arm-bsp/n1sdp: Enable OP-TEE cache in N1SDP

This change enables N1SDP cache to improve performance by removing this patch: HACK-disable-instruction-cache-and-data-cache.patch Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
arm-bsp/n1sdp: Move OP-TEE to DDR4
2026-07-18 16:37:08 +00:00 · 2023-10-19 21:14:39 -05:00 · 2023-10-19 21:14:39 -05:00 · 2023-10-19 21:14:39 -05:00 · 2023-10-16 09:28:49 -04:00 · 2023-10-06 09:23:53 -04:00
566 changed files with 14490 additions and 26227 deletions
@@ -1 +1,2 @@
 __pycache__
+build
@@ -1,12 +1,13 @@
-image: ghcr.io/siemens/kas/kas:3.2
+image: ghcr.io/siemens/kas/kas:3.2.3

 variables:
  CPU_REQUEST: ""
  DEFAULT_TAG: ""
+  CACHE_DIR: $CI_BUILDS_DIR/persist
  # These are needed as the k8s executor doesn't respect the container entrypoint
  # by default
-  FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: 0
  FF_KUBERNETES_HONOR_ENTRYPOINT: 1
+  FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: 0

 stages:
  - prep
@@ -20,11 +21,11 @@ stages:
  interruptible: true
  variables:
    KAS_WORK_DIR: $CI_PROJECT_DIR/work
-    KAS_REPO_REF_DIR: $CI_BUILDS_DIR/persist/repos
-    SSTATE_DIR: $CI_BUILDS_DIR/persist/sstate
-    DL_DIR: $CI_BUILDS_DIR/persist/downloads
+    KAS_REPO_REF_DIR: $CACHE_DIR/repos
+    SSTATE_DIR: $CACHE_DIR/sstate
+    DL_DIR: $CACHE_DIR/downloads
    BB_LOGCONFIG: $CI_PROJECT_DIR/ci/logging.yml
-    TOOLCHAIN_DIR: $CI_BUILDS_DIR/persist/toolchains
+    TOOLCHAIN_DIR: $CACHE_DIR/toolchains
    IMAGE_DIR: $CI_PROJECT_DIR/work/build/tmp/deploy/images
    TOOLCHAIN_LINK_DIR: $CI_PROJECT_DIR/work/build/toolchains
  before_script:
@@ -35,17 +36,30 @@ stages:
    - mkdir --verbose --parents $KAS_WORK_DIR $KAS_REPO_REF_DIR $SSTATE_DIR $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
    # Must do this here, as it's the only way to make sure the toolchain is installed on the same builder
    - ./ci/get-binary-toolchains $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
-    # This can be removed with Kas 3.2
-    - sudo apt-get update && sudo apt-get install --yes python3-subunit

 # Generalised fragment to do a Kas build
 .build:
  extends: .setup
  variables:
    KUBERNETES_CPU_REQUEST: $CPU_REQUEST
+  rules:
+    # Don't run MR pipelines
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      when: never
+    # Don't run pipelines for tags
+    - if: $CI_COMMIT_TAG
+      when: never
+    # Don't run if BUILD_ENABLE_REGEX is set, but the job doesn't match the regex
+    - if: '$BUILD_ENABLE_REGEX != null && $CI_JOB_NAME !~ $BUILD_ENABLE_REGEX'
+      when: never
+    # Allow the dev kernels to fail and not fail the overall build
+    - if: '$KERNEL == "linux-yocto-dev"'
+      allow_failure: true
+    # Catch all for everything else
+    - if: '$KERNEL != "linux-yocto-dev"'
  script:
    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME")
-    - kas shell --update --force-checkout $KASFILES -c 'cat conf/*.conf'
+    - kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES 
    - kas build $KASFILES
    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
  artifacts:
@@ -53,9 +67,11 @@ stages:
    when: on_failure
    paths:
      - $CI_PROJECT_DIR/work/build/tmp/work*/**/temp/log.do_*.*
+      - $CI_PROJECT_DIR/work/build/tmp/work*/**/testimage/*

 #
-# Prep stage, update repositories once
+# Prep stage, update repositories once.
+# Set the CI variable CI_CLEAN_REPOS=1 to refetch the respositories from scratch
 #
 update-repos:
  extends: .setup
@@ -67,9 +83,12 @@ update-repos:
 # Build stage, the actual build jobs
 #
 # Available options for building are
+#  DISTRO: [poky, poky-tiny]
+#  KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
 #  TOOLCHAINS: [gcc, clang, armgcc, external-gccarm]
 #  TCLIBC: [glibc, musl]
-#  FIRMWARE: [uboot, edk2]
+#  FIRMWARE: [u-boot, edk2]
+#  TS: [none, trusted-services]
 #  VIRT: [none, xen]
 #  TESTING: testimage

