CI: move meta-oe to use blacksail branch

This now has a blacksail branch.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

.gitlab-ci.yml

@@ -1,4 +1,4 @@
-image: ${MIRROR_GHCR}/siemens/kas/kas:4.7
+image: ${MIRROR_GHCR}/siemens/kas/kas:5.2
 
 variables:
   # These are needed as the k8s executor doesn't respect the container
@@ -9,14 +9,16 @@ variables:
   CPU_REQUEST: ""
   # The default machine tag for the build jobs
   DEFAULT_TAG: ""
-  # The directory to use as the persistent cache (the root for DL_DIR, SSTATE_DIR, etc)
-  CACHE_DIR: $CI_BUILDS_DIR/persist
+  # The directory to use as the persistent cache (the root for DL_DIR,
+  # SSTATE_DIR, etc). The default is the build tree which will not be
+  # persistent, so this should be set in the runner.
+  CACHE_DIR: $CI_PROJECT_DIR
   # The container mirror to use
   MIRROR_GHCR: ghcr.io
   # The list of extra Kas fragments to be used when building
   EXTRA_KAS_FILES: ""
-  # The NVD API key to use when fetching CVEs
-  NVDCVE_API_KEY: ""
+  # Whether warnings should be fatal (0/1)
+  FATAL_WARNINGS: 0
 
 stages:
   - prep
@@ -61,13 +63,15 @@ stages:
     # Catch all for everything else
     - if: '$KERNEL != "linux-yocto-dev"'
   script:
-    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME" $EXTRA_KAS_FILES):lockfile.yml
-    - echo KASFILES=$KASFILES
-    - kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES
-    - kas build $KASFILES
-    - ./ci/check-warnings $KAS_BUILD_DIR/warnings.log
-    - kas shell ci/base.yml:lockfile.yml --command "$CI_PROJECT_DIR/ci/junit.sh $KAS_WORK_DIR/build"
-
+    - |
+      KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME" $EXTRA_KAS_FILES):lockfile.yml
+      echo KASFILES=$KASFILES
+      kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES
+      kas build $KASFILES
+      if [ $FATAL_WARNINGS -ne 0 ]; then
+        ./ci/check-warnings $KAS_BUILD_DIR/warnings.log
+      fi
+      kas shell ci/base.yml:lockfile.yml --command "$CI_PROJECT_DIR/ci/junit.sh $KAS_WORK_DIR/build"
   artifacts:
     name: "logs"
     when: on_failure
@@ -156,6 +160,15 @@ corstone1000-mps3:
       - FIRMWARE: none
         SECUREDEBUG: [none, secure-debug]
 
+corstone1000-a320-fvp:
+  extends: .build
+  parallel:
+    matrix:
+      - FIRMWARE: corstone1000-firmware-only
+        TESTING: [testimage, tftf]
+      - FIRMWARE: none
+        TESTING: testimage
+
 documentation:
   extends: .setup
   script:

ci/base.yml

@@ -7,11 +7,12 @@ distro: poky
 
 defaults:
   repos:
-    branch: master
+    branch: blacksail
 
 repos:
   bitbake:
     url: https://git.openembedded.org/bitbake
+    branch: "2.20"
     layers:
       bitbake: disabled
 

ci/corstone1000-a320-fvp.yml

@@ -2,8 +2,7 @@
 
 header:
   version: 14
+  includes:
+    - ci/corstone1000-fvp.yml
 
-local_conf_header:
-  a320: |
-    MACHINE_FEATURES += "cortexa320"
-    OVERRIDES .= ":cortexa320"
+machine: corstone1000-a320-fvp

ci/cve.yml

@@ -1,20 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
-
-header:
-  version: 14
-
-local_conf_header:
-  cve: |
-    INHERIT += "cve-check"
-
-    # Allow the runner environment to provide an API key
-    NVDCVE_API_KEY = "${@d.getVar('BB_ORIGENV').getVar('NVDCVE_API_KEY') or ''}"
-
-    # Just show the warnings for our layers
-    CVE_CHECK_SHOW_WARNINGS = "0"
-    CVE_CHECK_SHOW_WARNINGS:layer-arm-toolchain = "1"
-    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm = "1"
-    CVE_CHECK_SHOW_WARNINGS:layer-meta-arm-bsp = "1"
-
-    # Ignore the kernel, we sometime carry kernels in meta-arm
-    CVE_CHECK_SHOW_WARNINGS:pn-linux-yocto = "0"

ci/lts-revisions.yml

@@ -5,6 +5,7 @@ header:
 
 local_conf_header:
   latest_revisions: |
-    PREFERRED_VERSION_trusted-firmware-a ?= "2.10.%"
-    PREFERRED_VERSION_tf-a-tests ?= "2.10.%"
-    PREFERRED_VERSION_trusted-firmware-m ?= "2.1.%"
+    PREFERRED_VERSION_trusted-firmware-a ?= "2.14.%"
+    PREFERRED_VERSION_tf-a-tests ?= "2.14.%"
+    PREFERRED_VERSION_trusted-firmware-m ?= "2.2.%"
+    PREFERRED_VERSION_trusted-firmware-m-scripts-native ?= "2.2.%"

ci/meta-secure-core.yml

@@ -6,6 +6,7 @@ header:
 repos:
   meta-secure-core:
     url: https://github.com/Wind-River/meta-secure-core.git
+    branch: master
     layers:
       meta-secure-core-common:
       meta-signing-key:

ci/musca-b1.yml

@@ -6,11 +6,6 @@ header:
     - ci/base.yml
     - ci/meta-openembedded.yml
 
-local_conf_header:
-  version_for_ci: |
-    # For better CI coverage, use the LTS version of tf-m
-    PREFERRED_VERSION_trusted-firmware-m ?= "2.1.%"
-
 machine: musca-b1
 
 target:

ci/musca-s1.yml

@@ -6,6 +6,11 @@ header:
     - ci/base.yml
     - ci/meta-openembedded.yml
 
+local_conf_header:
+  version_for_ci: |
+    # For better CI coverage, use the LTS version of tf-m
+    PREFERRED_VERSION_trusted-firmware-m ?= "2.2.%"
+
 machine: musca-s1
 
 target:

ci/sstate-mirror.yml

@@ -5,7 +5,5 @@ header:
 
 local_conf_header:
   sstate_mirror: |
-    BB_HASHSERVE_UPSTREAM = "wss://hashserv.yoctoproject.org/ws"
-    SSTATE_MIRRORS = "file://.* http://sstate.yoctoproject.org/all/PATH;downloadfilename=PATH"
-    BB_HASHSERVE = "auto"
     BB_SIGNATURE_HANDLER = "OEEquivHash"
+    OE_FRAGMENTS += "core/yocto/sstate-mirror-cdn"

kas/corstone1000-a320-fvp.yml

@@ -0,0 +1,22 @@
+header:
+  version: 14
+  includes:
+    - kas/corstone1000-base.yml
+    - kas/corstone1000-image-configuration.yml
+    - kas/corstone1000-firmware-only.yml
+    - kas/fvp-eula.yml
+
+env:
+  DISPLAY:
+  WAYLAND_DISPLAY:
+  XAUTHORITY:
+
+local_conf_header:
+  testimagefvp: |
+    IMAGE_CLASSES += "fvpboot"
+
+  mass-storage: |
+    # Ensure the Mass Storage device is absent
+    FVP_CONFIG[board.msd_mmc.p_mmc_file] = "invalid.dat"
+
+machine: corstone1000-a320-fvp

kas/corstone1000-ssh.yml

@@ -0,0 +1,13 @@
+header:
+  version: 14
+  includes:
+    - ci/debug.yml
+
+local_conf_header:
+  sshd: |
+    IMAGE_FEATURES += "ssh-server-dropbear"
+  fvp_sshkeys: |
+    CORE_IMAGE_EXTRA_INSTALL:append = " ssh-pregen-hostkeys"
+
+target:
+  - core-image-minimal

meta-arm-bsp/conf/layer.conf

@@ -9,7 +9,7 @@ BBFILE_COLLECTIONS += "meta-arm-bsp"
 BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-arm-bsp = "5"
 
-LAYERSERIES_COMPAT_meta-arm-bsp = "wrynose"
+LAYERSERIES_COMPAT_meta-arm-bsp = "blacksail"
 
 LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
 # This won't be used by layerindex-fetch, but works everywhere else

meta-arm-bsp/conf/machine/corstone1000-a320-fvp.conf

@@ -0,0 +1,17 @@
+#@TYPE: Machine
+#@NAME: corstone1000-a320-fvp machine
+#@DESCRIPTION: Machine configuration for Corstone1000 64-bit FVP with A320 CPU
+
+require conf/machine/include/corstone1000-a320.inc
+require conf/machine/corstone1000-fvp.conf
+
+# Ethos-U85 FVP configuration
+ETHOSU_NUM_MACS ?= "256"
+FVP_CONFIG[host.ethosu.num_macs] = "${ETHOSU_NUM_MACS}"
+
+# Reuse FVP recipe overrides
+MACHINEOVERRIDES .= ":corstone1000-fvp"
+
+# Override FVP executable provider and executable name.
+FVP_PROVIDER:corstone1000-a320-fvp ??= "fvp-corstone1000-a320-native"
+FVP_EXE:corstone1000-a320-fvp = "FVP_Corstone-1000-A320"

meta-arm-bsp/conf/machine/corstone1000-fvp.conf

@@ -6,9 +6,6 @@ require conf/machine/include/corstone1000.inc
 require ${@bb.utils.contains('MACHINE_FEATURES', 'corstone1000-extsys', \
     'conf/machine/include/corstone1000-extsys.inc', '', d)}
 
-require ${@bb.utils.contains('MACHINE_FEATURES', 'cortexa320', \
-    'conf/machine/include/corstone1000-a320.inc', '', d)}
-
 TFA_TARGET_PLATFORM = "fvp"
 
 TFM_PLATFORM_IS_FVP = "TRUE"
@@ -24,9 +21,7 @@ DEFAULT_TEST_SUITES:append = " fvp_boot fvp_devices"
 
 # FVP Config
 FVP_PROVIDER ?= "fvp-corstone1000-native"
-FVP_PROVIDER:cortexa320 ?= "fvp-corstone1000-a320-native"
 FVP_EXE ?= "FVP_Corstone-1000"
-FVP_EXE:cortexa320 = "FVP_Corstone-1000-A320"
 FVP_CONSOLES[default] = "host_terminal_0"
 FVP_CONSOLES[tf-a] = "host_terminal_1"
 FVP_CONSOLES[se] = "secenc_terminal"
@@ -65,7 +60,7 @@ FVP_CONFIG[board.msd_mmc.diagnostics] ?= "0"
 FVP_CONFIG[board.msd_mmc.p_max_block_count] ?= "0xFFFF"
 FVP_CONFIG[board.msd_config.pl180_fifo_depth] ?= "16"
 FVP_CONFIG[board.msd_mmc.support_unpadded_images] ?= "true"
-FVP_CONFIG[board.msd_mmc.p_mmc_file] ?= "${IMAGE_NAME}.wic"
+FVP_CONFIG[board.msd_mmc.p_mmc_file] ?= "${IMAGE_LINK_NAME}.wic"
 
 # MMC2 card configuration
 FVP_CONFIG[board.msd_mmc_2.card_type] ?= "SDHC"

meta-arm-bsp/conf/machine/fvp-base.conf

@@ -60,7 +60,7 @@ FVP_CONFIG[cluster0.stage12_tlb_size] ?= "1024"
 FVP_CONFIG[cluster1.stage12_tlb_size] ?= "1024"
 FVP_CONFIG[bp.secureflashloader.fname] ?= "trusted-firmware-a/bl1.bin"
 FVP_CONFIG[bp.flashloader0.fname] ?= "trusted-firmware-a/fip.bin"
-FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${IMAGE_NAME}.wic"
+FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${IMAGE_LINK_NAME}.wic"
 
 # FVP Base default is 8.0, so there is no has_arm_v8-0 for it.  However, this is needed for every version after.  So set this accordingly
 FVP_EXTRA_ARGS = "--parameter cluster0.has_arm_v${ARM_ISA_MAJOR}-${ARM_ISA_MINOR}=1 --parameter cluster1.has_arm_v${ARM_ISA_MAJOR}-${ARM_ISA_MINOR}=1"

meta-arm-bsp/conf/machine/include/corstone1000-a320.inc

@@ -1,3 +1,4 @@
-ETHOSU_NUM_MACS ?= "256"
-
-FVP_CONFIG[host.ethosu.num_macs] = "${ETHOSU_NUM_MACS}"
+# Cortex-A320 variant of the Corstone-1000 platform.
+MACHINEOVERRIDES =. "corstone1000-a320:"
+MACHINE_FEATURES += "cortexa320"
+OVERRIDES .= ":cortexa320"

meta-arm-bsp/conf/machine/include/corstone1000.inc

@@ -5,19 +5,20 @@ require ${TUNE_FILE}
 MACHINEOVERRIDES =. "corstone1000:"
 
 # TF-M
-PREFERRED_VERSION_trusted-firmware-m ?= "2.2.%"
+PREFERRED_VERSION_trusted-firmware-m ?= "2.3.%"
+PREFERRED_VERSION_trusted-firmware-m-scripts-native ?= "2.3.%"
 
 # TF-A
 TFA_PLATFORM = "corstone1000"
-PREFERRED_VERSION_trusted-firmware-a ?= "2.14.%"
-PREFERRED_VERSION_tf-a-tests ?= "2.14.%"
+PREFERRED_VERSION_trusted-firmware-a ?= "2.15.%"
+PREFERRED_VERSION_tf-a-tests ?= "2.15.%"
 
 TFA_BL2_BINARY = "bl2-corstone1000.bin"
 TFA_FIP_BINARY = "fip-corstone1000.bin"
 
 # optee
-PREFERRED_VERSION_optee-os ?= "4.9.%"
-PREFERRED_VERSION_optee-client ?= "4.9.%"
+PREFERRED_VERSION_optee-os ?= "4.10.%"
+PREFERRED_VERSION_optee-client ?= "4.10.%"
 
 # Trusted Services
 TS_PLATFORM = "arm/corstone1000"
@@ -26,7 +27,7 @@ TS_SP_SE_PROXY_CONFIG = "corstone1000"
 MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
 
 # U-Boot
-PREFERRED_VERSION_u-boot ?= "2025.10"
+PREFERRED_VERSION_u-boot ?= "2026.07"
 MACHINE_FEATURES += "efi"
 EFI_PROVIDER ?= "grub-efi"
 

meta-arm-bsp/conf/machine/rdn2.conf

@@ -49,10 +49,15 @@ FVP_CONFIG[board.dram_size] ?= "0x200000000"
 FVP_CONFIG[board.virtio_net.enabled] ?= "1"
 FVP_CONFIG[board.virtio_net.hostbridge.userNetworking] ?= "1"
 FVP_CONFIG[board.virtio_net.hostbridge.userNetPorts] = "2222=22"
-FVP_CONFIG[board.virtioblockdevice.image_path] ?= "${IMAGE_NAME}.wic"
+FVP_CONFIG[board.virtioblockdevice.image_path] ?= "${IMAGE_LINK_NAME}.wic"
 
 FVP_CONSOLES[default] = "terminal_ns_uart_ap"
 FVP_TERMINALS[css.scp.terminal_uart_scp] ?= "SCP Console"
 FVP_TERMINALS[css.mcp.terminal_uart_mcp] ?= "MCP Console"
 FVP_TERMINALS[css.terminal_ns_uart_ap] ?= "NS Console"
 FVP_TERMINALS[css.terminal_s_uart_ap] ?= "S Console"
+
+# Seeing intermittent test timeout errors in CI where the boot is almost
+# complete.  Lengthen the timeout to allow for more opportunity to
+# complete successfully.
+TEST_FVP_LINUX_BOOT_TIMEOUT = "900"

meta-arm-bsp/conf/machine/rdv2.conf

@@ -51,10 +51,15 @@ FVP_CONFIG[board.dram_size] ?= "0x200000000"
 FVP_CONFIG[board.virtio_net.enabled] ?= "1"
 FVP_CONFIG[board.virtio_net.hostbridge.userNetworking] ?= "1"
 FVP_CONFIG[board.virtio_net.hostbridge.userNetPorts] = "2222=22"
-FVP_CONFIG[board.virtioblockdevice.image_path] ?= "${IMAGE_NAME}.wic"
+FVP_CONFIG[board.virtioblockdevice.image_path] ?= "${IMAGE_LINK_NAME}.wic"
 
 FVP_CONSOLES[default] = "terminal_ns_uart_ap"
 FVP_TERMINALS[css.scp.terminal_uart_scp] ?= "SCP Console"
 FVP_TERMINALS[css.mcp.terminal_uart_mcp] ?= "MCP Console"
 FVP_TERMINALS[css.terminal_ns_uart_ap] ?= "NS Console"
 FVP_TERMINALS[css.terminal_s_uart_ap] ?= "S Console"
+
+# Seeing intermittent test timeout errors in CI where the boot is almost
+# complete.  Lengthen the timeout to allow for more opportunity to
+# complete successfully.
+TEST_FVP_LINUX_BOOT_TIMEOUT = "900"

meta-arm-bsp/conf/machine/sbsa-ref.conf

@@ -26,6 +26,8 @@ EFI_PROVIDER ?= "${@bb.utils.contains("DISTRO_FEATURES", "systemd", "systemd-boo
 SERIAL_CONSOLES ?= "115200;ttyAMA0 115200;hvc0"
 
 EXTRA_IMAGEDEPENDS += "edk2-firmware"
+#FIXME - in 2.15.0, new logic for pen hold the SMP cores was added, which breaks this platform.  Hold this back until it can be resolved.
+PREFERRED_VERSION_trusted-firmware-a ?= "2.14.%"
 
 QB_SYSTEM_NAME = "qemu-system-aarch64"
 QB_MACHINE = "-machine sbsa-ref"

meta-arm-bsp/documentation/corstone1000-a320/.readthedocs.yaml

@@ -0,0 +1,12 @@
+version: 2
+build:
+  os: "ubuntu-22.04"
+  tools:
+    python: "3.9"
+sphinx:
+  configuration: meta-arm-bsp/documentation/corstone1000-a320/conf.py
+formats:
+  - pdf
+python:
+  install:
+    - requirements: meta-arm-bsp/documentation/requirements.txt

meta-arm-bsp/documentation/corstone1000-a320/conf.py

@@ -0,0 +1,117 @@
+# SPDX-FileCopyrightText: <text>Copyright 2026 Arm Limited and/or its
+# affiliates <open-source-office@arm.com></text>
+#
+# SPDX-License-Identifier: MIT
+
+# Configuration file for the Sphinx documentation builder.
+#
+# This file only contains a selection of the most common options. For a full
+# list see the documentation:
+# https://www.sphinx-doc.org/en/master/usage/configuration.html
+
+# -- Path setup --------------------------------------------------------------
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#
+# sys.path.insert(0, os.path.abspath('.'))
+
+import os
+import re
+import sys
+
+import yaml
+
+# Append the documentation directory to the path, so we can import variables
+sys.path.append(os.path.dirname(__file__))
+
+_metadata_path = os.path.join(os.path.dirname(__file__), 'corstone-a320_metadata.yaml')
+with open(_metadata_path, encoding='utf-8') as metadata_file:
+    _metadata = yaml.safe_load(metadata_file) or {}
+
+_metadata_variables = {
+    item['name']: item['value']
+    for item in _metadata.get('variables', [])
+    if item.get('name') and item.get('value')
+}
+
+
+# -- Project information -----------------------------------------------------
+
+project = 'Corstone-1000 Armv9-A Edge-AI'
+copyright = '2026, Arm Limited'
+author = 'Arm Limited'
+
+
+# -- General configuration ---------------------------------------------------
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+    'myst_parser',
+    'sphinx_rtd_theme',
+]
+
+source_suffix = {
+    '.rst': 'restructuredtext',
+    '.md': 'markdown',
+}
+
+myst_enable_extensions = [
+    'colon_fence',
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+# This pattern also affects html_static_path and html_extra_path.
+exclude_patterns = [
+    '_build',
+    'Thumbs.db',
+    '.DS_Store',
+    'docs/infra',
+    'corstone-a320_map.md',
+    'corstone-a320_metadata.yaml',
+]
+
+
+# -- Options for HTML output -------------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+#
+html_theme = 'sphinx_rtd_theme'
+html_theme_options = {
+    'flyout_display': 'attached',
+}
+
+# Define the canonical URL if you are using a custom domain on Read the Docs
+html_baseurl = os.environ.get("READTHEDOCS_CANONICAL_URL", "")
+
+# Tell Jinja2 templates the build is running on Read the Docs
+if os.environ.get("READTHEDOCS", "") == "True":
+    if "html_context" not in globals():
+        html_context = {}
+    html_context["READTHEDOCS"] = True
+
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+#html_static_path = ['_static']
+
+
+def _replace_metadata_variables(app, docname, source):
+    source[0] = re.sub(
+        r'\$([A-Za-z0-9_]+)',
+        lambda match: _metadata_variables.get(match.group(1), match.group(0)),
+        source[0],
+    )
+
+
+def setup(app):
+    app.connect('source-read', _replace_metadata_variables)

meta-arm-bsp/documentation/corstone1000-a320/corstone-a320_map.md

@@ -0,0 +1,6 @@
+- topics/introducing.md
+- topics/software-architecture.md
+- topics/user-guide.md
+- topics/tests.md
+- topics/release-notes.md
+- topics/change-log.md

meta-arm-bsp/documentation/corstone1000-a320/corstone-a320_metadata.yaml

@@ -0,0 +1,106 @@
+---
+title: Corstone-1000 with Cortex-A320
+subtitle: ""
+abstract: Arm Corstone-1000 with Cortex-A320 is a reference solution for IoT devices. It is part of Total Solution for IoT which consists of hardware and software reference implementation.
+author: Arm
+status: REL
+keywords: [IoT, software]
+bookpartno: 112000
+product: Corstone-1000 with Cortex-A320
+product_type: Open Source Projects
+product_revision:
+  - prefix: Version
+    version: "0101"
+    version_label: "2026.02"
+output_type: "software"
+conformance_notice: "true"
+content_type: User Guide
+audience:
+  - Software Developers
+categories:
+  - IoT
+themes:
+  - IoT
+intended_audience: Software Developers
+terminology_review: new
+releases:
+ - revision: 0100-01
+   date: 2026-05-01
+   change_summary: Update
+   permissions: nonconfidential
+
+variables:
+- name: arm_developer_cs1000_website
+  value: 'https://developer.arm.com/Tools%20and%20Software/Corstone-1000%20Software'
+- name: arm_developer_cs1000_search
+  value: 'https://developer.arm.com/search#q=corstone-1000'
+- name: arm_developer_mhu_website
+  value: 'https://developer.arm.com/documentation/ka005129/latest/#:~:text=An%20MHU%20is%20a%20device,that%20a%20message%20is%20available'
+- name: arm_developer_secureboot_website
+  value: 'https://developer.arm.com/documentation/PRD29-GENC-009492/c/TrustZone-Software-Architecture/Booting-a-secure-system/Secure-boot'
+- name: arm_architecture_security_features_platform_security
+  value: 'https://www.arm.com/architecture/security-features/platform-security'
+- name: linux_repository
+  value: 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/'
+- name: arm_trustzone_for_cortex_a_website
+  value: 'https://www.arm.com/technologies/trustzone-for-cortex-a'
+- name: arm_fmw_framework_a_profile_pdf
+  value: 'https://developer.arm.com/documentation/den0077/latest'
+- name: arm_fmw_framework_m_profile_pdf
+  value: 'https://developer.arm.com/architectures/Firmware%20Framework%20for%20M-Profile'
+- name: platform_security_fwu_for_a_profile_pdf
+  value: 'https://developer.arm.com/documentation/den0118/a/'
+- name: psa_firmware_update_ihi_0093_api_reference_website
+  value: 'https://arm-software.github.io/psa-api/fwu/1.0/api/api.html'
+- name: edk2_capsule_generation_tool_repository
+  value: 'https://github.com/tianocore/edk2/blob/master/BaseTools/Source/Python/Capsule/GenerateCapsule.py'
+- name: psa_fwu_den0018_specification_website
+  value: 'https://developer.arm.com/documentation/den0118/latest/'
+- name: ts_psa_fwu_service_website
+  value: 'https://trusted-services.readthedocs.io/en/stable/services/fwu/psa-fwu-m.html'
+- name: tfm_shim_layer_website
+  value: 'https://trustedfirmware-m.readthedocs.io/en/latest/design_docs/services/tfm_fwu_service.html#shim-layer-between-fwu-and-bootloader'
+- name: op_tee_os_repository
+  value: 'https://github.com/OP-TEE/optee_os'
+- name: psa_certified_website
+  value: 'https://www.psacertified.org/'
+- name: psa_l2_ready
+  value: 'https://www.psacertified.org/products/corstone-1000/'
+- name: systemready_ir_certification
+  value: 'https://armkeil.blob.core.windows.net/developer/Files/pdf/certificate-list/arm-systemready-ve-arm-neoverse.pdf'
+- name: trusted_board_boot_requirements_client_pdf
+  value: 'https://developer.arm.com/documentation/den0006/latest'
+- name: trusted_firmware_m_website
+  value: 'https://www.trustedfirmware.org/projects/tf-m/'
+- name: trusted_firmware_m_bl1_website
+  value: 'https://trustedfirmware-m.readthedocs.io/en/latest/design_docs/booting/bl1.html'
+- name: trusted_firmware_a_bl2_website
+  value: 'https://developer.arm.com/documentation/108028/0000/RD-TC22-software/Software-components/AP-firmware/Trusted-firmware-A-BL2'
+- name: trusted_firmware_a_fip_guide
+  value: 'https://trustedfirmware-a.readthedocs.io/en/latest/design/firmware-design.html#firmware-image-package-fip'
+- name: trusted_services_website
+  value: 'https://www.trustedfirmware.org/projects/trusted-services/'
+- name: trusted_services_uefi_smm_website
+  value: 'https://trusted-services.readthedocs.io/en/integration/services/uefi-smm-services.html#'
+- name: das_u_boot_repository
+  value: 'https://github.com/u-boot/u-boot.git'
+- name: keil_rtx5_website
+  value: 'https://developer.arm.com/Tools%20and%20Software/Keil%20MDK/RTX5%20RTOS'
+- name: ppa_website
+  value: 'https://developer.arm.com/documentation/102738/0100/Power--performance--and-area-analysis'
+- name: mcuboot_website
+  value: 'https://docs.mcuboot.com/'
+- name: arm_developer_fvp
+  value: 'https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps'
+- name: secure_debug_manager_repo_readme
+  value: 'https://github.com/ARM-software/secure-debug-manager/tree/master?tab=readme-ov-file#secure-debug-manager-psa-adac--sdc-600'
+- name: secure_debug_manager_armds_integration
+  value: 'https://github.com/ARM-software/secure-debug-manager?tab=readme-ov-file#arm-development-studio-integration'
+- name: meta_arm_repository_release_branch
+  value: 'https://docs.yoctoproject.org/next/migration-guides/migration-6.0.html'
+- name: arm_ulink_pro_website
+  value: 'https://www.arm.com/products/development-tools/debug-probes/ulink-pro'
+- name: arm_ds_website
+  value: 'https://www.arm.com/products/development-tools/embedded-and-software/arm-development-studio'
+- name: edk2_repository
+  value: 'https://github.com/tianocore/edk2'

meta-arm-bsp/documentation/corstone1000-a320/index.md

@@ -0,0 +1,12 @@
+# Corstone-1000 Armv9-A Edge-AI
+
+```{toctree}
+:maxdepth: 2
+
+topics/introducing
+topics/software-architecture
+topics/user-guide
+topics/tests
+topics/release-notes
+topics/change-log
+```

