 

meta-arm-toolchain/recipes-core/util-linux/util-linux_%.bbappend

@@ -0,0 +1 @@
+PACKAGECONFIG:remove = "${@bb.utils.contains('TCMODE', 'external-arm', 'libmount-mountfd-support', '' , d)}"

meta-arm-toolchain/recipes-devtools/external-arm-toolchain/external-arm-toolchain.bb

@@ -118,54 +118,80 @@ do_install() {
 	else
 		cp ${CP_ARGS} ${EXTERNAL_TOOLCHAIN}/${EAT_TARGET_SYS}/libc/lib/${linker_name} ${D}${base_libdir}/
 	fi
-	ln -sf ../../lib/librt.so.1 ${D}${libdir}/librt.so
-	ln -sf ../../lib/libcrypt.so.1 ${D}${libdir}/libcrypt.so
-	ln -sf ../../lib/libresolv.so.2 ${D}${libdir}/libresolv.so
-	ln -sf ../../lib/libnss_hesiod.so.2 ${D}${libdir}/libnss_hesiod.so
-	ln -sf ../../lib/libutil.so.1 ${D}${libdir}/libutil.so
-	ln -sf ../../lib/libBrokenLocale.so.1 ${D}${libdir}/libBrokenLocale.so
-	ln -sf ../../lib/libpthread.so.0 ${D}${libdir}/libpthread.so
-	ln -sf ../../lib/libthread_db.so.1 ${D}${libdir}/libthread_db.so
-	ln -sf ../../lib/libanl.so.1 ${D}${libdir}/libanl.so
-	ln -sf ../../lib/libdl.so.2 ${D}${libdir}/libdl.so
-	ln -sf ../../lib/libnss_db.so.2 ${D}${libdir}/libnss_db.so
-	ln -sf ../../lib/libnss_dns.so.2 ${D}${libdir}/libnss_dns.so
-	ln -sf ../../lib/libnss_files.so.2 ${D}${libdir}/libnss_files.so
-	ln -sf ../../lib/libnss_compat.so.2 ${D}${libdir}/libnss_compat.so
-	ln -sf ../../lib/libm.so.6 ${D}${libdir}/libm.so
-	ln -sf ../../lib/libc_malloc_debug.so.0 ${D}${libdir}/libc_malloc_debug.so
 
-	# remove potential .so duplicates from base_libdir
-	# for all symlinks created above in libdir
-	rm -f ${D}${base_libdir}/librt.so
-	rm -f ${D}${base_libdir}/libcrypt.so
-	rm -f ${D}${base_libdir}/libresolv.so
-	rm -f ${D}${base_libdir}/libnss_hesiod.so
-	rm -f ${D}${base_libdir}/libutil.so
-	rm -f ${D}${base_libdir}/libBrokenLocale.so
-	rm -f ${D}${base_libdir}/libpthread.so
-	rm -f ${D}${base_libdir}/libthread_db.so
-	rm -f ${D}${base_libdir}/libanl.so
-	rm -f ${D}${base_libdir}/libdl.so
-	rm -f ${D}${base_libdir}/libnss_db.so
-	rm -f ${D}${base_libdir}/libnss_dns.so
-	rm -f ${D}${base_libdir}/libnss_files.so
-	rm -f ${D}${base_libdir}/libnss_compat.so
-	rm -f ${D}${base_libdir}/libm.so
-
-	# Move these completely to ${libdir} and delete duplicates in ${base_libdir}
-	for lib in asan hwasan atomic gfortran gomp itm lsan sanitizer stdc++ tsan ubsan; do
-		if [ -e ${D}${base_libdir}/lib${lib}.spec ] ; then
-			mv ${D}${base_libdir}/lib${lib}.spec ${D}${libdir}
+	if ${@bb.utils.contains('DISTRO_FEATURES', 'usrmerge', 'false', 'true', d)}; then
+		ln -sf ../../lib/librt.so.1 ${D}${libdir}/librt.so
+		ln -sf ../../lib/libcrypt.so.1 ${D}${libdir}/libcrypt.so
+		ln -sf ../../lib/libresolv.so.2 ${D}${libdir}/libresolv.so
+		ln -sf ../../lib/libnss_hesiod.so.2 ${D}${libdir}/libnss_hesiod.so
+		ln -sf ../../lib/libutil.so.1 ${D}${libdir}/libutil.so
+		ln -sf ../../lib/libBrokenLocale.so.1 ${D}${libdir}/libBrokenLocale.so
+		ln -sf ../../lib/libpthread.so.0 ${D}${libdir}/libpthread.so
+		ln -sf ../../lib/libthread_db.so.1 ${D}${libdir}/libthread_db.so
+		ln -sf ../../lib/libanl.so.1 ${D}${libdir}/libanl.so
+		ln -sf ../../lib/libdl.so.2 ${D}${libdir}/libdl.so
+		ln -sf ../../lib/libnss_db.so.2 ${D}${libdir}/libnss_db.so
+		ln -sf ../../lib/libnss_dns.so.2 ${D}${libdir}/libnss_dns.so
+		ln -sf ../../lib/libnss_files.so.2 ${D}${libdir}/libnss_files.so
+		ln -sf ../../lib/libnss_compat.so.2 ${D}${libdir}/libnss_compat.so
+		ln -sf ../../lib/libm.so.6 ${D}${libdir}/libm.so
+		ln -sf ../../lib/libc_malloc_debug.so.0 ${D}${libdir}/libc_malloc_debug.so
+		if [ -f ${D}${base_libdir}/libmvec.so.1 ]; then
+			ln -sf ../../lib/libmvec.so.1 ${D}${libdir}/libmvec.so
 		fi
-		if [ -e ${D}${base_libdir}/lib${lib}.a ] ; then
-			mv ${D}${base_libdir}/lib${lib}.a ${D}${libdir}
-		fi
-		rm -f ${D}${base_libdir}/lib${lib}*
-	done
 
