arm-bsp/optee-os: backport fix for CVE-2023-41325

This bug has been fixed in 3.22, backport for 3.20. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>
arm/optee: handle CVE-2021-36133 as disputed
2026-07-18 04:27:08 +00:00 · 2023-11-13 09:38:48 -05:00 · 2023-11-13 09:38:48 -05:00 · 2023-11-10 20:03:19 +00:00 · 2023-11-09 12:00:22 -05:00 · 2023-11-09 11:00:16 -05:00
880 changed files with 24661 additions and 65874 deletions
@@ -1 +1,2 @@
 __pycache__
+build
@@ -1,4 +1,14 @@
-image: ghcr.io/siemens/kas/kas:latest-release
+image: ${MIRROR_GHCR}/siemens/kas/kas:4.0
+
+variables:
+  CPU_REQUEST: ""
+  DEFAULT_TAG: ""
+  CACHE_DIR: $CI_BUILDS_DIR/persist
+  MIRROR_GHCR: ghcr.io
+  # These are needed as the k8s executor doesn't respect the container entrypoint
+  # by default
+  FF_KUBERNETES_HONOR_ENTRYPOINT: 1
+  FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: 0

 stages:
  - prep
@@ -6,15 +16,17 @@ stages:

 # Common job fragment to get a worker ready
 .setup:
+  tags:
+    - $DEFAULT_TAG
  stage: build
  interruptible: true
  variables:
    KAS_WORK_DIR: $CI_PROJECT_DIR/work
-    KAS_REPO_REF_DIR: $CI_BUILDS_DIR/persist/repos
-    SSTATE_DIR: $CI_BUILDS_DIR/persist/sstate
-    DL_DIR: $CI_BUILDS_DIR/persist/downloads
+    KAS_REPO_REF_DIR: $CACHE_DIR/repos
+    SSTATE_DIR: $CACHE_DIR/sstate
+    DL_DIR: $CACHE_DIR/downloads
    BB_LOGCONFIG: $CI_PROJECT_DIR/ci/logging.yml
-    TOOLCHAIN_DIR: $CI_BUILDS_DIR/persist/toolchains
+    TOOLCHAIN_DIR: $CACHE_DIR/toolchains
    IMAGE_DIR: $CI_PROJECT_DIR/work/build/tmp/deploy/images
    TOOLCHAIN_LINK_DIR: $CI_PROJECT_DIR/work/build/toolchains
  before_script:
@@ -25,107 +37,99 @@ stages:
    - mkdir --verbose --parents $KAS_WORK_DIR $KAS_REPO_REF_DIR $SSTATE_DIR $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
    # Must do this here, as it's the only way to make sure the toolchain is installed on the same builder
    - ./ci/get-binary-toolchains $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
-    - sudo apt update && sudo apt install --yes telnet python3-subunit

 # Generalised fragment to do a Kas build
 .build:
  extends: .setup
+  variables:
+    KUBERNETES_CPU_REQUEST: $CPU_REQUEST
+  rules:
+    # Don't run MR pipelines
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      when: never
+    # Don't run pipelines for tags
+    - if: $CI_COMMIT_TAG
+      when: never
+    # Don't run if BUILD_ENABLE_REGEX is set, but the job doesn't match the regex
+    - if: '$BUILD_ENABLE_REGEX != null && $CI_JOB_NAME !~ $BUILD_ENABLE_REGEX'
+      when: never
+    # Allow the dev kernels to fail and not fail the overall build
+    - if: '$KERNEL == "linux-yocto-dev"'
+      allow_failure: true
+    # Catch all for everything else
+    - if: '$KERNEL != "linux-yocto-dev"'
  script:
-    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME")
-    - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
+    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME"):lockfile.yml
+    - kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES
    - kas build $KASFILES
    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
  artifacts:
    name: "logs"
-    when: on_failure
+    when: always
    paths:
      - $CI_PROJECT_DIR/work/build/tmp/work*/**/temp/log.do_*.*
-
-# Workaround for Zephyr not currectly handling TESTIMAGE_AUTO
-.build_and_test:
-  extends: .setup
-  script:
-    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME")
-    - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
-    - kas build $KASFILES
-    - kas build $KASFILES -c testimage
-    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
-
+      - $CI_PROJECT_DIR/work/build/tmp/work*/**/testimage/*

 #
-# Prep stage, update repositories once
+# Prep stage, update repositories once.
+# Set the CI variable CI_CLEAN_REPOS=1 to refetch the respositories from scratch
 #
 update-repos:
  extends: .setup
  stage: prep
+  allow_failure:
+    exit_codes: 128
  script:
-    - flock --verbose --timeout 60 $KAS_REPO_REF_DIR ./ci/update-repos
+    - |
+      flock --verbose --timeout 60 $KAS_REPO_REF_DIR ./ci/update-repos
+      # Only generate if doesn't already exist, to allow feature branches to drop one in.
+      if test -f lockfile.yml; then
+        echo Using existing lockfile.yml
+      else
+        # Be sure that this is the complete list of layers being fetched
+        kas dump --lock --update ci/qemuarm64.yml:ci/meta-openembedded.yml:ci/clang.yml:ci/meta-virtualization.yml | tee lockfile.yml
+      fi
+  artifacts:
+    name: "lockfile"
+    paths:
+      - lockfile.yml

 #
 # Build stage, the actual build jobs
 #
 # Available options for building are
-#  TOOLCHAINS: [gcc, clang, armgcc, external-gccarm]
+#  DISTRO: [poky, poky-tiny]
+#  KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+#  TOOLCHAINS: [gcc, clang, external-gccarm]
 #  TCLIBC: [glibc, musl]
+#  FIRMWARE: [u-boot, edk2]
+#  TS: [none, trusted-services]
 #  VIRT: [none, xen]
 #  TESTING: testimage

-corstone500:
-  extends: .build
-  parallel:
-    matrix:
-      - TESTING: testimage
-  tags:
-    - x86_64
-
 corstone1000-fvp:
  extends: .build
  parallel:
    matrix:
-      - TESTING: testimage
-  tags:
-    - x86_64
+      - TESTING: [testimage, tftf]

 corstone1000-mps3:
  extends: .build
+  parallel:
+    matrix:
+      - TESTING: [none, tftf]
+

 fvp-base:
  extends: .build
  parallel:
    matrix:
      - TESTING: testimage
-  tags:
-    - x86_64
-
-fvp-base-arm32:
-  extends: .build
-  parallel:
-    matrix:
-      - TOOLCHAINS: [gcc, external-gccarm]
-        TESTING: testimage
-  tags:
-    - x86_64
-
-fvp-baser-aemv8r64:
-  extends: .build
-  parallel:
-    matrix:
-      - TESTING: testimage
-  tags:
-    - x86_64
+      - FIRMWARE: edk2

 fvps:
  extends: .build

-gem5-arm64:
-  extends: .build
-  parallel:
-    matrix:
-      - VIRT: [none, xen]
-
-gem5-atp-arm64:
-  extends: .build
-
 generic-arm64:
  extends: .build

@@ -134,13 +138,7 @@ juno:
  parallel:
    matrix:
      - TOOLCHAINS: [gcc, clang]
-        FIRMWARE: [none, edk2]
-
-microbit-v1:
-  extends: .build_and_test
-  parallel:
-    matrix:
-      - TESTING: testimage-zephyr
+        FIRMWARE: [u-boot, edk2]

 musca-b1:
  extends: .build
@@ -152,46 +150,60 @@ n1sdp:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, armgcc]
-
-qemu-cortex-a53:
-  extends: .build
-
-qemu-cortex-m3:
-  extends: .build_and_test
-  parallel:
-    matrix:
-      - TESTING: testimage-zephyr
-
-qemu-cortex-r5:
-  extends: .build
+      - TESTING: [none, n1sdp-ts, n1sdp-optee, tftf]

 qemu-generic-arm64:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
        TESTING: testimage

 qemuarm64-secureboot:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
        TCLIBC: [glibc, musl]
+        TS: [none, qemuarm64-secureboot-ts]
        TESTING: testimage

 qemuarm64:
  extends: .build
  parallel:
    matrix:
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+        TESTING: testimage
+      - DISTRO: poky-tiny
+        TESTING: testimage
      - VIRT: xen

+qemuarm-secureboot:
+  extends: .build
+  parallel:
+    matrix:
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        TCLIBC: [glibc, musl]
+        TESTING: testimage
+      - TOOLCHAINS: external-gccarm
+        TESTING: testimage
+
 qemuarm:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+        TESTING: testimage
+      - DISTRO: poky-tiny
        TESTING: testimage
      - VIRT: xen

@@ -199,18 +211,20 @@ qemuarmv5:
  extends: .build
  parallel:
    matrix:
-      - TESTING: testimage
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TESTING: testimage
+      - DISTRO: poky-tiny
+        TESTING: testimage

 sgi575:
  extends: .build

-tc0:
-  extends: .build
-  tags:
-    - x86_64
-
 tc1:
  extends: .build
+  parallel:
+    matrix:
+      - TESTING: testimage
  tags:
    - x86_64

@@ -220,18 +234,18 @@ toolchains:
 selftest:
  extends: .setup
  script:
-    - KASFILES=./ci/qemuarm64.yml:./ci/selftest.yml
-    - kas shell --update --force-checkout $KASFILES -c 'oe-selftest --num-processes 1 --run-tests runfvp'
+    - KASFILES=./ci/qemuarm64.yml:./ci/selftest.yml:lockfile.yml
+    - kas shell --update --force-checkout $KASFILES -c 'oe-selftest --num-processes 2 --select-tag meta-arm --run-all-tests'

 # Validate layers are Yocto Project Compatible
 check-layers:
  extends: .setup
  script:
-    - kas shell --update --force-checkout ci/base.yml:ci/meta-openembedded.yml --command \
+    - kas shell --update --force-checkout ci/base.yml:ci/meta-openembedded.yml:lockfile.yml --command \
      "yocto-check-layer-wrapper $CI_PROJECT_DIR/$LAYER --dependency $CI_PROJECT_DIR/meta-* $KAS_WORK_DIR/meta-openembedded/meta-oe --no-auto-dependency"
  parallel:
    matrix:
-      - LAYER: [meta-arm, meta-arm-bsp, meta-arm-toolchain, meta-gem5]
+      - LAYER: [meta-arm, meta-arm-bsp, meta-arm-toolchain]

 pending-updates:
  extends: .setup
@@ -241,16 +255,15 @@ pending-updates:
  script:
    - rm -fr update-report
    # This configuration has all of the layers we need enabled
-    - kas shell ci/gem5-arm64.yml --command \
-      "$CI_PROJECT_DIR/scripts/machine-summary.py -t report -o $CI_PROJECT_DIR/update-report $($CI_PROJECT_DIR/ci/listmachines.py meta-arm meta-arm-bsp meta-gem5)"
+    - kas shell --update --force-checkout ci/qemuarm64.yml:ci/meta-openembedded.yml:ci/meta-secure-core.yml:lockfile.yml --command \
+      "$CI_PROJECT_DIR/scripts/machine-summary.py -t report -o $CI_PROJECT_DIR/update-report $($CI_PROJECT_DIR/ci/listmachines.py meta-arm meta-arm-bsp)"
  # Do this on x86 whilst the compilers are x86-only
  tags:
    - x86_64

 # What percentage of machines in the layer do we build
 machine-coverage:
-  stage: build
-  interruptible: true
+  extends: .setup
  script:
    - ./ci/check-machine-coverage
  coverage: '/Coverage: \d+/'
@@ -263,3 +276,26 @@ metrics:
  script:
    - kas shell --update --force-checkout ci/base.yml --command \
      "$CI_PROJECT_DIR/ci/patchreview $CI_PROJECT_DIR/meta-* --verbose --metrics $CI_PROJECT_DIR/metrics.txt"
+
+documentation:
+  extends: .setup
+  script:
+    - |
+      # This can be removed when the kas container has python3-venv installed
+      sudo apt-get update && sudo apt-get install --yes python3-venv
+
+      python3 -m venv venv
+      . ./venv/bin/activate
+
+      pip3 install -r meta-arm-bsp/documentation/requirements.txt
+
+      for CONF in meta-*/documentation/*/conf.py ; do
+        echo Building $CONF...
+        SOURCE_DIR=$(dirname $CONF)
+        MACHINE=$(basename $SOURCE_DIR)
+        sphinx-build -vW $SOURCE_DIR build-docs/$MACHINE
+      done
+      test -d build-docs/
+  artifacts:
+    paths:
+      - build-docs/
@@ -6,10 +6,6 @@ This repository contains the Arm layers for OpenEmbedded.