meta-arm-bsp/documentation/corstone1000-a320/topics/change-log.md

@@ -0,0 +1,150 @@
+# Change log {.chapter permissions=non-confidential}
+
+This document contains a summary of the new features, changes and fixes in each release of the Corstone-1000 with Cortex-A320 software stack.
+
+## Version 2026.05 {.reference}
+
+The following changes are present in this release:
+
+- Continued Corstone-1000 with Cortex-A320 enablement across U-Boot, TF-A, TF-M, OP-TEE, and Linux with the split A320 device tree, GIC-700 support, Ethos-U85 DT alignment, and NPU reset via the external-system controller.
+- Enabled and documented FVP SMP builds and platform-agnostic multicore support, including the errata override fixes for Corstone-1000 with Cortex-A320 and removal of the reboot workaround note.
+- Split Corstone-1000 with Cortex-A320 FVP support into a dedicated machine configuration and standalone documentation.
+
+### Corstone-1000 with Cortex-A320 components versions {.reference}
+
+The following component versions are available:
+
+Table: Corstone-1000 with Cortex-A320 component versions
+
++----------------------------------------+-----------------------------------+
+| Component                              | Version                           |
++========================================+===================================+
+| linux-yocto                            | 6.19                              |
++----------------------------------------+-----------------------------------+
+| u-boot                                 | 2025.10                           |
++----------------------------------------+-----------------------------------+
+| external-system                        | 0.1.0                             |
++----------------------------------------+-----------------------------------+
+| optee-client                           | 4.9.0                             |
++----------------------------------------+-----------------------------------+
+| optee-os                               | 4.9.0                             |
++----------------------------------------+-----------------------------------+
+| trusted-firmware-a                     | 2.14.1                            |
++----------------------------------------+-----------------------------------+
+| trusted-firmware-m                     | 2.2.2                             |
++----------------------------------------+-----------------------------------+
+| libts                                  | v1.3.0                            |
++----------------------------------------+-----------------------------------+
+| ts-sp-{se-proxy, smm-gateway}          | v1.3.0                            |
++----------------------------------------+-----------------------------------+
+| ts-psa-{crypto, iat, its. ps}-api-test | 74dc6646ff                        |
++----------------------------------------+-----------------------------------+
+
+### Yocto distribution components versions {.reference}
+
+The following Yocto distribution components versions are available:
+
+Table: Yocto distribution component versions
+
++-------------------+------------+
+| Component         | Version    |
++===================+============+
+| meta-arm          | wrynose    |
++-------------------+------------+
+| bitbake           | 22021758e6 |
++-------------------+------------+
+| meta-openembedded | 9af4488d46 |
++-------------------+------------+
+| openembedded-core | 06dd66e622 |
++-------------------+------------+
+| meta-yocto        | 8251bdad5f |
++-------------------+------------+
+| meta-secure-core  | 07a99ae241 |
++-------------------+------------+
+| busybox           | 1.37.0     |
++-------------------+------------+
+| musl              | 1.2.6      |
++-------------------+------------+
+| gcc-arm-none-eabi | 15.2.rel1  |
++-------------------+------------+
+| gcc-cross-aarch64 | 15.2.0     |
++-------------------+------------+
+| openssl           | 3.5.6      |
++-------------------+------------+
+
+## Version 2025.12 {.reference}
+
+The following changes are present in this release:
+
+- Delivered end-to-end Cortex-A320 enablement across U-Boot, TF-A, TF-M, OP-TEE, Yocto machine layers, and documentation, including device-tree updates, MPIDR handling, and FVP model renaming.
+- Rolled out the PSA Firmware Update (DEN0118) pipeline: U-Boot capsule parsing, Bootloader Abstraction Layer in TF-M, ESRT exposure, and Trusted Services IPC bridges replacing legacy capsule code.
+- Hardened the new firmware update flow with EFI self-tests, metadata restructuring for partial and multi-image acceptance, and RSE-COMMS gating refinements.
+- Upgraded key firmware components (TF-A 2.13.0, TF-M 2.2.1, Trusted Services 1.2.0, OP-TEE OS 4.7.0) and introduced targeted test skips plus integer-only build modes to keep validation green.
+- Cleaned and renumbered downstream patch series across Trusted Services and TF-M while removing obsolete integrations to align with upstream baselines.
+- Refreshed release material and architecture guides to describe the A320 profile, PSA FWU behavior, and updated software stack.
+- Added KAS profiles, machine includes, and automated FVP selection logic to streamline developer workflows for the refreshed platform configuration.
+
+### Corstone-1000 with Cortex-A320 components versions {.reference}
+
+The following component versions are available:
+
+Table: Corstone-1000 with Cortex-A320 component versions
+
++----------------------------------------+-----------------------------------+
+| Component                              | Version                           |
++========================================+===================================+
+| linux-yocto                            | 6.12.60                           |
++----------------------------------------+-----------------------------------+
+| u-boot                                 | 2025.04                           |
++----------------------------------------+-----------------------------------+
+| optee-client                           | 4.7.0                             |
++----------------------------------------+-----------------------------------+
+| optee-os                               | 4.7.0                             |
++----------------------------------------+-----------------------------------+
+| trusted-firmware-a                     | 2.13.0                            |
++----------------------------------------+-----------------------------------+
+| trusted-firmware-m                     | 2.2.1                             |
++----------------------------------------+-----------------------------------+
+| libts                                  | v1.2.0                            |
++----------------------------------------+-----------------------------------+
+| ts-sp-{se-proxy, smm-gateway}          | v1.2.0                            |
++----------------------------------------+-----------------------------------+
+| ts-psa-{crypto, iat, its. ps}-api-test | 74dc6646ff                        |
++----------------------------------------+-----------------------------------+
+
+### Yocto distribution components versions {.reference}
+
+The following Yocto distribution components versions are available:
+
+
+Table: Yocto distribution component versions
+
++-------------------+------------+
+| Component         | Version    |
++===================+============+
+| meta-arm          | whinlatter |
++-------------------+------------+
+| bitbake           | 0dde1a3ff8 |
++-------------------+------------+
+| meta-openembedded | fc0152e434 |
++-------------------+------------+
+| openembedded-core | 4bd920ad7d |
++-------------------+------------+
+| meta-yocto        | b3b6592635 |
++-------------------+------------+
+| meta-secure-core  | 63209fb150 |
++-------------------+------------+
+| meta-ethos        | aa2504a32f |
++-------------------+------------+
+| meta-sca          | e68f1a9d17 |
++-------------------+------------+
+| busybox           | 1.37.0     |
++-------------------+------------+
+| musl              | 1.2.5      |
++-------------------+------------+
+| gcc-arm-none-eabi | 13.3.rel1  |
++-------------------+------------+
+| gcc-cross-aarch64 | 15.2.0     |
++-------------------+------------+
+| openssl           | 3.5.4      |
++-------------------+------------+

meta-arm-bsp/documentation/corstone1000-a320/topics/introducing.md

@@ -0,0 +1,14 @@
+# Introduction {.chapter permissions=non-confidential}
+
+Arm Corstone-1000 with Cortex-A320 is a reference solution for IoT devices
+based on Arm Corstone-1000, but with Cortex-A320 CPU, Ethos-U85 NPU and
+GIC700 (Generic Interrupt Controller). It is part of Total Solution
+for IoT which consists of hardware and software reference implementations.
+
+## Disclaimer {.reference}
+
+Arm reference solutions are Arm public example software projects that track and
+pull upstream components, incorporating their respective security fixes
+published over time. Arm partners are responsible for ensuring that the
+components they use contain all the required security fixes, if and when they
+deploy a product derived from Arm reference solutions.

meta-arm-bsp/documentation/corstone1000-a320/topics/release-notes.md

@@ -0,0 +1,40 @@
+# Release notes {.chapter permissions=non-confidential}
+
+You expressly assume all liabilities and risks relating to your use or operation
+of your software and hardware designed or modified using the Arm Tools,
+including without limitation, your software or hardware designed or
+intended for safety-critical applications. Should your software or hardware
+prove defective, you assume the entire cost of all necessary servicing, repair
+or correction.
+
+## Release notes - 2026.05 {.reference}
+
+The following knowns issues and limitations are present in this release:
+
+- Crypto isolation is not supported in the Secure world of Corstone-1000. Additionally, clients in
+  the Normal world are not isolated from one another. Therefore, if an end user wants to add a new
+  Secure Partition (SP) (such as a software TPM) that accesses the Crypto service via the SE-Proxy,
+  they are responsible for implementing their own isolation mechanisms to ensure proper security boundaries.
+- DSTREAM debug probe may experience unreliable USB connectivity when used with Arm DS for secure debug.
+  This issue is under active investigation, and we are working to identify and resolve compatibility issues in a future update.
+  As a more stable alternative, the ULINKpro debug probe is recommended for use with Corstone-1000 in secure debug scenarios.
+
+## Release notes - 2025.12 {.reference}
+
+The following knowns issues and limitations are present in this release:
+
+- Corstone-1000 with Cortex-A320 FVP does not currently support Symmetric Multiprocessing
+- Corstone-1000 with Cortex-A320 FVP becomes unresponsive when the Linux kernel driver for the Ethos-U85 NPU loads automatically after a software reboot.
+- Crypto isolation is not supported in the Secure world of Corstone-1000. Additionally, clients in
+  the Normal world are not isolated from one another. Therefore, if an end user wants to add a new
+  Secure Partition (SP) (such as a software TPM) that accesses the Crypto service via the SE-Proxy,
+  they are responsible for implementing their own isolation mechanisms to ensure proper security boundaries.
+- DSTREAM debug probe may experience unreliable USB connectivity when used with Arm DS for secure debug.
+  This issue is under active investigation, and we are working to identify and resolve compatibility issues in a future update.
+  As a more stable alternative, the ULINKpro debug probe is recommended for use with Corstone-1000 in secure debug scenarios.
+
+## Support {.reference}
+
+For technical support, email [Arm subsystem support](mailto:support-subsystem-iot@arm.com).
+
+For security issues, contact [Arm Security](mailto:psirt@arm.com).

meta-arm-bsp/documentation/corstone1000-a320/topics/software-architecture.md

@@ -0,0 +1,311 @@
+# Software architecture {.chapter permissions=non-confidential}
+
+The combination of Corstone-1000 software and hardware reference solution is [PSA Level-2 ready certified]($psa_l2_ready) as well as [Arm SystemReady Devicetree certified]($systemready_ir_certification). Please rely on the Corstone-1000 platform for certification needs.
+
+More information on the Corstone-1000 subsystems product(s), variants and design can be
+found on [Arm Developer]($arm_developer_cs1000_website).
+
+This document explicitly focuses on the software part of the solution and
+provides internal details on the software components. The reference
+software package of the platform can be retrieved following instructions
+present in the user guide document.
+
+## Design overview {.reference}
+
+This variant of the Corstone-1000 platform replaces the Host System's Cortex-A35
+processor with a Cortex-A320. In this configuration, the optional External System
+(previously a Cortex-M3) is replaced by an Arm Ethos-U85 Neural Processing Unit (NPU).
+The Ethos-U85 runs in the direct drive configuration, where the Host System is
+responsible for managing the NPU directly.
+
+![Cortex-A320 subsystems](../images/CorstoneA320Subsystems.png)
+
+## Secure boot chain {.reference}
+
+For the security of a device, it is essential that only authorized
+software should run on the device.
+
+The Corstone-1000 boot uses a [Secure boot]($arm_developer_secureboot_website) chain process
+where an already authenticated image verifies and loads the following software in the chain.
+
+For the boot chain process to work, the start of the chain should be trusted, forming the
+Root of Trust (RoT) of the device. The RoT of the device is immutable in
+nature and encoded into the device by the device manufacturer before it
+is deployed into the field.
+In Corstone-1000, the content of the ROM and CC312 One Time Programmable (OTP) memory forms the RoT.
+
+Verification of an image can happen either by comparing the computed and stored hashes, or by
+checking the signature of the image if the image is signed.
+
+![Secure boot chain](../images/SecureBootChain.png)
+
+It is a lengthy chain to boot the software on Corstone-1000.
+
+### TF-M BL1\_1 {.reference}
+
+On power-up, the Secure Enclave begins execution from TF-M BL1\_1, which resides in ROM and serves as
+the Root of Trust (RoT) for the device.
+
+TF-M BL1\_1 is the immutable bootloader and is responsible for:
+
+- Provisioning the device during the first boot
+- Performing hardware initialization
+- Verifying the integrity and authenticity of the next stage in the boot chain
+
+At boot time, TF-M BL1\_1:
+
+- Copies the TF-M BL1\_2 image from OTP to RAM.
+- Verifies the integrity of BL1\_2 by comparing its computed hash with the hash stored in OTP.
+
+### TF-M BL1\_2 {.reference}
+
+During provisioning, the TF-M BL1\_2 binary, along with its hashes and cryptographic keys, is stored
+in One-Time Programmable (OTP) memory.
+
+Once verified, TF-M BL1\_2:
+
+- Takes control and verifies the next stage in the boot chain, which is TF-M BL2.
+- Computes the hash of the BL2 image and compares it with the BL2 hash stored in OTP to ensure
+  integrity before transferring execution to BL2.
+
+The TF-M BL1 design details can be found in the [TF-M design documents]($trusted_firmware_m_bl1_website).
+
+:::note
+Corstone-1000 has some differences compared to this design due to memory (OTP/ROM) limitations:
+
+- BL1\_1 code size is larger than needed because it handles most of the hardware initialization instead of the BL1\_2.
+- BL1\_2 cannot be updated during provisioning time because the provisioning bundle that contains its code is located in the ROM.
+- BL1\_2 does not use the post-quantum LMS verification.
+- BL2 cannot be updated because it is verified by comparing the computed hash to the hash stored in the OTP.
+
+:::
+
+### TF-M BL2 {.reference}
+
+In this system, TF-M BL2 refers to MCUBoot.
+
+On the first boot, MCUBoot can provision additional cryptographic keys. It is responsible for authenticating both:
+
+- TF-M (Trusted Firmware-M), and
+- The initial bootloader of the Host system, [Trusted Firmware-A (TF-A) BL2]($trusted_firmware_a_bl2_website)
+
+This authentication is done by verifying the digital signatures of the respective images.
+
+MCUBoot performs image verification in the following steps:
+
+1. Load the image from non-volatile memory into RAM.
+2. Validate the image's signature using the corresponding public key.
+
+:::note
+The public key present in the image header is validated by comparing with the hash. Depending on the image, the hash of the public key is either stored in the OTP or part of the software which is being already verified in the previous stages.
+:::
+
+The execution control is passed to TF-M after the verification.
+As the runtime executable of the Secure Enclave, TF-M initializes itself before
+bringing the Host system out of reset.
+
+### Host system authentication {.reference}
+
+The Host system follows the boot standard defined in [Trusted Board Boot Requirements Client]($trusted_board_boot_requirements_client_pdf)
+to authenticate the Secure and Non-secure software.
+
+The [Firmware Image Package (FIP)]($trusted_firmware_a_fip_guide) packs bootloader images and
+other payloads into a single archive.
+
+![FIPDiagram](../images/FIPDiagram.png)
+
+The FIP for Corstone-1000 contains:
+
+- Trusted firmware-A BL2
+- AP EL3 Runtime firmware, BL31 image
+- AP Secure Payload, BL32 image
+- AP Normal world firmware -U-boot, BL33 image
+- Trusted OS Firmware configuration file used by Trusted OS (BL32), TOS_FW_CONFIG
+- Key certificates
+- Content certificates
+
+To load and validate TF-A BL2, TF-M BL2 first parses the GUID Partition Table (GPT)
+to locate the FIP. It then determines the offset of TF-A BL2 within the FIP.
+
+:::note
+TF-M does not check the FIP signature, it only checks the TF-A BL2's signature in the FIP.
+:::
+
+The implicitly trusted components are:
+
+- A SHA-256 hash of the Root of Trust Public Key (ROTPK.) For development purposes, a development ROTPK is used and its hash embedded into the TF-A BL2 image. This public key is provided by the TF-A source code.
+- TF-A BL2 image - it can be trusted because it has been verified by TF-M BL2 before starting TF-A.
+
+The remaining components in the Chain of Trust (CoT) are either certificates or bootloader images.
+
+#### Bootloader authentication {.reference}
+
+The FIP contains two types of certificates:
+
+- Content Certificates used to store the hash of a bootloader image.
+- Key Certificates used to verify public keys used to sign Content Certificates.
+
+The Host system bootloader images are authenticated by computing their hash and comparing it to the corresponding hash found in the Content Certificate.
+
+#### Certificates verification {.reference}
+
+The public keys defined in the Trusted Key Certificate are used to verify the later certificates in
+the CoT process. The Trusted Key Certificate is verified with the Root of Trust Public Key.
+
+#### UEFI authenticated variables {.reference}
+
+For UEFI Secure Boot, authenticated variables can be accessed from the secure flash.
+The feature has been integrated in U-Boot, which authenticates the images as per the UEFI
+specification before executing them.
+
+## Secure services {.reference}
+
+Corstone-1000 is unique in offering a secure environment for running trusted workloads.
+While the Host system includes TrustZone technology, the platform also features a hardware-isolated
+Secure Enclave, specifically designed to execute these secure workloads.
+
+In Corstone-1000, essential Secure Services—such as Cryptography, Protected Storage,
+Internal Trusted Storage, and Attestation—are provided through PSA Functional APIs implemented in TF-M.
+
+From the user's perspective, there is no difference when communicating with these services,
+whether they run in the Secure Enclave or in the Secure world of the Host system.
+The diagram below illustrates the data flow for such calls.
+
+![Secure services](../images/SecureServices.png)
+
+The Secure Enclave Proxy Secure Partition (SE Proxy SP) is a proxy managed by OP-TEE that forwards
+Secure Service calls to the Secure Enclave. This communication uses the
+[RSE communication protocol](https://tf-m-user-guide.trustedfirmware.org/platform/arm/rse/rse_comms.html).
+While the protocol supports shared memory and MHU interrupts as a doorbell mechanism between cores,
+in Corstone-1000, the entire message is currently transmitted through the MHU channels.
+Corstone-1000 implements Isolation Level 2 using the Cortex-M0+ Memory Protection Unit (MPU).
+
+Users can define their own secure services to run either in the Host system's Secure World or in
+the Secure Enclave. This choice involves a trade-off between latency and security.
+Services running in the Secure Enclave benefit from strong, hardware-enforced isolation,
+offering higher security but at the cost of increased latency. In contrast, services running in the
+Host Secure World experience lower latency, but rely on TrustZone technology for virtualized isolation,
+which offers comparatively less robust security.
+
+## PSA secure firmware update {.reference}
+
+The Corstone-1000 platform necessitates a robust, secure, and flexible firmware update mechanism
+including partial capsule update to ensure fielded devices can receive critical patches, feature enhancements,
+and security fixes without compromising system integrity. To meet these requirements, we have implemented the
+Platform Security Architecture (PSA) Firmware Update (FWU) framework on Corstone-1000, leveraging Trusted Firmware-M (TF-M)
+for the Secure Enclave, U-Boot as the host-side client on Cortex-A, and the UEFI capsule update mechanism for payload
+encapsulation. This design supports the Fixed Virtual Platform (FVP) target, providing consistent behavior across
+simulation-based deployments. The Corstone-1000 supports FWU
+which complies with the
+[Platform Security Firmware Update for the A-profile Arm Architecture]($platform_security_fwu_for_a_profile_pdf)
+and [PSA Firmware Update IHI 0093]($psa_firmware_update_ihi_0093_api_reference_website)
+specifications.
+
+To standardize and streamline capsule creation with multiple FMP payloads, the
+[EDK2 capsule generation tool]($edk2_capsule_generation_tool_repository)
+tool has been integrated into the meta-arm Yocto layer for Corstone-1000. This integration involves defining
+build rules for generating UEFI capsules as part of the firmware image build process. Configuration parameters
+exposed in the recipe allow developers to specify the number of FMP payloads, target image GUIDs, version numbers etc.
+This capsule ensures that all update payloads conform to the UEFI FMP specification and are ready for
+validation and delivery by U‑Boot.
+
+The FWU solution for Corstone-1000 is composed of three primary domains:
+
+- Host System
+- Trusted Services intermediary
+- Secure Enclave
+
+Each domain has distinct responsibilities and communicates through standardized interfaces.
+
+![System architecture PSA firmware update](../images/SystemArchitecturePSAFirmwareUpdate.png)
+
+On the host side, U-Boot functions as the FWU client and orchestrates the update process from capsule retrieval to
+payload delivery based on [PSA FWU DEN0018 specification]($psa_fwu_den0018_specification_website)
+via Arm FF-A framework. The Trusted-Services SE Proxy secure partition serves as a gateway between the non-secure host
+environment and the Secure Enclave. The [PSA FWU service]($ts_psa_fwu_service_website) running in the Trusted Services
+implementation forwards the data to the Secure Enclave via MHU-based PSA calls. Within the Secure Enclave, the PSA FWU
+Agent, conforming to [PSA Firmware Update IHI 0093]($psa_firmware_update_ihi_0093_api_reference_website) specification,
+orchestrates the actual flash programming, metadata management, and rollback protection mechanisms. The agent relies on a
+bespoke [shim layer]($tfm_shim_layer_website) to abstract hardware‑specific flash operations and bootloader interactions.
+
+As defined in the specification, the external flash is divided into two banks: one bank holds the
+currently running images, while the other is used to stage new images.
+
+There are four updatable components: **BL2**, **TF-M**, **the FIP** and **the Kernel Image** (the initramfs bundle).
+New images are delivered and accepted in the form of UEFI capsules.
+
+![External flash](../images/ExternalFlash.png)
+
+When a FWU is initiated on Corstone-1000, the following sequence of operations takes place:
+
+1. Capsule Retrieval and Preparation
+
+   U-Boot on the host system retrieves the firmware capsule.
+   It validates the capsule header and parses the FMP (Firmware Management Protocol) descriptor list to identify the payloads to be updated.
+
+   For each FMP descriptor, U-Boot:
+
+   Splits the firmware payload into 4 KiB chunks.
+   Invokes the PSA_FWU_Update API for each chunk, transmitting the buffer address via the FF-A (Firmware Framework for Arm) shared memory interface.
+
+2. Secure Transmission and Forwarding
+
+   The PSA Firmware Update (FWU) service, running as part of Trusted Services, receives the chunks through Secure Partition Client (SPC) calls.
+   It forwards these chunks to the Secure Enclave using MHU-based PSA calls.
+
+3. Flashing Within the Secure Enclave
+
+   Inside the Secure Enclave, the PSA FWU Agent dispatches each chunk to the shim layer.
+
+   The shim layer:
+
+   Erases the corresponding sectors in the non-active flash bank.
+   Writes the received firmware chunks at the correct offsets.
+   During partial updates, it also copies static partitions from the active bank to the non-active one to maintain consistency.
+
+4. Finalization and Boot Preparation
+
+   After all chunks are successfully written:
+
+   The shim updates the firmware manifest and the EFI System Resource Table (ESRT) entries to reflect the new image version.
+   This step enables the bootloader to recognize the new firmware for a trial boot.
+   The platform then performs an automatic reset, booting into the non-active bank in trial mode.
+
+5. Trial Boot and Confirmation
+
+   In trial mode, U-Boot evaluates the new firmware and issues either an accept or reject command using the PSA FWU ABI.
+   These commands are sent to the Secure Enclave, instructing the shim to update the firmware metadata accordingly.
+
+6. Recovery and Fallback Mechanism
+
+   If the trial boot is successful, the host sends an acknowledgment, transitioning the firmware state from 'trial' to 'regular'.
+
+   If the system fails or becomes unresponsive:
+
+   A watchdog timer triggers a system reset.
+   The BL1 firmware in the Secure Enclave detects repeated failures and reverts to the previously known-good flash bank.
+   This rollback mechanism ensures the device remains operational and recoverable, even after a failed update.
+
+![Secure firmware update](../images/SecureFirmwareUpdate.png)
+
+## UEFI runtime support in U-Boot {.reference}
+
+The implementation of UEFI boot-time and runtime APIs requires persistent variable storage. In
+Corstone-1000, UEFI variables are stored using the Protected Storage (PS) service.
+
+The diagram below illustrates the data flow for storing UEFI variables. U-Boot's UEFI subsystem
+communicates with the Secure World using the U-Boot FF-A driver, which interfaces with the
+[UEFI System Management Mode (SMM) service]($trusted_services_uefi_smm_website).
+
+The SMM service provides support for the UEFI System Management Mode. This support is implemented by the SMM Gateway secure partition.
+The SMM service then uses the Proxy Protected Storage (PS) provided by the SE Proxy SP.
+These PS calls are forwarded to the Secure Enclave, following the communication path described earlier.
+
+![UEFI runtime support flow](../images/UEFISupport.png)
+
+## References {.reference}
+
+For more information, see:
+
+- [Arm Developer]($arm_developer_cs1000_search)
+- [Arm Security Architectures]($arm_architecture_security_features_platform_security)