-	# Clean up duplicate libs that are both in base_libdir and libdir
-	rm -f ${D}${libdir}/libgcc*
+		# remove potential .so duplicates from base_libdir
+		# for all symlinks created above in libdir
+		rm -f ${D}${base_libdir}/librt.so
+		rm -f ${D}${base_libdir}/libcrypt.so
+		rm -f ${D}${base_libdir}/libresolv.so
+		rm -f ${D}${base_libdir}/libnss_hesiod.so
+		rm -f ${D}${base_libdir}/libutil.so
+		rm -f ${D}${base_libdir}/libBrokenLocale.so
+		rm -f ${D}${base_libdir}/libpthread.so
+		rm -f ${D}${base_libdir}/libthread_db.so
+		rm -f ${D}${base_libdir}/libanl.so
+		rm -f ${D}${base_libdir}/libdl.so
+		rm -f ${D}${base_libdir}/libnss_db.so
+		rm -f ${D}${base_libdir}/libnss_dns.so
+		rm -f ${D}${base_libdir}/libnss_files.so
+		rm -f ${D}${base_libdir}/libnss_compat.so
+		rm -f ${D}${base_libdir}/libm.so
+		rm -f ${D}${base_libdir}/libmvec.so
+
+		# Move these completely to ${libdir} and delete duplicates in ${base_libdir}
+		for lib in asan hwasan atomic gfortran gomp itm lsan sanitizer stdc++ tsan ubsan; do
+			if [ -e ${D}${base_libdir}/lib${lib}.spec ] ; then
+				mv ${D}${base_libdir}/lib${lib}.spec ${D}${libdir}
+			fi
+			if [ -e ${D}${base_libdir}/lib${lib}.a ] ; then
+				mv ${D}${base_libdir}/lib${lib}.a ${D}${libdir}
+			fi
+			rm -f ${D}${base_libdir}/lib${lib}*
+		done
+
+		# Clean up duplicate libs that are both in base_libdir and libdir
+		rm -f ${D}${libdir}/libgcc*
+	else
+		ln -sf libcrypt.so.1 ${D}${libdir}/libcrypt.so
+		ln -sf libresolv.so.2 ${D}${libdir}/libresolv.so
+		ln -sf libnss_hesiod.so.2 ${D}${libdir}/libnss_hesiod.so
+		ln -sf libutil.so.1 ${D}${libdir}/libutil.so
+		ln -sf libBrokenLocale.so.1 ${D}${libdir}/libBrokenLocale.so
+		ln -sf libpthread.so.0 ${D}${libdir}/libpthread.so
+		ln -sf libthread_db.so.1 ${D}${libdir}/libthread_db.so
+		ln -sf libanl.so.1 ${D}${libdir}/libanl.so
+		ln -sf libdl.so.2 ${D}${libdir}/libdl.so
+		ln -sf libnss_db.so.2 ${D}${libdir}/libnss_db.so
+		ln -sf libnss_dns.so.2 ${D}${libdir}/libnss_dns.so
+		ln -sf libnss_files.so.2 ${D}${libdir}/libnss_files.so
+		ln -sf libnss_compat.so.2 ${D}${libdir}/libnss_compat.so
+		ln -sf libm.so.6 ${D}${libdir}/libm.so
+		ln -sf libc_malloc_debug.so.0 ${D}${libdir}/libc_malloc_debug.so
+		if [ -f ${D}${libdir}/libmvec.so.1 ]; then
+			ln -sf libmvec.so.1 ${D}${libdir}/libmvec.so
+		fi
+	fi
 