  This layer contains general recipes for the Arm architecture, such as firmware, FVPs, and Arm-specific integration.

-* meta-arm-autonomy
-
-  This layer is the distribution for a reference stack for autonomous systems.
-
 * meta-arm-bsp

  This layer contains machines for Arm reference platforms, for example FVP Base, N1SDP, and Juno.
@@ -18,15 +14,6 @@ This repository contains the Arm layers for OpenEmbedded.

  This layer contains recipes for Arm's binary toolchains (GCC and Clang for -A and -M), and a recipe to build Arm's GCC.

-* meta-atp
-
-  This layer contains recipes for the Adaptive Traffic Generation integration into meta-gem5.
-
-* meta-gem5
-
-  This layer contains recipes and machines for gem5, a system-level and processor simulator.
-
-
 Other Directories
 -----------------

@@ -1,6 +0,0 @@
-header:
-  version: 11
-
-local_conf_header:
-  cc: |
-    GCCVERSION = "arm-11.2"
@@ -1,11 +1,11 @@
 header:
-  version: 11
+  version: 14

 distro: poky

 defaults:
  repos:
-    refspec: kirkstone
+    branch: nanbield

 repos:
  meta-arm:
@@ -26,25 +26,18 @@ env:

 local_conf_header:
  base: |
-    BB_SERVER_TIMEOUT = "60"
    CONF_VERSION = "2"
-    BB_NUMBER_THREADS = "16"
-    PARALLEL_MAKE = "-j16"
-    LICENSE_FLAGS_ACCEPTED += "armcompiler Arm-FVP-EULA"
  setup: |
    PACKAGE_CLASSES = "package_ipk"
    PACKAGECONFIG:remove:pn-qemu-system-native = "gtk+ sdl"
-    EXTRA_IMAGE_FEATURES:append = " debug-tweaks"
    PACKAGECONFIG:append:pn-perf = " coresight"
    INHERIT += "rm_work"
    DISTRO_FEATURES:remove = "ptest"
-  kvm: |
-    QEMU_USE_KVM = ""
-  perf: |
-    CORE_IMAGE_EXTRA_INSTALL += "perf"
-  sshkeys: |
-    CORE_IMAGE_EXTRA_INSTALL += "ssh-pregen-hostkeys"
+  extrapackages: |
+    CORE_IMAGE_EXTRA_INSTALL += "perf opencsd"
+    CORE_IMAGE_EXTRA_INSTALL:append:aarch64 = " gator-daemon"
+
 machine: unset

 target:
-  - core-image-base
+  - core-image-sato
@@ -1,11 +1,19 @@
 header:
-  version: 11
+  version: 14

 repos:
  meta-clang:
    url: https://github.com/kraj/meta-clang
-    refspec: master

 local_conf_header:
-  clang: |
+  toolchain: |
    TOOLCHAIN = "clang"
+    PREFERRED_PROVIDER_llvm = "clang"
+    PREFERRED_PROVIDER_llvm-native = "clang-native"
+    PREFERRED_PROVIDER_nativesdk-llvm = "nativesdk-clang"
+    PROVIDES:pn-clang = "llvm"
+    PROVIDES:pn-clang-native = "llvm-native"
+    PROVIDES:pn-nativesdk-clang = "nativesdk-llvm"
+    # This is needed to stop bitbake getting confused about what clang/llvm is
+    # being used, see https://github.com/kraj/meta-clang/pull/766
+    BBMASK += "/meta/recipes-devtools/llvm/llvm.*\.bb"
@@ -1,13 +1,15 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml
    - ci/meta-openembedded.yml
-local_conf_header:
-    perf: |
+    - ci/poky-tiny.yml
+    - ci/meta-secure-core.yml

-distro: poky-tiny
+local_conf_header:
+    extrapackages: |
+    # Intentionally blank to prevent perf from being added to the image in base.yml

 target:
-  - perf
  - corstone1000-image
+  - perf
@@ -1,12 +1,12 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/corstone1000-common.yml
+    - ci/fvp.yml

 local_conf_header:
    fvp-config: |
        # Remove Dropbear SSH as it will not fit into the corstone1000 image.
        IMAGE_FEATURES:remove = " ssh-server-dropbear"
-        INHERIT += "fvpboot"

 machine: corstone1000-fvp
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/corstone1000-common.yml

@@ -1,18 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-
-local_conf_header:
-  testimagefvp: |
-    INHERIT += "fvpboot"
-    IMAGE_FEATURES:remove = " ssh-server-dropbear"
-  perf: |
-
-machine: corstone500
-
-distro: poky-tiny
-
-target:
-  - core-image-minimal
-  - perf
@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+# Add universally helpful features when testing boards
+local_conf_header:
+  debug: |
+    EXTRA_IMAGE_FEATURES:append = " debug-tweaks"
@@ -0,0 +1,31 @@
+#! /usr/bin/env python3
+
+"""
+Download the lockfile.yml produced by a CI pipeline, specified by the GitLab
+server, full name of the meta-arm project, and the refspec that was executed.
+
+For example,
+$ ./download-lockfile.py https://gitlab.com/ rossburton/meta-arm master
+
+SPDX-FileCopyrightText: Copyright 2023 Arm Limited and Contributors
+SPDX-License-Identifier: GPL-2.0-only
+"""
+
+import argparse
+import gitlab
+import io
+import zipfile
+
+parser = argparse.ArgumentParser()
+parser.add_argument("server", help="GitLab server name")
+parser.add_argument("project", help="meta-arm project name")
+parser.add_argument("refspec", help="Branch/commit")
+args = parser.parse_args()
+
+gl = gitlab.Gitlab(args.server)
+project = gl.projects.get(args.project)
+artefact = project.artifacts.download(ref_name=args.refspec, job="update-repos")
+
+z = zipfile.ZipFile(io.BytesIO(artefact))
+z.extract("lockfile.yml")
+print("Fetched lockfile.yml")
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14

 local_conf_header:
  bootfirmware: |
@@ -7,3 +7,11 @@ local_conf_header:
    MACHINE_FEATURES += "efi"
    TFA_UBOOT = "0"
    TFA_UEFI = "1"
+
+    EXTRA_IMAGEDEPENDS += "edk2-firmware"
+    EFI_PROVIDER ?= "grub-efi"
+
+    QB_DEFAULT_BIOS = "QEMU_EFI.fd"
+    WKS_FILE ?= "efi-disk.wks.in"
+  failing_tests: |
+    TEST_SUITES:remove = "xorg"
@@ -1,8 +1,11 @@
 header:
-  version: 11
+  version: 14

 local_conf_header:
  cc: |
    SKIP_RECIPE[gcc-cross-arm] = "Using external toolchain"
    TCMODE = "external-arm"
    EXTERNAL_TOOLCHAIN = "${TOPDIR}/toolchains/${TARGET_ARCH}"
+    # Temporary workaround for a number binaries in the toolchains that are using 32bit timer API
+    # This must be done here instead of the recipe because of all the libraries in the toolchain have the issue
+    INSANE_SKIP:append = " 32bit-time"
@@ -1,16 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-
-machine: fvp-base-arm32
-
-local_conf_header:
-  testimagefvp: |
-    INHERIT = "fvpboot"
-    # This fails but we can't add to the ignorelist from meta-arm yet
-    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
-    TEST_SUITES:remove = "parselogs"
-    # Tell testimage to connect to localhost:8122, and forward that to SSH in the FVP.
-    TEST_TARGET_IP = "127.0.0.1:8122"
-    FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] = "8122=22"
@@ -1,16 +1,7 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml
+    - ci/fvp.yml

 machine: fvp-base
-
-local_conf_header:
-  testimagefvp: |
-    INHERIT += "fvpboot"
-    # This fails but we can't add to the ignorelist from meta-arm yet
-    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
-    TEST_SUITES:remove = "parselogs"
-    # Tell testimage to connect to localhost:8022, and forward that to SSH in the FVP.
-    TEST_TARGET_IP = "localhost:8022"
-    FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
@@ -1,7 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-
-machine: fvp-baser-aemv8r64
-
@@ -0,0 +1,12 @@
+header:
+  version: 14
+
+local_conf_header:
+  testimagefvp: |
+    LICENSE_FLAGS_ACCEPTED += "Arm-FVP-EULA"
+    IMAGE_CLASSES += "fvpboot"
+  failing_tests: |
+    # This fails but we can't add to the ignorelist from meta-arm yet
+    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
+    TEST_SUITES:remove = "parselogs"
+    TEST_SUITES:remove = "xorg"
@@ -1,20 +1,25 @@
 # Simple target to build the FVPs that are publically available

 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

 machine: qemuarm64

 local_conf_header:
+  license: |
+    LICENSE_FLAGS_ACCEPTED += "Arm-FVP-EULA"
  sdk: |
    SDKMACHINE = "x86_64"

 target:
+  # Target packages to test aarch64
+  - fvp-base-a-aem
+  - fvp-corstone1000
+  # Nativesdk to test x86-64
  - nativesdk-fvp-base-a-aem
+  - nativesdk-fvp-corstone1000
  - nativesdk-fvp-n1-edge
  - nativesdk-fvp-sgi575
-  - nativesdk-fvp-corstone500
-  - nativesdk-fvp-corstone1000
-  - nativesdk-fvp-tc0
+  - nativesdk-fvp-tc1
@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  toolchain: |
+    TOOLCHAIN = "gcc"
@@ -1,16 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-    - ci/meta-openembedded.yml
-
-repos:
-  meta-arm:
-    layers:
-      meta-gem5:
-
-machine: gem5-arm64
-
-target:
-  - core-image-minimal
-  - gem5-aarch64-native
@@ -1,15 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/gem5-arm64.yml
-
-repos:
-  meta-arm:
-    layers:
-      meta-atp:
-
-machine: gem5-atp-arm64
-
-target:
-  - atp-native
-  - core-image-minimal
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -1,46 +1,51 @@
 #!/bin/bash
-set -u
+set -u -e

-HOST_ARCH=$(uname -m)
-VER="11.2-2022.02"
+BASENAME=arm-gnu-toolchain
+VER=${VER:-12.2.rel1}
+HOST_ARCH=${HOST_ARCH:-$(uname -m)}

-DOWNLOAD_DIR=$1
-TOOLCHAIN_DIR=$2
-TOOLCHAIN_LINK_DIR=$3
+# Use the standard kas container locations if nothing is passed into the script
+DOWNLOAD_DIR="${1:-/builds/persist/downloads/}"
+TOOLCHAIN_DIR="${2:-/builds/persist//toolchains/}"
+TOOLCHAIN_LINK_DIR="${3:-build/toolchains/}"

 # These should be already created by .gitlab-ci.yml, but do here if run outside of that env
 mkdir -p $DOWNLOAD_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR

+download() {
+	TRIPLE=$1
+	URL=https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/$BASENAME-$VER-$HOST_ARCH-$TRIPLE.tar.xz
+	wget -P $DOWNLOAD_DIR -nc $URL
+}
+
 if [ $HOST_ARCH = "aarch64" ]; then
-	#AArch64 Linux hosted cross compilers
+	# AArch64 Linux hosted cross compilers

-	#AArch32 target with hard float (arm-none-linux-gnueabihf)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/gcc-arm-$VER-$HOST_ARCH-arm-none-linux-gnueabihf.tar.xz
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf
 elif [ $HOST_ARCH = "x86_64" ]; then
-	#x86_64 Linux hosted cross compilers
+	# x86_64 Linux hosted cross compilers

-	#AArch32 target with hard float (arm-linux-none-gnueabihf)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/gcc-arm-$VER-$HOST_ARCH-arm-none-linux-gnueabihf.tar.xz
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf

-	#AArch64 GNU/Linux target (aarch64-none-linux-gnu)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/gcc-arm-$VER-$HOST_ARCH-aarch64-none-linux-gnu.tar.xz
-
-	#AArch64 GNU/Linux target (aarch64_be-none-linux-gnu)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/gcc-arm-$VER-$HOST_ARCH-aarch64_be-none-linux-gnu.tar.xz
+	# AArch64 GNU/Linux target
+	download aarch64-none-linux-gnu
 else
 	echo "ERROR - Unknown build arch of $HOST_ARCH"
 	exit 1
 fi

-for i in arm aarch64 aarch64_be; do
-	if [ ! -d $TOOLCHAIN_DIR/gcc-arm-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
-		if [ ! -f $DOWNLOAD_DIR/gcc-arm-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
+for i in arm aarch64; do
+	if [ ! -d $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
+		if [ ! -f $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
 			continue
 		fi

-		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/gcc-arm-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
+		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
 	fi

 	# Setup a link for the toolchain to use local to the building machine (e.g., not in a shared location)
-	ln -s $TOOLCHAIN_DIR/gcc-arm-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
+	ln -s $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
 done
@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  libc: |
+    TCLIBC = "glibc"
@@ -3,7 +3,7 @@
 # This script is expecting an input of machine name, optionally followed by a
 # colon and a list of one or more parameters separated by commas between
 # brackets.  For example, the following are acceptable:
-# corstone500
+# corstone1000-mps3
 # fvp-base: [testimage]
 # qemuarm64-secureboot: [clang, glibc, testimage]
 #
@@ -18,7 +18,7 @@ for i in $(echo $1 | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
 	# defaults, we can simply ignore those parameters.  They are necessary
 	# to pass in so that matrix can correctly setup all of the permutations
 	# of each individual run.
-	if [[ $i == 'none' || $i == 'gcc' || $i == 'glibc' ]]; then
+	if [[ $i == 'none' ]]; then
 		continue
 	fi
 	FILES+=":ci/$i.yml"
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-dev"
@@ -1,8 +1,6 @@
 header:
-  version: 9
-  includes:
-    - kas/fvp-baser-aemv8r64-bsp.yml
+  version: 14

 local_conf_header:
-  base-rt: |
+  kernel: |
    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-rt"
@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto"
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14

 repos:
  meta-openembedded:
@@ -9,3 +9,4 @@ repos:
      meta-networking:
      meta-oe:
      meta-python:
+      meta-perl:
@@ -0,0 +1,11 @@
+header:
+  version: 14
+
+repos:
+  meta-secure-core:
+    url: https://github.com/Wind-River/meta-secure-core.git
+    layers:
+      meta:
+      meta-signing-key:
+      meta-efi-secure-boot:
+      
@@ -1,9 +1,8 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/meta-openembedded.yml

 repos:
  meta-virtualization:
    url: git://git.yoctoproject.org/meta-virtualization
-    refspec: master
@@ -1,13 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/meta-openembedded.yml
-
-repos:
-  meta-zephyr:
-    url: https://git.yoctoproject.org/git/meta-zephyr
-    layers:
-      meta-zephyr-core:
-
-target:
-  - zephyr-kernel-test-all
@@ -1,11 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-    - ci/meta-zephyr.yml
-
-local_conf_header:
-  failing_tests: |
-    ZEPHYRTESTS:remove = "common"
-
-machine: microbit-v1
@@ -1,15 +1,10 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml
-    - ci/meta-zephyr.yml
-
-local_conf_header:
-  nonbuilding_tests: |
-    ZEPHYRTESTS:remove = "common sleep poll device queue"
+    - ci/meta-openembedded.yml

 machine: musca-b1

 target:
  - trusted-firmware-m
-  - zephyr-kernel-test-all
@@ -1,15 +1,10 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml
-    - ci/meta-zephyr.yml
-
-local_conf_header:
-  nonbuilding_tests: |
-    ZEPHYRTESTS:remove = "common sleep poll device queue"
+    - ci/meta-openembedded.yml

 machine: musca-s1

 target:
  - trusted-firmware-m
-  - zephyr-kernel-test-all
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14

 local_conf_header:
  libc: |
@@ -0,0 +1,12 @@
+header:
+  version: 14
+
+# Config specific for the optee-xtests
+local_conf_header:
+  optee-test: |
+    # Include ARM FFA
+    MACHINE_FEATURES:append = " arm-ffa"
+    # Include trusted services
+    TEST_SUITES:append = " trusted_services"
+    # Include Optee xtests
+    IMAGE_INSTALL:append = " optee-test"
@@ -0,0 +1,14 @@
+header:
+  version: 14
+  includes:
+    - ci/meta-openembedded.yml
+
+local_conf_header:
+  trusted_services: |
+    TEST_SUITES:append = " trusted_services"
+    # Include TS Crypto, TS Protected Storage, TS Internal and Trusted Storage SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its"
+    # Include TS demo/test tools into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests"
+    # Include TS PSA Arch tests into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"
@@ -1,6 +1,10 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

 machine: n1sdp
+
+local_conf_header:
+  unsupported_trusted_services: |
+    MACHINE_FEATURES:remove = "ts-smm-gateway"
@@ -0,0 +1,14 @@
+header:
+  version: 14
+
+distro: poky-tiny
+
+local_conf_header:
+  hacking: |
+    TEST_SUITES = "_qemutiny ping"
+  extrapackages: |
+    # Intentionally blank to prevent perf from being added to the image in base.yml
+
+target:
+  - core-image-minimal
+  - perf
@@ -0,0 +1,4 @@
+header:
+  version: 14
+
+distro: poky
@@ -1,9 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-    - ci/meta-zephyr.yml
-
-# FIXME - testimage fails all tests currently, but all the tests build
-
-machine: qemu-cortex-a53
@@ -1,18 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-    - ci/meta-zephyr.yml
-
-repos:
-  meta-zephyr:
-    layers:
-      meta-zephyr-bsp:
-
-local_conf_header:
-  tclibc: |
-    TCLIBC = "newlib"
-  nonbuilding_tests: |
-    ZEPHYRTESTS:remove = "context pending sleep"
-
-machine: qemu-cortex-m3
@@ -1,11 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-    - ci/meta-zephyr.yml
-
-local_conf_header:
-  nonbuilding_tests: |
-    ZEPHYRTESTS:remove = "common poll sleep queue device"
-
-machine: qemu-cortex-r5
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/generic-arm64.yml

@@ -10,5 +10,5 @@ local_conf_header:
 machine: qemu-generic-arm64

 target:
-  - core-image-base
+  - core-image-sato
  - sbsa-acs
@@ -0,0 +1,12 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarm-secureboot
+
+target:
+  - core-image-base
+  - optee-examples
+  - optee-test
+  - optee-os-tadevkit
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -0,0 +1,14 @@
+header:
+  version: 14
+  includes:
+    - ci/meta-openembedded.yml
+
+local_conf_header:
+  trusted_services: |
+    TEST_SUITES:append = " trusted_services"
+    # Include TS Crypto, TS Protected Storage, TS Internal Trusted Storage and SMM-Gateway SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its ts-smm-gateway"
+    # Include TS demo/test tools into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests"
+    # Include TS PSA Arch tests into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"
@@ -1,18 +1,12 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

 machine: qemuarm64-secureboot

-local_conf_header:
-  failing_tests: |
-    # software IO TLB: Cannot allocate buffer
-    DEFAULT_TEST_SUITES:remove = "parselogs"
-
 target:
  - core-image-base
  - optee-examples
  - optee-test
-  - optee-spdevkit
  - optee-os-tadevkit
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14

 local_conf_header:
  setup: |
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -1,9 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-
-machine: tc0
-
-target:
-  - tc-artifacts-image
@@ -1,9 +1,11 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml
+    - ci/fvp.yml
+    - ci/meta-openembedded.yml

 machine: tc1

 target:
-  - tc-artifacts-image
+  - core-image-minimal
@@ -1,8 +0,0 @@
-header:
-  version: 11
-
-local_conf_header:
-  testimage: |
-    IMAGE_CLASSES += "testimage"
-    TEST_TARGET = "QemuTargetZephyr"
-    TEST_SUITES = "zephyr"
@@ -1,13 +1,19 @@
 header:
-  version: 11
+  version: 14
+  includes:
+    - ci/debug.yml

 local_conf_header:
  testimage: |
    IMAGE_CLASSES += "testimage"
    TESTIMAGE_AUTO = "1"
+  kvm: |
+    QEMU_USE_KVM = ""
  slirp: |
    TEST_RUNQEMUPARAMS = "slirp"
-    TEST_SERVER_IP = "127.0.0.1"
-    QEMU_USE_SLIRP = "1"
  sshd: |
    IMAGE_FEATURES:append = " ssh-server-dropbear"
+  sshkeys: |
+    CORE_IMAGE_EXTRA_INSTALL += "ssh-pregen-hostkeys"
+  universally_failing_tests: |
+    TEST_SUITES:remove = "opkg"
@@ -0,0 +1,8 @@
+header:
+  version: 14
+
+local_conf_header:
+  tftf: |
+    TFA_UBOOT = "0"
+    TFA_UEFI = "0"
+    TFTF_TESTS = "1"
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/base.yml

@@ -11,11 +11,10 @@ local_conf_header:
  toolchains: |
    SDKMACHINE = "x86_64"

-# No target armcompiler as currently there is no arm64 build
 target:
-  - nativesdk-armcompiler
  - gcc-aarch64-none-elf
  - nativesdk-gcc-aarch64-none-elf
  - gcc-arm-none-eabi
  - nativesdk-gcc-arm-none-eabi
-  - nativesdk-androidclang
+  - gcc-arm-none-eabi-11.2
+  - nativesdk-gcc-arm-none-eabi-11.2
@@ -0,0 +1,8 @@
+header:
+  version: 14
+
+local_conf_header:
+  bootfirmware: |
+    PREFERRED_PROVIDER_virtual/bootloader = "u-boot"
+    TFA_UBOOT = "1"
+    TFA_UEFI = "0"
@@ -4,6 +4,7 @@

 import sys
 import os
+import shutil
 import subprocess
 import pathlib

@@ -22,7 +23,6 @@ repositories = (
    "https://git.yoctoproject.org/git/poky",
    "https://git.openembedded.org/meta-openembedded",
    "https://git.yoctoproject.org/git/meta-virtualization",
-    "https://git.yoctoproject.org/git/meta-zephyr",
    "https://github.com/kraj/meta-clang",
 )