meta-arm-bsp/documentation/corstone1000-a320/topics/user-guide.md

@@ -0,0 +1,265 @@
+# Build, flash and run {.chapter permissions=non-confidential}
+
+The Arm Corstone-1000 with Cortex-A320 software stack uses the Yocto Project to build a tiny Linux distribution suitable for the Arm Corstone-1000 with Cortex-A320 platform (kernel and initramfs filesystem less than 6 MB on the flash).
+
+The Corstone-1000 with Cortex-A320 software stack can be run on [Arm Corstone-1000 with Cortex-A320 FVP (Fixed Virtual Platform)](https://developer.arm.com/downloads/-/arm-ecosystem-fvps) and is built on top of Yocto Project's [Wrynose release]($meta_arm_repository_release_branch).
+
+The Yocto Project relies on the [BitBake](https://docs.yoctoproject.org/bitbake.html#bitbake-documentation) tool as its build tool. Please see the [Yocto Project documentation](https://docs.yoctoproject.org/) for more information.
+
+## Prerequisites {.reference}
+
+This guide assumes that your host machine is running Ubuntu 24.04 LTS (with `sudo` rights), with at least
+32GB of free disk space and 16GB of RAM as minimum requirement.
+
+The following prerequisites must be available on the host system:
+
+- Git 2.39.2 or greater.
+- Python 3.11.2 or greater.
+- GNU Tar 1.34 or greater.
+- GNU Compiler Collection 12.2 or greater.
+- GNU Make 4.3 or greater.
+- tmux 3.3 or greater.
+
+Please follow the steps described in the Yocto mega manual:
+
+- [Compatible Linux Distribution](https://docs.yoctoproject.org/singleindex.html#compatible-linux-distribution)
+- [Build Host Packages](https://docs.yoctoproject.org/singleindex.html#build-host-packages)
+
+## Software components {.reference}
+
+Within the Yocto Project, each component included in the Corstone-1000 with Cortex-A320 software stack is specified as
+a [BitBake recipe](https://docs.yoctoproject.org/bitbake/2.2/bitbake-user-manual/bitbake-user-manual-intro.html#recipes).
+The recipes specific to the Corstone-1000 with Cortex-A320 BSP are located at:
+`${WORKSPACE}/meta-arm/meta-arm-bsp/`.
+
+`${WORKSPACE}` refers to the absolute path to your workspace where the `meta-arm` repository will be cloned. Consider exporting it (e.g., `export WORKSPACE=$(realpath .)`) if you're already in the workspace directory,
+so you can copy and paste the commands from this guide verbatim.
+
+The Yocto machine config files are at:
+
+- `${WORKSPACE}/meta-arm/meta-arm-bsp/conf/machine/include/corstone1000-a320.inc`
+- `${WORKSPACE}/meta-arm/meta-arm-bsp/conf/machine/corstone1000-a320-fvp.conf`
+
+:::note
+All the paths stated in this document are absolute paths.
+:::
+
+### Host processor components {.reference}
+
+This section describes the components used in the host processor.
+
+#### Trusted Firmware-A {.reference}
+
+The following [Trusted Firmware-A](https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git) components are used:
+
+Table: Trusted Firmware-A components
+
+| Type      | Path                                                                                                             |
+| --------- | ---------------------------------------------------------------------------------------------------------------- |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend`                |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.15.0.bb`                     |
+
+#### Trusted Services {.reference}
+
+The following [Trusted Services](https://trusted-services.readthedocs.io/en/latest/index.html) components are used:
+
+Table: Trusted Services components
+
+| Type      | Path                                                                                                             |
+| --------- | ---------------------------------------------------------------------------------------------------------------- |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/libts_%.bbappend`                          |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-psa-crypto-api-test_%.bbappend`        |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-psa-iat-api-test_%.bbappend`           |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-psa-its-api-test_%.bbappend`           |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-psa-ps-api-test_%.bbappend`            |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-sp-se-proxy_%.bbappend`                |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/trusted-services/ts-sp-smm-gateway_%.bbappend`             |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/libts_git.bb`                                  |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-crypto-api-test_git.bb`                |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-iat-api-test_git.bb`                   |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-its-api-test_git.bb`                   |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/ts-psa-ps-api-test_git.bb`                    |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-smm-gateway_git.bb`                     |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/trusted-services/ts-sp-se-proxy_git.bb`                        |
+
+#### OP-TEE {.reference}
+
+The following [OP-TEE](https://git.trustedfirmware.org/OP-TEE/optee_os.git) components are used:
+
+Table: OP-TEE components
+
+| Type      | Path                                                                                                             |
+| --------- | ---------------------------------------------------------------------------------------------------------------- |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_%.bbappend`                                 |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-security/optee/optee-os_4.10.0.bb`                                       |
+
+#### U-Boot {.reference}
+
+The following [U-Boot](https://github.com/u-boot/u-boot.git) components are used:
+
+Table: U-Boot components
+
+| Type      | Path                                                                                                             |
+| --------- | ---------------------------------------------------------------------------------------------------------------- |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend`                                           |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot_%.bbappend`                                       |
+| Recipe    | `${WORKSPACE}/core/meta/recipes-bsp/u-boot/u-boot_2026.07.bb`                                                   |
+
+#### Linux {.reference}
+
+The distribution is based on the [Poky](https://docs.yoctoproject.org/ref-manual/terms.html#term-Poky)
+distribution which is a Linux distribution stripped down to a minimal configuration.
+
+The provided distribution is based on [BusyBox](https://www.busybox.net/) and built using [musl libc](https://musl.libc.org/).
+
+The following Linux components are used:
+
+Table: Linux components
+
+| Type      | Path                                                                                                             |
+| --------- | ---------------------------------------------------------------------------------------------------------------- |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-yocto_%.bbappend`                                |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-yocto_6.19.bb`                                   |
+| defconfig | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-kernel/linux/files/corstone1000/defconfig`                          |
+
+### Secure enclave components {.reference}
+
+This section describes the secure enclave components.
+
+#### Trusted Firmware-M {.reference}
+
+The following [Trusted Firmware-M](https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git) are used:
+
+Table: Trusted Firmware-M secure enclave components
+
+| Type      | Path                                                                                                             |
+| --------- | ---------------------------------------------------------------------------------------------------------------- |
+| bbappend  | `${WORKSPACE}/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m_%.bbappend`                |
+| Recipe    | `${WORKSPACE}/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_2.3.0.bb`                      |
+
+## Build {.reference}
+
+To build the software stack, do the following:
+
+:::note
+Building binaries natively on Windows and AArch64 Linux is not supported. Use an Intel or AMD 64-bit architecture Linux based development machine to build the software stack and transfer the binaries to run the software stack on an FVP in Windows or AArch64 Linux if required.
+:::
+
+1. Create a new folder that will be your workspace:
+
+   ```
+   mkdir ${WORKSPACE}
+   cd ${WORKSPACE}
+   ```
+
+2. Install kas version 4.4 with `sudo` rights:
+
+   ```
+   sudo pip3 install kas==4.4
+   ```
+
+   Ensure the kas installation directory is visible on the `$PATH` environment variable.
+
+3. Clone the `meta-arm` Yocto layer in the workspace `${WORKSPACE}`.
+
+   ```
+   cd ${WORKSPACE}
+   git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2026.05
+   ```
+
+4. Accept the EULA on the [Arm Developer](https://developer.arm.com/downloads/-/arm-ecosystem-fvps/eula) site to build a Corstone-1000 with Cortex-A320 image for FVP as follows:
+
+   ```
+   export ARM_FVP_EULA_ACCEPT="True"
+   ```
+
+5. Build a Corstone-1000 with Cortex-A320 image:
+
+   ```
+   kas build meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml
+   ```
+
+A clean build takes a significant amount of time given that all of the development machine utilities are also
+built along with the target images. Those development machine utilities include executables (Python,
+CMake, etc.) and the required toolchains.
+
+Once the build succeeds, all output binaries will be placed in `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/`.
+
+Everything apart from the Secure Enclave ROM firmware is bundled into a single binary, the
+`corstone1000-flash-firmware-image-corstone1000-a320-fvp.wic` file.
+
+The output binaries run in the Corstone-1000 with Cortex-A320 platform are the following:
+
+- The Secure Enclave ROM firmware: `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/trusted-firmware-m/bl1.bin`
+- The internal firmware flash image: `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/corstone1000-flash-firmware-image-corstone1000-a320-fvp.wic`
+
+## Build with SSH {.reference}
+
+The `meta-arm/kas/corstone1000-a320-fvp.yml` build produces an image for booting from flash.
+
+To build a bootable mass storage OS image with Dropbear SSH enabled, run:
+
+```
+kas build meta-arm/ci/corstone1000-a320-fvp.yml:meta-arm/kas/corstone1000-ssh.yml
+```
+
+The mass storage OS image can be found at `${WORKSPACE}/build/tmp/deploy/images/corstone1000-a320-fvp/core-image-minimal-corstone1000-a320-fvp.wic`
+
+:::note
+The generated `core-image-minimal-corstone1000-a320-fvp.fvpconf` attaches the mass storage OS image to `board.msd_mmc.p_mmc_file`.
+:::
+
+
+## Run {.reference}
+
+Once the platform is turned ON, the Secure Enclave will start to boot, wherein the relevant memory contents of the `*.wic`
+file are copied to their respective memory locations. Firewall policies are enforced
+on memories and peripherals before bringing the Host Processor out of reset.
+
+The Host Processor will boot TrustedFirmware-A, OP-TEE, U-Boot and then Linux before presenting a login prompt.
+
+A Fixed Virtual Platform (FVP) model of the Corstone-1000 with Cortex-A320 platform must be available to run the
+Corstone-1000 with Cortex-A320 FVP software image.
+
+A Yocto recipe is provided to download the latest supported FVP version.
+
+The recipe is located at `${WORKSPACE}/meta-arm/meta-arm/recipes-devtools/fvp/fvp-corstone1000-a320.bb`.
+
+The latest FVP version is `11.31.cs1000_a320_2` for Corstone-1000 with Cortex-A320, and the model is automatically downloaded and installed when using the `runfvp` command as follows:
+
+```
+kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml \
+-c "../meta-arm/scripts/runfvp -- --version"
+```
+
+The FVP can also be manually downloaded from [Arm Developer](https://developer.arm.com/downloads/-/arm-ecosystem-fvps) to download the Corstone-1000 with Cortex-A320 FVP package.
+
+To set up the FVP:
+
+1. Run `tmux`:
+
+   ```
+   cd ${WORKSPACE} && tmux
+   ```
+
+2. Run the FVP within `tmux`:
+
+   ```
+   kas shell meta-arm/kas/corstone1000-a320-fvp.yml:meta-arm/ci/debug.yml \
+   -c "../meta-arm/scripts/runfvp --terminals=tmux"
+   ```
+
+   When the script is executed, three terminal instances will be launched:
+
+   - one for the Secure Enclave processing element
+   - two for the Host processor processing element.
+
+   ```
+   corstone1000-a320-fvp login:
+   ```
+
+3. Log in using the `root` username.
+
+## Security issue reporting {.reference}
+
+To report any security issues identified with Corstone-1000 with Cortex-A320, please send an email to [psirt@arm.com](mailto:psirt@arm.com).

meta-arm-bsp/documentation/corstone1000/change-log.rst

@@ -10,6 +10,71 @@ Change Log
 This document contains a summary of the new features, changes and
 fixes in each release of Corstone-1000 software stack.
 
+***************
+Version 2026.05
+***************
+
+Changes
+=======
+
+- Upgraded key Corstone-1000 components to U-Boot 2025.10, TF-A 2.14.1, TF-M 2.2.2, OP-TEE 4.9.0, Trusted Services 1.3.0, and Linux 6.19.
+- Added GPT support in TF-M and updated MCUboot to use the GPT library for firmware-update partitions.
+- Extended the TF-M firmware update flow with GPT fixes, partition create/remove/duplicate operations, metadata-only handling, flash erase protection, stale partition cleanup, and better handling of older images during PSA FWU.
+- Added SSH-enabled build overlay for FVP mass-storage images.
+- Removed GRUB from the initramfs boot package set.
+
+Corstone-1000 components versions
+=================================
+
++-------------------------------------------+-------------------+
+| linux-yocto                               | 6.19              |
++-------------------------------------------+-------------------+
+| u-boot                                    | 2025.10           |
++-------------------------------------------+-------------------+
+| external-system                           | 0.1.0             |
++-------------------------------------------+-------------------+
+| optee-client                              | 4.9.0             |
++-------------------------------------------+-------------------+
+| optee-os                                  | 4.9.0             |
++-------------------------------------------+-------------------+
+| trusted-firmware-a                        | 2.14.1            |
++-------------------------------------------+-------------------+
+| trusted-firmware-m                        | 2.2.2             |
++-------------------------------------------+-------------------+
+| libts                                     | v1.3.0            |
++-------------------------------------------+-------------------+
+| ts-sp-{se-proxy, smm-gateway}             | v1.3.0            |
++-------------------------------------------+-------------------+
+| ts-psa-{crypto, iat, its. ps}-api-test    | 74dc6646ff        |
++-------------------------------------------+-------------------+
+
+Yocto distribution components versions
+======================================
+
++-------------------------------------------+----------------+
+| meta-arm                                  | wrynose        |
++-------------------------------------------+----------------+
+| bitbake                                   | 22021758e6     |
++-------------------------------------------+----------------+
+| meta-openembedded                         | 9af4488d46     |
++-------------------------------------------+----------------+
+| openembedded-core                         | 06dd66e622     |
++-------------------------------------------+----------------+
+| meta-yocto                                | 8251bdad5f     |
++-------------------------------------------+----------------+
+| meta-secure-core                          | 07a99ae241     |
++-------------------------------------------+----------------+
+| busybox                                   | 1.37.0         |
++-------------------------------------------+----------------+
+| musl                                      | 1.2.6          |
++-------------------------------------------+----------------+
+| gcc-arm-none-eabi                         | 15.2.rel1      |
++-------------------------------------------+----------------+
+| gcc-cross-aarch64                         | 15.2.0         |
++-------------------------------------------+----------------+
+| openssl                                   | 3.5.6          |
++-------------------------------------------+----------------+
+
 ***************
 Version 2025.12
 ***************

meta-arm-bsp/documentation/corstone1000/release-notes.rst

@@ -19,6 +19,12 @@ intended for safety-critical applications. Should Your Software or Your Hardware
 prove defective, you assume the entire cost of all necessary servicing, repair
 or correction.
 
+***********************
+Release notes - 2026.05
+***********************
+
+The same notes as the 2025.05 release still apply.
+
 ***********************
 Release notes - 2025.12
 ***********************

meta-arm-bsp/documentation/corstone1000/software-architecture.rst

@@ -116,19 +116,6 @@ The Corstone-1000 architecture is designed to cover a range of
 `Power, Performance, and Area (PPA) <ppa-website_>`__ applications, and enable extension
 for use-case specific applications, for example, sensors, cloud connectivity, and edge computing.
 
-**************************************
-Corstone-1000 with Cortex-A320 Variant
-**************************************
-
-This variant of the Corstone-1000 platform replaces the Host System's Cortex-A35 processor
-with a Cortex-A320. In this configuration, the optional External System (previously a Cortex-M3)
-is replaced by an Arm Ethos-U85 Neural Processing Unit (NPU).
-The Ethos-U85 runs in the direct drive configuration, where the Host System is responsible for managing the NPU directly.
-
-.. image:: images/CorstoneA320Subsystems.png
-   :width: 720
-   :alt: CorstoneA320Subsystems
-
 *****************
 Secure Boot Chain
 *****************

meta-arm-bsp/documentation/requirements.txt

@@ -7,5 +7,6 @@ jinja2==3.1.1
 
 # Required to build the documentation
 sphinx==7.1.2
+myst-parser~=3.0.1
 sphinx_rtd_theme~=3.0.0
 docutils~=0.18.1

meta-arm-bsp/files/wic/corstone1000-flash-firmware-fvp.wks.in

@@ -23,7 +23,7 @@ part --source rawcopy --size 144k --sourceparams="file=trusted-firmware-m/bl2_si
 part --source rawcopy --size 320k --sourceparams="file=trusted-firmware-m/tfm_s_signed.bin" --align 4 --part-name="tfm_primary" --uuid 07F9616C-1233-439C-ACBA-72D75421BF70 --part-type 7FAD470E-5EC5-5C03-A2C1-4756B495DE61
 
 # Rawcopy of the FIP binary
-part --source rawcopy --size 2 --sourceparams="file=signed_fip.bin" --align 4 --part-name="FIP_A" --uuid B9C7AC9D-40FF-4675-956B-EEF4DE9DF1C5 --part-type F1933675-5A8C-5B6D-9EF4-846739E89BC8
+part --source rawcopy --size 2560k --sourceparams="file=signed_fip.bin" --align 4 --part-name="FIP_A" --uuid B9C7AC9D-40FF-4675-956B-EEF4DE9DF1C5 --part-type F1933675-5A8C-5B6D-9EF4-846739E89BC8
 
 # Rawcopy of kernel with initramfs
 part --source rawcopy --size 12 --sourceparams="file=Image.gz-initramfs-${MACHINE}.bin" --align 4 --part-name="kernel_primary" --uuid BF7A6142-0662-47FD-9434-6A8811980816 --part-type F771AFF9-C7E9-5F99-9EDA-2369DD694F61

meta-arm-bsp/lib/oeqa/runtime/cases/parselogs-ignores-rdn2.txt

@@ -1,2 +1,3 @@
 arch_timer: Failed to initialize memory-mapped timer.
 PCI: OF: of_root node is NULL, cannot create PCI host bridge node
+_OSC: platform retains control of PCIe features (AE_ERROR)

meta-arm-bsp/lib/oeqa/runtime/cases/parselogs-ignores-rdv2.txt

@@ -1,2 +1,3 @@
 arch_timer: Failed to initialize memory-mapped timer.
 PCI: OF: of_root node is NULL, cannot create PCI host bridge node
+_OSC: platform retains control of PCIe features (AE_ERROR)

meta-arm-bsp/recipes-bsp/external-system/external-system_git.bb

@@ -1,17 +1,18 @@
 SUMMARY = "External system Cortex-M3 Firmware"
 DESCRIPTION = "Firmware to be loaded and run in External System Harness in\
                support to the main application CPU."
-HOMEPAGE = "https://git.linaro.org/landing-teams/working/arm/external-system.git"
+HOMEPAGE = "https://gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx"
 DEPENDS = "gcc-arm-none-eabi-native"
 INHIBIT_DEFAULT_DEPS = "1"
-LICENSE = "BSD-3-Clause & Apache-2.0"
-LIC_FILES_CHKSUM = "file://license.md;md5=e44b2531cd6ffe9dece394dbe988d9a0 \
+LICENSE = "Apache-2.0 AND BSD-3-Clause"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=e44b2531cd6ffe9dece394dbe988d9a0 \
                     file://cmsis/LICENSE.txt;md5=e3fc50a88d0a364313df4b21ef20c29e"
 
-SRC_URI = "gitsm://git.gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx.git;protocol=https;branch=master \
+SRC_URI = "gitsm://gitlab.arm.com/arm-reference-solutions/corstone1000/external_system/rtx.git;protocol=https;branch=master \
            file://0001-tools-gen_module_code-atomically-rewrite-the-generat.patch"
-SRCREV = "8c9dca74b104ff6c9722fb0738ba93dd3719c080"
-PV .= "+git"
+SRCREV = "3a38cef6e9582907ad6f79950e3d54330c9ab42c"
+
+UPSTREAM_CHECK_COMMITS = "1"
 
 COMPATIBLE_MACHINE = "(corstone1000)"
 PACKAGE_ARCH = "${MACHINE_ARCH}"

meta-arm-bsp/recipes-bsp/images/corstone1000-flash-firmware-image.bb

@@ -160,9 +160,10 @@ TFA_FIP_BINARY = "fip.bin"
 TFA_BL2_RE_IMAGE_LOAD_ADDRESS = "0x62353000"
 TFA_BL2_RE_SIGN_BIN_SIZE = "0x2d000"
 TFA_FIP_RE_IMAGE_LOAD_ADDRESS = "0x68130000"
-TFA_FIP_RE_SIGN_BIN_SIZE = "0x00200000"
+TFA_FIP_RE_SIGN_BIN_SIZE = "0x00280000"
 RE_LAYOUT_WRAPPER_VERSION = "0.0.7"
 TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-EC-P256_1.pem"
+TFM_IMAGE_SIGN_PSA_KEY_IDS = "2147451244"
 RE_IMAGE_OFFSET = "0x1000"
 
 do_sign_images() {

meta-arm-bsp/recipes-bsp/images/firmware-image-juno.bb

@@ -12,19 +12,27 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
 
 COMPATIBLE_MACHINE = "juno"
 
-LINARO_RELEASE = "19.06"
-
-SRC_URI = "http://releases.linaro.org/members/arm/platforms/${LINARO_RELEASE}/juno-latest-oe-uboot.zip;subdir=${S} \
-    file://images-r0.txt \
-    file://images-r1.txt \
-    file://images-r2.txt \
+SRC_URI = " \
+    file://mbb_v151.ebf \
+    file://io_b118.bit \
+    file://tapid.arm \
+    file://pms_v103.bin \
+    file://pms_v104.bin \
+    file://pms_v105.bin \
+    file://mb-board.txt \
+    file://site1-HBI0262B-board.txt \
+    file://site1-HBI0262C-board.txt \
+    file://site1-HBI0262D-board.txt \
+    file://site1-images.txt \
+    file://hdlcdclk.dat \
+    file://startup.nsh \
+    file://selftest \
+    file://config.txt \
     file://uEnv.txt \
 "
-SRC_URI[md5sum] = "01b662b81fa409d55ff298238ad24003"
-SRC_URI[sha256sum] = "b8a3909bb3bc4350a8771b863193a3e33b358e2a727624a77c9ecf13516cec82"
 
-FIRMWARE_DIR = "juno-firmware-${LINARO_RELEASE}"
-S = "${UNPACKDIR}/${FIRMWARE_DIR}"
+FIRMWARE_DIR = "juno-firmware"
+S = "${UNPACKDIR}"
 
 inherit deploy nopackages
 
@@ -34,23 +42,63 @@ do_compile[noexec] = "1"
 # The ${D} is used as a temporary directory and we don't generate any
 # packages for this recipe.
 do_install() {
-    cp -a ${S} ${D}/
+    install -d ${D}/${FIRMWARE_DIR}/
+    cp -f ${UNPACKDIR}/config.txt ${D}/${FIRMWARE_DIR}/
+
+    # Files in the MB directory are mostly the same, except for the PMS file and references to the PMS file by name
+    install -d ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${UNPACKDIR}/mbb_v151.ebf ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${UNPACKDIR}/io_b118.bit ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${UNPACKDIR}/tapid.arm  ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${UNPACKDIR}/pms_v103.bin ${D}/${FIRMWARE_DIR}/MB/HBI0262B/
+    cp -f ${UNPACKDIR}/mb-board.txt ${D}/${FIRMWARE_DIR}/MB/HBI0262B/board.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${UNPACKDIR}/mbb_v151.ebf ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${UNPACKDIR}/io_b118.bit ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${UNPACKDIR}/tapid.arm  ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    cp -f ${UNPACKDIR}/pms_v104.bin ${D}/${FIRMWARE_DIR}/MB/HBI0262C/
+    sed 's/pms_v103/pms_v104/g' ${UNPACKDIR}/mb-board.txt > ${D}/${FIRMWARE_DIR}/MB/HBI0262C/board.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${UNPACKDIR}/mbb_v151.ebf ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${UNPACKDIR}/io_b118.bit ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${UNPACKDIR}/tapid.arm  ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    cp -f ${UNPACKDIR}/pms_v105.bin ${D}/${FIRMWARE_DIR}/MB/HBI0262D/
+    sed 's/pms_v103/pms_v105/g' ${UNPACKDIR}/mb-board.txt > ${D}/${FIRMWARE_DIR}/MB/HBI0262D/board.txt
+
+    # The SITE1 image files are mostly the same except for the DTB they reference
+    install -d ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/
+    cp -f ${UNPACKDIR}/site1-HBI0262B-board.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/board.txt
+    cp -f ${UNPACKDIR}/site1-images.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/images.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/
+    cp -f ${UNPACKDIR}/site1-HBI0262C-board.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/board.txt
+    sed 's/juno\.dtb/juno-r1.dtb/g' ${UNPACKDIR}/site1-images.txt > ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/images.txt
+
+    install -d ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/
+    cp -f ${UNPACKDIR}/site1-HBI0262D-board.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/board.txt
+    sed 's/juno\.dtb/juno-r2.dtb/g' ${UNPACKDIR}/site1-images.txt > ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/images.txt
+
+    # The files in SOFTWARE are listed in the SITE1 board.txt file by name
+    install -d ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    cp -f ${RECIPE_SYSROOT}/firmware/trusted-firmware-a/fip.bin \
+        ${D}/${FIRMWARE_DIR}/SOFTWARE/fip.bin
+
     cp -f ${RECIPE_SYSROOT}/firmware/trusted-firmware-a/bl1.bin \
         ${D}/${FIRMWARE_DIR}/SOFTWARE/bl1.bin
 
-    cp -f ${RECIPE_SYSROOT}/firmware/trusted-firmware-a/fip.bin \
-        ${D}/${FIRMWARE_DIR}/SOFTWARE/fip.bin
+    cp -f ${UNPACKDIR}/hdlcdclk.dat ${D}/${FIRMWARE_DIR}/SOFTWARE/
 
     cp -f ${RECIPE_SYSROOT}/firmware/scp-firmware/scp_romfw_bypass.bin \
         ${D}/${FIRMWARE_DIR}/SOFTWARE/scp_bl1.bin
 
+    cp -f ${UNPACKDIR}/startup.nsh ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    cp -f ${UNPACKDIR}/selftest ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    dd if=/dev/zero of="${D}/${FIRMWARE_DIR}/SOFTWARE/blank.img" bs=1024 count=192 status=none
+
     # u-boot environment file
     cp -f ${UNPACKDIR}/uEnv.txt ${D}/${FIRMWARE_DIR}/SOFTWARE/
-
-    # Juno images list file
-    cp -f ${UNPACKDIR}/images-r0.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/images.txt
-    cp -f ${UNPACKDIR}/images-r1.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/images.txt
-    cp -f ${UNPACKDIR}/images-r2.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/images.txt
 }
 
 do_deploy() {

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/config.txt

@@ -0,0 +1,28 @@
+TITLE: V2M-Juno Configuration File
+
+[CONFIGURATION]
+AUTORUN: TRUE                    ;Auto Run from power on
+TESTMENU: FALSE                  ;MB Peripheral Test Menu
+
+UPDATE: FALSE                    ;Force JTAG and FPGA update to DBs
+VERIFY: FALSE                    ;Force FPGA verify to DBs
+
+DVIMODE: VGA                     ;VGA or SVGA or XGA or SXGA or UXGA
+
+MBLOG: FALSE                     ;LOG MB MICRO in run mode FALSE/UART0/UART1
+DBLOG: FALSE                     ;LOG DB MICRO in run mode FALSE/UART1 (when MBLOG is not UART1)
+
+USERSWITCH: 00000000             ;UserSwitch[7:0] in binary
+CONFSWITCH: 00000000             ;Configuration Switch[7:0] in binary, Core[0:1] Cluster[2]
+ASSERTNPOR: TRUE                 ;External resets assert nPOR
+WDTRESET: RESETMB                ;Watchdog reset options NONE/RESETMB/RESETDB
+
+PCIMASTER: DB1                   ;Port Failover DB1/SL3
+MASTERSITE: DB1                  ;Boot Master DB1/SL3
+
+REMOTE: NONE                     ;Selects remote command via USB or FTP NONE/USB/FTP
+
+MCCMACADDRESS: 0xFFFFFFFFFFFF    ;MCC MAC Address (must be even MAC address)
+SMCMACADDRESS: 0xFFFFFFFFFFFF    ;SMC MAC Address
+
+HOSTNAME: V2M-JUNO-A2		 ;Host name for FTP [15 characters max]

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/images-r1.txt

@@ -1,71 +0,0 @@
-TITLE: Versatile Express Images Configuration File
-
-[IMAGES]
-TOTALIMAGES: 10                  ;Number of Images (Max: 32)
-
-NOR0UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR0ADDRESS: 0x00000000          ;Image Flash Address
-NOR0FILE: \SOFTWARE\fip.bin      ;Image File Name
-NOR0LOAD: 00000000               ;Image Load Address
-NOR0ENTRY: 00000000              ;Image Entry Point
-
-NOR1UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR1ADDRESS: 0x03EC0000          ;Image Flash Address
-NOR1FILE: \SOFTWARE\bl1.bin      ;Image File Name
-NOR1LOAD: 00000000               ;Image Load Address
-NOR1ENTRY: 00000000              ;Image Entry Point
-
-NOR2UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR2ADDRESS: 0x00500000          ;Image Flash Address
-NOR2FILE: \SOFTWARE\Image        ;Image File Name
-NOR2NAME: norkern                ;Rename kernel to norkern
-NOR2LOAD: 00000000               ;Image Load Address
-NOR2ENTRY: 00000000              ;Image Entry Point
-
-NOR3UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR3ADDRESS: 0x03000000          ;Image Flash Address
-NOR3FILE: \SOFTWARE\juno-r1.dtb  ;Image File Name
-NOR3NAME: board.dtb              ;Specify target filename to preserve file extension
-NOR3LOAD: 00000000               ;Image Load Address
-NOR3ENTRY: 00000000              ;Image Entry Point
-
-NOR4UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR4ADDRESS: 0x030C0000          ;Image Flash Address
-NOR4FILE: \SOFTWARE\hdlcdclk.dat ;Image File Name
-NOR4LOAD: 00000000               ;Image Load Address
-NOR4ENTRY: 00000000              ;Image Entry Point
-
-NOR5UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR5ADDRESS: 0x03E40000          ;Image Flash Address
-NOR5FILE: \SOFTWARE\scp_bl1.bin  ;Image File Name
-NOR5LOAD: 00000000               ;Image Load Address
-NOR5ENTRY: 00000000              ;Image Entry Point
-
-NOR6UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR6ADDRESS: 0x0BF00000          ;Image Flash Address
-NOR6FILE: \SOFTWARE\startup.nsh  ;Image File Name
-NOR6NAME: startup.nsh
-NOR6LOAD: 00000000               ;Image Load Address
-NOR6ENTRY: 00000000              ;Image Entry Point
-
-NOR7UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR7ADDRESS: 0x0BFC0000          ;Image Flash Address
-NOR7FILE: \SOFTWARE\blank.img    ;Image File Name
-NOR7NAME: BOOTENV
-NOR7LOAD: 00000000               ;Image Load Address
-NOR7ENTRY: 00000000              ;Image Entry Point
-
-NOR8UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR8ADDRESS: 0x03100000          ;Image Flash Address
-NOR8FILE: \SOFTWARE\selftest     ;Image File Name
-NOR8LOAD: 00000000               ;Image Load Address
-NOR8ENTRY: 00000000              ;Image Entry Point
-
-NOR9UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR9ADDRESS: 0x03180000          ;Image Flash Address
-NOR9NAME: uEnv.txt
-NOR9FILE: \SOFTWARE\uEnv.txt     ;Image File Name
-NOR9LOAD: 00000000               ;Image Load Address
-NOR9ENTRY: 00000000              ;Image Entry Point
-
-

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/images-r2.txt

@@ -1,71 +0,0 @@
-TITLE: Versatile Express Images Configuration File
-
-[IMAGES]
-TOTALIMAGES: 10                  ;Number of Images (Max: 32)
-
-NOR0UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR0ADDRESS: 0x00000000          ;Image Flash Address
-NOR0FILE: \SOFTWARE\fip.bin      ;Image File Name
-NOR0LOAD: 00000000               ;Image Load Address
-NOR0ENTRY: 00000000              ;Image Entry Point
-
-NOR1UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR1ADDRESS: 0x03EC0000          ;Image Flash Address
-NOR1FILE: \SOFTWARE\bl1.bin      ;Image File Name
-NOR1LOAD: 00000000               ;Image Load Address
-NOR1ENTRY: 00000000              ;Image Entry Point
-
-NOR2UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR2ADDRESS: 0x00500000          ;Image Flash Address
-NOR2FILE: \SOFTWARE\Image        ;Image File Name
-NOR2NAME: norkern                ;Rename kernel to norkern
-NOR2LOAD: 00000000               ;Image Load Address
-NOR2ENTRY: 00000000              ;Image Entry Point
-
-NOR3UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR3ADDRESS: 0x03000000          ;Image Flash Address
-NOR3FILE: \SOFTWARE\juno-r2.dtb  ;Image File Name
-NOR3NAME: board.dtb              ;Specify target filename to preserve file extension
-NOR3LOAD: 00000000               ;Image Load Address
-NOR3ENTRY: 00000000              ;Image Entry Point
-
-NOR4UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR4ADDRESS: 0x030C0000          ;Image Flash Address
-NOR4FILE: \SOFTWARE\hdlcdclk.dat ;Image File Name
-NOR4LOAD: 00000000               ;Image Load Address
-NOR4ENTRY: 00000000              ;Image Entry Point
-
-NOR5UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR5ADDRESS: 0x03E40000          ;Image Flash Address
-NOR5FILE: \SOFTWARE\scp_bl1.bin  ;Image File Name
-NOR5LOAD: 00000000               ;Image Load Address
-NOR5ENTRY: 00000000              ;Image Entry Point
-
-NOR6UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR6ADDRESS: 0x0BF00000          ;Image Flash Address
-NOR6FILE: \SOFTWARE\startup.nsh  ;Image File Name
-NOR6NAME: startup.nsh
-NOR6LOAD: 00000000               ;Image Load Address
-NOR6ENTRY: 00000000              ;Image Entry Point
-
-NOR7UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR7ADDRESS: 0x0BFC0000          ;Image Flash Address
-NOR7FILE: \SOFTWARE\blank.img    ;Image File Name
-NOR7NAME: BOOTENV
-NOR7LOAD: 00000000               ;Image Load Address
-NOR7ENTRY: 00000000              ;Image Entry Point
-
-NOR8UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR8ADDRESS: 0x03100000          ;Image Flash Address
-NOR8FILE: \SOFTWARE\selftest     ;Image File Name
-NOR8LOAD: 00000000               ;Image Load Address
-NOR8ENTRY: 00000000              ;Image Entry Point
-
-NOR9UPDATE: AUTO                 ;Image Update:NONE/AUTO/FORCE
-NOR9ADDRESS: 0x03180000          ;Image Flash Address
-NOR9NAME: uEnv.txt
-NOR9FILE: \SOFTWARE\uEnv.txt     ;Image File Name
-NOR9LOAD: 00000000               ;Image Load Address
-NOR9ENTRY: 00000000              ;Image Entry Point
-
-