 	# Besides ld-${EAT_VER_LIBC}.so, other libs can have duplicates like lib*-${EAT_VER_LIBC}.so
 	# Only remove them if both are regular files and are identical
@@ -205,13 +231,13 @@ do_install() {
 	rm -rf ${D}${includedir}/rpcsvc/rquota.*
 
 	if [ -f ${D}${libdir}/libc.so ];then
-		sed -i -e "s# /${EAT_LIBDIR}/${EAT_TARGET_SYS}# ../../${EAT_LIBDIR}#g" -e "s# /usr/${EAT_LIBDIR}/# /usr/lib/#g" -e "s# /usr/${EAT_LIBDIR}/${EAT_TARGET_SYS}# .#g" -e "s# /${EAT_LIBDIR}/ld-linux# ../../${EAT_LIBDIR}/ld-linux#g" ${D}${libdir}/libc.so
+		sed -i -e "s# /usr/${EAT_LIBDIR}/# /usr/lib/#g" -e "s# /${EAT_LIBDIR}/ld-linux# ../../${base_libdir}/ld-linux#g" ${D}${libdir}/libc.so
 		sed -i -e "s# /${EAT_LIBDIR}/libc.so.6# /lib/libc.so.6#g" ${D}${libdir}/libc.so
-		sed -i -e "s# /lib# ../../lib#g" -e "s# /usr/lib# .#g" ${D}${libdir}/libc.so
+		sed -i -e "s# /lib# ../../${base_libdir}#g" -e "s# /usr/lib# .#g" ${D}${libdir}/libc.so
 	fi
 
 	if [ -f ${D}${base_libdir}/libc.so ];then
-		sed -i -e "s# /${EAT_LIBDIR}/${EAT_TARGET_SYS}# ../../lib#g" -e "s# /usr/${EAT_LIBDIR}/${EAT_TARGET_SYS}# .#g" -e "s# /${EAT_LIBDIR}/# /lib/#g" ${D}${base_libdir}/libc.so
+		sed -i -e "s# /${EAT_LIBDIR}/# /lib/#g" ${D}${base_libdir}/libc.so
 		if [ -f ${D}${base_libdir}/libc.so.6 ]; then
 			sed -i -e "s# /usr/${EAT_LIBDIR}/libc.so.6# /lib/libc.so.6#g" -e "s# /${EAT_LIBDIR}/libc.so.6# /lib/libc.so.6#g" ${D}${base_libdir}/libc.so.6
 		fi
@@ -527,7 +553,6 @@ FILES:${PN} += "\
 	${base_libdir}/ld*.so.* \
 	${base_libdir}/ld-*.so \
 	${base_libdir}/libpthread*.so.* \
-	${base_libdir}/libpthread*.so \
 	${base_libdir}/libpthread-*.so \
 	${base_libdir}/libresolv*.so.* \
 	${base_libdir}/libresolv-*.so \