@@ -32,12 +32,25 @@ if __name__ == "__main__":
        sys.exit(1)

    base_repodir = pathlib.Path(os.environ["KAS_REPO_REF_DIR"])
+    failed = False

    for repo in repositories:
        repodir = base_repodir / repo_shortname(repo)
+
+        if "CI_CLEAN_REPOS" in os.environ:
+            print("Cleaning %s..." % repo)
+            shutil.rmtree(repodir, ignore_errors=True)
+
        if repodir.exists():
-            print("Updating %s..." % repo)
-            subprocess.run(["git", "-C", repodir, "fetch"], check=True)
+            try:
+                print("Updating %s..." % repo)
+                subprocess.run(["git", "-C", repodir, "-c", "gc.autoDetach=false", "fetch"], check=True)
+            except subprocess.CalledProcessError as e:
+                print(e)
+                failed = True
        else:
            print("Cloning %s..." % repo)
            subprocess.run(["git", "clone", "--bare", repo, repodir], check=True)
+
+    if failed:
+        sys.exit(128)
@@ -1,5 +1,5 @@
 header:
-  version: 11
+  version: 14
  includes:
    - ci/meta-virtualization.yml

@@ -0,0 +1,49 @@
+# OEQA on Arm FVPs
+
+OE-Core's [oeqa][OEQA] framework provides a method of performing runtime tests on machines using the `testimage` Yocto task. meta-arm has good support for writing test cases against [Arm FVPs][FVP], meaning the [runfvp][RUNFVP] boot configuration can be re-used.
+
+Tests can be configured to run automatically post-build by setting the variable `TESTIMAGE_AUTO="1"`, e.g. in your Kas file or local.conf.
+
+meta-arm provides the OEFVPTarget which must be set up in the machine configuration:
+```
+TEST_TARGET = "OEFVPTarget"
+TEST_SERVER_IP = "127.0.0.1"
+TEST_TARGET_IP = "127.0.0.1:2222"
+IMAGE_FEATURES:append = " ssh-server-dropbear"
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "2222=22"
+FVP_CONSOLES[default] = "terminal_0"
+FVP_CONSOLES[tf-a] = "s_terminal_0"
+```
+
+The test target also generates a log file with the prefix 'fvp_log' in the image recipe's `${WORKDIR}/testimage` containing the FVP's stdout.
+
+OEFVPTarget supports two different test interfaces - SSH and pexpect.
+
+## SSH
+
+As in OEQA in OE-core, tests cases can run commands on the machine using SSH. It therefore requires that an SSH server is installed in the image.
+
+This uses the `run` method on the target, e.g:
+```
+(status, output) = self.target.run('uname -a')
+```
+which executes a single command on the target (using `ssh -c`) and returns the status code and the output. It is therefore useful for running tests in a Linux environment.
+
+For examples of test cases, see meta/lib/oeqa/runtime/cases in OE-Core. The majority of test cases depend on `ssh.SSHTest.test_ssh`, which first validates that the SSH connection is functioning.
+
+## pexpect
+
+To support firmware and baremetal testing, OEFVPTarget also allows test cases to make assertions against one or more consoles using the pexpect library.
+
+Internally, this test target launches a [Pexpect][PEXPECT] instance for each entry in FVP_CONSOLES which can be used with the provided alias. The whole Pexpect API is exposed on the target, where the alias is always passed as the first argument, e.g.:
+```
+self.target.expect('default', r'root@.*\:~#', timeout=30)
+self.assertNotIn(b'ERROR:', self.target.before('tf-a'))
+```
+
+For an example of a full test case, see meta-arm/lib/oeqa/runtime/cases/linuxboot.py This test case can be used to minimally verify that a machine boots to a Linux shell. The default timeout is 10 minutes, but this can be configured with the variable TEST_FVP_LINUX_BOOT_TIMEOUT, which expects a value in seconds.
+
+[OEQA]: https://docs.yoctoproject.org/test-manual/intro.html
+[FVP]: https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
+[RUNFVP]: runfvp.md
+[PEXPECT]: https://pexpect.readthedocs.io/en/stable/overview.html
@@ -55,7 +55,7 @@ The name of the FVP binary itself, for example `fvp-base` uses `FVP_Base_RevC-2x

 The name of the recipe that provides the FVP executable set in `FVP_EXE`, for example `fvp-base` uses `fvp-base-a-aem-native`.  This *must* be a `-native` recipe as the binary will be executed on the build host.

-There are recipes for common FVPs in meta-arm already, and writing new recipes is trivial.  For FVPs which are free to download `fvp-base-a-aem.bb` is a good example. Some FVPs must be downloaded separately as they need an account on Arm's website, `fvp-base-r-aem.bb` is a good example of those.
+There are recipes for common FVPs in meta-arm already, and writing new recipes is trivial.  For FVPs which are free to download `fvp-base-a-aem.bb` is a good example. Some FVPs must be downloaded separately as they need an account on Arm's website.

 If `FVP_PROVIDER` is not set then it is assumed that `FVP_EXE` is installed on the host already.

@@ -64,7 +64,7 @@ If `FVP_PROVIDER` is not set then it is assumed that `FVP_EXE` is installed on t
 Parameters passed to the FVP with the `--parameter`/`-C` option.  These are expressed as variable flags so individual parameters can be altered easily. For example:

 ```
-FVP_CONFIG[bp.flashloader0.fname] = "${DEPLOY_DIR_IMAGE}/fip-fvp.bin"
+FVP_CONFIG[bp.flashloader0.fname] = "fip-fvp.bin"
 ```

 ### `FVP_DATA`
@@ -72,8 +72,8 @@ FVP_CONFIG[bp.flashloader0.fname] = "${DEPLOY_DIR_IMAGE}/fip-fvp.bin"
 Specify raw data to load at the specified address, passed to the FVP with the `--data` option.  This is a space-separated list of parameters in the format `[INST=]FILE@[MEMSPACE:]ADDRESS`. For example:

 ```
-FVP_DATA = "cluster0.cpu0=${DEPLOY_DIR_IMAGE}/Image@0x80080000 \
-            cluster0.cpu0=${DEPLOY_DIR_IMAGE}/fvp-base-revc.dtb@0x83000000"
+FVP_DATA = "cluster0.cpu0=Image@0x80080000 \
+            cluster0.cpu0=fvp-base-revc.dtb@0x83000000"
 ```

 ### `FVP_APPLICATIONS`
@@ -81,7 +81,7 @@ FVP_DATA = "cluster0.cpu0=${DEPLOY_DIR_IMAGE}/Image@0x80080000 \
 Applications to load on the cores, passed to the FVP with the `--application` option.  These are expressed as variable flags with the flag name being the instance and flag value the filename, for example:

 ```
-FVP_APPLICATIONS[cluster0] = "${DEPLOY_DIR_IMAGE}/linux-system.axf"
+FVP_APPLICATIONS[cluster0] = "linux-system.axf"
 ```

 Note that symbols are not allowed in flag names, so if you need to use a wildcard in the instance then you'll need to use `FVP_EXTRA_ARGS` and `--application` directly.
@@ -98,13 +98,16 @@ FVP_TERMINALS[bp.terminal_2] = ""
 FVP_TERMINALS[bp.terminal_3] = ""
 ```

-### `FVP_CONSOLE`
+### `FVP_CONSOLES`

-This specifies what serial port is used when `--console` is passed to runfvp. Note that this has to be the FVP identifier but without the board prefix, for example:
+This specifies what serial ports can be used in oeqa tests, along with an alias to be used in the test cases. Note that the values have to be the FVP identifier but without the board prefix, for example:
 ```
-FVP_CONSOLE = "terminal_0"
+FVP_CONSOLES[default] = "terminal_0"
+FVP_CONSOLES[tf-a] = "s_terminal_0"
 ```

+The 'default' console is also used when `--console` is passed to runfvp.
+
 ### `FVP_EXTRA_ARGS`

 Arbitrary extra arguments that are passed directly to the FVP.  For example:
@@ -113,6 +116,14 @@ Arbitrary extra arguments that are passed directly to the FVP.  For example:
 FVP_EXTRA_ARGS = "--simlimit 60"
 ```

+### `FVP_ENV_PASSTHROUGH`
+
+The FVP is launched with an isolated set of environment variables. Add the name of a Bitbake variable to this list to pass it through to the FVP environment. For example:
+
+```
+FVP_ENV_PASSTHROUGH = "ARMLMD_LICENSE_FILE FM_TRACE_PLUGINS"
+```
+

 [AEM]: https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms/arm-ecosystem-models
 [FVP]: https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
@@ -0,0 +1,65 @@
+# The Trusted Services: framework for developing root-of-trust services
+
+meta-arm layer includes recipes for [Trusted Services][^1] Secure Partitions and Normal World applications
+in `meta-arm/recipes-security/trusted-services`
+
+## Secure Partitions recipes
+
+We define dedicated recipes for all supported Trusted Services (TS) Secure Partitions.
+These recipes produce ELF and DTB files for SPs.
+These files are automatically included into optee-os image accordingly to defined MACHINE_FEATURES.
+
+### How to include TS SPs
+
+To include TS SPs into optee-os image you need to add into MACHINE_FEATURES
+features for each [Secure Partition][^2] you would like to include:
+
+| Secure Partition  | MACHINE_FEATURE |
+| ----------------- | --------------- |
+| Attestation       | ts-attesation   |
+| Crypto            | ts-crypto       |
+| Internal Storage  | ts-its          |
+| Protected Storage | ts-storage      |
+| se-proxy          | ts-se-proxy     |
+| smm-gateway       | ts-smm-gateway  |
+| spm-test[1-3]     | optee-spmc-test |
+
+Other steps depend on your machine/platform definition:
+
+1. For communications between Secure and Normal Words Linux kernel option `CONFIG_ARM_FFA_TRANSPORT=y`
+   is required. If your platform doesn't include it already you can add `arm-ffa` into MACHINE_FEATURES.
+   (Please see ` meta-arm/recipes-kernel/arm-ffa-tee`.)
+
+   For running the `uefi-test` or the `xtest -t ffa_spmc` tests under Linux the `arm-ffa-user` drivel is required. This is
+   enabled if the `ts-smm-gateway` and/or the `optee-spmc-test` machine features are enabled.
+   (Please see ` meta-arm/recipes-kernel/arm-ffa-user`.)
+
+2. optee-os might require platform specific OP-TEE build parameters (for example what SEL the SPM Core is implemented at).
+   You can find examples in `meta-arm/recipes-security/optee/optee-os_%.bbappend` for qemuarm64-secureboot machine
+   and in `meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc` and `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc`
+   for N1SDP and Corstone1000 platforms accordingly.
+
+3. trusted-firmware-a might require platform specific TF-A build parameters (SPD and SPMC details on the platform).
+   See `meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend` for qemuarm64-secureboot machine
+   and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-n1sdp.inc` and
+   `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for N1SDP and Corstone1000 platforms.
+
+## Normal World applications
+
+Optionally for testing purposes you can add `packagegroup-ts-tests` into your image. It includes 
+[Trusted Services test and demo tools][^3] and [xtest][^4] configured to include the `ffa_spmc` tests.
+
+## OEQA Trusted Services tests
+
+  meta-arm also includes Trusted Service OEQA tests which can be used for automated testing.
+See `ci/trusted-services.yml` for an example how to include them into an image.
+
+
+------
+[^1]: https://trusted-services.readthedocs.io/en/integration/overview/index.html
+
+[^2]: https://trusted-services.readthedocs.io/en/integration/deployments/secure-partitions.html
+
+[^3]: https://trusted-services.readthedocs.io/en/integration/deployments/test-executables.html
+
+[^4]: https://optee.readthedocs.io/en/latest/building/gits/optee_test.html
@@ -0,0 +1,12 @@
+header:
+  version: 13
+
+repos:
+  meta-arm:
+    layers:
+      meta-arm-systemready:
+
+distro: nodistro
+
+target:
+  - arm-systemready-firmware
@@ -0,0 +1,17 @@
+header:
+  version: 13
+  includes:
+    - kas/arm-systemready-firmware.yml
+
+env:
+  TESTIMAGE_AUTO: "1"
+  # The full testimage run typically takes around 12-24h on fvp-base.
+  TEST_OVERALL_TIMEOUT: "${@ 24*60*60}"
+
+local_conf_header:
+  systemready-ir-acs: |
+    IMAGE_CLASSES:append = " testimage"
+
+
+target:
+  - arm-systemready-ir-acs
@@ -0,0 +1,7 @@
+header:
+  version: 13
+  includes:
+    - kas/arm-systemready-firmware.yml
+
+target:
+  - arm-systemready-linux-distros-debian
@@ -0,0 +1,7 @@
+header:
+  version: 13
+  includes:
+    - kas/arm-systemready-firmware.yml
+
+target:
+  - arm-systemready-linux-distros-opensuse
@@ -1,6 +1,9 @@
 header:
  version: 11