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/mb-board.txt

@@ -0,0 +1,26 @@
+BOARD: HBI0262
+TITLE: MotherBoard Configuration File
+
+[MCCS]
+MBBIOS: mbb_v151.ebf        ;MB BIOS IMAGE
+
+[FPGAS]
+MBIOFPGA: io_b118.bit       ;MB IOFPGA
+
+[PMIC]
+MBPMIC: pms_v103.bin        ;MB PMIC
+
+[OSCCLKS]
+TOTALOSCCLKS: 11
+OSC0: 50.0                  ;OSC0 Juno SYSREFCLK    (System clock)
+OSC1: 50.0                  ;OSC1 Juno AONREFCLK    (Always On)
+OSC2: 50.0                  ;OSC2 Juno PXLREFCLK    (HS pixel clock)
+OSC3: 47.5                  ;OSC3 Juno PXCLKIN      (LS pixel clock)
+OSC4: 2.11                  ;OSC4 Juno I2SCLK       (Audio)
+OSC5: 50.0                  ;OSC5 Juno SMCMCLK      (Static memory)
+OSC6: 50.0                  ;OSC6 Juno CA53 REF_CLK (RSVD)
+OSC7: 50.0                  ;OSC7 Juno CA57 REF_CLK (RSVD)
+OSC8: 50.0                  ;OSC8 Juno GPU  REF_CLK (RSVD)
+OSC9: 30.0                  ;OSC9  IOFPGA BOOT      (RSVD)
+OSC10: 24.0                 ;OSC10 IOFPGA UART      (RSVD)
+OSC11: 7.37                 ;OSC11 Juno UARTCLK     (UART clock)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/site1-HBI0262B-board.txt

@@ -0,0 +1,22 @@
+BOARD: HBI0262
+TITLE: V2M-Juno DevChip Configuration File
+
+[SCC REGISTERS]
+TOTALSCCS: 12                   ;Total Number of SCC registers
+SCC: 0x054 0x0007FFFE           ;Enable non-secure DMA operations
+SCC: 0x05C 0x00FE001E           ;Enable default GPU Texture Formats
+SCC: 0x100 0x003F1000           ;A57 PLL Register 0 (800MHz)
+SCC: 0x104 0x0001F300           ;A57 PLL Register 1
+SCC: 0x108 0x00371000           ;A53 PLL Register 0 (700MHz)
+SCC: 0x10C 0x0001B300           ;A53 PLL Register 1
+SCC: 0x118 0x003F1000           ;SYS PLL Register 0 (1600MHz)
+SCC: 0x11C 0x0001F100           ;SYS PLL Register 1
+SCC: 0x0F8 0x0BEC0000           ;BL1 entry point
+SCC: 0x0FC 0xABE40000           ;BL0 entry point
+
+SCC: 0x00C 0x000000C2           ;Clock Control, TMIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)
+SCC: 0x010 0x000000C2           ;Clock Control, TSIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/site1-HBI0262C-board.txt

@@ -0,0 +1,24 @@
+BOARD: HBI0262
+TITLE: V2M-Juno DevChip Configuration File
+
+[SCC REGISTERS]
+TOTALSCCS: 13                   ;Total Number of SCC registers
+SCC: 0x054 0x0007FFFE           ;Enable non-secure DMA operations
+SCC: 0x05C 0x00FE001E           ;Enable default GPU Texture Formats
+SCC: 0x100 0x003F1000           ;A57 PLL Register 0 (800MHz)
+SCC: 0x104 0x0001F300           ;A57 PLL Register 1
+SCC: 0x108 0x00331000           ;A53 PLL Register 0 (650MHz)
+SCC: 0x10C 0x00019300           ;A53 PLL Register 1
+SCC: 0x118 0x003F1000           ;SYS PLL Register 0 (1600MHz)
+SCC: 0x11C 0x0001F100           ;SYS PLL Register 1
+SCC: 0x0F8 0x0BEC0000           ;BL1 entry point
+SCC: 0x0FC 0xABE40000           ;BL0 entry point
+
+SCC: 0xA14 0x00000000           ;PCLKDBG_CONTROL DIV=1
+
+SCC: 0x00C 0x000000C2           ;Clock Control, TMIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)
+SCC: 0x010 0x000000C2           ;Clock Control, TSIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/site1-HBI0262D-board.txt

@@ -0,0 +1,24 @@
+BOARD: HBI0262
+TITLE: V2M-Juno DevChip Configuration File
+
+[SCC REGISTERS]
+TOTALSCCS: 13                   ;Total Number of SCC registers
+SCC: 0x054 0x0007FFFE           ;Enable non-secure DMA operations
+SCC: 0x05C 0x00FE001E           ;Enable default GPU Texture Formats
+SCC: 0x100 0x00271000           ;A72 PLL Register 0 (1000MHz)
+SCC: 0x104 0x00013100           ;A72 PLL Register 1
+SCC: 0x108 0x003F1000           ;A53 PLL Register 0 (800MHz)
+SCC: 0x10C 0x0001F300           ;A53 PLL Register 1
+SCC: 0x118 0x003F1000           ;SYS PLL Register 0 (1600MHz)
+SCC: 0x11C 0x0001F100           ;SYS PLL Register 1
+SCC: 0x0F8 0x0BEC0000           ;BL1 entry point
+SCC: 0x0FC 0xABE40000           ;BL0 entry point
+
+SCC: 0xA14 0x00000000           ;PCLKDBG_CONTROL DIV=1
+
+SCC: 0x00C 0x000000C2           ;Clock Control, TMIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)
+SCC: 0x010 0x000000C2           ;Clock Control, TSIF2XCLK, Register 0xC1 = default
+                                ;[3:0] CLKSEL : 0 Output gated, 1 AON_REF_CLK, 2 SYSCLK
+                                ;[7:4] CLKDIV : Clock divider -1 (0 give a division of 1)

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/startup.nsh

@@ -0,0 +1,4 @@
+echo -off
+echo Juno startup.nsh from NOR flash
+echo Example command to start the kernel:
+echo norkern dtb=board.dtb initrd=ramdisk.img console=ttyAMA0,115200n8 root=/dev/sda2 rw rootwait earlyprintk=pl011,0x7ff80000 debug user_debug=31 androidboot.hardware=juno loglevel=9 sky2.mac_address=0xAA,0xBB,0xCC,0xDD,0xEE,0xFF

meta-arm-bsp/recipes-bsp/images/firmware-image-juno/tapid.arm

@@ -0,0 +1,97 @@
+# ARM TAP controller IR register lengths file
+#
+# Copyright (C) 2008 ARM Limited.  All rights reserved.
+#
+# This file contains a definition of the devices names, ID codes, ID code mask
+# and IR lengths for devices used on ARM boards. This file is read by the
+# progcards_usb.exe program and used to determine if a device ID is valid and
+# the corresponding IR length. A device that is not recognized will be display
+# as 'UNKOWN' and device details should be added to this file.
+#
+# DEVICE NAME    ID CODE     ID MASK     IR LENGTH
+# -------------  ----------  ----------  ---------
+
+# XILINX PLDs
+
+XC9572           0x09504093  0x0FFFFFFF  8
+XC9536XL         0x29602093  0x0FFFFFFF  8
+XC9572XL         0x09604093  0x0FFFFFFF  8
+XC95288XL        0x09616093  0x0FFFFFFF  8
+XCR3256XL        0xF494FFFF  0x0FFF8001  4
+XC4036XLA        0x00224093  0x00FFFFFF  3
+XC4062XLA        0x00230093  0x00FFFFFF  3
+XC4085XLA        0x00238093  0x00FFFFFF  3
+XC2C32A          0x06E1C093  0x0FFF0FFF  8
+XC2C64A          0x06E5D093  0x0FFF0FFF  8
+XC2C128          0x06D8A093  0x0FFF0FFF  8
+XC2C256          0x16D4c093  0x0FFF0FFF  8
+XC2C384          0x06D5C093  0x0FFF0FFF  8
+
+# XILINX FPGAs
+
+XCV600           0x10630093  0x00FFFFFF  5
+XCV600E          0x90A30093  0x00FFFFFF  5
+XCV1000          0x40640093  0x0FFFFFFF  5
+XCV2000E         0xF0A50093  0x0FFFFFFF  5
+XC2V2000         0x01038093  0x0FFFFFFF  6
+XC2V6000         0x31060093  0x0FFFFFFF  6
+XC2V8000         0x01070093  0x0FFFFFFF  6
+XC4VLX40         0x316A4093  0x0FFFFFFF  10
+XC4VLX160        0x01718093  0x0FFFFFFF  10
+XC4VLX200        0x01734093  0x0FFFFFFF  10
+XC5VLX50T        0x02A96093  0x0FFFFFFF  10
+XC5VLX110        0x228D6093  0x0FFFFFFF  10
+XC5VLX330        0x2295C093  0x0FFFFFFF  10
+XC2S200E         0x20A1C093  0x0FFFFFFF  5
+XC2S300E         0x90A20093  0x0FFFFFFF  5
+XC3S200A         0x02218093  0x0FFFFFFF  6
+XC3S4000         0x01448093  0x0FFFFFFF  6
+XC6SLX45         0x04008093  0x0FFFFFFF  6
+
+# ARM
+
+ARM7TDMI         0x3F0F0F0F  0xFFFFFFFF  4
+ARM7TDMI-r4      0x40700F0F  0xFFFFFFFF  4
+ARM720T          0x0F0F0F0F  0xFFFFFFFF  4
+ARM920T          0x10920F0F  0xFFFFFFFF  4
+ARM926EJ-S       0x07926F0F  0xFFFFFFFF  4
+ARM940T          0x1F0F0F0F  0xFFFFFFFF  4
+ARM10200         0x00A20F0F  0xFFFFFFFF  4
+ARMFLASH         0x0F0E5F2F  0xFFFFFFFF  5
+ARMDBT           0x00000F0F  0xFFFFFFFF  5
+PWP926EJ-S_BS2   0x0F21FF0F  0xFFFFFFFF  2
+ARM_BS2_         0x0F203F0F  0xFFFFFFFF  2
+ARM1136J-Sr0_BS2 0x0F21DF0F  0xFFFFFFFF  2
+ARM11MPCore_BS5  0x17536021  0xFFFFFFFF  5
+PXP1176JZF_BS2   0x0F2258EF  0xFFFFFFFF  2
+CORTEXA8         0x0F423477  0xFFFFFFFF  4
+CORTEXA9         0x08226021  0xFFFFFFFF  4
+
+# ALTERA
+
+EPM3032A         0x170320DD  0xFFFFFFFF  10
+EPM7256AE        0x172560DD  0xFFFFFFFF  10
+EPM7512AE        0x175120DD  0xFFFFFFFF  10
+EPM1270          0x020A30DD  0xFFFFFFFF  10
+EP20K1000E       0x090000DD  0xFFFFFFFF  10
+EP2S180F         0x020960DD  0xFFFFFFFF  10
+
+# Misc
+
+ispClock5520     0x00150043  0xFFFFFFFF  8
+ispClock5620     0x00160043  0xFFFFFFFF  8
+ispClock5610V    0x00161043  0xFFFFFFFF  8
+ispClock5610AV   0x00166043  0xFFFFFFFF  8
+ISSP             0x0F0F0F0F  0x0FFFFFFF  5
+Mali200          0x10400477  0xFFFFFFFF  2
+PLX6520          0x3197839B  0xFFFFFFFF  5
+PLX8114          0x21FB239B  0xFFFFFFFF  5
+PLX8518          0x1214639B  0xFFFFFFFF  5
+PLX8518          0x4214639B  0xFFFFFFFF  5
+
+STM32TMC         0x16410041  0x0FFF0FFF  5
+STM32CM3         0x3BA00477  0x0FFFFFFF  4
+IDT89HPES32H8    0x08035067  0xFFFFFFFF  6
+IDT89H16NT16     0x28090067  0xFFFFFFFF  6
+NX5000_BYPASS    0x14951185  0xFFFFFFFF  4
+NX5000_FC1152    0x03387589  0xFFFFFFFF  4

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0002-plat-corstone1000-add-Cortex-A320-support.patch

@@ -1,231 +0,0 @@
-From 4e23e72e65481fe917d8a0af355b3b7669d5acb6 Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Thu, 7 Aug 2025 10:05:02 +0000
-Subject: [PATCH] plat: corstone1000: add Cortex-A320 support
-
-Introduce `CORSTONE1000_CORTEX_A320` to enable Cortex-A320 on
-Corstone-1000 while keeping Cortex-A35 as the default. When the
-define is enabled, the build switches from `cortex_a35.S` to
-`cortex_a320.S`, maintaining compatibility with existing A35-based
-designs.
-
-Also add Normal-World mappings for the Ethos-U85 NPU and its SRAM
-on Cortex-A320 platforms so U-Boot and other non-secure software
-can safely access these regions:
-
-* **Ethos-U85 registers**: base `0x1A050000`, size `0x00004000` (16 KB),
-  attrs `MT_DEVICE | MT_RW | MT_NS`
-* **Non-secure SRAM**: base `0x02400000`, size `0x00400000` (4 MB),
-  attrs `MT_MEMORY | MT_RW | MT_NS`
-
-Enable GICv3 with GIC-600 when building for Cortex-A320 (retain
-GICv2/GIC-400 for Cortex-A35):
-
-* Update `plat_my_core_pos()` and `plat_arm_calc_core_pos()` to use
-  the Cortex-A320 MPIDR_EL1 affinity layout.
-* Add an A320-specific core-position routine in assembly guarded by
-  `CORSTONE1000_CORTEX_A320`.
-* Switch to the GICv3 driver with GIC-600 extensions: update GIC base
-  addresses, use GICv3 APIs, and set `USE_GIC_DRIVER=3`,
-  `GICV3_SUPPORT_GIC600=1`, `GIC_ENABLE_V4_EXTN=1`.
-
-These changes prepare the platform for Cortex-A320 integration and
-ensure correct GIC configuration and secondary-core bring-up, while
-preserving A35 behavior.
-
-Upstream-Status: Submitted (https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/45729)
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
-Signed-off-by: Michael Safwat <michael.safwat@arm.com>
----
- .../common/corstone1000_helpers.S             | 35 ++++++++++++++++++-
- .../corstone1000/common/corstone1000_plat.c   |  4 +++
- .../corstone1000/common/corstone1000_pm.c     |  8 +++++
- .../common/include/platform_def.h             | 26 ++++++++++++++
- plat/arm/board/corstone1000/platform.mk       | 11 ++++++
- 5 files changed, 83 insertions(+), 1 deletion(-)
-
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_helpers.S b/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-index a4ca9fe98223..665dbc61a92e 100644
---- a/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-+++ b/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2021-2024 Arm Limited and Contributors. All rights reserved.
-+ * Copyright (c) 2021-2025 Arm Limited and Contributors. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  */
-@@ -13,6 +13,39 @@
- 	.globl	plat_is_my_cpu_primary
- 	.globl	plat_arm_calc_core_pos
- 
-+#ifdef CORSTONE1000_CORTEX_A320
-+	.globl	plat_my_core_pos
-+
-+func plat_my_core_pos
-+	mrs	x0, mpidr_el1
-+	b	plat_arm_calc_core_pos
-+endfunc plat_my_core_pos
-+
-+func plat_arm_calc_core_pos
-+	/* Aff0 is always 0 for Cortex-A320
-+	MPIDR format: https://developer.arm.com/documentation/109551/0001/AArch64-registers/AArch64-Identification-registers-summary/MPIDR-EL1--Multiprocessor-Affinity-Register?lang=en
-+	*/
-+	/* Extract Aff1 (core ID) */
-+	ubfx    x1, x0, #MPIDR_AFF1_SHIFT, #MPIDR_AFFINITY_BITS
-+
-+	/* Extract Aff2 (cluster lower bits) */
-+	ubfx    x2, x0, #MPIDR_AFF2_SHIFT, #MPIDR_AFFINITY_BITS
-+
-+	/* Extract Aff3 (cluster upper bits) */
-+	ubfx    x3, x0, #MPIDR_AFF3_SHIFT, #MPIDR_AFFINITY_BITS
-+
-+	/* cluster_id = (Aff3 << 8) | Aff2 */
-+	lsl     x3, x3, #MPIDR_AFFINITY_BITS
-+	orr     x3, x3, x2
-+
-+	/* core_pos = core_id + (cluster_id * FVP_MAX_CPUS_PER_CLUSTER) */
-+	mov	x4, #CORSTONE1000_MAX_CPUS_PER_CLUSTER
-+	madd	x0, x3, x4, x1
-+
-+	ret
-+endfunc plat_arm_calc_core_pos
-+#endif
-+
- 	/* --------------------------------------------------------------------
- 	 * void plat_secondary_cold_boot_setup (void);
- 	 *
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_plat.c b/plat/arm/board/corstone1000/common/corstone1000_plat.c
-index e388c82f311b..d34e80b29bb0 100644
---- a/plat/arm/board/corstone1000/common/corstone1000_plat.c
-+++ b/plat/arm/board/corstone1000/common/corstone1000_plat.c
-@@ -26,6 +26,10 @@ const mmap_region_t plat_arm_mmap[] = {
- 	ARM_MAP_NS_DRAM1,
- 	CORSTONE1000_MAP_DEVICE,
- 	CORSTONE1000_EXTERNAL_FLASH,
-+#ifdef CORSTONE1000_CORTEX_A320
-+	ARM_MAP_ETHOS_U85,
-+	ARM_MAP_NONSECURE_SRAM,
-+#endif
- 	{0}
- };
- 
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_pm.c b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-index ac808873b9e7..a87697e97f11 100644
---- a/plat/arm/board/corstone1000/common/corstone1000_pm.c
-+++ b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-@@ -8,7 +8,11 @@
- #include <plat/arm/common/plat_arm.h>
- #include <platform_def.h>
- #include <plat/common/platform.h>
-+#ifdef CORSTONE1000_CORTEX_A320
-+#include <drivers/arm/gicv3.h>
-+#else
- #include <drivers/arm/gicv2.h>
-+#endif
- /*******************************************************************************
-  * Export the platform handlers via plat_arm_psci_pm_ops. The ARM Standard
-  * platform layer will take care of registering the handlers with PSCI.
-@@ -24,7 +28,11 @@ static void corstone1000_system_reset(void)
- 	 * Disable GIC CPU interface to prevent pending interrupt
- 	 * from waking up the AP from WFI.
- 	 */
-+#ifdef CORSTONE1000_CORTEX_A320
-+	gicv3_cpuif_disable(plat_my_core_pos());
-+#else
- 	gicv2_cpuif_disable();
-+#endif
- 
- 	/* Flush and invalidate data cache */
- 	dcsw_op_all(DCCISW);
-diff --git a/plat/arm/board/corstone1000/common/include/platform_def.h b/plat/arm/board/corstone1000/common/include/platform_def.h
-index 200383475c80..ffb1e2dec0e1 100644
---- a/plat/arm/board/corstone1000/common/include/platform_def.h
-+++ b/plat/arm/board/corstone1000/common/include/platform_def.h
-@@ -112,12 +112,19 @@
- #define ARM_SHARED_RAM_SIZE	(SZ_8K)  /* 8 KB */
- #define ARM_SHARED_RAM_BASE	ARM_TRUSTED_SRAM_BASE
- 
-+#ifdef CORSTONE1000_CORTEX_A320
-+#define TOTAL_SECURE_SRAM_SIZE		(SZ_4M)
-+#define TOTAL_NONSECURE_SRAM_SIZE	(SZ_4M)
-+#define PLAT_ARM_TRUSTED_SRAM_SIZE	(TOTAL_SECURE_SRAM_SIZE - \
-+					 ARM_SHARED_RAM_SIZE)
-+#else
- /* The remaining Trusted SRAM is used to load the BL images */
- #define TOTAL_SRAM_SIZE		(SZ_4M)  /* 4 MB */
- 
- 
- #define PLAT_ARM_TRUSTED_SRAM_SIZE	(TOTAL_SRAM_SIZE - \
- 					 ARM_SHARED_RAM_SIZE)
-+#endif
- 
- #define PLAT_ARM_MAX_BL2_SIZE	(180 * SZ_1K)  /* 180 KB */
- 
-@@ -208,8 +215,13 @@
- #define MAX_IO_BLOCK_DEVICES	1
- 
- /* GIC related constants */
-+#ifdef CORSTONE1000_CORTEX_A320
-+#define PLAT_ARM_GICD_BASE	0x1C000000
-+#define PLAT_ARM_GICR_BASE	0x1C040000
-+#else
- #define PLAT_ARM_GICD_BASE	0x1C010000
- #define PLAT_ARM_GICC_BASE	0x1C02F000
-+#endif
- 
- /* MHUv2 Secure Channel receiver and sender */
- #define PLAT_SDK700_MHU0_SEND	0x1B800000
-@@ -334,6 +346,20 @@
- 					CORSTONE1000_DEVICE_BASE, \
- 					CORSTONE1000_DEVICE_SIZE, \
- 					MT_DEVICE | MT_RW | MT_SECURE)
-+#ifdef CORSTONE1000_CORTEX_A320
-+#define ARM_ETHOS_U85_BASE		UL(0x1A050000)
-+#define ARM_ETHOS_U85_SIZE		UL(0x4000)
-+#define ARM_MAP_ETHOS_U85		MAP_REGION_FLAT( \
-+					ARM_ETHOS_U85_BASE, \
-+					ARM_ETHOS_U85_SIZE, \
-+					MT_DEVICE | MT_RW | MT_NS)
-+
-+#define ARM_NONSECURE_SRAM_BASE		(ARM_TRUSTED_SRAM_BASE + TOTAL_SECURE_SRAM_SIZE)
-+#define ARM_MAP_NONSECURE_SRAM		MAP_REGION_FLAT( \
-+					ARM_NONSECURE_SRAM_BASE, \
-+					TOTAL_NONSECURE_SRAM_SIZE, \
-+					MT_MEMORY | MT_RW | MT_NS)
-+#endif
- 
- #define ARM_IRQ_SEC_PHY_TIMER	29
- 
-diff --git a/plat/arm/board/corstone1000/platform.mk b/plat/arm/board/corstone1000/platform.mk
-index 65be9c1f5ad7..fe3e94865fca 100644
---- a/plat/arm/board/corstone1000/platform.mk
-+++ b/plat/arm/board/corstone1000/platform.mk
-@@ -9,7 +9,14 @@ ifeq ($(filter ${TARGET_PLATFORM}, fpga fvp),)
-         $(error TARGET_PLATFORM must be fpga or fvp)
- endif
- 
-+ifdef CORSTONE1000_CORTEX_A320
-+CORSTONE1000_CPU_LIBS	+=lib/cpus/aarch64/cortex_a320.S
-+$(eval $(call add_define,CORSTONE1000_CORTEX_A320))
-+GIC_ENABLE_V4_EXTN		:= 1
-+GICV3_SUPPORT_GIC600		:= 1
-+else
- CORSTONE1000_CPU_LIBS	+=lib/cpus/aarch64/cortex_a35.S
-+endif
- 
- PLAT_INCLUDES		:=	-Iplat/arm/board/corstone1000/common/include	\
- 				-Iplat/arm/board/corstone1000/include		\
-@@ -43,7 +50,11 @@ $(eval $(call add_define,CORSTONE1000_FVP_MULTICORE))
- endif
- endif
- 
-+ifdef CORSTONE1000_CORTEX_A320
-+USE_GIC_DRIVER			:=	3
-+else
- USE_GIC_DRIVER			:=	2
-+endif
- 
- BL2_SOURCES		+=	plat/arm/board/corstone1000/common/corstone1000_security.c		\
- 				plat/arm/board/corstone1000/common/corstone1000_err.c		\

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0002-plat-corstone1000-align-BL-config-region.patch

@@ -0,0 +1,45 @@
+From f05f9b75f60697be84217d0957e8864d58ee71bb Mon Sep 17 00:00:00 2001
+From: Oscar Belshaw <Oscar.Belshaw@arm.com>
+Date: Tue, 11 Aug 2026 15:40:27 +0100
+Subject: [PATCH] plat: corstone1000: align BL config mapping
+
+ARM_FW_CONFIG_BASE starts after the meminfo_t structure and is therefore
+not page aligned. Translation table mappings require page-aligned base
+addresses and sizes.
+
+Map the enclosing page from ARM_SHARED_RAM_BASE while retaining
+ARM_FW_CONFIG_BASE as the configuration load address. This prevents
+mmap_add_region_check() from returning -EINVAL during BL2 initialization.
+
+Only the mapping is widened: the reserved meminfo_t space at the start of
+shared RAM and the firmware configuration load addresses are unchanged.
+
+Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/54909]
+
+Signed-off-by: Oscar Belshaw <Oscar.Belshaw@arm.com>
+
+---
+ .../arm/board/corstone1000/common/include/platform_def.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/plat/arm/board/corstone1000/common/include/platform_def.h b/plat/arm/board/corstone1000/common/include/platform_def.h
+index 382426869b..6673010d2f 100644
+--- a/plat/arm/board/corstone1000/common/include/platform_def.h
++++ b/plat/arm/board/corstone1000/common/include/platform_def.h
+@@ -334,11 +334,11 @@
+  * Map the region for the optional device tree configuration with read and
+  * write permissions
+  */
+-#define ARM_MAP_BL_CONFIG_REGION	MAP_REGION_FLAT( \
+-					ARM_FW_CONFIG_BASE, \
+-					(ARM_FW_CONFIG_LIMIT \
+-					 - ARM_FW_CONFIG_BASE), \
+-					MT_MEMORY | MT_RW | MT_SECURE)
++#define ARM_MAP_BL_CONFIG_REGION	MAP_REGION_FLAT( \
++					ARM_SHARED_RAM_BASE, \
++					(ARM_FW_CONFIG_LIMIT \
++					 - ARM_SHARED_RAM_BASE), \
++					MT_MEMORY | MT_RW | MT_SECURE)
+ 
+ #define CORSTONE1000_DEVICE_BASE	(0x1A000000)
+ #define CORSTONE1000_DEVICE_SIZE	(0x26000000)

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0003-feat-corestone-1000-make-mutlicore-support-platform-.patch