meta-arm/lib/fvp/runner.py

@@ -134,8 +134,14 @@ class FVPRunner:
         for console in self._pexpects:
             import pexpect
             # Ensure pexpect logs all remaining output to the logfile
-            console.expect(pexpect.EOF, timeout=5.0)
-            console.close()
+            try:
+                console.expect(pexpect.EOF, timeout=30.0)
+            except pexpect.TIMEOUT:
+                pexpect_logfile = ""
+                if console.logfile is not None:
+                    pexpect_logfile = f" ({console.logfile})"
+                self._logger.debug(f"Unable to get EOF on pexpect spawn obj{pexpect_logfile}.")
+            console.close(force=True)
 
         if self._fvp_process and self._fvp_process.returncode and \
                 self._fvp_process.returncode > 0:

meta-arm/lib/oeqa/controllers/fvp.py

@@ -3,6 +3,7 @@ import enum
 import pathlib
 import pexpect
 import os
+import time
 
 from oeqa.core.target.ssh import OESSHTarget
 from fvp import runner
@@ -127,9 +128,19 @@ class OEFVPTarget(OESSHTarget):
         def call_pexpect(terminal, *args, **kwargs):
             attr = getattr(self.terminals[terminal], name)
             if callable(attr):
-                return attr(*args, **kwargs)
+                self.logger.debug(f"Calling {name} on {terminal} : with arguments -> {args}  :  {kwargs}")
+                start_time = time.monotonic()  # Record the start time
+
+                attr = getattr(self.terminals[terminal], name)
+                result = attr(*args, **kwargs)
+
+                end_time = time.monotonic()  # Record the end time
+                elapsed_time = end_time - start_time
+                self.logger.debug(f"Execution time for result: [ {result} ] - elapsed_time: {elapsed_time} seconds")
             else:
-                return attr
+                result = attr
+
+            return result
 
         return call_pexpect
 

meta-arm/lib/oeqa/runtime/cases/fvp_devices.py

@@ -1,16 +1,29 @@
 from oeqa.runtime.case import OERuntimeTestCase
 from oeqa.core.decorator.data import skipIfNotInDataVar
 from oeqa.core.decorator.depends import OETestDepends
+from time import sleep
 
 
 class FvpDevicesTest(OERuntimeTestCase):
-    def run_cmd(self, cmd, check=True):
+    def run_cmd(self, cmd, check=True, retry=3):
         """
         A wrapper around self.target.run, which:
           * Fails the test on command failure by default
           * Allows the "run" behavior to be overridden in sub-classes
+          * Has a retry mechanism when SSH returns 255
         """
-        (status, output) = self.target.run(cmd)
+        status = 255
+        # The loop is retrying the self.target.run() which uses SSH only when
+        # the SSH return code is 255, which might be an issue with
+        # "Connection refused" because the port isn't open yet
+        while status == 255 and retry > 0:
+            (status, output) = self.target.run(cmd)
+            retry -= 1
+            # In case the status is 255, delay the next retry to give time to
+            # the system to settle
+            if status == 255:
+                sleep(30)
+
         if status and check:
             self.fail("Command '%s' returned non-zero exit "
                       "status %d:\n%s" % (cmd, status, output))

meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc

@@ -246,4 +246,5 @@ addtask deploy after do_install
 CVE_PRODUCT = "arm:arm-trusted-firmware \
                arm:trusted_firmware-a \
                arm:arm_trusted_firmware \
-               arm_trusted_firmware_project:arm_trusted_firmware"
+               arm_trusted_firmware_project:arm_trusted_firmware \
+               trustedfirmware:trusted_firmware-a"

meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m.inc

@@ -123,3 +123,5 @@ INSANE_SKIP:${PN}-dbg += "buildpaths"
 # Target binaries will be 32-bit Arm
 INSANE_SKIP:${PN} += "arch"
 INSANE_SKIP:${PN}-dbg += "arch"
+
+CVE_PRODUCT = "trustedfirmware:trusted_firmware-m"