@@ -85,7 +104,7 @@ corstone1000-fvp:
  extends: .build
  parallel:
    matrix:
-      - TESTING: [testimage,tftf]
+      - TESTING: [testimage, tftf]
  tags:
    - x86_64

@@ -97,17 +116,7 @@ fvp-base:
  parallel:
    matrix:
      - TESTING: testimage
-  tags:
-    - x86_64
-
-fvp-base-arm32:
-  extends: .build
-  parallel:
-    matrix:
-      - TOOLCHAINS: [gcc, external-gccarm]
-        TESTING: testimage
-  tags:
-    - x86_64
+      - FIRMWARE: edk2

 fvp-baser-aemv8r64:
  extends: .build
@@ -120,15 +129,6 @@ fvp-baser-aemv8r64:
 fvps:
  extends: .build

-gem5-arm64:
-  extends: .build
-  parallel:
-    matrix:
-      - VIRT: [none, xen]
-
-gem5-atp-arm64:
-  extends: .build
-
 generic-arm64:
  extends: .build

@@ -137,7 +137,7 @@ juno:
  parallel:
    matrix:
      - TOOLCHAINS: [gcc, clang]
-        FIRMWARE: [uboot, edk2]
+        FIRMWARE: [u-boot, edk2]

 musca-b1:
  extends: .build
@@ -150,29 +150,36 @@ n1sdp:
  parallel:
    matrix:
      - TOOLCHAINS: [gcc, armgcc]
+        TS: [none, n1sdp-ts]

 qemu-generic-arm64:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
        TESTING: testimage

 qemuarm64-secureboot:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
        TCLIBC: [glibc, musl]
-        TS: [none, trusted-services]
+        TS: [none, qemuarm64-secureboot-ts]
        TESTING: testimage

 qemuarm64:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
-        EFI: [uboot, edk2]
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+        TESTING: testimage
+      - DISTRO: poky-tiny
        TESTING: testimage
      - VIRT: xen

@@ -180,15 +187,20 @@ qemuarm-secureboot:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang, external-gccarm]
        TESTING: testimage

 qemuarm:
  extends: .build
  parallel:
    matrix:
-      - TOOLCHAINS: [gcc, clang]
-        EFI: [uboot, edk2]
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+        TESTING: testimage
+      - DISTRO: poky-tiny
        TESTING: testimage
      - VIRT: xen

@@ -196,13 +208,20 @@ qemuarmv5:
  extends: .build
  parallel:
    matrix:
-      - TESTING: testimage
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TESTING: testimage
+      - DISTRO: poky-tiny
+        TESTING: testimage

 sgi575:
  extends: .build

 tc1:
  extends: .build
+  parallel:
+    matrix:
+      - TESTING: testimage
  tags:
    - x86_64

@@ -223,7 +242,7 @@ check-layers:
      "yocto-check-layer-wrapper $CI_PROJECT_DIR/$LAYER --dependency $CI_PROJECT_DIR/meta-* $KAS_WORK_DIR/meta-openembedded/meta-oe --no-auto-dependency"
  parallel:
    matrix:
-      - LAYER: [meta-arm, meta-arm-bsp, meta-arm-toolchain, meta-gem5, meta-atp]
+      - LAYER: [meta-arm, meta-arm-bsp, meta-arm-toolchain]

 pending-updates:
  extends: .setup
@@ -233,8 +252,8 @@ pending-updates:
  script:
    - rm -fr update-report
    # This configuration has all of the layers we need enabled
-    - kas shell ci/gem5-arm64.yml --command \
-      "$CI_PROJECT_DIR/scripts/machine-summary.py -t report -o $CI_PROJECT_DIR/update-report $($CI_PROJECT_DIR/ci/listmachines.py meta-arm meta-arm-bsp meta-gem5)"
+    - kas shell --update --force-checkout ci/qemuarm64.yml:ci/meta-openembedded.yml --command \
+      "$CI_PROJECT_DIR/scripts/machine-summary.py -t report -o $CI_PROJECT_DIR/update-report $($CI_PROJECT_DIR/ci/listmachines.py meta-arm meta-arm-bsp)"
  # Do this on x86 whilst the compilers are x86-only
  tags:
    - x86_64
@@ -6,10 +6,6 @@ This repository contains the Arm layers for OpenEmbedded.

  This layer contains general recipes for the Arm architecture, such as firmware, FVPs, and Arm-specific integration.

-* meta-arm-autonomy
-
-  This layer is the distribution for a reference stack for autonomous systems.
-
 * meta-arm-bsp

  This layer contains machines for Arm reference platforms, for example FVP Base, N1SDP, and Juno.
@@ -18,15 +14,6 @@ This repository contains the Arm layers for OpenEmbedded.

  This layer contains recipes for Arm's binary toolchains (GCC and Clang for -A and -M), and a recipe to build Arm's GCC.