@@ -1,113 +0,0 @@
-From a9801643d9d4d3f24960c5f24d5f5c3fd4889cc1 Mon Sep 17 00:00:00 2001
-From: Alex Chapman <alecha05@e142473.arm.com>
-Date: Tue, 3 Mar 2026 17:00:58 +0000
-Subject: [PATCH] feat(corestone-1000): make mutlicore support platform generic
-
-To improve portability, testing coverage, and future platform enablement.
-
-- Replace FVP-only multicore checks with platform-generic checks.
-- Add the corresponding TF-M patch to the Corstone-1000 recipe.
-
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/49092]
-Signed-off-by: Alex Chapman <alex.chapman@arm.com>
----
- plat/arm/board/corstone1000/common/corstone1000_helpers.S | 4 ++--
- plat/arm/board/corstone1000/common/corstone1000_pm.c      | 6 +++---
- plat/arm/board/corstone1000/common/include/platform_def.h | 4 ++--
- plat/arm/board/corstone1000/platform.mk                   | 6 ++----
- 4 files changed, 9 insertions(+), 11 deletions(-)
-
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_helpers.S b/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-index 665dbc61a..d41df4ebe 100644
---- a/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-+++ b/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2021-2025 Arm Limited and Contributors. All rights reserved.
-+ * Copyright (c) 2021-2026 Arm Limited and Contributors. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  */
-@@ -54,7 +54,7 @@ endfunc plat_arm_calc_core_pos
- 	 * --------------------------------------------------------------------
- 	 */
- func plat_secondary_cold_boot_setup
--#if defined(CORSTONE1000_FVP_MULTICORE)
-+#if defined(CORSTONE1000_MULTICORE)
- 
- 	/* Calculate the address of our hold entry */
- 	bl	plat_my_core_pos
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_pm.c b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-index a87697e97..2c7a2c67b 100644
---- a/plat/arm/board/corstone1000/common/corstone1000_pm.c
-+++ b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2021-2025, Arm Limited and Contributors. All rights reserved.
-+ * Copyright (c) 2021-2026, Arm Limited and Contributors. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  */
-@@ -41,7 +41,7 @@ static void corstone1000_system_reset(void)
- 	*watchdog_ctrl_reg = SECURE_WATCHDOG_MASK_ENABLE;
- }
- 
--#if defined(CORSTONE1000_FVP_MULTICORE)
-+#if defined(CORSTONE1000_MULTICORE)
- int corstone1000_validate_ns_entrypoint(uintptr_t entrypoint)
- {
- 	/*
-@@ -77,7 +77,7 @@ void corstone1000_pwr_domain_on_finish(const psci_power_state_t *target_state)
- #endif
- 
- plat_psci_ops_t plat_arm_psci_pm_ops = {
--#if defined(CORSTONE1000_FVP_MULTICORE)
-+#if defined(CORSTONE1000_MULTICORE)
- 	.pwr_domain_on = corstone1000_pwr_domain_on,
- 	.pwr_domain_on_finish = corstone1000_pwr_domain_on_finish,
- 	.validate_ns_entrypoint = corstone1000_validate_ns_entrypoint,
-diff --git a/plat/arm/board/corstone1000/common/include/platform_def.h b/plat/arm/board/corstone1000/common/include/platform_def.h
-index ffb1e2dec..4682b8b5d 100644
---- a/plat/arm/board/corstone1000/common/include/platform_def.h
-+++ b/plat/arm/board/corstone1000/common/include/platform_def.h
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2021-2025, Arm Limited and Contributors. All rights reserved.
-+ * Copyright (c) 2021-2026, Arm Limited and Contributors. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  */
-@@ -266,7 +266,7 @@
- 
- #define PLAT_ARM_TRUSTED_MAILBOX_BASE	ARM_TRUSTED_SRAM_BASE
- 
--#if defined(CORSTONE1000_FVP_MULTICORE)
-+#if defined(CORSTONE1000_MULTICORE)
- /* The secondary core entrypoint address points to bl31_warm_entrypoint
-  * and the address size is 8 bytes */
- #define CORSTONE1000_SECONDARY_CORE_ENTRYPOINT_ADDRESS_SIZE    UL(0x8)
-diff --git a/plat/arm/board/corstone1000/platform.mk b/plat/arm/board/corstone1000/platform.mk
-index fe3e94865..dee40f3b3 100644
---- a/plat/arm/board/corstone1000/platform.mk
-+++ b/plat/arm/board/corstone1000/platform.mk
-@@ -1,5 +1,5 @@
- #
--# Copyright (c) 2021-2025 Arm Limited and Contributors. All rights reserved.
-+# Copyright (c) 2021-2026 Arm Limited and Contributors. All rights reserved.
- #
- # SPDX-License-Identifier: BSD-3-Clause
- #
-@@ -44,10 +44,8 @@ $(eval $(call add_define,CORSTONE1000_WITH_BL32))
- endif
- 
- ENABLE_MULTICORE       :=      0
--ifneq ($(filter ${TARGET_PLATFORM}, fvp),)
- ifeq (${ENABLE_MULTICORE},1)
--$(eval $(call add_define,CORSTONE1000_FVP_MULTICORE))
--endif
-+$(eval $(call add_define,CORSTONE1000_MULTICORE))
- endif
- 
- ifdef CORSTONE1000_CORTEX_A320
--- 
-2.43.0

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/0003-plat-corstone1000-delay-early-GPT-access.patch

@@ -0,0 +1,83 @@
+From: Oscar Belshaw <Oscar.Belshaw@arm.com>
+Subject: [PATCH] fix(corstone1000): delay early GPT access
+
+TF-A 2.15 initializes GPT before MMU setup in the common BL2 boot path.
+On Corstone1000 MPS3, early memory-mapped flash reads have returned an
+invalid MBR signature, preventing boot. A 25 ms delay before GPT access
+has allowed boot and reset tests to complete on the tested configurations.
+
+Override the weak plat_arm_io_setup hook for Corstone1000 BL2 with
+RESET_TO_BL2 and ARM_GPT_SUPPORT enabled. Preserve arm_io_setup and its
+error handling, then wait 25 ms before returning to common GPT setup.
+
+The common system-counter enable occurs in arm_bl31_platform_setup, and
+common generic_delay_timer_init occurs after GPT initialization. Enable
+the system counter here with the same CNTCR configuration used by BL31,
+then initialize the delay driver before calling mdelay. Driver initialization
+alone does not enable the hardware counter. Do not reset the counter value;
+leave the later common initialization unchanged.
+
+Use the same hook for FPGA, A35 FVP and A320 FVP. Keep the common GPT-before-
+MMU ordering and reset handling unchanged, without diagnostic flash reads
+or console output.
+
+This is a timing workaround, not a hardware readiness check. The underlying
+cause and any required hardware settling interval remain under investigation;
+25 ms is the tested delay, not a documented minimum platform requirement.
+
+Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/54910]
+Signed-off-by: Oscar Belshaw <Oscar.Belshaw@arm.com>
+---
+ .../corstone1000/common/corstone1000_plat.c      | 28 ++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/plat/arm/board/corstone1000/common/corstone1000_plat.c b/plat/arm/board/corstone1000/common/corstone1000_plat.c
+index d34e80b..1c51145 100644
+--- a/plat/arm/board/corstone1000/common/corstone1000_plat.c
++++ b/plat/arm/board/corstone1000/common/corstone1000_plat.c
+@@ -6,10 +6,14 @@
+ 
+ #include <assert.h>
+ 
++#include <arch.h>
+ #include <common/bl_common.h>
++#include <common/debug.h>
+ 
++#include <drivers/delay_timer.h>
+ #include <drivers/generic_delay_timer.h>
+ #include <drivers/io/io_storage.h>
++#include <lib/mmio.h>
+ #include <plat/common/platform.h>
+ #include <plat/arm/common/arm_fconf_getter.h>
+ #include <plat/arm/common/arm_fconf_io_storage.h>
+@@ -33,6 +37,30 @@ const mmap_region_t plat_arm_mmap[] = {
+ 	{0}
+ };
+ 
++#define CS1K_GPT_DELAY	25U /* GPT initialization delay in milliseconds. */
++
++#if defined(IMAGE_BL2) && RESET_TO_BL2 && ARM_GPT_SUPPORT
++void plat_arm_io_setup(void)
++{
++	int err;
++
++	err = arm_io_setup();
++	if (err < 0) {
++		panic();
++	}
++
++	/*
++	 * Allow time before early memory-mapped flash reads. This is a
++	 * workaround for invalid GPT reads observed on MPS3; the underlying
++	 * readiness requirement still needs investigation.
++	 */
++	mmio_write_32(ARM_SYS_CNTCTL_BASE + CNTCR_OFF,
++		     CNTCR_FCREQ(0U) | CNTCR_EN);
++	generic_delay_timer_init();
++	mdelay(CS1K_GPT_DELAY);
++}
++#endif
++
+ static void set_fip_image_source(void)
+ {
+ 	const struct plat_io_policy *policy;

meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/corstone1000/tf-a-tests/0001-plat-corstone1000-Add-Cortex-A320-support.patch

@@ -1,157 +0,0 @@
-From ff4bb404474a3310654827c36c4ac882eb0344b5 Mon Sep 17 00:00:00 2001
-From: Michael Safwat <michael.safwat@arm.com>
-Date: Tue, 26 Aug 2025 11:20:01 +0000
-Subject: [PATCH] plat: corstone1000: Add Cortex-A320 support
-
-Switch platform to GICv3 (GIC-600) for Corstone-1000 with Cortex-A320
-depending on CORSTONE1000_CORTEX_A320:
-    - Define GICD and GICR bases.
-    - Update the platform sources to include the GIC-V3 files.
-
-Move the NVM offset to prevent overlap with the TFTF firmware,
-which starts at 0x80000000 (TFTF_BASE).
-
-Introduce a new skip file tests_to_skip_cortex_a320 to be used when building
-TF-A-Tests with CORSTONE1000_CORTEX_A320=1. This ensures that tests which
-are not supported or cause traps on Corstone-1000 with Cortex-A320 are
-consistently skipped during execution.
-
-Skipped entries:
-    CPU extensions/AMUv1 suspend/resume
-    CPU extensions/Use trace buffer control Registers
-
-Signed-off-by: Michael Safwat <michael.safwat@arm.com>
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Upstream-Status: Submitted (https://review.trustedfirmware.org/c/TF-A/tf-a-tests/+/42352)
----
- plat/arm/corstone1000/corstone1000_def.h      | 12 ++++++++++-
- plat/arm/corstone1000/include/platform_def.h  | 11 +++++-----
- plat/arm/corstone1000/platform.mk             | 20 ++++++++++++++++++
- .../tests_to_skip_cortex_a320.txt             | 21 +++++++++++++++++++
- 4 files changed, 58 insertions(+), 6 deletions(-)
- create mode 100644 plat/arm/corstone1000/tests_to_skip_cortex_a320.txt
-
-diff --git a/plat/arm/corstone1000/corstone1000_def.h b/plat/arm/corstone1000/corstone1000_def.h
-index 3e6f036acc9a..c4fa9a3b5f68 100644
---- a/plat/arm/corstone1000/corstone1000_def.h
-+++ b/plat/arm/corstone1000/corstone1000_def.h
-@@ -26,13 +26,23 @@
-  * GIC-400 & interrupt handling related constants
-  ******************************************************************************/
- /* GIC memory map */
-+#ifdef CORSTONE1000_CORTEX_A320
-+#define GICD_BASE	0x1C000000
-+#define GICR_BASE	0x1C040000
-+
-+/* GIC re-distributor doesn't exits on gic-600, but we still need to
-+ * provide GICC_BASE as the gic driver needs it
-+ */
-+#define GICC_BASE		0x0
-+#else
-+
- #define GICD_BASE		0x1C010000
- #define GICC_BASE		0x1C02F000
- /* GIC re-distributor doesn't exits on gic-400, but we still need to
-  * provide GICR_BASE as the gic driver needs it
-  */
- #define GICR_BASE		0x0
--
-+#endif
- /*******************************************************************************
-  * PL011 related constants
-  ******************************************************************************/
-diff --git a/plat/arm/corstone1000/include/platform_def.h b/plat/arm/corstone1000/include/platform_def.h
-index 91f4cda19a90..2a9e5c4c35bb 100644
---- a/plat/arm/corstone1000/include/platform_def.h
-+++ b/plat/arm/corstone1000/include/platform_def.h
-@@ -98,12 +98,13 @@
- #endif
- 
- /*
-- * USE 0x200000 DRAM offset to store TFTF data
-- *
-- * Please note that this won't be suitable for all test scenarios and
-- * for this reason some tests will be disabled in this configuration.
-+ * When USE_NVM = 0, TFTF_NVM_OFFSET marks the DRAM region
-+ * used as NVM. This region must not overlap the memory where
-+ * the TFTF image is loaded. The load address is given by
-+ * the TFTF_BASE macro. Set TFTF_NVM_OFFSET to leave enough
-+ * space for the TFTF image.
-  */
--#define TFTF_NVM_OFFSET		0x40000
-+#define TFTF_NVM_OFFSET		0x80000
- #define TFTF_NVM_SIZE		(128 * SZ_1M)	/* 128 MB */
- 
- /*******************************************************************************
-diff --git a/plat/arm/corstone1000/platform.mk b/plat/arm/corstone1000/platform.mk
-index cd7a19162bcf..dfdd27abd897 100644
---- a/plat/arm/corstone1000/platform.mk
-+++ b/plat/arm/corstone1000/platform.mk
-@@ -6,6 +6,16 @@
- 
- PLAT_INCLUDES	:=	-Iplat/arm/corstone1000/include/
- 
-+CORSTONE1000_CORTEX_A320   :=      0
-+ifeq (${CORSTONE1000_CORTEX_A320},1)
-+PLAT_SOURCES	:=	drivers/arm/timer/private_timer.c		\
-+                        drivers/arm/timer/system_timer.c                \
-+                        plat/arm/corstone1000/plat_helpers.S            \
-+                        plat/arm/corstone1000/corstone1000_pwr_state.c  \
-+                        plat/arm/corstone1000/corstone1000_topology.c   \
-+                        plat/arm/corstone1000/corstone1000_mem_prot.c   \
-+                        plat/arm/corstone1000/plat_setup.c
-+else
- PLAT_SOURCES	:=	drivers/arm/timer/private_timer.c		\
- 			drivers/arm/timer/system_timer.c		\
- 			plat/arm/corstone1000/plat_helpers.S		\
-@@ -13,6 +23,7 @@ PLAT_SOURCES	:=	drivers/arm/timer/private_timer.c		\
- 			plat/arm/corstone1000/corstone1000_topology.c	\
- 			plat/arm/corstone1000/corstone1000_mem_prot.c	\
- 			plat/arm/corstone1000/plat_setup.c
-+endif
- 
- PLAT_SUPPORTS_NS_RESET	:=	1
- 
-@@ -21,6 +32,15 @@ $(eval $(call assert_boolean,PLAT_SUPPORTS_NS_RESET))
- $(eval $(call add_define,TFTF_DEFINES,PLAT_SUPPORTS_NS_RESET))
- 
- FIRMWARE_UPDATE := 0
-+
-+ifeq ($(CORSTONE1000_CORTEX_A320),1)
-+$(eval $(call add_define,TFTF_DEFINES,CORSTONE1000_CORTEX_A320))
-+endif
-+
-+ifeq (${CORSTONE1000_CORTEX_A320},1)
-+PLAT_TESTS_SKIP_LIST    :=      plat/arm/corstone1000/tests_to_skip_cortex_a320.txt
-+else
- PLAT_TESTS_SKIP_LIST    :=      plat/arm/corstone1000/tests_to_skip.txt
-+endif
- 
- include plat/arm/common/arm_common.mk
-diff --git a/plat/arm/corstone1000/tests_to_skip_cortex_a320.txt b/plat/arm/corstone1000/tests_to_skip_cortex_a320.txt
-new file mode 100644
-index 000000000000..87b9241daba0
---- /dev/null
-+++ b/plat/arm/corstone1000/tests_to_skip_cortex_a320.txt
-@@ -0,0 +1,21 @@
-+Realm payload tests
-+Realm payload boot
-+Realm payload multi CPU request
-+Realm payload Delegate and Undelegate
-+Multi CPU Realm payload Delegate and Undelegate
-+Testing delegation fails
-+Realm testing with SPM tests
-+PSCI System Suspend Validation
-+PSCI STAT/Stats test cases after system suspend
-+IRQ support in TSP/Resume preempted STD SMC after PSCI SYSTEM SUSPEND
-+PSCI SYSTEM SUSPEND stress tests
-+Timer framework Validation/Verify the timer interrupt generation
-+CPU Hotplug/CPU hotplug
-+PSCI CPU Suspend
-+PSCI CPU Suspend in OSI mode
-+PSCI STAT/for valid composite state CPU suspend
-+FF-A Setup and Discovery/FF-A RXTX remap unmapped region success
-+FF-A Memory Sharing/Normal World VM retrieve request into SPMC
-+Boot requirement tests
-+CPU extensions/AMUv1 suspend/resume
-+CPU extensions/Use trace buffer control Registers

meta-arm-bsp/recipes-bsp/trusted-firmware-a/tf-a-tests_%.bbappend

@@ -9,8 +9,3 @@ EXTRA_OEMAKE:append:cortexa320 = " \
         CORSTONE1000_CORTEX_A320=1 \
         "
 TFTF_MODE:corstone1000 = "release"
-
-FILESEXTRAPATHS:prepend:corstone1000 := "${THISDIR}/files/corstone1000/tf-a-tests:"
-SRC_URI:append:corstone1000 = " \
-        file://0001-plat-corstone1000-Add-Cortex-A320-support.patch \
-        "

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc

@@ -5,13 +5,12 @@ COMPATIBLE_MACHINE = "(corstone1000)"
 FILESEXTRAPATHS:prepend := "${THISDIR}/files/corstone1000:"
 SRC_URI:append = " \
 	file://0001-Fix-FF-A-version-in-SPMC-manifest.patch \
-	file://0002-plat-corstone1000-add-Cortex-A320-support.patch \
-	file://0003-feat-corestone-1000-make-mutlicore-support-platform-.patch \
+	file://0002-plat-corstone1000-align-BL-config-region.patch \
+	file://0003-plat-corstone1000-delay-early-GPT-access.patch \
 "
 
 TFA_DEBUG = "1"
 TFA_UBOOT ?= "1"
-TFA_MBEDTLS = "1"
 TFA_BUILD_TARGET = "bl2 bl31 fip"
 
 # Enabling Secure-EL1 Payload Dispatcher (SPD)
@@ -23,10 +22,10 @@ TFA_SPMD_SPM_AT_SEL2 = "0"
 # BL2 loads BL32 (optee). So, optee needs to be built first:
 DEPENDS += "optee-os"
 
-ENABLE_CORTEX_A35_ERRATA = " \
+ENABLE_CORTEX_A_ERRATA = " \
     ERRATA_A35_855472=1 \
 "
-ENABLE_CORTEX_A35_ERRATA:cortexta320 = ""
+ENABLE_CORTEX_A_ERRATA:cortexa320 = ""
 FVP_GIC_DRIVER ?= "FVP_GICV2"
 FVP_GIC_DRIVER:cortexa320 = "FVP_GICV3"
 
@@ -54,7 +53,7 @@ EXTRA_OEMAKE:append = " \
                         NR_OF_IMAGES_IN_FW_BANK=4 \
                         COT=tbbr \
                         ARM_ROTPK_LOCATION=devel_rsa  \
-                        ${ENABLE_CORTEX_A35_ERRATA} \
+                        ${ENABLE_CORTEX_A_ERRATA} \
                         ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem \
                         BL32=${RECIPE_SYSROOT}/${nonarch_base_libdir}/firmware/tee-pager_v2.bin \
                         FVP_USE_GIC_DRIVER=${FVP_GIC_DRIVER} \

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-fvp-base.inc

@@ -55,9 +55,6 @@ TFA_PLATFORM = "fvp"
 # Disable debug build if measured boot is enabled.
 TFA_DEBUG := "${@bb.utils.contains('MACHINE_FEATURES', 'ts-attestation', '0',\
               d.getVar('TFA_DEBUG'), d)}"
-# Add mbedtls if measured boot is enabled
-TFA_MBEDTLS := "${@bb.utils.contains('MACHINE_FEATURES', 'ts-attestation',\
-               '1', d.getVar('TFA_MBEDTLS'), d)}"
 TFA_UBOOT ?= "1"
 TFA_BUILD_TARGET = "bl1 bl2 bl31 dtbs fip"
 

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-juno.inc

@@ -3,7 +3,6 @@
 COMPATIBLE_MACHINE = "juno"
 TFA_PLATFORM = "juno"
 TFA_DEBUG = "1"
-TFA_MBEDTLS = "1"
 TFA_UBOOT ?= "1"
 TFA_BUILD_TARGET = "bl1 bl2 bl31 dtbs fip"
 

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-rdn2.inc

@@ -27,3 +27,29 @@ SRCREV_tfa = "a4b376b128bb5b91771002f7808566f53c8d9f3a"
 SRC_URI:remove = "file://0001-feat-build-add-HOSTLDFLAGS-to-pass-flags-to-host-lin.patch"
 LIC_FILES_CHKSUM:remove = "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e"
 LIC_FILES_CHKSUM += "file://docs/license.rst;md5=1118e32884721c0be33267bd7ae11130"
+
+# sub-directory in which mbedtls will be downloaded
+# Only needed for legacy versions, as v2.15.0 added this as a git submodule
+TFA_MBEDTLS_DIR ?= "mbedtls"
+# This should be set to MBEDTLS download URL if MBEDTLS is needed
+SRC_URI_MBEDTLS ??= ""
+# This should be set to MBEDTLS LIC FILES checksum
+LIC_FILES_CHKSUM_MBEDTLS ??= ""
+# add MBEDTLS to our sources if activated
+SRC_URI:append = " ${@bb.utils.contains('TFA_MBEDTLS', '1', '${SRC_URI_MBEDTLS}', '', d)}"
+# Update license variables
+LICENSE:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', ' AND Apache-2.0', '', d)}"
+LIC_FILES_CHKSUM:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', ' ${LIC_FILES_CHKSUM_MBEDTLS}', '', d)}"
+# add mbed TLS to version
+SRCREV_FORMAT:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', '_mbedtls', '', d)}"
+
+# Handle MBEDTLS
+EXTRA_OEMAKE += "${@bb.utils.contains('TFA_MBEDTLS', '1', 'MBEDTLS_DIR=${TFA_MBEDTLS_DIR}', '', d)}"
+
+# in TF-A src, docs/getting_started/prerequisites.rst lists the expected version mbedtls
+# mbedtls-3.6.5
+SRCBRANCH_MBEDTLS = "mbedtls-3.6"
+SRC_URI_MBEDTLS = "gitsm://github.com/Mbed-TLS/mbedtls;name=mbedtls;protocol=https;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/mbedtls;branch=${SRCBRANCH_MBEDTLS}"
+SRCREV_mbedtls = "e185d7fd85499c8ce5ca2a54f5cf8fe7dbe3f8df"
+
+LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=379d5819937a6c2f1ef1630d341e026d"

meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-rdv2.inc

@@ -27,3 +27,29 @@ SRCREV_tfa = "a4b376b128bb5b91771002f7808566f53c8d9f3a"
 SRC_URI:remove = "file://0001-feat-build-add-HOSTLDFLAGS-to-pass-flags-to-host-lin.patch"
 LIC_FILES_CHKSUM:remove = "file://docs/license.rst;md5=6ed7bace7b0bc63021c6eba7b524039e"
 LIC_FILES_CHKSUM += "file://docs/license.rst;md5=1118e32884721c0be33267bd7ae11130"
+
+# sub-directory in which mbedtls will be downloaded
+# Only needed for legacy versions, as v2.15.0 added this as a git submodule
+TFA_MBEDTLS_DIR ?= "mbedtls"
+# This should be set to MBEDTLS download URL if MBEDTLS is needed
+SRC_URI_MBEDTLS ??= ""
+# This should be set to MBEDTLS LIC FILES checksum
+LIC_FILES_CHKSUM_MBEDTLS ??= ""
+# add MBEDTLS to our sources if activated
+SRC_URI:append = " ${@bb.utils.contains('TFA_MBEDTLS', '1', '${SRC_URI_MBEDTLS}', '', d)}"
+# Update license variables
+LICENSE:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', ' AND Apache-2.0', '', d)}"
+LIC_FILES_CHKSUM:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', ' ${LIC_FILES_CHKSUM_MBEDTLS}', '', d)}"
+# add mbed TLS to version
+SRCREV_FORMAT:append = "${@bb.utils.contains('TFA_MBEDTLS', '1', '_mbedtls', '', d)}"
+
+# Handle MBEDTLS
+EXTRA_OEMAKE += "${@bb.utils.contains('TFA_MBEDTLS', '1', 'MBEDTLS_DIR=${TFA_MBEDTLS_DIR}', '', d)}"
+
+# in TF-A src, docs/getting_started/prerequisites.rst lists the expected version mbedtls
+# mbedtls-3.6.5
+SRCBRANCH_MBEDTLS = "mbedtls-3.6"
+SRC_URI_MBEDTLS = "gitsm://github.com/Mbed-TLS/mbedtls;name=mbedtls;protocol=https;destsuffix=${BB_GIT_DEFAULT_DESTSUFFIX}/mbedtls;branch=${SRCBRANCH_MBEDTLS}"
+SRCREV_mbedtls = "e185d7fd85499c8ce5ca2a54f5cf8fe7dbe3f8df"
+
+LIC_FILES_CHKSUM_MBEDTLS = "file://mbedtls/LICENSE;md5=379d5819937a6c2f1ef1630d341e026d"

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0001-CC312-alignment-of-cc312-differences-between-fvp-and.patch

@@ -1,8 +1,8 @@
-From 4274b94aa0af175e31b8883ec6f2113133608e24 Mon Sep 17 00:00:00 2001
+From 4cfcc1af5dd1a9aaadcf42a46d5dc769977b4fed Mon Sep 17 00:00:00 2001
 From: Ali Can Ozaslan <ali.oezaslan@arm.com>
 Date: Wed, 15 May 2024 12:12:15 +0000
-Subject: [PATCH] CC312: alignment of cc312 differences between fvp and mps3
- corstone1000 platforms
+Subject: [PATCH 01/14] CC312: alignment of cc312 differences between fvp and
+ mps3 corstone1000 platforms
 
 Configures CC312 mps3 model same as predefined cc312 FVP
 configuration while keeping debug ports closed.
@@ -15,10 +15,10 @@ Upstream-Status: Inappropriate [Requires an aligment cc3xx with mps3 hw and fvp
  1 file changed, 3 insertions(+)
 
 diff --git a/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c b/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c
-index 31e4332bed64..4b08c02526d3 100644
+index b43e86988a41..af8181ca815a 100644
 --- a/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c
 +++ b/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c
-@@ -207,6 +207,9 @@ CClibRetCode_t CC_LibInit(CCRndContext_t *rndContext_ptr, CCRndWorkBuff_t  *rndW
+@@ -209,6 +209,9 @@ CClibRetCode_t CC_LibInit(CCRndContext_t *rndContext_ptr, CCRndWorkBuff_t  *rndW
          goto InitErr2;
      }
  
@@ -28,3 +28,6 @@ index 31e4332bed64..4b08c02526d3 100644
      /* turn off the DFA since Cerberus doen't support it */
      reg = CC_HAL_READ_REGISTER(CC_REG_OFFSET(HOST_RGF, HOST_AO_LOCK_BITS));
      CC_REG_FLD_SET(0, HOST_AO_LOCK_BITS, HOST_FORCE_DFA_ENABLE, reg, 0x0);
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0001-arm-trusted-firmware-m-disable-address-warnings-into.patch

@@ -1,25 +0,0 @@
-From f3400c6527e6d0c073215694e19734a6268a6bc9 Mon Sep 17 00:00:00 2001
-From: Ali Can Ozaslan <ali.oezaslan@arm.com>
-Date: Wed, 24 Jan 2024 16:10:08 +0000
-Subject: [PATCH] arm/trusted-firmware-m: disable address warnings into an
- error
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
-Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
-Upstream-Status: Inappropriate
----
- toolchain_GNUARM.cmake | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/toolchain_GNUARM.cmake b/toolchain_GNUARM.cmake
-index 56a220ba8471..af80a2746676 100644
---- a/toolchain_GNUARM.cmake
-+++ b/toolchain_GNUARM.cmake
-@@ -113,6 +113,7 @@ add_compile_options(
-     -Wno-format
-     -Wno-return-type
-     -Wno-unused-but-set-variable
-+    -Wno-error=address
-     -c
-     -fdata-sections
-     -ffunction-sections

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0002-Corstone-1000-Enable-different-DRBG-configurations.patch

@@ -1,7 +1,7 @@
-From dae5f3d1ec85e29f44d3f19bec2312607751ec22 Mon Sep 17 00:00:00 2001
+From a02970f522567169fa1851ab1b5431793e365cb0 Mon Sep 17 00:00:00 2001
 From: Devaraj Ranganna <devaraj.ranganna@arm.com>
 Date: Thu, 18 Sep 2025 22:07:38 +0100
-Subject: [PATCH] Corstone-1000: Enable different DRBG configurations
+Subject: [PATCH 02/14] Corstone-1000: Enable different DRBG configurations
 
 The following DRBG configurations are enabled:
 
@@ -18,10 +18,10 @@ Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
  1 file changed, 7 insertions(+)
 
 diff --git a/platform/ext/target/arm/corstone1000/cc3xx_config.h b/platform/ext/target/arm/corstone1000/cc3xx_config.h
-index ac034b17982a..e3f78439861f 100644
+index 68707f3a2194..8c53cace937c 100644
 --- a/platform/ext/target/arm/corstone1000/cc3xx_config.h
 +++ b/platform/ext/target/arm/corstone1000/cc3xx_config.h
-@@ -90,6 +90,13 @@
+@@ -100,6 +100,13 @@
  #error "cc3xx_config: RNG config must select a single DRBG"
  #endif /* CC3XX_CONFIG_RNG_DRBG_HMAC + CC3XX_CONFIG_RNG_DRBG_CTR + CC3XX_CONFIG_RNG_DRBG_HASH */
  
@@ -35,3 +35,6 @@ index ac034b17982a..e3f78439861f 100644
  /* Whether an external TRNG should be used in place of the standard CC3XX TRNG */
  /* #define CC3XX_CONFIG_RNG_EXTERNAL_TRNG */
  
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0002-Platform-CS1000-Remove-unused-BL1-files.patch