+env:
+  DISPLAY: ""
+
 distro: poky-tiny

 defaults:
@@ -16,7 +19,7 @@ repos:

  poky:
    url: https://git.yoctoproject.org/git/poky
-    refspec: master
+    refspec: 31dd418207f6c95ef0aad589cd03cd2a4c9a8bf2
    layers:
      meta:
      meta-poky:
@@ -24,20 +27,22 @@ repos:

  meta-openembedded:
    url: https://git.openembedded.org/meta-openembedded
-    refspec: master
+    refspec: 5a01ab461c9bcabcbb2298236602373948f8f073
    layers:
      meta-oe:
      meta-python:

-  meta-arm-image:
-     url: https://git.gitlab.arm.com/arm-reference-solutions/meta-arm-image.git
-     refspec: 9f611833ef58394b707836d69356c4e27d0265fc 
+  meta-secure-core:
+    url: https://github.com/wind-river/meta-secure-core.git
+    layers:
+      meta:
+      meta-signing-key:
+      meta-efi-secure-boot:

 local_conf_header:
  base: |
    CONF_VERSION = "2"
    PACKAGE_CLASSES = "package_ipk"
-    LICENSE_FLAGS_ACCEPTED += "armcompiler"
    BB_NUMBER_THREADS ?= "16"
    PARALLEL_MAKE ?= "-j16"
    PACKAGECONFIG:append:pn-perf = " coresight"
@@ -2,13 +2,7 @@ header:
  version: 11
  includes:
    - kas/corstone1000-base.yml
-
-repos:
-  run-scripts:
-     url: https://git.gitlab.arm.com/arm-reference-solutions/model-scripts.git
-     refspec: b40b4227fe6b6fc8e4b688db8928f4be76e94eb7
-     layers:
-      .: 'excluded'
+    - kas/fvp-eula.yml

 machine: corstone1000-fvp

@@ -16,8 +10,7 @@ local_conf_header:
    fvp-config: |
        # Remove Dropbear SSH as it will not fit into the corstone1000 image.
        IMAGE_FEATURES:remove = " ssh-server-dropbear"
-        INHERIT = " ${@bb.utils.contains('BUILD_ARCH', 'x86_64', 'fvpboot', '', d)}"
-        LICENSE_FLAGS_ACCEPTED:append = " Arm-FVP-EULA"
+        INHERIT += "fvpboot"

 target:
  - corstone1000-image
@@ -1,47 +0,0 @@
-header:
-  version: 11
-
-distro: poky-tiny
-
-defaults:
-  repos:
-    refspec: master
-
-repos:
-  meta-arm:
-    layers:
-      meta-arm:
-      meta-arm-bsp:
-      meta-arm-toolchain:
-
-  poky:
-    url: https://git.yoctoproject.org/git/poky
-    refspec: master
-    layers:
-      meta:
-      meta-poky:
-      meta-yocto-bsp:
-
-  meta-openembedded:
-    url: https://git.openembedded.org/meta-openembedded
-    refspec: master
-    layers:
-      meta-oe:
-      meta-python:
-
-local_conf_header:
-  base: |
-    CONF_VERSION = "2"
-    PACKAGE_CLASSES = "package_ipk"
-    LICENSE_FLAGS_ACCEPTED += "armcompiler"
-    BB_NUMBER_THREADS ?= "16"
-    PARALLEL_MAKE ?= "-j16"
-    PACKAGECONFIG:append:pn-perf = " coresight"
-  fvp-config: |
-    IMAGE_CLASSES:append = " ${@bb.utils.contains('BUILD_ARCH', 'x86_64', 'fvpboot', '', d)}"
-    LICENSE_FLAGS_ACCEPTED:append = " Arm-FVP-EULA"
-
-machine: corstone500
-
-target:
-  - core-image-minimal
@@ -1,8 +1,16 @@
 header:
-  version: 9
+  version: 13
+  includes:
+    - kas/fvp-eula.yml
+
+env:
+  DISPLAY:
+  WAYLAND_DISPLAY:
+  XAUTHORITY:
+

 distro: poky
-machine: fvp-baser-aemv8r64
+machine: fvp-base

 defaults:
  repos:
@@ -10,8 +18,6 @@ defaults:

 repos:
  meta-arm:
-    url: https://git.yoctoproject.org/git/meta-arm
-    path: layers/meta-arm
    layers:
      meta-arm:
      meta-arm-bsp:
@@ -24,9 +30,6 @@ repos:
      meta:
      meta-poky:

-env:
-  FVP_BASE_R_ARM_EULA_ACCEPT: "False"
-
 local_conf_header:
  base: |
    CONF_VERSION = "2"
@@ -34,8 +37,7 @@ local_conf_header:
    PACKAGECONFIG:remove:pn-qemu-system-native = "gtk+ sdl"
    EXTRA_IMAGE_FEATURES:append = " debug-tweaks ssh-server-openssh"
    CORE_IMAGE_EXTRA_INSTALL:append = " ssh-pregen-hostkeys"
-    LICENSE_FLAGS_ACCEPTED:append = " ${@oe.utils.vartrue('FVP_BASE_R_ARM_EULA_ACCEPT', 'Arm-FVP-EULA', '', d)}"
-    IMAGE_CLASSES:append = " testimage"
+    IMAGE_CLASSES:append = " testimage fvpboot"

 target:
  - core-image-minimal
@@ -0,0 +1,5 @@
+header:
+  version: 13
+
+env:
+  ARM_FVP_EULA_ACCEPT:
@@ -0,0 +1,7 @@
+header:
+  version: 9
+
+local_conf_header:
+  tftf: |
+    TFA_UBOOT = "0"
+    TFTF_TESTS = "1"
@@ -1,23 +0,0 @@
-meta-arm-autonomy Yocto Layer
-=============================
-
-The meta-arm-autonomy layer is being deprecated from master, with bug fixes
-only being applied to the following branches. Additionally, all support and
-maintenance of meta-arm-autonomy will stop as per the schedule below.
-
-    honister: End-of-life scheduled to June 2022
-    hardknot: End-of-life scheduled to December 2021
-    gatesgarth: End-of-life scheduled to October 2021
-    dunfell: End-of-life scheduled to October 2021
-    master: End-of-life scheduled to October 2021 and code removed
-
-
-Contributing
------------
-This project has not put in place a process for contributions currently. If you
-would like to contribute, please contact the maintainers
-
-
-Maintainer(s)
-------------
-* Diego Sueiro <diego.sueiro@arm.com>
@@ -9,13 +9,18 @@ BBFILE_COLLECTIONS += "meta-arm-bsp"
 BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-arm-bsp = "5"

-LAYERSERIES_COMPAT_meta-arm-bsp = "kirkstone"
+LAYERSERIES_COMPAT_meta-arm-bsp = "nanbield"

 LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
 # This won't be used by layerindex-fetch, but works everywhere else
-LAYERDEPENDS_meta-arm-bsp:append:corstone1000 = " meta-python openembedded-layer"
+LAYERDEPENDS_meta-arm-bsp:append:corstone1000 = " meta-python openembedded-layer efi-secure-boot"
 LAYERDEPENDS_meta-arm-bsp:append:musca-b1 = " meta-python"
 LAYERDEPENDS_meta-arm-bsp:append:musca-s1 = " meta-python"

 # Additional license directories.
 LICENSE_PATH += "${LAYERDIR}/custom-licenses"
+
+BBFILES_DYNAMIC += " \
+    meta-arm-systemready:${LAYERDIR}/dynamic-layers/meta-arm-systemready/*/*/*.bb \
+    meta-arm-systemready:${LAYERDIR}/dynamic-layers/meta-arm-systemready/*/*/*.bbappend \
+"
@@ -9,7 +9,7 @@ TFM_PLATFORM_IS_FVP = "TRUE"

 # testimage config
 TEST_TARGET = "OEFVPTarget"
-TEST_SUITES = "noop"
+TEST_SUITES = "fvp_boot"

 # FVP Config
 FVP_PROVIDER ?= "fvp-corstone1000-native"
@@ -17,21 +17,25 @@ FVP_EXE ?= "FVP_Corstone-1000"
 FVP_CONSOLE ?= "host_terminal_0"

 # FVP Parameters
-FVP_CONFIG[se.trustedBootROMloader.fname] ?= "${DEPLOY_DIR_IMAGE}/bl1.bin"
+FVP_CONFIG[se.trustedBootROMloader.fname] ?= "bl1.bin"
 FVP_CONFIG[board.xnvm_size] ?= "64"
 FVP_CONFIG[se.trustedSRAM_config] ?= "6"
 FVP_CONFIG[se.BootROM_config] ?= "3"
 FVP_CONFIG[board.hostbridge.interfaceName] ?= "tap0"
 FVP_CONFIG[board.smsc_91c111.enabled] ?= "1"
 FVP_CONFIG[board.hostbridge.userNetworking] ?= "true"
-FVP_CONFIG[board.hostbridge.userNetPorts] ?= "5555=5555,8080=80,8022=22"
+FVP_CONFIG[board.hostbridge.userNetPorts] ?= "5555=5555,8080=80,2222=22"
 FVP_CONFIG[board.se_flash_size] ?= "8192"
 FVP_CONFIG[diagnostics] ?= "4"
 FVP_CONFIG[disable_visualisation] ?= "true"
 FVP_CONFIG[se.nvm.update_raw_image] ?= "0"
+FVP_CONFIG[se.cryptocell.USER_OTP_FILTERING_DISABLE] ?= "1"

 # Boot image
-FVP_DATA ?= "board.flash0=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic.nopt@0x68100000"
+FVP_DATA ?= "board.flash0=${IMAGE_NAME}.wic@0x68000000"
+
+# External system (cortex-M3)
+FVP_CONFIG[extsys_harness0.extsys_flashloader.fname] ?= "es_flashfw.bin"

 # FVP Terminals
 FVP_TERMINALS[host.host_terminal_0] ?= "Normal World Console"
@@ -39,3 +43,16 @@ FVP_TERMINALS[host.host_terminal_1] ?= "Secure World Console"
 FVP_TERMINALS[se.secenc_terminal] ?= "Secure Enclave Console"
 FVP_TERMINALS[extsys0.extsys_terminal] ?= "Cortex M3"