-* meta-atp
-
-  This layer contains recipes for the [AMBA Adaptive Traffic Profiles (ATP)](https://developer.arm.com/documentation/ihi0082/latest) generation integration into meta-gem5.
-
-* meta-gem5
-
-  This layer contains recipes and machines for gem5, a system-level and processor simulator.
-
-
 Other Directories
 -----------------

@@ -1,26 +0,0 @@
-This causes illegal instruction faults in pixman, so xserver crashes.
-https://github.com/kraj/meta-clang/issues/696
-
-From 8659c5c5bec39dd43a1988b19d4cf30507a44679 Mon Sep 17 00:00:00 2001
-From: Ross Burton <ross.burton@arm.com>
-Date: Mon, 28 Nov 2022 16:52:50 +0000
-Subject: [PATCH] Revert "pixman: Do not use clang assembler for now"
-
-This reverts commit 84dbafa42d8141b00da75d6664aef07c252a52ee.
---
- conf/nonclangable.conf | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/conf/nonclangable.conf b/conf/nonclangable.conf
-index 04112f4..b5db848 100644
--- a/conf/nonclangable.conf
-+++ b/conf/nonclangable.conf
-@@ -347,5 +347,4 @@ DEPENDS:append:pn-pixman:mips:toolchain-clang = " openmp"
- #| .endfunc
- #| ^
- CFLAGS:append:pn-pixman:arm:toolchain-clang = " -no-integrated-as"
-CFLAGS:append:pn-pixman:aarch64:toolchain-clang = " -no-integrated-as"
- 
-- 
-2.34.1
-
@@ -3,4 +3,4 @@ header:

 local_conf_header:
  cc: |
-    GCCVERSION = "arm-11.3"
+    GCCVERSION = "arm-12.2"
@@ -5,7 +5,7 @@ distro: poky

 defaults:
  repos:
-    refspec: langdale
+    refspec: mickledore

 repos:
  meta-arm:
@@ -35,8 +35,9 @@ local_conf_header:
    PACKAGECONFIG:append:pn-perf = " coresight"
    INHERIT += "rm_work"
    DISTRO_FEATURES:remove = "ptest"
-  perf: |
-    CORE_IMAGE_EXTRA_INSTALL += "perf"
+  extrapackages: |
+    CORE_IMAGE_EXTRA_INSTALL += "perf opencsd"
+    CORE_IMAGE_EXTRA_INSTALL:append:aarch64 = " gator-daemon"

 machine: unset

@@ -4,16 +4,10 @@ header:
 repos:
  meta-clang:
    url: https://github.com/kraj/meta-clang
-    patches:
-      pixman:
-        repo: meta-arm
-        path: ci/0001-Revert-pixman-Do-not-use-clang-assembler-for-now.patch

 local_conf_header:
-  clang: |
+  toolchain: |
    TOOLCHAIN = "clang"
-    # Backport d89e06ad94a46f6810d0a8787004b71b8ecaf87d to langdale
-    OBJCOPY:pn-linux-yocto:toolchain-clang = "${HOST_PREFIX}objcopy"
-    # Perf needs fixes backported, use GCC for now
-    # https://lore.kernel.org/linux-perf-users/Y5d4k7fDxfRP7hcN@kernel.org/T/#t
-    TOOLCHAIN:pn-perf = "gcc"
+    # This is needed to stop bitbake getting confused about what clang/llvm is
+    # being used, see https://github.com/kraj/meta-clang/pull/766
+    BBMASK += "/meta/recipes-devtools/llvm/llvm.*\.bb"
@@ -3,13 +3,12 @@ header:
  includes:
    - ci/base.yml
    - ci/meta-openembedded.yml
+    - ci/poky-tiny.yml

 local_conf_header:
-    perf: |
+    extrapackages: |
    # Intentionally blank to prevent perf from being added to the image in base.yml

-distro: poky-tiny
-
 target:
  - corstone1000-image
  - perf
@@ -2,11 +2,11 @@ header:
  version: 11
  includes:
    - ci/corstone1000-common.yml
+    - ci/fvp.yml

 local_conf_header:
    fvp-config: |
        # Remove Dropbear SSH as it will not fit into the corstone1000 image.
        IMAGE_FEATURES:remove = " ssh-server-dropbear"
-        INHERIT += "fvpboot"

 machine: corstone1000-fvp
@@ -2,18 +2,11 @@ header:
  version: 11
  includes:
    - ci/base.yml
+    - ci/fvp.yml
+    - ci/poky-tiny.yml

 local_conf_header:
-  testimagefvp: |
-    INHERIT += "fvpboot"
+  fvp-config: |
    IMAGE_FEATURES:remove = " ssh-server-dropbear"
-  perf: |
-    # Intentionally blank to prevent perf from being added to the image in base.yml

 machine: corstone500
-
-distro: poky-tiny
-
-target:
-  - core-image-minimal
-  - perf
@@ -2,17 +2,6 @@ header:
  version: 11
  includes:
    - ci/base.yml
+    - ci/fvp.yml