@@ -1,449 +0,0 @@
-From 9ed08f26cafc2c6e5bf1d5cc04f91ca17d94a1bd Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Wed, 13 Aug 2025 14:02:57 +0000
-Subject: [PATCH] Platform: CS1000: Remove unused BL1 files
-
-These files are not referenced anywhere so removed them to prevent
-confusion.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [9a7bdf9ef595196e1e518a27d3c79079aedb5bda]
----
- .../arm/corstone1000/bl1/CMakeLists.txt       | 345 ------------------
- .../arm/corstone1000/bl1/bl1_security_cnt.c   |  75 ----
- 2 files changed, 420 deletions(-)
- delete mode 100644 platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt
- delete mode 100644 platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c
-
-diff --git a/platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt b/platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt
-deleted file mode 100644
-index d85b0611dd42..000000000000
---- a/platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt
-+++ /dev/null
-@@ -1,345 +0,0 @@
--#-------------------------------------------------------------------------------
--# Copyright (c) 2020-2024, Arm Limited. All rights reserved.
--#
--# SPDX-License-Identifier: BSD-3-Clause
--#
--#-------------------------------------------------------------------------------
--
--cmake_minimum_required(VERSION 3.15)
--cmake_policy(SET CMP0079 NEW)
--
--project("BL1 Bootloader" VERSION 0.0.1 LANGUAGES C ASM)
--
--# BL1 only loads the BL2 image, image number always equals 1
--set(BL1_IMAGE_NUMBER 1)
--
--# Version of BL2 image
--set(BL2_IMAGE_VERSION "0.1.0")
--
--add_executable(bl1)
--
--set_target_properties(bl1
--    PROPERTIES
--        SUFFIX ".axf"
--        RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin"
--)
--
--target_link_options(bl1
--    PRIVATE
--        $<$<C_COMPILER_ID:GNU>:-Wl,-Map=${CMAKE_BINARY_DIR}/bin/bl1.map>
--)
--
--add_convert_to_bin_target(bl1)
--
--# bl2_crypto reused as it is, but it pulls the MCUBOOT_IMAGE_NUMBER=${MCUBOOT_IMAGE_NUMBER}
--# configuration, where image number is 3. (Coming from BL2 build). To not to collide with BL1's
--# build where image number is 1 mbedcrypto library is separated from the build of other source
--# files.
--target_link_libraries(bl1
--    PRIVATE
--        bl1_main
--        bl2_crypto
--        cmsis_stack_override
--        cmsis
--)
--
--# add_convert_to_bin_target(bl1) requires at least one source file added to bl1. This sources will
--# be built with wrong image number macro (value coming from BL2 config), so the start-up files
--# added here, as those not use this image number macro.
--target_sources(bl1
--    PRIVATE
--        $<$<C_COMPILER_ID:GNU>:${CMAKE_CURRENT_SOURCE_DIR}/../Device/Source/startup_corstone1000.c>
--)
--
--# Needed for the GCC startup files
--target_include_directories(bl1
--    PRIVATE
--        ${CMAKE_SOURCE_DIR}/platform/include
--        ../Device/Include
--)
--
--# target_add_scatter_file(bl1) cannot be used as it would add the platform_region_defs dependency
--# to bl1, again pulling the image number property matching with BL2 build, so scatter setup done
--# here by hand.
--target_link_options(bl1
--    PRIVATE
--        -T $<TARGET_OBJECTS:bl1_scatter>
--)
--
--add_library(bl1_scatter OBJECT)
--
--add_dependencies(bl1
--        bl1_scatter
--    )
--
--target_sources(bl1_scatter
--    PRIVATE
--        ../Device/Source/gcc/corstone1000_bl1.ld
--)
--
--set_source_files_properties(../Device/Source/gcc/corstone1000_bl1.ld
--    PROPERTIES
--    LANGUAGE C
--)
--
--target_compile_options(bl1_scatter
--    PRIVATE
--        -E
--        -P
--        -xc
--)
--
--target_compile_definitions(bl1_scatter
--    PRIVATE
--        MCUBOOT_IMAGE_NUMBER=${BL1_IMAGE_NUMBER}
--        BL1
--)
--
--target_include_directories(bl1_scatter
--    PRIVATE
--        ../partition
--)
--
--# Library to spearate build from bl2_mbedcrypto configurations
--add_library(bl1_main STATIC)
--
--target_compile_definitions(bl1_main
--    PRIVATE
--        MCUBOOT_IMAGE_NUMBER=${BL1_IMAGE_NUMBER}
--        BL1
--        BL2
--        $<$<BOOL:${PLATFORM_IS_FVP}>:PLATFORM_IS_FVP>
--)
--
--# Configurations based on bl2/CMakeLists.txt
--
--# Many files are reused form TF-M's bl2 directory
--set(BL2_SOURCE ${CMAKE_SOURCE_DIR}/bl2)
--
--target_sources(bl1_main
--    PRIVATE
--        ${BL2_SOURCE}/src/flash_map.c
--        ./provisioning.c
--)
--
--target_include_directories(bl1_main
--    PRIVATE
--        $<BUILD_INTERFACE:${BL2_SOURCE}/include>
--)
--
--# Include path needed for mbedcrypto headers
--target_include_directories(bl1_main
--    PRIVATE
--        $<BUILD_INTERFACE:${MBEDCRYPTO_PATH}/include>
--)
--
--# Configurations based on bl2/ext/mcuboot/CMakeLists.txt
--target_link_libraries(bl1_main
--    PRIVATE
--        mcuboot_config
--        bl2_crypto_config
--)
--
--target_include_directories(bl1_main
--    PRIVATE
--        $<BUILD_INTERFACE:${BL2_SOURCE}/ext/mcuboot/include>
--)
--
--target_sources(bl1_main
--    PRIVATE
--        ${BL2_SOURCE}/ext/mcuboot/bl2_main.c
--        ${BL2_SOURCE}/ext/mcuboot/keys.c
--        ${BL2_SOURCE}/ext/mcuboot/flash_map_legacy.c
--)
--
--# Configurations based on ${MCUBOOT_PATH}/boot/bootutil/CMakeLists.txt
--# add_subdirectory("${MCUBOOT_PATH}/boot/bootutil" bootutil) cannot work as we want to define different hal
--# functions compared to BL2
--target_sources(bl1_main
--    PRIVATE
--        ${MCUBOOT_PATH}/boot/bootutil/src/loader.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/bootutil_misc.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/bootutil_public.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/image_validate.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/image_rsa.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/tlv.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/boot_record.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/swap_scratch.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/swap_move.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/swap_misc.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/encrypted.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/fault_injection_hardening.c
--        ${MCUBOOT_PATH}/boot/bootutil/src/fault_injection_hardening_delay_rng_mbedtls.c
--)
--
--target_include_directories(bl1_main
--    PRIVATE
--        $<BUILD_INTERFACE:${MCUBOOT_PATH}/boot/bootutil/include>
--        $<BUILD_INTERFACE:${MCUBOOT_PATH}/boot/bootutil/src>
--        $<BUILD_INTERFACE:${MCUBOOT_PATH}/boot>
--)
--
--# Configurations based on platform/CMakeLists.txt
--target_include_directories(bl1_main
--    PRIVATE
--        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/include>
--        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/ext/driver>
--        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/ext/common>
--        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/ext>
--        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/platform/ext/accelerator/interface>
--)
--
--target_sources(bl1_main
--    PRIVATE
--        $<$<BOOL:${PLATFORM_DEFAULT_UART_STDOUT}>:${CMAKE_SOURCE_DIR}/platform/ext/common/uart_stdout.c>
--        $<$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>:${CMAKE_SOURCE_DIR}/platform/ext/common/template/nv_counters.c>
--        $<$<OR:$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>,$<BOOL:${PLATFORM_DEFAULT_OTP}>>:${CMAKE_SOURCE_DIR}/platform/ext/common/template/flash_otp_nv_counters_backend.c>
--        $<$<BOOL:${PLATFORM_DEFAULT_OTP}>:${CMAKE_SOURCE_DIR}/platform/ext/common/template/otp_flash.c>
--)
--
--target_link_libraries(bl1_main
--    PRIVATE
--        bl2_hal
--        cmsis
--)
--
--target_compile_definitions(bl1_main
--    PRIVATE
--        MCUBOOT_${MCUBOOT_UPGRADE_STRATEGY}
--        $<$<BOOL:${SYMMETRIC_INITIAL_ATTESTATION}>:SYMMETRIC_INITIAL_ATTESTATION>
--        $<$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>:PLATFORM_DEFAULT_NV_COUNTERS>
--        $<$<BOOL:${MCUBOOT_HW_KEY}>:MCUBOOT_HW_KEY>
--        MCUBOOT_FIH_PROFILE_${MCUBOOT_FIH_PROFILE}
--        $<$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>:PLATFORM_DEFAULT_NV_COUNTERS>
--        $<$<BOOL:${PLATFORM_DEFAULT_OTP}>:PLATFORM_DEFAULT_OTP>
--        $<$<BOOL:${OTP_NV_COUNTERS_RAM_EMULATION}>:OTP_NV_COUNTERS_RAM_EMULATION=1>
--        $<$<BOOL:${TFM_DUMMY_PROVISIONING}>:TFM_DUMMY_PROVISIONING>
--        $<$<BOOL:${PLATFORM_DEFAULT_OTP_WRITEABLE}>:OTP_WRITEABLE>
--)
--
--# Configurations based on cc312 cmake files
--target_compile_definitions(bl1_main
--    PRIVATE
--        $<$<BOOL:${CRYPTO_HW_ACCELERATOR_OTP_STATE}>:CRYPTO_HW_ACCELERATOR_OTP_${CRYPTO_HW_ACCELERATOR_OTP_STATE}>
--        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:CRYPTO_HW_ACCELERATOR>
--        $<$<BOOL:${ENABLE_FWU_AGENT_DEBUG_LOGS}>:ENABLE_FWU_AGENT_DEBUG_LOGS>
--)
--
--target_include_directories(bl1_main
--    PRIVATE
--        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/platform/ext/accelerator/cc312>
--        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/lib/ext/cryptocell-312-runtime/shared/include/mbedtls>
--        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/lib/ext/cryptocell-312-runtime/shared/include/crypto_api/cc3x>
--        ../soft_crc
--)
--
--# Configurations based on platform level cmake files
--target_sources(bl1_main
--    PRIVATE
--        ../CMSIS_Driver/Driver_Flash.c
--        ../CMSIS_Driver/Driver_USART.c
--        ../Device/Source/device_definition.c
--        ../Device/Source/system_core_init.c
--        ../Native_Driver/firewall.c
--        ../Native_Driver/uart_pl011_drv.c
--        ../fw_update_agent/fwu_agent.c
--        ../soft_crc/soft_crc.c
--        ../Native_Driver/arm_watchdog_drv.c
--        ../Native_Driver/watchdog.c
--        bl1_boot_hal.c
--        bl1_flash_map.c
--        bl1_security_cnt.c
--        flash_map_extended.c
--        bl1_rotpk.c
--)
--
--if (PLATFORM_IS_FVP)
--target_sources(bl1_main
--    PRIVATE
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/strata/spi_strataflashj3_flash_lib.c
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/cfi/cfi_drv.c
--)
--else()
--target_sources(bl1_main
--    PRIVATE
--        ${PLATFORM_DIR}/ext/target/arm/drivers/qspi/xilinx_pg153_axi/xilinx_pg153_axi_qspi_controller_drv.c
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/n25q256a/spi_n25q256a_flash_lib.c
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/sst26vf064b/spi_sst26vf064b_flash_lib.c
--)
--endif()
--
--target_include_directories(bl1_main
--    PRIVATE
--        ../partition
--        ../Device/Include
--        ../.
--        ../CMSIS_Driver/Config
--        ../Device/Config
--        ../Native_Driver
--        ../fw_update_agent
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/common
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/cfi
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/strata
--        ${PLATFORM_DIR}/ext/target/arm/drivers/qspi/xilinx_pg153_axi
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/n25q256a
--        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/sst26vf064b
--
--)
--
--############################### SIGNING BL2 image ##################################
--
--find_package(Python3)
--
--set(FLASH_AREA_NUM 8)
--configure_file(signing_layout.c.in ${CMAKE_CURRENT_BINARY_DIR}/signing_layout.c @ONLY)
--add_library(signing_layout_for_bl2 OBJECT ${CMAKE_CURRENT_BINARY_DIR}/signing_layout.c)
--
--target_compile_options(signing_layout_for_bl2
--    PRIVATE
--        $<$<C_COMPILER_ID:GNU>:-E\;-xc>
--        $<$<C_COMPILER_ID:ARMClang>:-E\;-xc>
--        $<$<C_COMPILER_ID:IAR>:--preprocess=ns\;$<TARGET_OBJECTS:signing_layout_s>>
--)
--target_compile_definitions(signing_layout_for_bl2
--    PRIVATE
--        MCUBOOT_IMAGE_NUMBER=${BL1_IMAGE_NUMBER}
--        BL1
--)
--
--target_include_directories(signing_layout_for_bl2
--    PRIVATE
--        ../partition
--)
--
--if (CONFIG_TFM_BOOT_STORE_MEASUREMENTS AND CONFIG_TFM_BOOT_STORE_ENCODED_MEASUREMENTS)
--    set(MCUBOOT_MEASURED_BOOT ON)
--endif()
--
--add_custom_target(bl2_signed_bin
--    ALL
--    SOURCES bl2_signed.bin
--)
--add_custom_command(OUTPUT bl2_signed.bin
--    DEPENDS $<TARGET_FILE_DIR:bl2>/bl2.bin
--    DEPENDS bl2_bin signing_layout_for_bl2
--    WORKING_DIRECTORY ${MCUBOOT_PATH}/scripts
--
--    #Sign secure binary image with provided secret key
--    COMMAND ${Python3_EXECUTABLE} ${BL2_SOURCE}/ext/mcuboot/scripts/wrapper/wrapper.py
--        -v ${BL2_IMAGE_VERSION}
--        --layout $<TARGET_OBJECTS:signing_layout_for_bl2>
--        -k ${MCUBOOT_KEY_S}
--        --public-key-format $<IF:$<BOOL:${MCUBOOT_HW_KEY}>,full,hash>
--        --align 1
--        --pad
--        --pad-header
--        -H 0x400
--        -s ${MCUBOOT_SECURITY_COUNTER_S}
--        -d \"\(0,${MCUBOOT_S_IMAGE_MIN_VER}\)\"
--        $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},OVERWRITE_ONLY>:--overwrite-only>
--        $<$<BOOL:${MCUBOOT_ENC_IMAGES}>:-E${MCUBOOT_KEY_ENC}>
--        $<$<BOOL:${MCUBOOT_MEASURED_BOOT}>:--measured-boot-record>
--        $<TARGET_FILE_DIR:bl2>/bl2.bin
--        ${CMAKE_CURRENT_BINARY_DIR}/bl2_signed.bin
--    COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/bl2_signed.bin $<TARGET_FILE_DIR:bl2>
--)
-diff --git a/platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c b/platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c
-deleted file mode 100644
-index 32c1481cca11..000000000000
---- a/platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c
-+++ /dev/null
-@@ -1,75 +0,0 @@
--/*
-- * Copyright (c) 2019-2021, Arm Limited. All rights reserved.
-- *
-- * SPDX-License-Identifier: BSD-3-Clause
-- *
-- */
--
--#include "bootutil/security_cnt.h"
--#include "tfm_plat_nv_counters.h"
--#include "tfm_plat_defs.h"
--#include "bootutil/fault_injection_hardening.h"
--#include <stdint.h>
--#include "tfm_plat_provisioning.h"
--#include "fwu_agent.h"
--
--fih_ret boot_nv_security_counter_init(void)
--{
--    FIH_DECLARE(fih_rc, FIH_FAILURE);
--
--    fih_rc = fih_ret_encode_zero_equality(tfm_plat_init_nv_counter());
--
--    FIH_RET(fih_rc);
--}
--
--fih_ret boot_nv_security_counter_get(uint32_t image_id, fih_int *security_cnt)
--{
--    FIH_DECLARE(fih_rc, FIH_FAILURE);
--    uint32_t security_cnt_soft;
--
--    /* Check if it's a null-pointer. */
--    if (!security_cnt) {
--        FIH_RET(FIH_FAILURE);
--    }
--
--    if (image_id != 0) {
--        FIH_RET(FIH_FAILURE);
--    }
--
--    fih_rc = fih_ret_encode_zero_equality(
--             tfm_plat_read_nv_counter(PLAT_NV_COUNTER_BL1_0,
--                                      sizeof(security_cnt_soft),
--                                      (uint8_t *)&security_cnt_soft));
--    *security_cnt = fih_int_encode(security_cnt_soft);
--
--    FIH_RET(fih_rc);
--}
--
--int32_t boot_nv_security_counter_update(uint32_t image_id,
--                                        uint32_t img_security_cnt)
--{
--    enum tfm_plat_err_t err;
--    enum fwu_agent_error_t fwu_err;
--
--    if (image_id != 0) {
--        return -1;
--    }
--
--    if (tfm_plat_provisioning_is_required()) {
--
--        err = tfm_plat_set_nv_counter(PLAT_NV_COUNTER_BL1_0, img_security_cnt);
--        if (err != TFM_PLAT_ERR_SUCCESS) {
--            return -1;
--        }
--
--    } else {
--
--        fwu_err = fwu_stage_nv_counter(FWU_BL2_NV_COUNTER, img_security_cnt);
--        if (fwu_err != FWU_AGENT_SUCCESS) {
--            return -1;
--        }
--
--    }
--
--    return 0;
--}

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0003-Platform-Corstone1000-Fix-BL1-compiler-switch-and-re.patch

@@ -1,43 +0,0 @@
-From 1d7ab426f171516c15ce8e5223541c62c91ec596 Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Wed, 13 Aug 2025 14:31:53 +0000
-Subject: [PATCH] Platform: Corstone1000: Fix BL1 compiler switch and
- regression test failure
-
-Introduce a dedicated preprocessor definition (`BL1_BUILD`) added only to the
-platform_bl1_1 target. This ensures that #if BL1 checks are evaluated correctly
-based on the actual build configuration.
-
-Signed-off-by: Michael Safwat <michael.safwat@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [f25649cc0de56f360069c6128670f7533ba5e14d]
----
- platform/ext/target/arm/corstone1000/CMakeLists.txt | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-index ff7cf7330a07..66dfb2399503 100644
---- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
-+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-@@ -146,6 +146,7 @@ target_sources(platform_s
-         rse_comms_permissions_hal.c
-         mem_check_v6m_v7m_hal.c
-         ${PLATFORM_DIR}/ext/common/mem_check_v6m_v7m.c
-+        platform.c
- )
- 
- if (PLATFORM_IS_FVP)
-@@ -215,6 +216,13 @@ target_compile_definitions(platform_bl1_1
-         $<$<BOOL:${CRYPTO_HW_ACCELERATOR_OTP_PROVISIONING}>:CRYPTO_HW_ACCELERATOR_OTP_PROVISIONING>
-         MBEDTLS_CONFIG_FILE="${CMAKE_SOURCE_DIR}/lib/ext/mbedcrypto/mbedcrypto_config/tfm_mbedcrypto_config_default.h"
-         MBEDTLS_PSA_CRYPTO_CONFIG_FILE="${CMAKE_SOURCE_DIR}/lib/ext/mbedcrypto/mbedcrypto_config/crypto_config_default.h"
-+
-+        # This definition is only added to the bl1_main target. There are
-+        # files that are shared between the BL1 and TFM_S targets. This flag
-+        # can be used if the BL1 target needs different implementation than
-+        # the TFM_S target.
-+        BL1_BUILD
-+
- )
- 
- target_include_directories(platform_bl1_1_interface

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0003-bl2-corstone-1000-secure-debug-waiting-in-CM-LCS.patch

@@ -0,0 +1,93 @@
+From d8141d0d445bc5117b21dc684410b115e82d5568 Mon Sep 17 00:00:00 2001
+From: Devaraj Ranganna <devaraj.ranganna@arm.com>
+Date: Mon, 22 Sep 2025 12:59:43 +0100
+Subject: [PATCH 03/14] bl2: corstone-1000: secure debug waiting in CM LCS
+
+Currently, when the device is in Secure Enable (SE) LCS state,
+setting the dcu_en register causes a CC-312 reset. Because CC-312 and
+the device share a power domain, this effectively resets the device.
+
+Temporarily perform the secure-debug handshake while the device
+remains in the CM provisioned state. The long-term solution is to
+complete the secure-debug handshake, reset the device, and apply
+dcu_en during BL2.
+
+Upstream-Status: Inappropriate [Need to be redesigned]
+Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
+Signed-off-by: Ahmed Gomaa <Ahmed.Gomaa@arm.com>
+---
+ .../arm/corstone1000/bl2/boot_hal_bl2.c       | 46 ++++++++++++-------
+ 1 file changed, 30 insertions(+), 16 deletions(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
+index 9bc0f20e1045..d034efe59f5d 100644
+--- a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
++++ b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
+@@ -187,7 +187,7 @@ int32_t boot_platform_post_init(void)
+     int32_t result;
+     enum tfm_plat_err_t plat_err;
+ #ifdef PLATFORM_PSA_ADAC_SECURE_DEBUG
+-    bool provisioning_required;
++    /* bool provisioning_required; */
+ #endif
+ 
+ #ifdef CRYPTO_HW_ACCELERATOR
+@@ -204,26 +204,40 @@ int32_t boot_platform_post_init(void)
+     }
+ 
+ #ifdef PLATFORM_PSA_ADAC_SECURE_DEBUG
+-    plat_err = tfm_plat_provisioning_is_required(&provisioning_required);
++    /*
++     * TODO: Currently, when the device is in Secure Enable (SE) LCS state,
++     * setting `dcu_en` register causes CC-312 reset, which effectively resets
++     * the device as they are both on the same power domain. Therefore,
++     * temporarily perform the secure-debug handshake while the device remains
++     * in the CM provisioned state.
++     *
++     * The long-term solution is to complete the secure-debug handshake, reset
++     * the device, and apply `dcu_en` during BL2.
++     *
++     * TF-M 2.3 splits the provisioning check into an error return and a Boolean
++     * output value. Keep the complete gate commented while this workaround is
++     * required:
++     *
++     * plat_err = tfm_plat_provisioning_is_required(&provisioning_required);
++     * if (plat_err != TFM_PLAT_ERR_SUCCESS) {
++     *     BOOT_LOG_ERR("Platform provisioning required check failed");
++     *     FIH_PANIC;
++     * }
++     *
++     * if (!provisioning_required) {
++     */
++
++    plat_err = tfm_plat_otp_read(SECURE_DEBUG_ROTPK_ID, 32, secure_debug_rotpk);
+     if (plat_err != TFM_PLAT_ERR_SUCCESS) {
+-        BOOT_LOG_ERR("Platform provisioning required check failed");
+-        FIH_PANIC;
++        return plat_err;
+     }
+ 
+-    if (!provisioning_required) {
+-
+-        plat_err = tfm_plat_otp_read(SECURE_DEBUG_ROTPK_ID, 32, secure_debug_rotpk);
+-        if (plat_err != TFM_PLAT_ERR_SUCCESS) {
+-            return plat_err;
+-        }
+-
+ #ifndef PSA_ADAC_AS_TFM_RUNTIME_SERVICE
+-        result = tfm_to_psa_adac_corstone1000_secure_debug(secure_debug_rotpk, 32);
+-        BOOT_LOG_INF("%s: Corstone-1000 Secure Debug is a %s.\r\n", __func__,
+-                (result == 0) ? "success" : "failure");
++    result = tfm_to_psa_adac_corstone1000_secure_debug(secure_debug_rotpk, 32);
++    BOOT_LOG_INF("%s: Corstone-1000 Secure Debug is a %s.\r\n", __func__,
++            (result == 0) ? "success" : "failure");
+ #endif /* PSA_ADAC_AS_TFM_RUNTIME_SERVICE */
+-
+-    }
++    /* } */
+ #endif /* PLATFORM_PSA_ADAC_SECURE_DEBUG */
+ 
+     return 0;
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0004-Build-fix-remaining-GCC-v14.2-AES-type-error.patch

@@ -0,0 +1,33 @@
+From 8a30545506d8a7f58f0ad30130593e0f78e8b219 Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@arm.com>
+Date: Mon, 23 Feb 2026 11:53:38 -0500
+Subject: [PATCH 04/14] Build: fix remaining GCC v14.2 AES type error
+
+GCC v14.2 diagnoses the incompatible pointer type used when passing
+the ECB key buffer to bl1_key_to_cc3xx_key(). Cast the uint32_t key
+buffer to the uint8_t pointer type expected by the helper.
+
+Upstream-Status: Inappropriate [GCC v14.2 compatibility workaround]
+
+Signed-off-by: Jon Mason <jon.mason@arm.com>
+Signed-off-by: Ahmed Gomaa <Ahmed.Gomaa@arm.com>
+---
+ platform/ext/target/arm/corstone1000/bl1/cc312_rom_crypto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/bl1/cc312_rom_crypto.c b/platform/ext/target/arm/corstone1000/bl1/cc312_rom_crypto.c
+index 6bc89fe1155c..2008e9641b49 100644
+--- a/platform/ext/target/arm/corstone1000/bl1/cc312_rom_crypto.c
++++ b/platform/ext/target/arm/corstone1000/bl1/cc312_rom_crypto.c
+@@ -338,7 +338,7 @@ static int32_t aes_256_ecb_encrypt(enum tfm_bl1_key_id_t key_id,
+         return -1;
+     }
+ 
+-    rc = bl1_key_to_cc3xx_key(key_id, &cc3xx_key_type, key_buf, sizeof(key_buf));
++    rc = bl1_key_to_cc3xx_key(key_id, &cc3xx_key_type, (uint8_t *)key_buf, sizeof(key_buf));
+     if (rc) {
+         return rc;
+     }
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0005-Platform-Corstone1000-Enable-FWU-partition.patch

@@ -1,33 +0,0 @@
-From fdfbb3b82f62a2d4575a983ebaee14a67130d316 Mon Sep 17 00:00:00 2001
-From: Ali Can Ozaslan <ali.oezaslan@arm.com>
-Date: Tue, 15 Oct 2024 12:50:16 +0000
-Subject: [PATCH] Platform: Corstone1000: Enable FWU partition
-
-Enable firmware update partition for Corstone-1000 platform.
-
-Increase the necessary flags to enable firmware update partition.
-Set TFM_FWU_BOOTLOADER_LIB to use Corstone-1000 specific bootloader
-configuration. Fix linker issues caused by enablement.
-
-Upstream-Status: Backport [0107057d1411ec68e374fbd0ddc0e12abd5754ec]
-Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
----
- platform/ext/target/arm/corstone1000/config.cmake | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/platform/ext/target/arm/corstone1000/config.cmake b/platform/ext/target/arm/corstone1000/config.cmake
-index 7a88542a32fc..6d9cb1fea750 100644
---- a/platform/ext/target/arm/corstone1000/config.cmake
-+++ b/platform/ext/target/arm/corstone1000/config.cmake
-@@ -55,6 +55,10 @@ set(TFM_PARTITION_CRYPTO                ON          CACHE BOOL      "Enable Cryp
- set(TFM_PARTITION_INITIAL_ATTESTATION   ON          CACHE BOOL      "Enable Initial Attestation partition")
- set(TFM_PARTITION_INTERNAL_TRUSTED_STORAGE ON       CACHE BOOL      "Enable Internal Trusted Storage partition")
- 
-+set(TFM_PARTITION_FIRMWARE_UPDATE         ON        CACHE BOOL      "Enable firmware update partition")
-+set(PLATFORM_HAS_FIRMWARE_UPDATE_SUPPORT ON         CACHE BOOL      "Wheter the platform has firmware update support")
-+set(MCUBOOT_DATA_SHARING                 ON         CACHE BOOL      "Enable Data Sharing")
-+set(TFM_FWU_BOOTLOADER_LIB                "${CMAKE_CURRENT_LIST_DIR}/bootloader/mcuboot"   CACHE STRING    "Bootloader configure file for Firmware Update partition")
- 
- if (${CMAKE_BUILD_TYPE} STREQUAL Debug OR ${CMAKE_BUILD_TYPE} STREQUAL RelWithDebInfo)
-   set(ENABLE_FWU_AGENT_DEBUG_LOGS     TRUE          CACHE BOOL      "Enable Firmware update agent debug logs.")