+# MMC card configuration
+FVP_CONFIG[board.msd_mmc.card_type] ?= "SDHC"
+FVP_CONFIG[board.msd_mmc.p_fast_access] ?= "0"
+FVP_CONFIG[board.msd_mmc.diagnostics] ?= "2"
+FVP_CONFIG[board.msd_mmc.p_max_block_count] ?= "0xFFFF"
+FVP_CONFIG[board.msd_config.pl180_fifo_depth] ?= "16"
+
+# MMC2 card configuration
+FVP_CONFIG[board.msd_mmc_2.card_type] ?= "SDHC"
+FVP_CONFIG[board.msd_mmc_2.p_fast_access] ?= "0"
+FVP_CONFIG[board.msd_mmc_2.diagnostics] ?= "2"
+FVP_CONFIG[board.msd_mmc_2.p_max_block_count] ?= "0xFFFF"
+FVP_CONFIG[board.msd_config_2.pl180_fifo_depth] ?= "16"
@@ -1,45 +0,0 @@
-#@TYPE: Machine
-#@NAME: Corstone-500 machine
-#@DESCRIPTION: Machine configuration for the Corstone-500 platform
-
-require conf/machine/include/arm/armv7a/tune-cortexa5.inc
-
-# Corstone-500 is built against poky-tiny distro.
-# poky-tiny sets PREFERRED_PROVIDER_virtual/kernel to linux-yocto-tiny.
-# Since distro config is evaluated after the machine config, we need to
-# use the strongest override possible (forcevariable) so the
-# PREFERRED_PROVIDER_virtual/kernel specified in the machine config will
-# apply.
-#
-PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.15%"
-
-EXTRA_IMAGEDEPENDS += "trusted-firmware-a u-boot"
-
-IMAGE_CLASSES += "wic_nopt"
-IMAGE_FEATURES += "debug-tweaks"
-IMAGE_FSTYPES:forcevariable = "cpio.gz squashfs wic wic.nopt"
-
-SERIAL_CONSOLES = "115200;ttyAMA0"
-
-# Corstone-500 u-boot configuration
-UBOOT_MACHINE = "corstone500_defconfig"
-UBOOT_IMAGE_ENTRYPOINT = "0x84000000"
-UBOOT_IMAGE_LOADADDRESS = "0x84000000"
-PREFERRED_VERSION_u-boot ?= "2022.01"
-
-# making sure EXTRA_IMAGEDEPENDS will be used while creating the image
-WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
-
-WKS_FILE ?= "core-image-minimal.corstone500.wks"
-
-TEST_TARGET = "OEFVPTarget"
-TEST_SUITES = "noop"
-
-FVP_PROVIDER ?= "fvp-corstone500-native"
-FVP_EXE ?= "FVP_Corstone-500"
-FVP_CONFIG[board.flashloader0.fname] ?= "${DEPLOY_DIR_IMAGE}/bl1.bin"
-FVP_DATA ?= "css.cluster.cpu0=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic.nopt@0x80000000"
-FVP_CONSOLE ?= "terminal_0"
-FVP_TERMINALS[css.terminal_0] ?= "console"
-FVP_TERMINALS[css.terminal_1] ?= ""
@@ -1,23 +0,0 @@
-# Configuration for Armv7-A Base Platform FVP
-
-#@TYPE: Machine
-#@NAME: Armv7-A Base Platform FVP machine
-#@DESCRIPTION: Machine configuration for Armv7-A Base Platform FVP model
-
-require conf/machine/fvp-common.inc
-require conf/machine/include/arm/arch-armv7a.inc
-
-# FVP u-boot configuration
-PREFERRED_VERSION_u-boot ?= "2021.10"
-UBOOT_MACHINE = "vexpress_aemv8a_aarch32_defconfig"
-
-KERNEL_IMAGETYPE = "zImage"
-
-FVP_CONFIG[cluster0.cpu0.CONFIG64] = "0"
-FVP_CONFIG[cluster0.cpu1.CONFIG64] = "0"
-FVP_CONFIG[cluster0.cpu2.CONFIG64] = "0"
-FVP_CONFIG[cluster0.cpu3.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu0.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu1.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu2.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu3.CONFIG64] = "0"
@@ -4,12 +4,59 @@
 #@NAME: Armv8-A Base Platform FVP machine
 #@DESCRIPTION: Machine configuration for Armv8-A Base Platform FVP model

-require conf/machine/fvp-common.inc
 require conf/machine/include/arm/arch-armv8a.inc

 TUNE_FEATURES = "aarch64"

-# FVP u-boot configuration
-UBOOT_MACHINE = "vexpress_aemv8a_semi_defconfig"
+ARM_SYSTEMREADY_FIRMWARE = "trusted-firmware-a:do_deploy"
+ARM_SYSTEMREADY_ACS_CONSOLE = "default"
+EXTRA_IMAGEDEPENDS = "${ARM_SYSTEMREADY_FIRMWARE}"

+MACHINE_FEATURES = "efi"
+
+IMAGE_NAME_SUFFIX = ""
+IMAGE_FSTYPES += "wic"
+WKS_FILE ?= "efi-disk.wks.in"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+KERNEL_DEVICETREE = "arm/fvp-base-revc.dtb"
 KERNEL_IMAGETYPE = "Image"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+
+# FVP u-boot configuration
+UBOOT_MACHINE = "vexpress_fvp_defconfig"
+
+EFI_PROVIDER ?= "grub-efi"
+
+# As this is a virtual target that will not be used in the real world there is
+# no need for real SSH keys.
+MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"
+
+TEST_TARGET = "OEFVPTarget"
+TEST_TARGET_IP = "127.0.0.1:2222"
+DEFAULT_TEST_SUITES:append = " fvp_boot fvp_devices"
+TEST_FVP_DEVICES ?= "rtc watchdog networking virtiorng cpu_hotplug"
+
+FVP_PROVIDER ?= "fvp-base-a-aem-native"
+FVP_EXE ?= "FVP_Base_RevC-2xAEMvA"
+FVP_CONFIG[bp.ve_sysregs.exit_on_shutdown] ?= "1"
+FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
+# Tell testimage to connect to localhost:2222, and forward that to SSH in the FVP.
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] = "2222=22"
+FVP_CONFIG[bp.virtio_rng.enabled] ?= "1"
+FVP_CONFIG[cache_state_modelled] ?= "0"
+FVP_CONFIG[bp.secureflashloader.fname] ?= "bl1-fvp.bin"
+FVP_CONFIG[bp.flashloader0.fname] ?= "fip-fvp.bin"
+FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${IMAGE_NAME}.wic"
+# Set the baseline to ARMv8.4, as the default is 8.0.
+FVP_CONFIG[cluster0.has_arm_v8-4] = "1"
+FVP_CONFIG[cluster1.has_arm_v8-4] = "1"
+FVP_CONSOLES[default] = "terminal_0"
+FVP_TERMINALS[bp.terminal_0] ?= "Console"
+FVP_TERMINALS[bp.terminal_1] ?= ""
+FVP_TERMINALS[bp.terminal_2] ?= ""
+FVP_TERMINALS[bp.terminal_3] ?= ""
@@ -1,74 +0,0 @@
-# Configuration for Fixed Virtual Platform BaseR AEMv8r64 Machine
-
-#@TYPE: Machine
-#@NAME: FVP BaseR AEMv8r64 Machine
-#@DESCRIPTION: Machine configuration for FVP BaseR AEMv8r64
-
-require conf/machine/include/arm/armv8r/arch-armv8r64.inc
-
-EXTRA_IMAGEDEPENDS += "boot-wrapper-aarch64"
-
-PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.15%"
-PREFERRED_VERSION_linux-yocto-rt ?= "5.15%"
-
-KERNEL_IMAGETYPE = "Image"
-KERNEL_DEVICETREE = "arm/fvp-baser-aemv8r64.dtb"
-
-UBOOT_MACHINE ?= "vexpress_aemv8r_defconfig"
-
-SERIAL_CONSOLES = "115200;ttyAMA0"
-
-IMAGE_CLASSES:append = " fvpboot"
-IMAGE_FSTYPES += "wic"
-WKS_FILE ?= "efi-disk.wks.in"
-EFI_PROVIDER ?= "grub-efi"
-MACHINE_FEATURES:append = " efi"
-
-# As this is a virtual target that will not be used in the real world there is
-# no need for real SSH keys.  Disable rng-tools (which takes too long to
-# initialise) and install the pre-generated keys.
-PACKAGECONFIG:remove:pn-openssh = "rng-tools"
-MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"
-
-# testimage configuration
-TEST_TARGET = "OEFVPTarget"
-TEST_SUITES = "ping ssh"
-TEST_TARGET_IP ?= "127.0.0.1:8022"
-TEST_SERVER_IP ?= "127.0.1.1"
-
-FVP_EXTRA_ARGS = "-a cluster0*=${DEPLOY_DIR_IMAGE}/linux-system.axf"
-FVP_PROVIDER ?= "fvp-base-r-aem-native"
-FVP_EXE ?= "FVP_BaseR_AEMv8R"
-FVP_CONSOLE ?= "terminal_0"
-
-# FVP parameters
-FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic"
-FVP_CONFIG[bp.dram_metadata.init_value] ?= "0"
-FVP_CONFIG[bp.dram_metadata.is_enabled] ?= "true"
-FVP_CONFIG[bp.exclusive_monitor.monitor_access_level] ?= "1"
-FVP_CONFIG[bp.pl011_uart0.unbuffered_output] ?= "1"
-FVP_CONFIG[bp.pl011_uart0.untimed_fifos] ?= "true"
-FVP_CONFIG[bp.refcounter.non_arch_start_at_default] ?= "1"
-FVP_CONFIG[bp.smsc_91c111.enabled] ?= "0"
-FVP_CONFIG[bp.ve_sysregs.mmbSiteDefault] ?= "0"
-FVP_CONFIG[cache_state_modelled] ?= "0"
-FVP_CONFIG[cluster0.gicv3.cpuintf-mmap-access-level] ?= "2"
-FVP_CONFIG[cluster0.gicv3.SRE-enable-action-on-mmap] ?= "2"
-FVP_CONFIG[cluster0.gicv3.SRE-EL2-enable-RAO] ?= "1"
-FVP_CONFIG[cluster0.gicv3.extended-interrupt-range-support] ?= "1"
-FVP_CONFIG[cluster0.has_aarch64] ?= "1"
-FVP_CONFIG[cluster0.NUM_CORES] ?= "4"
-FVP_CONFIG[cluster0.stage12_tlb_size] ?= "512"
-FVP_CONFIG[gic_distributor.GICD_CTLR-DS-1-means-secure-only] ?= "1"
-FVP_CONFIG[gic_distributor.GITS_BASER0-type] ?= "1"
-FVP_CONFIG[gic_distributor.ITS-count] ?= "1"
-FVP_CONFIG[gic_distributor.ITS-hardware-collection-count] ?= "1"
-FVP_CONFIG[gic_distributor.has-two-security-states] ?= "0"
-FVP_CONFIG[pctl.startup] ?= "0.0.0.*"
-FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
-FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
-FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
-FVP_CONFIG[bp.virtio_rng.enabled] ?= "1"
-FVP_CONFIG[bp.vis.rate_limit-enable] ?= "0"
-FVP_CONFIG[bp.refcounter.use_real_time] ?= "1"
@@ -1,47 +0,0 @@
-# FVP common parameters
-
-#
-# Capturing FVP common configurations (Armv8-A Base Platform FVP,
-# Armv8-A Foundation Platform and Armv7-A Base Platform FVP).
-#
-
-MACHINE_FEATURES = "optee"
-
-IMAGE_FSTYPES += "wic"
-WKS_FILE ?= "fvp-base.wks"
-
-SERIAL_CONSOLES = "115200;ttyAMA0"
-
-PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-
-KERNEL_DEVICETREE = "arm/fvp-base-revc.dtb"
-
-EXTRA_IMAGEDEPENDS += "trusted-firmware-a u-boot"
-
-# As this is a virtual target that will not be used in the real world there is
-# no need for real SSH keys.  Disable rng-tools (which takes too long to
-# initialise) and install the pre-generated keys.
-PACKAGECONFIG:remove:pn-openssh = "rng-tools"
-MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"
-
-TEST_TARGET = "OEFVPTarget"
-
-FVP_PROVIDER ?= "fvp-base-a-aem-native"
-FVP_EXE ?= "FVP_Base_RevC-2xAEMvA"
-FVP_CONFIG[bp.ve_sysregs.exit_on_shutdown] ?= "1"
-FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
-FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
-FVP_CONFIG[cache_state_modelled] ?= "0"
-FVP_CONFIG[bp.secureflashloader.fname] ?= "${DEPLOY_DIR_IMAGE}/bl1-fvp.bin"
-FVP_CONFIG[bp.flashloader0.fname] ?= "${DEPLOY_DIR_IMAGE}/fip-fvp.bin"
-FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic"
-# Set the baseline to ARMv8.4, as the default is 8.0.
-FVP_CONFIG[cluster0.has_arm_v8-4] = "1"
-FVP_CONFIG[cluster1.has_arm_v8-4] = "1"
-FVP_CONSOLE ?= "terminal_0"
-FVP_DATA ?= "cluster0.cpu0=${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE}@0x80080000 \
-             cluster0.cpu0=${DEPLOY_DIR_IMAGE}/fvp-base-revc.dtb@0x83000000"
-FVP_TERMINALS[bp.terminal_0] ?= "Console"
-FVP_TERMINALS[bp.terminal_1] ?= ""
-FVP_TERMINALS[bp.terminal_2] ?= ""
-FVP_TERMINALS[bp.terminal_3] ?= ""
@@ -1,10 +0,0 @@
-require conf/machine/include/arm/arch-armv8r.inc
-
-TUNE_FEATURES:tune-armv8r            =+ "aarch64"
-PACKAGE_EXTRA_ARCHS:tune-armv8r      =+ "aarch64"
-BASE_LIB:tune-armv8r                 = "lib64"
-BASE_LIB:tune-armv8r-crc             = "lib64"
-BASE_LIB:tune-armv8r-crypto          = "lib64"
-BASE_LIB:tune-armv8r-simd            = "lib64"
-BASE_LIB:tune-armv8r-crc-simd        = "lib64"
-BASE_LIB:tune-armv8r-crc-crypto-simd = "lib64"
@@ -5,13 +5,13 @@ MACHINEOVERRIDES =. "corstone1000:"
 # TF-A
 TFA_PLATFORM = "corstone1000"
 EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+PREFERRED_VERSION_trusted-firmware-a ?= "2.9.%"
+PREFERRED_VERSION_tf-a-tests ?= "2.8.%"