meta-arm/recipes-devtools/fvp/execstack-native.bb

@@ -0,0 +1,21 @@
+SUMMARY = "execstack tool"
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=c93c0550bd3173f4504b2cbd8991e50b"
+
+DEPENDS = "binutils-native elfutils-native"
+
+SRC_URI = "git://git.yoctoproject.org/prelink-cross;protocol=https;branch=master"
+SRCREV = "ff2561c02ade96c5d4d56ddd4e27ff064840a176"
+PV = "1.0+git${SRCPV}"
+
+S = "${WORKDIR}/git"
+
+inherit autotools native
+
+do_compile() {
+    oe_runmake -C ${B}/src execstack
+}
+
+do_install() {
+    oe_runmake -C ${B}/src install-binPROGRAMS DESTDIR="${D}"
+}

meta-arm/recipes-devtools/fvp/fvp-base-a-aem_11.25.15.bb

@@ -14,3 +14,6 @@ UPSTREAM_VERSION_UNKNOWN = "1"
 MODEL_CODE = "FVP_Base_RevC-2xAEMvA"
 
 COMPATIBLE_HOST = "(aarch64|x86_64).*-linux"
+
+require remove-execstack.inc
+REMOVE_EXECSTACKS:x86-64 = "${FVPDIR}/models/${FVP_ARCH_DIR}*/libarmctmodel.so"

meta-arm/recipes-devtools/fvp/remove-execstack.inc

@@ -0,0 +1,26 @@
+# Clear the executable stack flag on named shared libraries. This are typically
+# not needed, and glibc 2.41 will refuse to dlopen() a library that expects
+# an executable stack.
+#
+# The stack permissions can be checked with readelf -lW <.so> | grep GNU_STACK.
+# RW is read/write, RWE is read/write/execute.
+
+DEPENDS += "execstack-native"
+
+REMOVE_EXECSTACKS ?= ""
+
+do_install:append() {
+    for SO in ${REMOVE_EXECSTACKS}; do
+        NAME=$(basename $SO)
+        SO=${D}$SO
+
+        test -f $SO || bbfatal remove-execstack: cannot find $SO
+
+        if execstack --query $SO | grep -q ^X; then
+            bbnote "Stripping executable stack bit on $NAME"
+            execstack --clear-execstack $SO
+        else
+            bbwarn "Executable stack stripping no longer required for $NAME, remove"
+        fi
+    done
+}

meta-arm/recipes-security/optee/optee-os.inc

@@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=c1f21c4f72f372ef38a5a4aee55ec173"
 inherit deploy python3native
 require optee.inc
 
-CVE_PRODUCT = "linaro:op-tee op-tee:op-tee_os"
+CVE_PRODUCT = "linaro:op-tee \
+               op-tee:op-tee_os \
+               trustedfirmware:op-tee"
 
 DEPENDS = "python3-pyelftools-native python3-cryptography-native"
 

meta-arm/recipes-security/optee/optee-os/CVE-2026-33317-1.patch

@@ -0,0 +1,51 @@
+From fcacaa1f80c601907299b8f9de8b57cc35cd5a68 Mon Sep 17 00:00:00 2001
+From: Etienne Carriere <etienne.carriere@st.com>
+Date: Wed, 21 Jan 2026 13:55:33 +0100
+Subject: [PATCH 1/3] ta: pkcs11: check output buffer size on get attribute
+ value
+
+Check client output buffer input size and update its output
+size on PKCS11_CMD_GET_ATTRIBUTE_VALUE command.
+
+CVE: CVE-2026-33317
+Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/commit/e031c4e562023fd9f199e39fd2e85797e4cbdca9]
+
+Fixes: 783c1515c2f9 ("ta: pkcs11: Add support for getting object size and attribute value")
+Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
+---
+ ta/pkcs11/src/object.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/ta/pkcs11/src/object.c b/ta/pkcs11/src/object.c
+index c9a95e1b2..ba3be7a71 100644
+--- a/ta/pkcs11/src/object.c
++++ b/ta/pkcs11/src/object.c
+@@ -800,6 +800,15 @@ enum pkcs11_rc entry_get_attribute_value(struct pkcs11_client *client,
+ 		goto out;
+ 	}
+ 
++	/*
++	 * We will update the template with relevant data, without resizing it.
++	 * Upon completion, it will be copied to client output buffer.
++	 */
++	if (out->memref.size < sizeof(*template) + template->attrs_size) {
++		rc = PKCS11_CKR_ARGUMENTS_BAD;
++		goto out;
++	}
++
+ 	/* Iterate over attributes and set their values */
+ 	/*
+ 	 * 1. If the specified attribute (i.e., the attribute specified by the
+@@ -912,6 +921,7 @@ enum pkcs11_rc entry_get_attribute_value(struct pkcs11_client *client,
+ 		rc = PKCS11_CKR_BUFFER_TOO_SMALL;
+ 
+ 	/* Move updated template to out buffer */
++	out->memref.size = sizeof(*template) + template->attrs_size;
+ 	TEE_MemMove(out->memref.buffer, template, out->memref.size);
+ 
+ 	DMSG("PKCS11 session %"PRIu32": get attributes %#"PRIx32,
+-- 
+2.43.0
+