 machine: fvp-base
-
-local_conf_header:
-  testimagefvp: |
-    INHERIT += "fvpboot"
-    # This fails but we can't add to the ignorelist from meta-arm yet
-    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
-    TEST_SUITES:remove = "parselogs"
-    # Tell testimage to connect to localhost:8022, and forward that to SSH in the FVP.
-    TEST_TARGET_IP = "localhost:8022"
-    FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
-  failing_tests: |
-    TEST_SUITES:remove = "xorg"
@@ -1,18 +1,11 @@
 header:
  version: 11
-  includes:
-    - ci/base.yml
-
-machine: fvp-base-arm32

 local_conf_header:
  testimagefvp: |
-    INHERIT = "fvpboot"
+    INHERIT += "fvpboot"
    # This fails but we can't add to the ignorelist from meta-arm yet
    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
    TEST_SUITES:remove = "parselogs"
-    # Tell testimage to connect to localhost:8122, and forward that to SSH in the FVP.
-    TEST_TARGET_IP = "127.0.0.1:8122"
-    FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] = "8122=22"
  failing_tests: |
    TEST_SUITES:remove = "xorg"
@@ -13,7 +13,8 @@ local_conf_header:

 target:
  - nativesdk-fvp-base-a-aem
-  - nativesdk-fvp-n1-edge
-  - nativesdk-fvp-sgi575
  - nativesdk-fvp-corstone500
  - nativesdk-fvp-corstone1000
+  - nativesdk-fvp-n1-edge
+  - nativesdk-fvp-sgi575
+  - nativesdk-fvp-tc1
@@ -0,0 +1,7 @@
+header:
+  version: 11
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  toolchain: |
+    TOOLCHAIN = "gcc"
@@ -1,16 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/base.yml
-    - ci/meta-openembedded.yml
-
-repos:
-  meta-arm:
-    layers:
-      meta-gem5:
-
-machine: gem5-arm64
-
-target:
-  - core-image-minimal
-  - gem5-aarch64-native
@@ -1,15 +0,0 @@
-header:
-  version: 11
-  includes:
-    - ci/gem5-arm64.yml
-
-repos:
-  meta-arm:
-    layers:
-      meta-atp:
-
-machine: gem5-atp-arm64
-
-target:
-  - atp-native
-  - core-image-minimal
@@ -1,8 +1,9 @@
 #!/bin/bash
-set -u
+set -u -e

-HOST_ARCH=$(uname -m)
-VER="11.3.rel1"
+BASENAME=arm-gnu-toolchain
+VER=${VER:-12.2.rel1}
+HOST_ARCH=${HOST_ARCH:-$(uname -m)}

 DOWNLOAD_DIR=$1
 TOOLCHAIN_DIR=$2
@@ -11,36 +12,39 @@ TOOLCHAIN_LINK_DIR=$3
 # These should be already created by .gitlab-ci.yml, but do here if run outside of that env
 mkdir -p $DOWNLOAD_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR

+download() {
+	TRIPLE=$1
+	URL=https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/$BASENAME-$VER-$HOST_ARCH-$TRIPLE.tar.xz
+	wget -P $DOWNLOAD_DIR -nc $URL
+}
+
 if [ $HOST_ARCH = "aarch64" ]; then
-	#AArch64 Linux hosted cross compilers
+	# AArch64 Linux hosted cross compilers

-	#AArch32 target with hard float (arm-none-linux-gnueabihf)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-arm-none-linux-gnueabihf.tar.xz
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf
 elif [ $HOST_ARCH = "x86_64" ]; then
-	#x86_64 Linux hosted cross compilers
+	# x86_64 Linux hosted cross compilers

-	#AArch32 target with hard float (arm-linux-none-gnueabihf)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-arm-none-linux-gnueabihf.tar.xz
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf

-	#AArch64 GNU/Linux target (aarch64-none-linux-gnu)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-aarch64-none-linux-gnu.tar.xz
-
-	#AArch64 GNU/Linux target (aarch64_be-none-linux-gnu)
-	wget -P $DOWNLOAD_DIR -nc https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/arm-gnu-toolchain-$VER-$HOST_ARCH-aarch64_be-none-linux-gnu.tar.xz
+	# AArch64 GNU/Linux target
+	download aarch64-none-linux-gnu
 else
 	echo "ERROR - Unknown build arch of $HOST_ARCH"
 	exit 1
 fi

-for i in arm aarch64 aarch64_be; do
-	if [ ! -d $TOOLCHAIN_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
-		if [ ! -f $DOWNLOAD_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
+for i in arm aarch64; do
+	if [ ! -d $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
+		if [ ! -f $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
 			continue
 		fi

-		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
+		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
 	fi