 TFA_BL2_BINARY = "bl2-corstone1000.bin"
 TFA_FIP_BINARY = "fip-corstone1000.bin"

 # TF-M
-PREFERRED_VERSION_trusted-firmware-m ?= "1.5%"
-TFM_PLATFORM = "arm/corstone1000"
 EXTRA_IMAGEDEPENDS += "virtual/trusted-firmware-m"

 # TF-M settings for signing host images
@@ -20,11 +20,11 @@ TFA_BL2_RE_SIGN_BIN_SIZE = "0x2d000"
 TFA_FIP_RE_IMAGE_LOAD_ADDRESS = "0x68130000"
 TFA_FIP_RE_SIGN_BIN_SIZE = "0x00200000"
 RE_LAYOUT_WRAPPER_VERSION = "0.0.7"
-TFM_SIGN_PRIVATE_KEY = "${S}/bl2/ext/mcuboot/root-RSA-3072_1.pem"
+TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
 RE_IMAGE_OFFSET = "0x1000"

 # u-boot
-PREFERRED_VERSION_u-boot ?= "2022.01"
+PREFERRED_VERSION_u-boot ?= "2023.07%"
 EXTRA_IMAGEDEPENDS += "u-boot"

 UBOOT_CONFIG ??= "EFI"
@@ -35,25 +35,37 @@ UBOOT_BOOTARGS = "earlycon=pl011,0x1a510000 console=ttyAMA0 loglevel=9"
 UBOOT_ARCH = "arm"
 UBOOT_EXTLINUX = "0"

-# optee
-PREFERRED_VERSION_optee-os ?= "3.14%"
-PREFERRED_VERSION_optee-client ?= "3.14%"
+#optee
+PREFERRED_VERSION_optee-os ?= "3.22%"
+PREFERRED_VERSION_optee-client ?= "3.22%"
 EXTRA_IMAGEDEPENDS += "optee-os"
 OPTEE_ARCH = "arm64"
 OPTEE_BINARY = "tee-pager_v2.bin"

-# Trusted Services(TS)
-EXTRA_IMAGEDEPENDS += "secure-partitions"
+# Include smm-gateway and se-proxy SPs into optee-os binary
+MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
+TS_PLATFORM = "arm/corstone1000"
+TS_SP_SE_PROXY_CONFIG = "corstone1000"
+
+# External System(Cortex-M3)
+EXTRA_IMAGEDEPENDS += "external-system"

 # Linux kernel
 PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto = "5.15%"
-KERNEL_IMAGETYPE = "Image"
+PREFERRED_VERSION_linux-yocto = "6.5%"
+KERNEL_IMAGETYPE = "Image.gz"

 INITRAMFS_IMAGE_BUNDLE ?= "1"

 #telling the build system which image is responsible of the generation of the initramfs rootfs
 INITRAMFS_IMAGE = "corstone1000-initramfs-image"
+IMAGE_NAME_SUFFIX = ""
+
+# add FF-A support in the kernel
+MACHINE_FEATURES += "arm-ffa"
+
+# prevent the kernel image from being included in the intramfs rootfs
+PACKAGE_EXCLUDE = "kernel-image-*"

 # enable this feature for kernel debugging
 # MACHINE_FEATURES += "corstone1000_kernel_debug"
@@ -66,3 +78,5 @@ WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"

 WKS_FILE ?= "corstone1000-image.corstone1000.wks"

+# Disable openssl in kmod to shink the initramfs size
+PACKAGECONFIG:remove:pn-kmod = "openssl"
@@ -6,24 +6,17 @@ MACHINEOVERRIDES =. "tc:"

 # Das U-boot
 UBOOT_MACHINE ?= "total_compute_defconfig"
-PREFERRED_VERSION_u-boot ?= "2021.10"
 UBOOT_RD_LOADADDRESS = "0x88000000"
 UBOOT_RD_ENTRYPOINT = "0x88000000"
 UBOOT_LOADADDRESS = "0x80080000"
 UBOOT_ENTRYPOINT = "0x80080000"
-# Below options will generate a key to sign the kernel Image and INITRAMFS_IMAGE
-# according to the default parameters of kernel-fitimage.bbclass. If the user
-# would prefer to use their own keys, disable the key generation using the
-# FIT_GENERATE_KEYS parameter and specify the location of the keys using the
-# below paramters.
-UBOOT_SIGN_ENABLE = "1"
-UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb"
-UBOOT_SIGN_KEYNAME = "dev_key"
-UBOOT_SIGN_KEYDIR = "${DEPLOY_DIR_IMAGE}/keys"
-FIT_GENERATE_KEYS = "1"

-PREFERRED_PROVIDER_virtual/kernel ?= "linux-arm64-ack"
-PREFERRED_VERSION_linux-arm64-ack ?= "5.10"
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+
+# OP-TEE
+PREFERRED_VERSION_optee-os ?= "3.20%"
+PREFERRED_VERSION_optee-client ?= "3.20%"
+PREFERRED_VERSION_optee-test ?= "3.20%"

 # Cannot use the default zImage on arm64
 KERNEL_IMAGETYPE = "Image"
@@ -32,5 +25,12 @@ KERNEL_CLASSES = " kernel-fitimage "

 IMAGE_FSTYPES += "cpio.gz"
 INITRAMFS_IMAGE ?= "core-image-minimal"
+IMAGE_NAME_SUFFIX = ""

 SERIAL_CONSOLES = "115200;ttyAMA0"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a optee-os"
+PREFERRED_VERSION_trusted-firmware-a ?= "2.8.%"
+# FIXME - there is signed image dependency/race with testimage.
+# This should be fixed in oe-core
+TESTIMAGEDEPENDS:append = " virtual/kernel:do_deploy"
@@ -10,18 +10,21 @@ require conf/machine/include/arm/arch-armv8a.inc

 MACHINE_FEATURES = "usbhost usbgadget alsa screen wifi bluetooth optee pci"

-KERNEL_IMAGETYPE = "Image"
+KERNEL_IMAGETYPE = "Image.gz"
 KERNEL_DEVICETREE = "arm/juno.dtb arm/juno-r1.dtb arm/juno-r2.dtb"

-IMAGE_FSTYPES += "tar.bz2 ext4"
+IMAGE_FSTYPES += "tar.bz2 ext4 cpio.gz"

 SERIAL_CONSOLES = "115200;ttyAMA0"

 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_u-boot ?= "2020.07"
 PREFERRED_PROVIDER_virtual/bootloader ?= "u-boot"

 EXTRA_IMAGEDEPENDS += "trusted-firmware-a virtual/bootloader firmware-image-juno"

 # Juno u-boot configuration
 UBOOT_MACHINE = "vexpress_aemv8a_juno_defconfig"
+
+INITRAMFS_IMAGE_BUNDLE ?= "1"
+INITRAMFS_IMAGE = "core-image-minimal"
+IMAGE_NAME_SUFFIX = ""
@@ -16,13 +16,8 @@ IMAGE_CLASSES += "qemuboot"
 QB_SYSTEM_NAME = "qemu-system-arm"
 QB_MACHINE = "-machine musca-b1"
 QB_CPU = "-cpu cortex-m33"
-QB_OPT_APPEND = "-nographic -vga none"
+QB_GRAPHICS = "-nographic -vga none"
 QB_MEM = "512k"
 QB_RNG = ""

-# Zephyr RTOS settings
-ZEPHYR_BOARD = "v2m_musca_b1"
-ZEPHYR_INHERIT_CLASSES += "zephyr-qemuboot"
-ARCH:musca-b1 = "arm"
-
-TFM_PLATFORM = "arm/musca_b1/sse_200"
+TFM_PLATFORM = "arm/musca_b1"
@@ -15,13 +15,8 @@ IMAGE_CLASSES += "qemuboot"
 QB_SYSTEM_NAME = "qemu-system-arm"
 QB_MACHINE = "-machine musca-s1"
 QB_CPU = "-cpu cortex-m33"
-QB_OPT_APPEND = "-nographic -vga none"
+QB_GRAPHICS = "-nographic -vga none"
 QB_MEM = "512k"
 QB_RNG = ""

-# Zephyr RTOS settings
-ZEPHYR_BOARD = "v2m_musca_s1"
-ZEPHYR_INHERIT_CLASSES += "zephyr-qemuboot"
-ARCH:musca-s1 = "arm"
-
 TFM_PLATFORM = "arm/musca_s1"
@@ -19,16 +19,24 @@ WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"

 # Use kernel provided by yocto
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.15%"
+PREFERRED_VERSION_linux-yocto ?= "6.5%"

 # RTL8168E Gigabit Ethernet Controller is attached to the PCIe interface
 MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "linux-firmware-rtl8168"

+# TF-A
 EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+TFA_PLATFORM = "n1sdp"
+
+# SCP
 EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"

 #UEFI EDK2 firmware
 EXTRA_IMAGEDEPENDS += "edk2-firmware"
+PREFERRED_VERSION_edk2-firmware ?= "202305"
+
+#optee
+PREFERRED_VERSION_optee-os ?= "3.22.%"