meta-arm/recipes-security/optee/optee-os/CVE-2026-33317-2.patch

@@ -0,0 +1,52 @@
+From 7e57efa90820489f123708f8ae5ee13706e8f4ce Mon Sep 17 00:00:00 2001
+From: Etienne Carriere <etienne.carriere@st.com>
+Date: Wed, 21 Jan 2026 13:58:09 +0100
+Subject: [PATCH 2/3] ta: pkcs11: check template consistency on get attribute
+ value
+
+Check client template holds consistent attribute area sizes
+value on PKCS11_CMD_GET_ATTRIBUTE_SIZE.
+
+CVE: CVE-2026-33317
+Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/commit/16926d5a46934c46e6656246b4fc18385a246900]
+
+Fixes: 783c1515c2f9 ("ta: pkcs11: Add support for getting object size and attribute value")
+Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
+---
+ ta/pkcs11/src/object.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/ta/pkcs11/src/object.c b/ta/pkcs11/src/object.c
+index ba3be7a71..470eeb247 100644
+--- a/ta/pkcs11/src/object.c
++++ b/ta/pkcs11/src/object.c
+@@ -840,12 +840,23 @@ enum pkcs11_rc entry_get_attribute_value(struct pkcs11_client *client,
+ 	for (; cur < end; cur += len) {
+ 		struct pkcs11_attribute_head *cli_ref = (void *)cur;
+ 		struct pkcs11_attribute_head cli_head = { };
++		uintptr_t cli_end = 0;
+ 		void *data_ptr = NULL;
+ 
++		if ((char *)(cli_ref + 1) > end) {
++			rc = PKCS11_CKR_ARGUMENTS_BAD;
++			goto out;
++		}
++
+ 		/* Make copy of header so that is aligned properly. */
+ 		TEE_MemMove(&cli_head, cli_ref, sizeof(cli_head));
+ 
+-		len = sizeof(*cli_ref) + cli_head.size;
++		if (ADD_OVERFLOW(sizeof(*cli_ref), cli_head.size, &len) ||
++		    ADD_OVERFLOW((uintptr_t)cur, len, &cli_end) ||
++		    (char *)cli_end > end) {
++			rc = PKCS11_CKR_ARGUMENTS_BAD;
++			goto out;
++		}
+ 
+ 		/* Treat hidden attributes as missing attributes */
+ 		if (attribute_is_hidden(&cli_head)) {
+-- 
+2.43.0
+