 	# Setup a link for the toolchain to use local to the building machine (e.g., not in a shared location)
-	ln -s $TOOLCHAIN_DIR/arm-gnu-toolchain-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
+	ln -s $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
 done
@@ -0,0 +1,7 @@
+header:
+  version: 11
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  libc: |
+    TCLIBC = "glibc"
@@ -18,7 +18,7 @@ for i in $(echo $1 | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
 	# defaults, we can simply ignore those parameters.  They are necessary
 	# to pass in so that matrix can correctly setup all of the permutations
 	# of each individual run.
-	if [[ $i == 'none' || $i == 'gcc' || $i == 'glibc' || $i == 'uboot' ]]; then
+	if [[ $i == 'none' ]]; then
 		continue
 	fi
 	FILES+=":ci/$i.yml"
@@ -0,0 +1,6 @@
+header:
+  version: 9
+
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-dev"
@@ -0,0 +1,6 @@
+header:
+  version: 9
+
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-rt"
@@ -0,0 +1,7 @@
+header:
+  version: 9
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto"
@@ -6,8 +6,8 @@ header:
 local_conf_header:
  trusted_services: |
    TEST_SUITES:append = " trusted_services"
-    # Include TS Crypto, Storage, ITS, Attestation and SMM-Gateway SPs into optee-os image
-    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its ts-attestation ts-smm-gateway"
+    # Include TS Crypto, TS Protected Storage, TS Internal and Trusted Storage SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its"
    # Include TS demo/test tools into image
    IMAGE_INSTALL:append = " packagegroup-ts-tests"
    # Include TS PSA Arch tests into image
@@ -0,0 +1,14 @@
+header:
+  version: 9
+
+distro: poky-tiny
+
+local_conf_header:
+  hacking: |
+    TEST_SUITES = "ping"
+  extrapackages: |
+    # Intentionally blank to prevent perf from being added to the image in base.yml
+
+target:
+  - core-image-minimal
+  - perf
@@ -0,0 +1,4 @@
+header:
+  version: 9
+
+distro: poky
@@ -0,0 +1,14 @@
+header:
+  version: 11
+  includes:
+    - ci/meta-openembedded.yml
+
+local_conf_header:
+  trusted_services: |
+    TEST_SUITES:append = " trusted_services"
+    # Include TS Crypto, TS Protected Storage, TS Internal Trusted Storage and SMM-Gateway SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its ts-smm-gateway"
+    # Include TS demo/test tools into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests"
+    # Include TS PSA Arch tests into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"
@@ -2,8 +2,11 @@ header:
  version: 11
  includes:
    - ci/base.yml
+    - ci/fvp.yml
+    - ci/meta-openembedded.yml

 machine: tc1

 target:
-  - tc-artifacts-image
+  - core-image-minimal
+  - trusted-firmware-m
@@ -0,0 +1,8 @@
+header:
+  version: 11
+
+local_conf_header:
+  bootfirmware: |
+    PREFERRED_PROVIDER_virtual/bootloader = "u-boot"
+    TFA_UBOOT = "1"
+    TFA_UEFI = "0"
@@ -4,6 +4,7 @@

 import sys
 import os
+import shutil
 import subprocess
 import pathlib

@@ -34,9 +35,14 @@ if __name__ == "__main__":

    for repo in repositories:
        repodir = base_repodir / repo_shortname(repo)
+
+        if "CI_CLEAN_REPOS" in os.environ:
+            print("Cleaning %s..." % repo)
+            shutil.rmtree(repodir, ignore_errors=True)
+
        if repodir.exists():
            print("Updating %s..." % repo)
-            subprocess.run(["git", "-C", repodir, "fetch"], check=True)
+            subprocess.run(["git", "-C", repodir, "-c", "gc.autoDetach=false", "fetch"], check=True)
        else:
            print("Cloning %s..." % repo)
            subprocess.run(["git", "clone", "--bare", repo, repodir], check=True)
@@ -1,6 +1,6 @@
 # The Trusted Services: framework for developing root-of-trust services

-  meta-arm layer includes recipes for [Trusted Services][1] Secure Partitions and Normal World applications
+meta-arm layer includes recipes for [Trusted Services][^1] Secure Partitions and Normal World applications
 in `meta-arm/recipes-security/trusted-services`

 ## Secure Partitions recipes
@@ -12,7 +12,7 @@ These files are automatically included into optee-os image accordingly to define
 ### How to include TS SPs

 To include TS SPs into optee-os image you need to add into MACHINE_FEATURES
-features for each [Secure Partition][2] you would like to include:
+features for each [Secure Partition][^2] you would like to include:

 | Secure Partition  | MACHINE_FEATURE |
 | ----------------- | --------------- |
@@ -22,32 +22,44 @@ features for each [Secure Partition][2] you would like to include:
 | Protected Storage | ts-storage      |
 | se-proxy          | ts-se-proxy     |
 | smm-gateway       | ts-smm-gateway  |
+| spm-test[1-3]     | optee-spmc-test |

 Other steps depend on your machine/platform definition:

 1. For communications between Secure and Normal Words Linux kernel option `CONFIG_ARM_FFA_TRANSPORT=y`
-is required. If your platform doesn't include it already you can add `arm-ffa` into MACHINE_FEATURES.
+   is required. If your platform doesn't include it already you can add `arm-ffa` into MACHINE_FEATURES.
+   (Please see ` meta-arm/recipes-kernel/arm-ffa-tee`.)
+
+   For running the `uefi-test` or the `xtest -t ffa_spmc` tests under Linux the `arm-ffa-user` drivel is required. This is
+   enabled if the `ts-smm-gateway` and/or the `optee-spmc-test` machine features are enabled.
+   (Please see ` meta-arm/recipes-kernel/arm-ffa-user`.)

 2. optee-os might require platform specific OP-TEE build parameters (for example what SEL the SPM Core is implemented at).
-You can find examples in `meta-arm/recipes-security/optee/optee-os_%.bbappend` for qemuarm64-secureboot machine
-and in `meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc` and `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc`
-for N1SDP and Corstone1000 platforms accordingly.
+   You can find examples in `meta-arm/recipes-security/optee/optee-os_%.bbappend` for qemuarm64-secureboot machine
+   and in `meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc` and `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc`
+   for N1SDP and Corstone1000 platforms accordingly.

 3. trusted-firmware-a might require platform specific TF-A build parameters (SPD and SPMC details on the platform).
-See `meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend` for qemuarm64-secureboot machine
-and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-n1sdp.inc` and
-`meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for N1SDP and Corstone1000 platforms.
+   See `meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend` for qemuarm64-secureboot machine
+   and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-n1sdp.inc` and
+   `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for N1SDP and Corstone1000 platforms.

 ## Normal World applications

-  Optionally for testing purposes you can add `packagegroup-ts-tests` and `packagegroup-ts-tests-psa` package groups into your image.
-They include [Trusted Services test and demo tools][3]
+Optionally for testing purposes you can add `packagegroup-ts-tests` into your image. It includes 
+[Trusted Services test and demo tools][^3] and [xtest][^4] configured to include the `ffa_spmc` tests.

 ## OEQA Trusted Services tests

  meta-arm also includes Trusted Service OEQA tests which can be used for automated testing.
 See `ci/trusted-services.yml` for an example how to include them into an image.

-[1] https://trusted-services.readthedocs.io/en/integration/overview/introduction.html
-[2] https://trusted-services.readthedocs.io/en/integration/developer/deployments/secure-partitions.html
-[3] https://trusted-services.readthedocs.io/en/integration/developer/deployments/test-executables.html
+
+------
+[^1]: https://trusted-services.readthedocs.io/en/integration/overview/index.html
+
+[^2]: https://trusted-services.readthedocs.io/en/integration/deployments/secure-partitions.html
+
+[^3]: https://trusted-services.readthedocs.io/en/integration/deployments/test-executables.html
+
+[^4]: https://optee.readthedocs.io/en/latest/building/gits/optee_test.html
@@ -5,7 +5,7 @@ distro: poky-tiny

 defaults:
  repos:
-    refspec: langdale
+    refspec: mickledore

 repos:
  meta-arm:
@@ -16,7 +16,7 @@ repos:

  poky:
    url: https://git.yoctoproject.org/git/poky
-    refspec: 79434a17eb4835e85fcd477baec08c8ce49a4c14
+    refspec: 31dd418207f6c95ef0aad589cd03cd2a4c9a8bf2
    layers:
      meta:
      meta-poky:
@@ -24,7 +24,7 @@ repos:

  meta-openembedded:
    url: https://git.openembedded.org/meta-openembedded
-    refspec: c5668905a6d8a78fb72c2cbf8b20e91e686ceb86
+    refspec: 5a01ab461c9bcabcbb2298236602373948f8f073
    layers:
      meta-oe:
      meta-python:
@@ -5,7 +5,7 @@ distro: poky-tiny

 defaults:
  repos:
-    refspec: langdale
+    refspec: master

 repos:
  meta-arm:
@@ -16,6 +16,7 @@ repos:

  poky:
    url: https://git.yoctoproject.org/git/poky
+    refspec: master
    layers:
      meta:
      meta-poky:
@@ -23,6 +24,7 @@ repos:

  meta-openembedded:
    url: https://git.openembedded.org/meta-openembedded
+    refspec: master
    layers:
      meta-oe:
      meta-python:
@@ -6,7 +6,7 @@ machine: fvp-baser-aemv8r64

 defaults:
  repos:
-    refspec: langdale
+    refspec: master

 repos:
  meta-arm:
@@ -9,7 +9,7 @@ BBFILE_COLLECTIONS += "meta-arm-bsp"
 BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-arm-bsp = "5"

-LAYERSERIES_COMPAT_meta-arm-bsp = "langdale"
+LAYERSERIES_COMPAT_meta-arm-bsp = "mickledore"

 LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
 # This won't be used by layerindex-fetch, but works everywhere else
@@ -29,9 +29,10 @@ FVP_CONFIG[board.se_flash_size] ?= "8192"
 FVP_CONFIG[diagnostics] ?= "4"
 FVP_CONFIG[disable_visualisation] ?= "true"
 FVP_CONFIG[se.nvm.update_raw_image] ?= "0"
+FVP_CONFIG[se.cryptocell.USER_OTP_FILTERING_DISABLE] ?= "1"

 # Boot image
-FVP_DATA ?= "board.flash0=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic.nopt@0x68100000"
+FVP_DATA ?= "board.flash0=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic@0x68000000"

 # External system (cortex-M3)
 FVP_CONFIG[extsys_harness0.extsys_flashloader.fname] ?= "${DEPLOY_DIR_IMAGE}/es_flashfw.bin"
@@ -12,7 +12,7 @@ require conf/machine/include/arm/armv7a/tune-cortexa5.inc
 # apply.
 #
 PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.19%"
+PREFERRED_VERSION_linux-yocto ?= "6.1%"

 EXTRA_IMAGEDEPENDS += "trusted-firmware-a u-boot"

@@ -26,7 +26,7 @@ SERIAL_CONSOLES = "115200;ttyAMA0"
 UBOOT_MACHINE = "corstone500_defconfig"
 UBOOT_IMAGE_ENTRYPOINT = "0x84000000"
 UBOOT_IMAGE_LOADADDRESS = "0x84000000"
-PREFERRED_VERSION_u-boot ?= "2022.07"
+PREFERRED_VERSION_u-boot ?= "2023.01"

 # making sure EXTRA_IMAGEDEPENDS will be used while creating the image
 WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
@@ -43,3 +43,6 @@ FVP_DATA ?= "css.cluster.cpu0=${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}.rootfs.wic.nopt@
 FVP_CONSOLE ?= "terminal_0"
 FVP_TERMINALS[css.terminal_0] ?= "console"
 FVP_TERMINALS[css.terminal_1] ?= ""
+
+# Disable openssl in kmod to shink the initramfs size
+PACKAGECONFIG:remove:pn-kmod = "openssl"
@@ -1,23 +0,0 @@
-# Configuration for Armv7-A Base Platform FVP
-
-#@TYPE: Machine
-#@NAME: Armv7-A Base Platform FVP machine
-#@DESCRIPTION: Machine configuration for Armv7-A Base Platform FVP model
-
-require conf/machine/include/fvp-common.inc
-require conf/machine/include/arm/arch-armv7a.inc
-
-# FVP u-boot configuration
-PREFERRED_VERSION_u-boot ?= "2022.04"
-UBOOT_MACHINE = "vexpress_aemv8a_aarch32_defconfig"
-
-KERNEL_IMAGETYPE = "zImage"
-
-FVP_CONFIG[cluster0.cpu0.CONFIG64] = "0"
-FVP_CONFIG[cluster0.cpu1.CONFIG64] = "0"
-FVP_CONFIG[cluster0.cpu2.CONFIG64] = "0"
-FVP_CONFIG[cluster0.cpu3.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu0.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu1.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu2.CONFIG64] = "0"
-FVP_CONFIG[cluster1.cpu3.CONFIG64] = "0"
@@ -9,7 +9,7 @@ require conf/machine/include/arm/arch-armv8a.inc

 TUNE_FEATURES = "aarch64"

-PREFERRED_VERSION_u-boot ?= "2022.04"
+PREFERRED_VERSION_u-boot ?= "2023.01"

 # FVP u-boot configuration
 UBOOT_MACHINE = "vexpress_aemv8a_semi_defconfig"
@@ -9,7 +9,7 @@ require conf/machine/include/arm/armv8r/arch-armv8r64.inc
 EXTRA_IMAGEDEPENDS += "boot-wrapper-aarch64"

 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_u-boot ?= "2022.07"
+PREFERRED_VERSION_u-boot ?= "2022.10"

 KERNEL_IMAGETYPE = "Image"
 KERNEL_DEVICETREE = "arm/fvp-baser-aemv8r64.dtb"
@@ -25,9 +25,7 @@ EFI_PROVIDER ?= "grub-efi"
 MACHINE_FEATURES:append = " efi"

 # As this is a virtual target that will not be used in the real world there is
-# no need for real SSH keys.  Disable rng-tools (which takes too long to
-# initialise) and install the pre-generated keys.
-PACKAGECONFIG:remove:pn-openssh = "rng-tools"
+# no need for real SSH keys.
 MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"

 # testimage configuration
@@ -22,7 +22,7 @@ TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
 RE_IMAGE_OFFSET = "0x1000"