 #grub-efi
 EFI_PROVIDER ?= "grub-efi"
@@ -1,22 +0,0 @@
-#@TYPE: Machine
-#@NAME: qemu_cortex_r5
-#@DESCRIPTION: Machine for Zephyr BOARD qemu_cortex_r5
-
-require conf/machine/include/qemu.inc
-require conf/machine/include/arm/armv7r/tune-cortexr5.inc
-
-# GLIBC will not work with Cortex-R.
-TCLIBC = "newlib"
-
-# For runqemu
-QB_SYSTEM_NAME = "qemu-system-aarch64"
-QB_MACHINE = "-machine xlnx-zcu102"
-QB_CPU = "-cpu cortex-r5"
-QB_MEM = "-m 64k"
-QB_OPT_APPEND = "-nographic -vga none"
-QB_RNG = ""
-
-# Zephyr RTOS settings
-ZEPHYR_BOARD = "qemu_cortex_r5"
-ZEPHYR_INHERIT_CLASSES += "zephyr-qemuboot"
-ARCH:qemu-cortex-r5 = "arm"
@@ -1,7 +0,0 @@
-# Configuration for TC0
-
-#@TYPE: Machine
-#@NAME: TC0
-#@DESCRIPTION: Machine configuration for TC0
-
-require conf/machine/include/tc.inc
@@ -5,3 +5,27 @@
 #@DESCRIPTION: Machine configuration for TC1

 require conf/machine/include/tc.inc
+
+TEST_TARGET = "OEFVPTarget"
+TEST_SUITES = "fvp_boot"
+
+# FVP Config
+FVP_PROVIDER ?= "fvp-tc1-native"
+FVP_EXE ?= "FVP_TC1"
+
+# FVP Parameters
+FVP_CONFIG[css.scp.ROMloader.fname] ?= "scp_romfw.bin"
+FVP_CONFIG[css.trustedBootROMloader.fname] ?= "bl1-tc.bin"
+FVP_CONFIG[board.flashloader0.fname] ?= "fip_gpt-tc.bin"
+
+#FVP_CONFIG[board.hostbridge.userNetworking] ?= "true"
+#FVP_CONFIG[board.hostbridge.userNetPorts] ?= "2222=22"
+#smsc ethernet takes a very long time to come up.  disable now to prevent testimage timeout
+#FVP_CONFIG[board.smsc_91c111.enabled] ?= "1"
+
+FVP_CONSOLE = "terminal_s1"
+FVP_TERMINALS[soc.terminal_s0] ?= "Secure Console"
+FVP_TERMINALS[soc.terminal_s1] ?= "Console"
+
+# Boot image
+FVP_DATA ?= "board.dram=fitImage-core-image-minimal-tc1-tc1@0x20000000"
@@ -0,0 +1,230 @@
+..
+ # Copyright (c) 2022-2023, Arm Limited.
+ #
+ # SPDX-License-Identifier: MIT
+
+##########
+Change Log
+##########
+
+This document contains a summary of the new features, changes and
+fixes in each release of Corstone-1000 software stack.
+
+***************
+Version 2023.06
+***************
+
+Changes
+=======
+
+- GPT support (in TF-M, TF-A, U-boot)
+- Use TF-M BL1 code as the ROM code instead of MCUboot (the next stage bootloader BL2 remains to be MCUboot)
+- Secure Enclave uses CC312 OTP as the provisioning backend in FVP and FPGA
+- NVMXIP block storage support in U-Boot
+- Upgrading the SW stack recipes
+- Upgrades for the U-Boot FF-A driver and MM communication
+
+Corstone-1000 components versions
+=================================
+
+-------------------------------------------+--------------------------------------------+
+| arm-ffa-tee                               | 1.1.2-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| arm-ffa-user                              | 5.0.1-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| corstone1000-external-sys-tests           | 1.0+gitAUTOINC+2945cd92f7-r0               |
+-------------------------------------------+--------------------------------------------+
+| external-system                           | 0.1.0+gitAUTOINC+8c9dca74b1-r0             |
+-------------------------------------------+--------------------------------------------+
+| linux-yocto                               | 6.1.25+gitAUTOINC+36901b5b29_581dc1aa2f-r0 |
+-------------------------------------------+--------------------------------------------+
+| u-boot                                    | 2023.01-r0                                 |
+-------------------------------------------+--------------------------------------------+
+| optee-client                              | 3.18.0-r0                                  |
+-------------------------------------------+--------------------------------------------+
+| optee-os                                  | 3.20.0-r0                                  |
+-------------------------------------------+--------------------------------------------+
+| trusted-firmware-a                        | 2.8.0-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| trusted-firmware-m                        | 1.7.0-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| ts-newlib                                 | 4.1.0-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| ts-psa-{crypto, iat, its. ps}-api-test    | 38cb53a4d9                                 |
+-------------------------------------------+--------------------------------------------+
+| ts-sp-{se-proxy, smm-gateway}             | 08b3d39471                                 |
+-------------------------------------------+--------------------------------------------+
+
+Yocto distribution components versions
+======================================
+
+-------------------------------------------+--------------------------------+
+| meta-arm                                  | mickledore                     |
+-------------------------------------------+--------------------------------+
+| poky                                      | mickledore                     |
+-------------------------------------------+--------------------------------+
+| meta-openembedded                         | mickledore                     |
+-------------------------------------------+--------------------------------+
+| busybox                                   | 1.36.0-r0                      |
+-------------------------------------------+--------------------------------+
+| musl                                      | 1.2.3+gitAUTOINC+7d756e1c04-r0 |
+-------------------------------------------+--------------------------------+
+| gcc-arm-none-eabi-native                  | 11.2-2022.02                   |
+-------------------------------------------+--------------------------------+
+| gcc-cross-aarch64                         | 12.2.rel1-r0                   |
+-------------------------------------------+--------------------------------+
+| openssl                                   | 3.1.0-r0                       |
+-------------------------------------------+--------------------------------+
+
+******************
+Version 2022.11.23
+******************
+
+Changes
+=======
+
+- Booting the External System (Cortex-M3) with RTX RTOS
+- Adding MHU communication between the HOST (Cortex-A35) and the External System
+- Adding a Linux application to test the External System
+- Adding ESRT (EFI System Resource Table) support
+- Upgrading the SW stack recipes
+- Upgrades for the U-Boot FF-A driver and MM communication
+
+Corstone-1000 components versions
+=================================
+
+-------------------------------------------+------------+
+| arm-ffa-tee                               | 1.1.1      |
+-------------------------------------------+------------+
+| arm-ffa-user                              | 5.0.0      |
+-------------------------------------------+------------+
+| corstone1000-external-sys-tests           | 1.0        |
+-------------------------------------------+------------+
+| external-system                           | 0.1.0      |
+-------------------------------------------+------------+
+| linux-yocto                               | 5.19       |
+-------------------------------------------+------------+
+| u-boot                                    | 2022.07    |
+-------------------------------------------+------------+
+| optee-client                              | 3.18.0     |
+-------------------------------------------+------------+
+| optee-os                                  | 3.18.0     |
+-------------------------------------------+------------+
+| trusted-firmware-a                        | 2.7.0      |
+-------------------------------------------+------------+
+| trusted-firmware-m                        | 1.6.0      |
+-------------------------------------------+------------+
+| ts-newlib                                 | 4.1.0      |
+-------------------------------------------+------------+
+| ts-psa-{crypto, iat, its. ps}-api-test    | 451aa087a4 |
+-------------------------------------------+------------+
+| ts-sp-{se-proxy, smm-gateway}             | 3d4956770f |
+-------------------------------------------+------------+
+
+Yocto distribution components versions
+======================================
+
+-------------------------------------------+---------------------+
+| meta-arm                                  | langdale            |
+-------------------------------------------+---------------------+
+| poky                                      | langdale            |
+-------------------------------------------+---------------------+
+| meta-openembedded                         | langdale            |
+-------------------------------------------+---------------------+
+| busybox                                   | 1.35.0              |
+-------------------------------------------+---------------------+
+| musl                                      | 1.2.3+git37e18b7bf3 |
+-------------------------------------------+---------------------+
+| gcc-arm-none-eabi-native                  | 11.2-2022.02        |
+-------------------------------------------+---------------------+
+| gcc-cross-aarch64                         | 12.2                |
+-------------------------------------------+---------------------+
+| openssl                                   | 3.0.5               |
+-------------------------------------------+---------------------+
+
+******************
+Version 2022.04.04
+******************
+
+Changes
+=======
+- Linux distro openSUSE, raw image installation and boot in the FVP.
+- SCT test support in FVP.
+- Manual capsule update support in FVP.
+
+******************
+Version 2022.02.25
+******************
+
+Changes
+=======
+- Building and running psa-arch-tests on Corstone-1000 FVP
+- Enabled smm-gateway partition in Trusted Service on Corstone-1000 FVP
+- Enabled MHU driver in Trusted Service on Corstone-1000 FVP
+- Enabled OpenAMP support in SE proxy SP on Corstone-1000 FVP
+
+******************
+Version 2022.02.21
+******************
+
+Changes
+=======
+- psa-arch-tests: recipe is dropped and merged into the secure-partitons recipe.
+- psa-arch-tests: The tests are align with latest tfm version for psa-crypto-api suite.
+
+******************
+Version 2022.01.18
+******************
+
+Changes
+=======
+- psa-arch-tests: change master to main for psa-arch-tests
+- U-Boot: fix null pointer exception for get_image_info
+- TF-M: fix capsule instability issue for Corstone-1000
+
+******************
+Version 2022.01.07
+******************
+
+Changes
+=======
+- Corstone-1000: fix SystemReady-IR ACS test (SCT, FWTS) failures.
+- U-Boot: send bootcomplete event to secure enclave.
+- U-Boot: support populating Corstone-1000 image_info to ESRT table.
+- U-Boot: add ethernet device and enable configs to support bootfromnetwork SCT.
+
+******************
+Version 2021.12.15
+******************
+
+Changes
+=======
+- Enabling Corstone-1000 FPGA support on:
+  - Linux 5.10
+  - OP-TEE 3.14
+  - Trusted Firmware-A 2.5
+  - Trusted Firmware-M 1.5
+- Building and running psa-arch-tests
+- Adding openamp support in SE proxy SP
+- OP-TEE: adding smm-gateway partition
+- U-Boot: introducing Arm FF-A and MM support
+
+******************
+Version 2021.10.29
+******************
+
+Changes
+=======
+- Enabling Corstone-1000 FVP support on:
+  - Linux 5.10
+  - OP-TEE 3.14
+  - Trusted Firmware-A 2.5
+  - Trusted Firmware-M 1.4
+- Linux kernel: enabling EFI, adding FF-A debugfs driver, integrating ARM_FFA_TRANSPORT.
+- U-Boot: Extending EFI support
+- python3-imgtool: adding recipe for Trusted-firmware-m
+- python3-imgtool: adding the Yocto recipe used in signing host images (based on MCUBOOT format)
+
+--------------
+
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*
@@ -0,0 +1,52 @@
+# Configuration file for the Sphinx documentation builder.
+#
+# This file only contains a selection of the most common options. For a full
+# list see the documentation:
+# https://www.sphinx-doc.org/en/master/usage/configuration.html
+
+# -- Path setup --------------------------------------------------------------
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#
+# import os
+# import sys
+# sys.path.insert(0, os.path.abspath('.'))
+
+
+# -- Project information -----------------------------------------------------
+
+project = 'corstone1000'
+copyright = '2020-2022, Arm Limited'
+author = 'Arm Limited'
+
+
+# -- General configuration ---------------------------------------------------
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+# This pattern also affects html_static_path and html_extra_path.
+exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store', 'docs/infra']
+
+
+# -- Options for HTML output -------------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+#
+html_theme = 'sphinx_rtd_theme'
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+#html_static_path = ['_static']
--- a/Show More
+++ b/Show More