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0005-plat-cs1k-Removed-unused-variables.patch

@@ -1,20 +1,21 @@
-From c579565c25937ae9455efe9cc3fbcace84c3e580 Mon Sep 17 00:00:00 2001
+From 9192041a3e6eec6b9e63dbdbe7fa49581aafa5b2 Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Mon, 29 Dec 2025 11:28:47 +0000
-Subject: [PATCH] plat: cs1k: Removed unused variables
+Subject: [PATCH 05/14] plat: cs1k: Removed unused variables
 
 Change-Id: I0dd3ff834c47c58dc833586c74791deca679a3ab
 Signed-off-by: Frazer Carsley <frazer.carsley@arm.com>
 Upstream-Status: Backport
+Signed-off-by: Ahmed Gomaa <Ahmed.Gomaa@arm.com>
 ---
  .../arm/corstone1000/bootloader/mcuboot/tfm_mcuboot_fwu.c     | 4 ----
  1 file changed, 4 deletions(-)
 
 diff --git a/platform/ext/target/arm/corstone1000/bootloader/mcuboot/tfm_mcuboot_fwu.c b/platform/ext/target/arm/corstone1000/bootloader/mcuboot/tfm_mcuboot_fwu.c
-index cff80b755..83b0bd27d 100644
+index deb14a9215b5..ed4a9f6804c9 100644
 --- a/platform/ext/target/arm/corstone1000/bootloader/mcuboot/tfm_mcuboot_fwu.c
 +++ b/platform/ext/target/arm/corstone1000/bootloader/mcuboot/tfm_mcuboot_fwu.c
-@@ -1511,7 +1511,6 @@ static psa_status_t fwu_accept_image(struct fwu_metadata *metadata,
+@@ -1614,7 +1614,6 @@ static psa_status_t fwu_accept_image(struct fwu_metadata *metadata,
          uint8_t number)
  {
      uint8_t current_state;
@@ -22,7 +23,7 @@ index cff80b755..83b0bd27d 100644
      uint32_t active_bank_index;
      uint32_t fwu_image_index;
      psa_status_t ret;
-@@ -1848,7 +1847,6 @@ static psa_status_t fwu_update_metadata(const psa_fwu_component_t *candidates, u
+@@ -2160,7 +2159,6 @@ static psa_status_t fwu_update_metadata(const psa_fwu_component_t *candidates, u
  {
      int ret;
      uint32_t active_index;
@@ -30,8 +31,8 @@ index cff80b755..83b0bd27d 100644
      uint32_t previous_active_index;
      uint8_t fwu_image_index;
  
-@@ -1864,10 +1862,8 @@ static psa_status_t fwu_update_metadata(const psa_fwu_component_t *candidates, u
- 
+@@ -2175,10 +2173,8 @@ static psa_status_t fwu_update_metadata(const psa_fwu_component_t *candidates, u
+     active_index = _metadata.active_index;
      if (active_index == BANK_0) {
          previous_active_index = BANK_1;
 -        bank_offset = BANK_1_PARTITION_OFFSET;
@@ -41,3 +42,6 @@ index cff80b755..83b0bd27d 100644
      } else {
          FWU_LOG_MSG("ERROR: %s: active_index %d\n\r",__func__,active_index);
          ret = PSA_ERROR_DATA_INVALID;
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0006-lib-gpt-Show-intent-of-GUIDs-in-unittests-more-clear.patch

@@ -1,7 +1,8 @@
-From ca0d50fc1abbfe165941dc0bd674bb117f236f87 Mon Sep 17 00:00:00 2001
+From 81813176251a37995390338914f309d8ca72549d Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Mon, 30 Mar 2026 14:06:20 +0100
-Subject: [PATCH] lib: gpt: Show intent of GUIDs in unittests more clearly
+Subject: [PATCH 06/14] lib: gpt: Show intent of GUIDs in unittests more
+ clearly
 
 The standard EFI_GUID macros used in the unittests do not convey the
 full meaning of the why that particular GUID is used. The new macros can
@@ -16,7 +17,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-fi
  1 file changed, 31 insertions(+), 24 deletions(-)
 
 diff --git a/lib/gpt/unittests/gpt/test_gpt.c b/lib/gpt/unittests/gpt/test_gpt.c
-index bd161ec74..32dfb8fb2 100644
+index bd161ec7445b..32dfb8fb2757 100644
 --- a/lib/gpt/unittests/gpt/test_gpt.c
 +++ b/lib/gpt/unittests/gpt/test_gpt.c
 @@ -69,6 +69,13 @@
@@ -214,3 +215,6 @@ index bd161ec74..32dfb8fb2 100644
      TEST_ASSERT_EQUAL(PSA_ERROR_DOES_NOT_EXIST, gpt_entry_read_by_type(&test_type, 0, &entry));
  
      /* Now, have a non-empty GPT but search for a type that won't exist */
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0007-Platform-Corstone1000-Increase-buffer-sizes.patch

@@ -1,46 +0,0 @@
-From 78231f27db0bbc747902b603bf279dce1707a3cc Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Mon, 16 Jun 2025 14:44:39 +0100
-Subject: [PATCH] Platform: Corstone1000: Increase buffer sizes
-
-Increase PSA_MAX_ASSET_SIZE and CRYPTO_IOVEC_BUFFER_SIZE
-to accommodate large size EFI variables set by new U-Boot version.
-
-This change is required to pass ACS tests related to Set/Get
-EFI variables. These ACS tests started failing after introducing new
-version of U-Boot, Trusted-Services and Trusted-Firmware-M while
-implementing PSA FWU support.
-
-Upstream-Status: Backport [bd80dee733e792eadfd2115f4bfa6bad748e5ce5]
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
----
- platform/ext/target/arm/corstone1000/config_tfm_target.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/config_tfm_target.h b/platform/ext/target/arm/corstone1000/config_tfm_target.h
-index 4920f67084d4..cf13712a1806 100644
---- a/platform/ext/target/arm/corstone1000/config_tfm_target.h
-+++ b/platform/ext/target/arm/corstone1000/config_tfm_target.h
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2022-2024, Arm Limited. All rights reserved.
-+ * SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  *
-@@ -27,13 +27,13 @@
- #define ITS_MAX_ASSET_SIZE   2048
- 
- /* The maximum asset size to be stored in the Protected Storage */
--#define PS_MAX_ASSET_SIZE   2592
-+#define PS_MAX_ASSET_SIZE   3500
- 
- /* This is needed to be able to process the EFI variables during PS writes. */
- #define CRYPTO_ENGINE_BUF_SIZE 0x5000
- 
- /* This is also has to be increased to fit the EFI variables into the iovecs. */
--#define CRYPTO_IOVEC_BUFFER_SIZE    6000
-+#define CRYPTO_IOVEC_BUFFER_SIZE    7200
- 
- /* The Mailbox partition is used as an NS Agent so its stack size is used to
-  * determine the PSP and PSPLIM during the SFN backend initialization. It has to

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0007-lib-gpt-Provide-macro-identifying-free-space.patch

@@ -1,7 +1,7 @@
-From 229313778bae6ca16d6e3b25437c8e87eddf3084 Mon Sep 17 00:00:00 2001
+From 02ce1958e127f0bec9bfb86cd3a3e406644e1fce Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Mon, 30 Mar 2026 14:35:45 +0100
-Subject: [PATCH] lib: gpt: Provide macro identifying free space
+Subject: [PATCH 07/14] lib: gpt: Provide macro identifying free space
 
 In the unit tests, it is often required to know where free space on the
 mocked disk is in order to determine where it is valid to create or move
@@ -15,7 +15,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-fi
  1 file changed, 23 insertions(+), 19 deletions(-)
 
 diff --git a/lib/gpt/unittests/gpt/test_gpt.c b/lib/gpt/unittests/gpt/test_gpt.c
-index 32dfb8fb2..0ae660336 100644
+index 32dfb8fb2757..0ae6603368e8 100644
 --- a/lib/gpt/unittests/gpt/test_gpt.c
 +++ b/lib/gpt/unittests/gpt/test_gpt.c
 @@ -58,6 +58,7 @@
@@ -155,3 +155,6 @@ index 32dfb8fb2..0ae660336 100644
  
      /* Fourth, start in the backup header area */
      TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, gpt_entry_move(
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0008-Platform-Corstone1000-Remove-duplicate-configuration.patch

@@ -1,31 +0,0 @@
-From 291b717c9ff6124dd132602e84f75f320adbfda1 Mon Sep 17 00:00:00 2001
-From: Yogesh Wani <yogesh.wani@arm.com>
-Date: Wed, 30 Apr 2025 14:39:37 +0100
-Subject: [PATCH] Platform: Corstone1000: Remove duplicate configuration
- parameters for Corstone-1000
-
-The PS_NUM_ASSET is duplicated in the cmake.config and the
-config_tfm_target.h file under Corstone-1000. The commit removes
-the one from the cmake.config and keeps the one in the header file.
-
-The whole rationale behind this is for the vendor to be able
-to override the configuration using the cmake file.
-
-Upstream-Status: Backport [948cb8e7601dcf1fe822d855c77749287fe6d9bd]
-Signed-off-by: Yogesh Wani <yogesh.wani@arm.com>
----
- platform/ext/target/arm/corstone1000/config.cmake | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/config.cmake b/platform/ext/target/arm/corstone1000/config.cmake
-index a923f63ca697..032265cdf4ac 100644
---- a/platform/ext/target/arm/corstone1000/config.cmake
-+++ b/platform/ext/target/arm/corstone1000/config.cmake
-@@ -74,7 +74,6 @@ endif()
- # Platform-specific configurations
- set(CONFIG_TFM_USE_TRUSTZONE            OFF)
- set(TFM_MULTI_CORE_TOPOLOGY             ON)
--set(PS_NUM_ASSETS                       "40"        CACHE STRING    "The maximum number of assets to be stored in the Protected Storage area")
- 
- set(MCUBOOT_USE_PSA_CRYPTO            ON               CACHE BOOL      "Enable the cryptographic abstraction layer to use PSA Crypto APIs")
- set(MCUBOOT_SIGNATURE_TYPE            "EC-P256"        CACHE STRING    "Algorithm to use for signature validation [RSA-2048, RSA-3072, EC-P256, EC-P384]")

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0008-lib-gpt-Add-operation-to-duplicate-entries.patch

@@ -1,7 +1,7 @@
-From 38daa61f876a6becb3968f1360d403f496634131 Mon Sep 17 00:00:00 2001
+From 69ee51ca58f8b1460a9ce4649c0e07f21201ff0a Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Mon, 16 Mar 2026 16:46:43 +0000
-Subject: [PATCH] lib: gpt: Add operation to duplicate entries
+Subject: [PATCH 08/14] lib: gpt: Add operation to duplicate entries
 
 Without this new function, callers of the library would have to first
 read the entry they want to duplicate, then attempt to create a new
@@ -20,7 +20,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-fi
  3 files changed, 201 insertions(+)
 
 diff --git a/lib/gpt/inc/gpt.h b/lib/gpt/inc/gpt.h
-index 34ce67580..334a08f41 100644
+index 34ce675801b3..334a08f41abe 100644
 --- a/lib/gpt/inc/gpt.h
 +++ b/lib/gpt/inc/gpt.h
 @@ -170,6 +170,25 @@ psa_status_t gpt_entry_move(const struct efi_guid_t *guid,
@@ -50,7 +50,7 @@ index 34ce67580..334a08f41 100644
   * \brief Creates a partition entry in the table.
   *
 diff --git a/lib/gpt/src/gpt.c b/lib/gpt/src/gpt.c
-index 0335befa7..920c4ccca 100644
+index 0335befa7770..920c4ccca78e 100644
 --- a/lib/gpt/src/gpt.c
 +++ b/lib/gpt/src/gpt.c
 @@ -516,6 +516,29 @@ psa_status_t gpt_entry_move(const struct efi_guid_t *guid,
@@ -84,7 +84,7 @@ index 0335befa7..920c4ccca 100644
                                const uint64_t           start,
                                const uint64_t           size,
 diff --git a/lib/gpt/unittests/gpt/test_gpt.c b/lib/gpt/unittests/gpt/test_gpt.c
-index 0ae660336..5d2c4243f 100644
+index 0ae6603368e8..5d2c4243f607 100644
 --- a/lib/gpt/unittests/gpt/test_gpt.c
 +++ b/lib/gpt/unittests/gpt/test_gpt.c
 @@ -738,6 +738,165 @@ void test_gpt_defragment_should_succeedWhenNoIOFailure(void)
@@ -253,3 +253,6 @@ index 0ae660336..5d2c4243f 100644
  void test_gpt_entry_create_should_createNewEntry(void)
  {
      /* Add an entry. It must not overlap with an existing entry and must also
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0009-lib-gpt-Consecutively-erase-blocks-when-moving-parti.patch

@@ -1,7 +1,8 @@
-From 0dcbef3a0800a2a610b32935a54762d4b42203f1 Mon Sep 17 00:00:00 2001
+From 4dab128d0da86be6ca09b861dfb157a11345e0e7 Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Tue, 17 Mar 2026 11:44:14 +0000
-Subject: [PATCH] lib: gpt: Consecutively erase blocks when moving partitions
+Subject: [PATCH 09/14] lib: gpt: Consecutively erase blocks when moving
+ partitions
 
 An LBA is typically smaller than a flash sector size, so it becomes
 inefficient to erase block by block and also erases the same sector
@@ -21,7 +22,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-fi
  1 file changed, 75 insertions(+), 27 deletions(-)
 
 diff --git a/lib/gpt/src/gpt.c b/lib/gpt/src/gpt.c
-index 920c4ccca..984c8f821 100644
+index 920c4ccca78e..984c8f82146c 100644
 --- a/lib/gpt/src/gpt.c
 +++ b/lib/gpt/src/gpt.c
 @@ -207,7 +207,7 @@ static psa_status_t read_entry_from_flash(const struct gpt_t *table,
@@ -238,3 +239,6 @@ index 920c4ccca..984c8f821 100644
      memcpy(lba_buf, temp_buf, GPT_HEADER_SIZE);
  
      return ret;
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0009-plat-corstone1000-Add-support-for-Cortex-A320-varian.patch