meta-arm/recipes-security/optee/optee-os/CVE-2026-33317-3.patch

@@ -0,0 +1,46 @@
+From 75c1a999d6b51520234276b207ceefbd5e18ed02 Mon Sep 17 00:00:00 2001
+From: Etienne Carriere <etienne.carriere@st.com>
+Date: Wed, 21 Jan 2026 14:03:26 +0100
+Subject: [PATCH 3/3] ta: pkcs11: fix attribute output size if too small on get
+ attribute value
+
+Correct the size field output value for attributes fetched with
+PKCS11_CMD_GET_ATTRIBUTE_VALUE where a too short buffer was provided.
+As per the PKCS#11 specification, in such case, the related attributes
+size field should be filled with CK_UNAVAILABLE_INFORMATION and the
+function to return an non-true-error code like CKR_BUFFER_TOO_SMALL.
+The implementation complied for the return value but was loading the
+required attribute data value size instead in CK_UNAVAILABLE_INFORMATION
+in the attribute size field.
+
+CVE: CVE-2026-33317
+Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/commit/149e8d7ecc4ef8bb00ab4a37fd2ccede6d79e1ca]
+
+Fixes: 783c1515c2f9 ("ta: pkcs11: Add support for getting object size and attribute value")
+Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
+Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
+---
+ ta/pkcs11/src/object.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/ta/pkcs11/src/object.c b/ta/pkcs11/src/object.c
+index 470eeb247..ed2ce2a95 100644
+--- a/ta/pkcs11/src/object.c
++++ b/ta/pkcs11/src/object.c
+@@ -900,8 +900,11 @@ enum pkcs11_rc entry_get_attribute_value(struct pkcs11_client *client,
+ 			attr_type_invalid = 1;
+ 			break;
+ 		case PKCS11_CKR_BUFFER_TOO_SMALL:
+-			if (data_ptr)
++			if (data_ptr) {
++				cli_head.size =
++					PKCS11_CK_UNAVAILABLE_INFORMATION;
+ 				buffer_too_small = 1;
++			}
+ 			break;
+ 		default:
+ 			rc = PKCS11_CKR_GENERAL_ERROR;
+-- 
+2.43.0
+

meta-arm/recipes-security/optee/optee-os/CVE-2026-33662.patch

@@ -0,0 +1,40 @@
+From 2fdf0aa10bd23c0e4633efa087a27ff07f79015f Mon Sep 17 00:00:00 2001
+From: Jens Wiklander <jens.wiklander@linaro.org>
+Date: Thu, 22 Jan 2026 14:19:36 +0100
+Subject: [PATCH] core: crypto_api: fix underflow in emsa_pkcs1_v1_5_encode()
+
+Guard against an integer underflow in emsa_pkcs1_v1_5_encode() that can
+occur when calculating the padding field in the EMA-PKCS1-v1_5 encoding.
+
+CVE: CVE-2026-33662
+Upstream-Status: Backport [https://github.com/OP-TEE/optee_os/commit/caeaa2ae551666068894005387cca4113b10873f]
+
+Fixes: f5a70e3efb80 ("drivers: crypto: generic resources for crypto device driver - RSA")
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
+Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com>
+---
+ core/drivers/crypto/crypto_api/acipher/rsassa.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/core/drivers/crypto/crypto_api/acipher/rsassa.c b/core/drivers/crypto/crypto_api/acipher/rsassa.c
+index 0f71b84cc..01f8d7dc9 100644
+--- a/core/drivers/crypto/crypto_api/acipher/rsassa.c
++++ b/core/drivers/crypto/crypto_api/acipher/rsassa.c
+@@ -45,9 +45,10 @@ static TEE_Result emsa_pkcs1_v1_5_encode(struct drvcrypt_rsa_ssa *ssa_data,
+ 	 * Calculate the PS size
+ 	 *  EM Size (modulus size) - 3 bytes - DigestInfo DER format size
+ 	 */
+-	ps_size = ssa_data->key.n_size - 3;
+-	ps_size -= ssa_data->digest_size;
+-	ps_size -= 10 + hash_oid->asn1_length;
++	if (SUB_OVERFLOW(ssa_data->key.n_size, 3, &ps_size) ||
++	    SUB_OVERFLOW(ps_size, ssa_data->digest_size, &ps_size) ||
++	    SUB_OVERFLOW(ps_size, 10 + hash_oid->asn1_length, &ps_size))
++		return TEE_ERROR_BAD_PARAMETERS;
+ 
+ 	CRYPTO_TRACE("PS size = %zu (n %zu)", ps_size, ssa_data->key.n_size);
+ 
+-- 
+2.43.0
+

meta-arm/recipes-security/optee/optee-os_4.1.0.bb

@@ -7,4 +7,8 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"
 SRCREV = "18b424c23aa5a798dfe2e4d20b4bde3919dc4e99"
 SRC_URI += " \
     file://0003-optee-enable-clang-support.patch \
+    file://CVE-2026-33317-1.patch \
+    file://CVE-2026-33317-2.patch \
+    file://CVE-2026-33317-3.patch \
+    file://CVE-2026-33662.patch \
    "