@@ -1,487 +0,0 @@
-From c5bcb737352ad2e1c24cc14a0b8ddf91ad7197b4 Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Tue, 29 Jul 2025 15:09:45 +0000
-Subject: [PATCH] plat: corstone1000: Add support for Cortex-A320 variant
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Add support for powering on the Cortex-A320 host in the DSU-120T
-cluster and reserve Host SRAM for the normal world on the
-Corstone-1000 platform. These changes enable secure-enclave firmware
-control of the Cortex-A320 power domain and memory access
-configuration.
-
-**DSU-120T Power-Policy Unit (PPU) driver**
-
-* Introduce a minimal driver to program the DSU-120T Power-Policy
-  Units, allowing the secure-enclave firmware to bring the
-  Cortex-A320 host cluster out of reset.
-* The DSU utility-bus registers are located at:
-  * `0x6091_0000` in the Host memory map.
-  * `0xC091_0000` in the Secure-Enclave memory map.
-* The FC1 firewall is configured so that only the Secure Enclave may
-  write to this window.
-* Add new CMake option `CORSTONE1000_DSU_120T` and platform define to
-  enable Cortex-A320 DSU-120T–specific code.
-
-**Host SRAM allocation**
-
-* Reserve a 4 MiB block of Host SRAM at `0x0240_0000` for the
-  Cortex-A320 normal world.
-* Open the same region in the Host-side firewall (CVM, region 2)
-  to allow non-secure access.
-* This configuration is compiled in when `CORSTONE1000_CORTEX_A320`
-  is defined.
-
-These updates prepare the Corstone-1000 platform for Cortex-A320
-integration with proper cluster power management and normal-world
-memory accessibility.
-
-Upstream-Status: Submitted (https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/45749)
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
----
- .../target/arm/corstone1000/CMakeLists.txt    |  31 +++
- .../Device/Include/platform_base_address.h    |   8 +-
- .../arm/corstone1000/bl1/boot_hal_bl1_1.c     |  50 ++++-
- .../target/arm/corstone1000/dsu-120t/ppu.c    |  40 ++++
- .../target/arm/corstone1000/dsu-120t/ppu.h    | 185 ++++++++++++++++++
- .../arm/corstone1000/tfm_hal_multi_core.c     |  28 ++-
- 6 files changed, 339 insertions(+), 3 deletions(-)
- create mode 100644 platform/ext/target/arm/corstone1000/dsu-120t/ppu.c
- create mode 100644 platform/ext/target/arm/corstone1000/dsu-120t/ppu.h
-
-diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-index 91bf197d86b7..993c51591fa7 100644
---- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
-+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-@@ -423,6 +423,37 @@ target_sources(tfm_spm
-         $<$<BOOL:${TFM_S_REG_TEST}>:${CMAKE_CURRENT_SOURCE_DIR}/target_cfg.c>
- )
- 
-+#========================= DSU-120T ============================================#
-+if (CORSTONE1000_DSU_120T)
-+    target_sources(tfm_psa_rot_partition_ns_agent_mailbox
-+        PUBLIC
-+            dsu-120t/ppu.c
-+    )
-+
-+    target_compile_definitions(tfm_psa_rot_partition_ns_agent_mailbox
-+        PUBLIC
-+            CORSTONE1000_DSU_120T
-+    )
-+
-+    target_compile_definitions(platform_bl1_1
-+        PUBLIC
-+            CORSTONE1000_DSU_120T
-+    )
-+
-+    target_include_directories(tfm_psa_rot_partition_ns_agent_mailbox
-+        PUBLIC
-+            dsu-120t
-+    )
-+endif()
-+
-+#========================= Ethos-U NPU =========================================#
-+if (CORSTONE1000_CORTEX_A320)
-+    target_compile_definitions(platform_bl1_1
-+        PUBLIC
-+            CORSTONE1000_CORTEX_A320
-+    )
-+endif()
-+
- #========================= tfm_adac ============================================#
- 
- if (${PLATFORM_PSA_ADAC_SECURE_DEBUG})
-diff --git a/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h b/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h
-index 5f9f03ddc610..3908d69bc9bd 100644
---- a/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h
-+++ b/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h
-@@ -1,5 +1,7 @@
- /*
-- * Copyright (c) 2017-2024 Arm Limited. All rights reserved.
-+ * SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors
-+ *
-+ * SPDX-License-Identifier: BSD-3-Clause
-  *
-  * Licensed under the Apache License, Version 2.0 (the "License");
-  * you may not use this file except in compliance with the License.
-@@ -79,6 +81,10 @@
- #define CORSTONE1000_HOST_AXI_QSPI_CTRL_REG_BASE_SE_SECURE_FLASH (0x90010000U) /* AXI QSPI Controller for SE FLash  */
- #define CORSTONE1000_HOST_DRAM_UEFI_CAPSULE        (0xA0000000U) /* 1.5 GB DDR                        */
- 
-+#ifdef CORSTONE1000_DSU_120T
-+#define CORSTONE1000_HOST_DSU_120T_BASE            (0xC0910000U) /* DSU-120T PPU                      */
-+#endif
-+
- /* Map Component definitions to Corstone definitions */
- #define CC3XX_BASE_S        CORSTONE1000_CRYPTO_ACCELERATOR_BASE
- 
-diff --git a/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c b/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c
-index b51a233e9143..1a5e98ad3c35 100644
---- a/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c
-+++ b/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2019-2024, Arm Limited. All rights reserved.
-+ * SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  *
-@@ -48,6 +48,15 @@ REGION_DECLARE(Image$$, ARM_LIB_HEAP, $$ZI$$Limit)[];
- #define HOST_SE_SECURE_FLASH_BASE_FVP       0x60010000
- #define HOST_AXI_QSPI_CTRL_REG_BASE_SE_SECURE_FLASH    0x60010000
- 
-+#ifdef CORSTONE1000_DSU_120T
-+#define HOST_DSU_120T_BASE              0x60910000
-+#endif
-+
-+#ifdef CORSTONE1000_CORTEX_A320
-+#define HOST_SECURE_SRAM_SIZE           0x400000
-+#define HOST_NONSECURE_SRAM_BASE        (HOST_TRUSTED_RAM_BASE + HOST_SECURE_SRAM_SIZE)
-+#endif
-+
- #define HOST_DRAM_BASE                  0x80000000
- #define HOST_DRAM_UEFI_CAPSULE          0x80000000
- 
-@@ -286,6 +295,25 @@ static void setup_se_firewall(void)
-     fc_enable_regions();
- #endif
- 
-+#ifdef CORSTONE1000_DSU_120T
-+#if (PLATFORM_IS_FVP)
-+    fc_select_region(7);
-+    fc_disable_regions();
-+    fc_disable_mpe(RGN_MPE0);
-+    fc_prog_rgn(RGN_SIZE_16MB, CORSTONE1000_HOST_DSU_120T_BASE);
-+    fc_prog_rgn_upper_addr(HOST_DSU_120T_BASE);
-+    fc_enable_addr_trans();
-+    fc_init_mpl(RGN_MPE0);
-+
-+    mpl_rights = (RGN_MPL_SECURE_READ_MASK |
-+                  RGN_MPL_SECURE_WRITE_MASK);
-+
-+    fc_enable_mpl(RGN_MPE0, mpl_rights);
-+    fc_prog_mid(RGN_MPE0, SE_MID);
-+    fc_enable_mpe(RGN_MPE0);
-+    fc_enable_regions();
-+#endif
-+#endif
-     fc_pe_enable();
- }
- 
-@@ -369,6 +397,26 @@ static void setup_host_firewall(void)
-     fc_enable_regions();
-     fc_rgn_lock();
- 
-+#ifdef CORSTONE1000_CORTEX_A320
-+    /* CVM - Non Secure RAM */
-+    fc_select_region(2);
-+    fc_disable_regions();
-+    fc_disable_mpe(RGN_MPE0);
-+    fc_prog_rgn(RGN_SIZE_4MB, HOST_NONSECURE_SRAM_BASE);
-+    fc_init_mpl(RGN_MPE0);
-+
-+    mpl_rights = (RGN_MPL_ANY_MST_MASK | RGN_MPL_NONSECURE_READ_MASK |
-+                                         RGN_MPL_NONSECURE_WRITE_MASK |
-+                                         RGN_MPL_NONSECURE_EXECUTE_MASK);
-+
-+    fc_enable_mpl(RGN_MPE0, mpl_rights);
-+    fc_disable_mpl(RGN_MPE0, ~mpl_rights);
-+
-+    fc_enable_mpe(RGN_MPE0);
-+    fc_enable_regions();
-+    fc_rgn_lock();
-+#endif
-+    
-     fc_pe_enable();
- 
-     /* DDR */
-diff --git a/platform/ext/target/arm/corstone1000/dsu-120t/ppu.c b/platform/ext/target/arm/corstone1000/dsu-120t/ppu.c
-new file mode 100644
-index 000000000000..d6be5982a8dd
---- /dev/null
-+++ b/platform/ext/target/arm/corstone1000/dsu-120t/ppu.c
-@@ -0,0 +1,40 @@
-+/*
-+ * SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors
-+ *
-+ * SPDX-License-Identifier: BSD-3-Clause
-+ *
-+ */
-+
-+#include <stdint.h>
-+#include "ppu.h"
-+
-+void PPU_SetPowerPolicy(PPU_TypeDef *ppu, PPU_PowerPolicy_Type policy, bool isDynamic)
-+{
-+    uint32_t regval = ppu->PWPR;
-+
-+    regval &= ~(PPU_PWPR_PWR_POLICY_Msk | PPU_PWPR_PWR_DYN_EN_Msk);
-+
-+    regval |= ((policy << PPU_PWPR_PWR_POLICY_Pos) & PPU_PWPR_PWR_POLICY_Msk);
-+
-+    if (isDynamic) {
-+        regval |= PPU_PWPR_PWR_DYN_EN_Msk;
-+    }
-+
-+    ppu->PWPR = regval;
-+}
-+
-+void PPU_SetOperatingPolicy(PPU_TypeDef *ppu, PPU_OperatingPolicy_Type policy, bool isDynamic)
-+{
-+    uint32_t regval = ppu->PWPR;
-+
-+    regval &= ~(PPU_PWPR_OP_POLICY_Msk | PPU_PWPR_OP_DYN_EN_Msk);
-+
-+    regval |= ((policy << PPU_PWPR_OP_POLICY_Pos) & PPU_PWPR_OP_POLICY_Msk);
-+
-+    if (isDynamic) {
-+        regval |= PPU_PWPR_OP_DYN_EN_Msk;
-+    }
-+
-+    ppu->PWPR = regval;
-+}
-+
-diff --git a/platform/ext/target/arm/corstone1000/dsu-120t/ppu.h b/platform/ext/target/arm/corstone1000/dsu-120t/ppu.h
-new file mode 100644
-index 000000000000..05470df9a884
---- /dev/null
-+++ b/platform/ext/target/arm/corstone1000/dsu-120t/ppu.h
-@@ -0,0 +1,185 @@
-+/*
-+ * SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors
-+ *
-+ * SPDX-License-Identifier: BSD-3-Clause
-+ *
-+ */
-+#ifndef PPU_H
-+#define PPU_H
-+
-+#include <stdbool.h>
-+#include <stdint.h>
-+#include "platform_base_address.h"
-+
-+// Bit definition for PPU_PWPR register
-+#define PPU_PWPR_PWR_POLICY_Pos            (0U)                                // Power mode policy
-+#define PPU_PWPR_PWR_POLICY_Msk            (0xFUL << PPU_PWPR_PWR_POLICY_Pos)  // 4 bits
-+#define PPU_PWPR_PWR_POLICY_OFF            (0UL << PPU_PWPR_PWR_POLICY_Pos)    // Logic off and RAM off.
-+#define PPU_PWPR_PWR_POLICY_OFF_EMU        (1UL << PPU_PWPR_PWR_POLICY_Pos)    // Emulated Off. Logic on with RAM on. This mode is used to emulate the functional condition of OFF without removing
-+#define PPU_PWPR_PWR_POLICY_MEM_RET        (2UL << PPU_PWPR_PWR_POLICY_Pos)    // Memory Retention. Logic off with RAM retained.
-+#define PPU_PWPR_PWR_POLICY_MEM_RET_EMU    (3UL << PPU_PWPR_PWR_POLICY_Pos)    // Emulated Memory Retention. Logic on with RAM on. This mode is used to emulate the functional condition of
-+#define PPU_PWPR_PWR_POLICY_FULL_RET       (5UL << PPU_PWPR_PWR_POLICY_Pos)    // Full Retention. Slice logic off with RAM contents retained.
-+#define PPU_PWPR_PWR_POLICY_FUNC_RET       (7UL << PPU_PWPR_PWR_POLICY_Pos)    // Functional Retention. Logic on with L3 Cache and Snoop Filter retained.
-+#define PPU_PWPR_PWR_POLICY_ON             (8UL << PPU_PWPR_PWR_POLICY_Pos)    // Logic on with RAM on, cluster is functional.
-+#define PPU_PWPR_PWR_POLICY_WARM_RST       (9UL << PPU_PWPR_PWR_POLICY_Pos)    // Warm Reset. Warm reset application with logic and RAM on.
-+#define PPU_PWPR_PWR_POLICY_DBG_RECOV      (10UL << PPU_PWPR_PWR_POLICY_Pos)   // Debug Recovery Reset. Warm reset application with logic and RAM on.
-+#define PPU_PWPR_PWR_DYN_EN_Pos            (8U)                                // Power mode dynamic transition enable.
-+#define PPU_PWPR_PWR_DYN_EN_Msk            (0x1UL << PPU_PWPR_PWR_DYN_EN_Pos)  // 1 bit
-+#define PPU_PWPR_LOCK_EN_Pos               (12U)                               // Lock enable bit for OFF, OFF_EMU, MEM_RET and MEM_RET_EMU power modes.
-+#define PPU_PWPR_LOCK_EN_Msk               (0x1UL << PPU_PWPR_LOCK_EN_Pos)     // 1 bit
-+#define PPU_PWPR_OP_POLICY_Pos             (16U)                               // Operating mode policy
-+#define PPU_PWPR_OP_POLICY_Msk             (0xFUL << PPU_PWPR_OP_POLICY_Pos)   // 4 bits
-+#define PPU_PWPR_OP_POLICY_OPMODE_00       (0UL << PPU_PWPR_OP_POLICY_Pos)     // ONE_SLICE_SF_ONLY_ON: One L3 Cache slice is operational, the Cache RAM is powered down.
-+#define PPU_PWPR_OP_POLICY_OPMODE_01       (1UL << PPU_PWPR_OP_POLICY_Pos)     // ONE_SLICE_HALF_RAM_ON: One L3 Cache slice is operational, half of the Cache RAMs are powered on.
-+#define PPU_PWPR_OP_POLICY_OPMODE_03       (3UL << PPU_PWPR_OP_POLICY_Pos)     // ONE_SLICE_FULL_RAM_ON: One L3 Cache slice is operational, all of the Cache RAMs are powered on.
-+#define PPU_PWPR_OP_POLICY_OPMODE_04       (4UL << PPU_PWPR_OP_POLICY_Pos)     // ALL_SLICE_SF_ONLY_ON: All L3 Cache slices are operational, the Cache RAMs in each slice are powered down.
-+#define PPU_PWPR_OP_POLICY_OPMODE_05       (5UL << PPU_PWPR_OP_POLICY_Pos)     // ALL_SLICE_HALF_RAM_ON: All L3 Cache slices are operational, half of the Cache RAMs are powered on.
-+#define PPU_PWPR_OP_POLICY_OPMODE_07       (7UL << PPU_PWPR_OP_POLICY_Pos)     // ALL_SLICE_FULL_RAM_ON: All L3 Cache slices are operational, all of the Cache RAMs are powered on.
-+#define PPU_PWPR_OP_POLICY_OPMODE_08       (8UL << PPU_PWPR_OP_POLICY_Pos)     // HALF_SLICE_SF_ONLY_ON: Half L3 Cache slices are operational, the Cache RAMs in each slice are powered down.
-+#define PPU_PWPR_OP_POLICY_OPMODE_09       (9UL << PPU_PWPR_OP_POLICY_Pos)     // HALF_SLICE_HALF_RAM_ON: Half L3 Cache slices are operational, half of the Cache RAMs are powered on.
-+#define PPU_PWPR_OP_POLICY_OPMODE_0B       (11UL << PPU_PWPR_PWR_POLICY_Pos)   // HALF_SLICE_FULL_RAM_ON: Half L3 Cache slices are operational, all of the Cache RAMs are powered on.
-+#define PPU_PWPR_OP_DYN_EN_Pos             (24U)                               // Operating mode dynamic transition enable.
-+#define PPU_PWPR_OP_DYN_EN_Msk             (0x1UL << PPU_PWPR_OP_DYN_EN_Pos)   // 1 bit
-+
-+// Bit definition for PPU_PWSR register
-+#define PPU_PWSR_PWR_STATUS_Pos            (0U)
-+#define PPU_PWSR_PWR_STATUS_Msk            (0xFUL << PPU_PWSR_PWR_STATUS_Pos)      // 4 bits
-+#define PPU_PWSR_PWR_STATUS_OFF            (0UL << PPU_PWSR_PWR_STATUS_Pos)        // Logic off and RAM off.
-+#define PPU_PWSR_PWR_STATUS_OFF_EMU        (1UL << PPU_PWSR_PWR_STATUS_Pos)        // Emulated Off. Logic on with RAM on. This mode is used to emulate the functional condition of OFF without removing
-+#define PPU_PWSR_PWR_STATUS_MEM_RET        (2UL << PPU_PWSR_PWR_STATUS_Pos)        // Memory Retention. Logic off with RAM retained.
-+#define PPU_PWSR_PWR_STATUS_MEM_RET_EMU    (3UL << PPU_PWSR_PWR_STATUS_Pos)        // Emulated Memory Retention. Logic on with RAM on. This mode is used to emulate the functional condition of
-+#define PPU_PWSR_PWR_STATUS_FULL_RET       (5UL << PPU_PWSR_PWR_STATUS_Pos)        // Full Retention. Slice logic off with RAM contents retained.
-+#define PPU_PWSR_PWR_STATUS_FUNC_RET       (7UL << PPU_PWSR_PWR_STATUS_Pos)        // Functional Retention. Logic on with L3 Cache and Snoop Filter retained.
-+#define PPU_PWSR_PWR_STATUS_ON             (8UL << PPU_PWSR_PWR_STATUS_Pos)        // Logic on with RAM on, cluster is functional.
-+#define PPU_PWSR_PWR_STATUS_WARM_RST       (9UL << PPU_PWSR_PWR_STATUS_Pos)        // Warm Reset. Warm reset application with logic and RAM on.
-+#define PPU_PWSR_PWR_STATUS_DBG_RECOV      (10UL << PPU_PWSR_PWR_STATUS_Pos)       // Debug Recovery Reset. Warm reset application with logic and RAM on.
-+#define PPU_PWSR_PWR_DYN_STATUS_Pos        (8U)                                    // Power mode dynamic transition enable.
-+#define PPU_PWSR_PWR_DYN_STATUS_Msk        (0x1UL << PPU_PWSR_PWR_DYN_STATUS_Pos)  // 1 bit
-+#define PPU_PWSR_LOCK_STATUS_Pos           (12U)                                   // Lock enable bit for OFF, OFF_EMU, MEM_RET and MEM_RET_EMU power modes.
-+#define PPU_PWSR_LOCK_STATUS_Msk           (0x1UL << PPU_PWSR_LOCK_STATUS_Pos)     // 1 bit
-+#define PPU_PWSR_OP_STATUS_Pos             (16U)                                   // Operating mode policy
-+#define PPU_PWSR_OP_STATUS_Msk             (0xFUL << PPU_PWSR_OP_STATUS_Pos)       // 4 bits
-+#define PPU_PWSR_OP_STATUS_OPMODE_00       (0UL << PPU_PWSR_OP_STATUS_Pos)         // ONE_SLICE_SF_ONLY_ON: One L3 Cache slice is operational, only the snoop filter RAM instances are active in the slice
-+#define PPU_PWSR_OP_STATUS_OPMODE_01       (1UL << PPU_PWSR_OP_STATUS_Pos)         // ONE_SLICE_HALF_RAM_ON: One L3 Cache slice is operational, half of the Cache RAMs are powered on.
-+#define PPU_PWSR_OP_STATUS_OPMODE_03       (3UL << PPU_PWSR_OP_STATUS_Pos)         // ONE_SLICE_FULL_RAM_ON: One L3 Cache slice is operational, all of the Cache RAMs are powered on.
-+#define PPU_PWSR_OP_STATUS_OPMODE_04       (4UL << PPU_PWSR_OP_STATUS_Pos)         // ALL_SLICE_SF_ONLY_ON: All L3 Cache slices are operational, the Cache RAMs in each slice are powered down.
-+#define PPU_PWSR_OP_STATUS_OPMODE_05       (5UL << PPU_PWSR_OP_STATUS_Pos)         // ALL_SLICE_HALF_RAM_ON: All L3 Cache slices are operational, half of the Cache RAMs are powered on.
-+#define PPU_PWSR_OP_STATUS_OPMODE_07       (7UL << PPU_PWSR_OP_STATUS_Pos)         // ALL_SLICE_FULL_RAM_ON: All L3 Cache slices are operational, all of the Cache RAMs are powered on.
-+#define PPU_PWSR_OP_STATUS_OPMODE_08       (8UL << PPU_PWSR_OP_STATUS_Pos)         // HALF_SLICE_SF_ONLY_ON: Half L3 Cache slices are operational, the Cache RAMs in each slice are powered down.
-+#define PPU_PWSR_OP_STATUS_OPMODE_09       (9UL << PPU_PWSR_OP_STATUS_Pos)         // HALF_SLICE_HALF_RAM_ON: Half L3 Cache slices are operational, half of the Cache RAMs are powered on.
-+#define PPU_PWSR_OP_STATUS_OPMODE_0B       (11UL << PPU_PWSR_OP_STATUS_Pos)        // HALF_SLICE_FULL_RAM_ON: Half L3 Cache slices are operational, all of the Cache RAMs are powered on.
-+#define PPU_PWSR_OP_DYN_STATUS_Pos         (24U)                                   // Operating mode dynamic transition enable.
-+#define PPU_PWSR_OP_DYN_STATUS_Msk         (0x1UL << PPU_PWSR_OP_DYN_STATUS_Pos)   // 1 bit
-+
-+/*!< PPU memory offsets */
-+#define DSU_120T_CLUSTER_PPU_OFFSET  0x030000
-+#define DSU_120T_CORE0_PPU_OFFSET    0x080000
-+#define DSU_120T_CORE1_PPU_OFFSET    0x180000
-+#define DSU_120T_CORE2_PPU_OFFSET    0x280000
-+#define DSU_120T_CORE3_PPU_OFFSET    0x380000
-+
-+/*!< PPU memory map */
-+#define CLUSTER_PPU_BASE (CORSTONE1000_HOST_DSU_120T_BASE + DSU_120T_CLUSTER_PPU_OFFSET)
-+#define CORE0_PPU_BASE (CORSTONE1000_HOST_DSU_120T_BASE + DSU_120T_CORE0_PPU_OFFSET)
-+#define CORE1_PPU_BASE (CORSTONE1000_HOST_DSU_120T_BASE + DSU_120T_CORE1_PPU_OFFSET)
-+#define CORE2_PPU_BASE (CORSTONE1000_HOST_DSU_120T_BASE + DSU_120T_CORE2_PPU_OFFSET)
-+#define CORE3_PPU_BASE (CORSTONE1000_HOST_DSU_120T_BASE + DSU_120T_CORE3_PPU_OFFSET)
-+
-+/*!< PPU declarations */
-+#define CLUSTER_PPU ((PPU_TypeDef *) CLUSTER_PPU_BASE)
-+#define CORE0_PPU   ((PPU_TypeDef *) CORE0_PPU_BASE)
-+#define CORE1_PPU   ((PPU_TypeDef *) CORE1_PPU_BASE)
-+#define CORE2_PPU   ((PPU_TypeDef *) CORE2_PPU_BASE)
-+#define CORE3_PPU   ((PPU_TypeDef *) CORE3_PPU_BASE)
-+
-+typedef struct
-+{
-+    volatile uint32_t PWPR;                      /*!< PPU Power Policy Register, Address offset: 0x00 */
-+    volatile uint32_t PMER;                      /*!< PPU Power Mode Emulation Enable Register, Address offset: 0x04 */
-+    volatile uint32_t PWSR;                      /*!< PPU Power Status Register, Address offset: 0x08 */
-+    volatile uint32_t RESERVED0;                 /*!< Reserved, Address offset: 0x0C */
-+    volatile uint32_t DISR;                      /*!< PPU Device Interface Input Current Status Register, Address offset: 0x10 */
-+    volatile uint32_t MISR;                      /*!< PPU Miscellaneous Input Current Status Register, Address offset: 0x14 */
-+    volatile uint32_t STSR;                      /*!< PPU Stored Status Register, Address offset: 0x18 */
-+    volatile uint32_t UNLK;                      /*!< PPU Unlock Register, Address offset: 0x1C */
-+    volatile uint32_t PWCR;                      /*!< PPU Power Configuration Register, Address offset: 0x20 */
-+    volatile uint32_t PTCR;                      /*!< PPU Power Mode Transition Register, Address offsets: 0x24 */
-+    volatile uint32_t RESERVED1[2];              /*!< Reserved: Address offsets 0x28 - 0x2C */
-+    volatile uint32_t IMR;                       /*!< PPU Interrupt Mask Register, Address offsets: 0x30 */
-+    volatile uint32_t AIMR;                      /*!< PPU Additional Interrupt Mask Register, Address offsets: 0x34 */
-+    volatile uint32_t ISR;                       /*!< PPU Interrupt Status Register, Address offsets: 0x38 */
-+    volatile uint32_t AISR;                      /*!< PPU Additional Interrupt Status Register, Address offsets: 0x3C */
-+    volatile uint32_t IESR;                      /*!< PPU Input Edge Sensitivity Register	Address offsets: 0x040 */
-+    volatile uint32_t OPSR;                      /*!< PPU Operating Mode Active Edge Sensitivity Register	Address offsets: 0x044 */
-+    volatile uint32_t RESERVED2[2];              /*!< Reserved: Address offsets 0x48 - 0x4C */
-+    volatile uint32_t FUNRR;                     /*!< Functional Retention RAM Configuration Register	Address offsets: 0x050 */
-+    volatile uint32_t FULRR;                     /*!< Full Retention RAM Configuration Register	Address offsets: 0x054 */
-+    volatile uint32_t MEMRR;                     /*!< Memory Retention RAM Configuration Register	Address offsets: 0x058 */
-+    volatile uint32_t RESERVED3[69];             /*!< Reserved: Address offsets 0x5C - 0x16C */
-+    volatile uint32_t DCDR0;                     /*!< Device Control Delay Configuration Register 0	Address offsets: 0x170 */
-+    volatile uint32_t DCDR1;                     /*!< Device Control Delay Configuration Register 1	Address offsets: 0x174 */
-+    volatile uint32_t RESERVED4[910];            /*!< Reserved, offsets 0x178 - 0xFAC */
-+    volatile uint32_t IDR0;                      /*!< PPU Identification Register 0, Address offsets: 0xFB0 */
-+    volatile uint32_t IDR1;                      /*!< PPU Identification Register 1, Address offsets: 0xFB4 */
-+    volatile uint32_t RESERVED5[4];             /*!< Reserved, offsets 0xFB8 - 0xFC4 */
-+    volatile uint32_t IIDR;                      /*!< PPU Implementation Identification Register, Address offsets: 0xFC8 */
-+    volatile uint32_t AIDR;                      /*!< PPU Architecture Identification Register, Address offsets: 0xFCC */
-+    volatile uint32_t PIDR4;                     /*!< PPU Peripheral Identification Register 4, Address offsets: 0xFD0 */
-+    volatile uint32_t PIDR5;                     /*!< PPU Peripheral Identification Register 5, Address offsets: 0xFD4 */
-+    volatile uint32_t PIDR6;                     /*!< PPU Peripheral Identification Register 6, Address offsets: 0xFD8 */
-+    volatile uint32_t PIDR7;                     /*!< PPU Peripheral Identification Register 7, Address offsets: 0xFDC */
-+    volatile uint32_t PIDR0;                     /*!< PPU Peripheral Identification Register 0, Address offsets: 0xFE0 */
-+    volatile uint32_t PIDR1;                     /*!< PPU Peripheral Identification Register 1, Address offsets: 0xFE4 */
-+    volatile uint32_t PIDR2;                     /*!< PPU Peripheral Identification Register 2, Address offsets: 0xFE8 */
-+    volatile uint32_t PIDR3;                     /*!< PPU Peripheral Identification Register 3, Address offsets: 0xFEC */
-+    volatile uint32_t CIDR0;                     /*!< PPU Component Identification Register 0,	Address offsets: 0xFF0 */
-+    volatile uint32_t CIDR1;                     /*!< PPU Component Identification Register 1,	Address offsets: 0xFF4 */
-+    volatile uint32_t CIDR2;                     /*!< PPU Component Identification Register 2,	Address offsets: 0xFF8 */
-+    volatile uint32_t CIDR3;                     /*!< PPU Component Identification Register 3,	Address offsets: 0xFFC */
-+} PPU_TypeDef;
-+
-+typedef enum {
-+    PPU_PWR_MODE_OFF         = 0, // Logic off and RAM off.
-+    PPU_PWR_MODE_OFF_EMU     = 1, // Emulated Off. Logic on with RAM on. This mode is used to emulate the functional condition of OFF without removing
-+    PPU_PWR_MODE_MEM_RET     = 2, // Memory Retention. Logic off with RAM retained.
-+    PPU_PWR_MODE_MEM_RET_EMU = 3, // Emulated Memory Retention. Logic on with RAM on. This mode is used to emulate the functional condition of
-+    PPU_PWR_MODE_FULL_RET    = 5, // Full Retention. Slice logic off with RAM contents retained.
-+    PPU_PWR_MODE_FUNC_RET    = 7, // Functional Retention. Logic on with L3 Cache and Snoop Filter retained.
-+    PPU_PWR_MODE_ON          = 8, // Logic on with RAM on, cluster is functional.
-+    PPU_PWR_MODE_WARM_RST    = 9, // Warm Reset. Warm reset application with logic and RAM on.
-+    PPU_PWR_MODE_DBG_RECOV   = 10 // Debug Recovery Reset. Warm reset application with logic and RAM on.
-+} PPU_PowerPolicy_Type;
-+
-+typedef enum {
-+    PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON   = 0, // One L3 Cache slice is operational, only the snoop filter RAM instances are active in the slice
-+    PPU_OP_MODE_ONE_SLICE_HALF_RAM_ON  = 1, // One L3 Cache slice is operational, half of the Cache RAMs are powered on.
-+    PPU_OP_MODE_ONE_SLICE_FULL_RAM_ON  = 3, // One L3 Cache slice is operational, all of the Cache RAMs are powered on.
-+    PPU_OP_MODE_ALL_SLICE_SF_ONLY_ON   = 4, // All L3 Cache slices are operational, the Cache RAMs in each slice are powered down.
-+    PPU_OP_MODE_ALL_SLICE_HALF_RAM_ON  = 5, // All L3 Cache slices are operational, half of the Cache RAMs are powered on.
-+    PPU_OP_MODE_ALL_SLICE_FULL_RAM_ON  = 7, // All L3 Cache slices are operational, all of the Cache RAMs are powered on.
-+    PPU_OP_MODE_HALF_SLICE_SF_ONLY_ON  = 8, // Half L3 Cache slices are operational, the Cache RAMs in each slice are powered down.
-+    PPU_OP_MODE_HALF_SLICE_HALF_RAM_ON = 9, // Half L3 Cache slices are operational, half of the Cache RAMs are powered on.
-+    PPU_OP_MODE_HALF_SLICE_FULL_RAM_ON = 11 // Half L3 Cache slices are operational, all of the Cache RAMs are powered on.
-+} PPU_OperatingPolicy_Type;
-+
-+/**
-+ * @brief  Set the power policy for a given PPU instance.
-+ *         Only modifies PWR_POLICY and PWR_DYN_EN bits.
-+ * @param  ppu: Pointer to the PPU instance (e.g., CLUSTER_PPU, CORE0_PPU1)
-+ * @param  policy: Power mode policy (e.g., PPU_PWR_MODE_ON)
-+ * @param  dynamic: Enable dynamic transitions enabled for power modes, allowing transitions to be initiated by changes on power mode DEVACTIVE inputs if non-zero
-+ * @retval None
-+ */
-+void PPU_SetPowerPolicy(PPU_TypeDef *ppu, PPU_PowerPolicy_Type policy, bool isDynamic);
-+
-+/**
-+ * @brief  Set the operating mode policy for a given PPU instance.
-+*          Only modifies OP_POLICY and OP_DYN_EN bits.
-+ * @param  ppu: Pointer to the PPU instance (e.g., CLUSTER_PPU, CORE0_PPU)
-+ * @param  policy: Operating mode policy (e.g., PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON)
-+ * @param  dynamic: Enable dynamic transitions enabled for operating modes, allowing transitions to be initiated by changes on operating mode DEVACTIVE inputs if non-zero
-+ * @retval None
-+ */
-+void PPU_SetOperatingPolicy(PPU_TypeDef *ppu, PPU_OperatingPolicy_Type policy, bool isDynamic);
-+
-+#endif /* PPU_H */
-diff --git a/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c b/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c
-index d0c6b8d590f9..10c66ac41ad2 100644
---- a/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c
-+++ b/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 2018-2024 Arm Limited. All rights reserved.
-+ * SPDX-FileCopyrightText: Copyright The TrustedFirmware-M Contributors
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  *
-@@ -11,6 +11,10 @@
- #include "tfm_hal_multi_core.h"
- #include "fwu_agent.h"
- 
-+#ifdef CORSTONE1000_DSU_120T
-+#include "ppu.h"
-+#endif
-+
- #define HOST_SYS_RST_CTRL_OFFSET     0x000
- #define HOST_CPU_PE0_CONFIG_OFFSET   0x010
- #define HOST_CPU_PE1_CONFIG_OFFSET   0x020
-@@ -98,6 +102,28 @@ void tfm_hal_boot_ns_cpu(uintptr_t start_addr)
- 
-     (void) start_addr;
- 
-+#ifdef CORSTONE1000_DSU_120T
-+    /* Power on DSU-120T cluster */
-+    PPU_SetOperatingPolicy(CLUSTER_PPU, PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON, false);
-+    PPU_SetPowerPolicy(CLUSTER_PPU, PPU_PWR_MODE_ON, false);
-+    
-+    /* Power on Cortex-A320 core0 in DSU-120T Cluster */
-+    PPU_SetOperatingPolicy(CORE0_PPU, PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON, false);
-+    PPU_SetPowerPolicy(CORE0_PPU, PPU_PWR_MODE_ON, false);
-+    
-+#if CORSTONE1000_FVP_MULTICORE
-+    /* Power on all Cortex-A320 cores in DSU-120T Cluster */
-+    PPU_SetOperatingPolicy(CORE1_PPU, PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON, false);
-+    PPU_SetPowerPolicy(CORE1_PPU, PPU_PWR_MODE_ON, false);
-+    
-+    PPU_SetOperatingPolicy(CORE2_PPU, PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON, false);
-+    PPU_SetPowerPolicy(CORE2_PPU, PPU_PWR_MODE_ON, false);
-+
-+    PPU_SetOperatingPolicy(CORE3_PPU, PPU_OP_MODE_ONE_SLICE_SF_ONLY_ON, false);
-+    PPU_SetPowerPolicy(CORE3_PPU, PPU_PWR_MODE_ON, false);
-+#endif
-+#endif
-+
- #ifdef EXTERNAL_SYSTEM_SUPPORT
-     /*release EXT SYS out of reset*/
-     tfm_external_system_boot();

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0010-lib-gpt-Clarify-API-operation.patch

@@ -1,7 +1,7 @@
-From 7e2ae2fc4f8ae8a16a24b87d0650c6b4b28fc870 Mon Sep 17 00:00:00 2001
+From 60608602c55f92c82263775cbe42b221f3ea5f09 Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Wed, 8 Apr 2026 17:39:13 +0100
-Subject: [PATCH] lib: gpt: Clarify API operation
+Subject: [PATCH 10/14] lib: gpt: Clarify API operation
 
 The move and duplicate operations both also move or copy (respectively)
 the partition data, which is not immediately obvious.
@@ -14,7 +14,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-fi
  1 file changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/lib/gpt/inc/gpt.h b/lib/gpt/inc/gpt.h
-index 334a08f41..c11ecbff2 100644
+index 334a08f41abe..c11ecbff2619 100644
 --- a/lib/gpt/inc/gpt.h
 +++ b/lib/gpt/inc/gpt.h
 @@ -152,7 +152,7 @@ __attribute__((nonnull(1)))
@@ -36,3 +36,6 @@ index 334a08f41..c11ecbff2 100644
   *
   * \param[in]  old_guid Entry to duplicate.
   * \param[in]  start    Starting LBA (0 uses the lowest free LBA possible).
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0011-bl2-corstone-1000-Remove-psa_adac_to_tfm_apply_permi.patch

@@ -1,48 +0,0 @@
-From 3a9e209596ca0ae5850ae382c624adf9932b16b4 Mon Sep 17 00:00:00 2001
-From: Devaraj Ranganna <devaraj.ranganna@arm.com>
-Date: Mon, 22 Sep 2025 12:48:57 +0100
-Subject: [PATCH] bl2: corstone-1000: Remove
- `psa_adac_to_tfm_apply_permissions`
-
-The API `psa_adac_to_tfm_apply_permissions` is added to `psa-adac`
-library. Therefore, remove it from
-`platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c`.
-
-Upstream-Status: Pending [Not submitted to upstream yet]
-Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
----
- .../arm/corstone1000/bl2/boot_hal_bl2.c       | 21 -------------------
- 1 file changed, 21 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-index 2abcfb5fd39d..8c4eb80d032c 100644
---- a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-+++ b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-@@ -111,27 +111,6 @@ static bool fill_flash_map_with_fip_data(uint8_t boot_index) {
- #endif /* !TFM_S_REG_TEST */
- 
- #ifdef PLATFORM_PSA_ADAC_SECURE_DEBUG
--int psa_adac_to_tfm_apply_permissions(uint8_t permissions_mask[16])
--{
--    (void)permissions_mask;
--
--    int ret;
--    uint32_t dcu_reg_values[4];
--
--    /* Below values provide same access as when platform is in development
--       life cycle state */
--    dcu_reg_values[0] = 0xffffe7fc;
--    dcu_reg_values[1] = 0x800703ff;
--    dcu_reg_values[2] = 0xffffffff;
--    dcu_reg_values[3] = 0xffffffff;
--
--    ret = crypto_hw_apply_debug_permissions((uint8_t*)dcu_reg_values, 16);
--    BOOT_LOG_INF("%s: debug permission apply %s\n\r", __func__,
--            (ret == 0) ? "success" : "fail");
--
--    return ret;
--}
--
- uint8_t secure_debug_rotpk[32];
- #endif /* PLATFORM_PSA_ADAC_SECURE_DEBUG */
- 

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0011-lib-gpt-Add-metadata-only-API-operations.patch

@@ -1,7 +1,7 @@
-From f9badce3570bbc89b141c86a6b8a988d90d81f0c Mon Sep 17 00:00:00 2001
+From b10d50f554745f2f9a2e43c24e1020c4da15a098 Mon Sep 17 00:00:00 2001
 From: Frazer Carsley <frazer.carsley@arm.com>
 Date: Wed, 8 Apr 2026 17:51:18 +0100
-Subject: [PATCH] lib: gpt: Add metadata-only API operations
+Subject: [PATCH 11/14] lib: gpt: Add metadata-only API operations
 
 Both move and duplicate functions also move or copy (respectively) the
 partition data. This is not always required, for example if the
@@ -17,7 +17,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-fi
  3 files changed, 473 insertions(+), 120 deletions(-)
 
 diff --git a/lib/gpt/inc/gpt.h b/lib/gpt/inc/gpt.h
-index c11ecbff2..c5bddb470 100644
+index c11ecbff2619..c5bddb4704e7 100644
 --- a/lib/gpt/inc/gpt.h
 +++ b/lib/gpt/inc/gpt.h
 @@ -170,6 +170,25 @@ psa_status_t gpt_entry_move(const struct efi_guid_t *guid,
@@ -74,7 +74,7 @@ index c11ecbff2..c5bddb470 100644
   * \brief Creates a partition entry in the table.
   *
 diff --git a/lib/gpt/src/gpt.c b/lib/gpt/src/gpt.c
-index 984c8f821..d6528f6a5 100644
+index 984c8f82146c..d6528f6a50ef 100644
 --- a/lib/gpt/src/gpt.c
 +++ b/lib/gpt/src/gpt.c
 @@ -222,9 +222,17 @@ static psa_status_t find_gpt_entry(const struct gpt_t      *table,
@@ -413,7 +413,7 @@ index 984c8f821..d6528f6a5 100644
              restore_to.header.array_lba,
              (restore_from->header.num_partitions +
 diff --git a/lib/gpt/unittests/gpt/test_gpt.c b/lib/gpt/unittests/gpt/test_gpt.c
-index 5d2c4243f..bd9eb8ba1 100644
+index 5d2c4243f607..bd9eb8ba1da5 100644
 --- a/lib/gpt/unittests/gpt/test_gpt.c
 +++ b/lib/gpt/unittests/gpt/test_gpt.c
 @@ -897,6 +897,153 @@ void test_gpt_entry_duplicate_should_failWhenTableFull(void)
@@ -699,3 +699,6 @@ index 5d2c4243f..bd9eb8ba1 100644
  void test_gpt_attr_set_should_setAttributes(void)
  {
      /* Start with a populated GPT */
+-- 
+2.39.5
+

meta-arm-bsp/recipes-bsp/trusted-firmware-m/files/corstone1000/0012-bl2-corstone-1000-secure-debug-waiting-in-CM-LCS.patch

@@ -1,53 +0,0 @@
-From 901a63f09369cfbed8eff8c450b8615bd4c361af Mon Sep 17 00:00:00 2001
-From: Devaraj Ranganna <devaraj.ranganna@arm.com>
-Date: Mon, 22 Sep 2025 12:59:43 +0100
-Subject: [PATCH] bl2: corstone-1000: secure debug waiting in CM LCS
-
-Currently, when the device is in Secure Enable (SE) LCS state, setting
-`dcu_en` register causes CC-312 reset, which effectively resets the
-device as they are both on same power domain. Therefore, temporarily
-disable moving SE enable before waiting for secure debug notification.
-The device will be in CM provisioned state.
-
-Long-term solution is to implement a solution similar to RSE, secure
-debug handshake is completed and then a reset is triggered and `dcu_en`
-is applied during bl2.
-
-Upstream-Status: Inappropriate [Need to be redesigned]
-Signed-off-by: Devaraj Ranganna <devaraj.ranganna@arm.com>
----
- .../ext/target/arm/corstone1000/bl2/boot_hal_bl2.c  | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-index 8c4eb80d032c..bf7b62881ad5 100644
---- a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-+++ b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-@@ -165,7 +165,18 @@ int32_t boot_platform_post_init(void)
-     }
- 
- #ifdef PLATFORM_PSA_ADAC_SECURE_DEBUG
-+    /*  TODO: Currently, when the device is in Secure Enable (SE) LCS state,
-+        setting `dcu_en` register causes CC-312 reset, which effectively resets
-+        the device as they are both on same power domain. Therefore, temporarily
-+        disable moving SE enable before waiting for secure debug notification.
-+        The device will be in CM provisioned state.
-+
-+        Long-term solution is to implement a solution similar to RSE, secure
-+        debug handshake is completed and then a reset is triggered and `dcu_en`
-+        is applied during bl2.
-+
-     if (!tfm_plat_provisioning_is_required()) {
-+    */
- 
-         plat_err = tfm_plat_otp_read(PLAT_OTP_ID_SECURE_DEBUG_PK, 32, secure_debug_rotpk);
-         if (plat_err != TFM_PLAT_ERR_SUCCESS) {
-@@ -176,7 +187,7 @@ int32_t boot_platform_post_init(void)
-         BOOT_LOG_INF("%s: Corstone-1000 Secure Debug is a %s.\r\n", __func__,
-                 (result == 0) ? "success" : "failure");
- 
--    }
-+  /*}*/
- #endif
- 
-     return 0;