 # u-boot
-PREFERRED_VERSION_u-boot ?= "2022.07"
+PREFERRED_VERSION_u-boot ?= "2023.01"
 EXTRA_IMAGEDEPENDS += "u-boot"

 UBOOT_CONFIG ??= "EFI"
@@ -34,7 +34,7 @@ UBOOT_ARCH = "arm"
 UBOOT_EXTLINUX = "0"

 #optee
-PREFERRED_VERSION_optee-os ?= "3.18.%"
+PREFERRED_VERSION_optee-os ?= "3.20.%"
 PREFERRED_VERSION_optee-client ?= "3.18.%"
 EXTRA_IMAGEDEPENDS += "optee-os"
 OPTEE_ARCH = "arm64"
@@ -43,13 +43,14 @@ OPTEE_BINARY = "tee-pager_v2.bin"
 # Include smm-gateway and se-proxy SPs into optee-os binary
 MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
 TS_PLATFORM = "arm/corstone1000"
+TS_SP_SE_PROXY_CONFIG = "corstone1000"

 # External System(Cortex-M3)
 EXTRA_IMAGEDEPENDS += "external-system"

 # Linux kernel
 PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
-PREFERRED_VERSION_linux-yocto = "5.19%"
+PREFERRED_VERSION_linux-yocto = "6.1%"
 KERNEL_IMAGETYPE = "Image.gz"

 INITRAMFS_IMAGE_BUNDLE ?= "1"
@@ -73,3 +74,6 @@ SERIAL_CONSOLES ?= "115200;ttyAMA0"
 WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"

 WKS_FILE ?= "corstone1000-image.corstone1000.wks"
+
+# Disable openssl in kmod to shink the initramfs size
+PACKAGECONFIG:remove:pn-kmod = "openssl"
@@ -16,21 +16,22 @@ PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"

 KERNEL_DEVICETREE = "arm/fvp-base-revc.dtb"

-EXTRA_IMAGEDEPENDS += "trusted-firmware-a u-boot"
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"

 # As this is a virtual target that will not be used in the real world there is
-# no need for real SSH keys.  Disable rng-tools (which takes too long to
-# initialise) and install the pre-generated keys.
-PACKAGECONFIG:remove:pn-openssh = "rng-tools"
+# no need for real SSH keys.
 MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"

 TEST_TARGET = "OEFVPTarget"
+TEST_TARGET_IP = "127.0.0.1:8022"

 FVP_PROVIDER ?= "fvp-base-a-aem-native"
 FVP_EXE ?= "FVP_Base_RevC-2xAEMvA"
 FVP_CONFIG[bp.ve_sysregs.exit_on_shutdown] ?= "1"
 FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
 FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
+# Tell testimage to connect to localhost:8022, and forward that to SSH in the FVP.
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] = "8022=22"
 FVP_CONFIG[cache_state_modelled] ?= "0"
 FVP_CONFIG[bp.secureflashloader.fname] ?= "${DEPLOY_DIR_IMAGE}/bl1-fvp.bin"
 FVP_CONFIG[bp.flashloader0.fname] ?= "${DEPLOY_DIR_IMAGE}/fip-fvp.bin"
@@ -11,16 +11,6 @@ UBOOT_RD_LOADADDRESS = "0x88000000"
 UBOOT_RD_ENTRYPOINT = "0x88000000"
 UBOOT_LOADADDRESS = "0x80080000"
 UBOOT_ENTRYPOINT = "0x80080000"
-# Below options will generate a key to sign the kernel Image and INITRAMFS_IMAGE
-# according to the default parameters of kernel-fitimage.bbclass. If the user
-# would prefer to use their own keys, disable the key generation using the
-# FIT_GENERATE_KEYS parameter and specify the location of the keys using the
-# below paramters.
-UBOOT_SIGN_ENABLE = "1"
-UBOOT_MKIMAGE_DTCOPTS = "-I dts -O dtb"
-UBOOT_SIGN_KEYNAME = "dev_key"
-UBOOT_SIGN_KEYDIR = "${DEPLOY_DIR_IMAGE}/keys"
-FIT_GENERATE_KEYS = "1"

 PREFERRED_PROVIDER_virtual/kernel ?= "linux-arm64-ack"

@@ -38,3 +28,8 @@ IMAGE_FSTYPES += "cpio.gz"
 INITRAMFS_IMAGE ?= "core-image-minimal"

 SERIAL_CONSOLES = "115200;ttyAMA0"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a optee-os"
+# FIXME - there is signed image dependency/race with testimage.
+# This should be fixed in oe-core
+TESTIMAGEDEPENDS:append = " virtual/kernel:do_deploy"
@@ -18,7 +18,6 @@ IMAGE_FSTYPES += "tar.bz2 ext4 cpio.gz"
 SERIAL_CONSOLES = "115200;ttyAMA0"

 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_u-boot ?= "2022.04"
 PREFERRED_PROVIDER_virtual/bootloader ?= "u-boot"

 EXTRA_IMAGEDEPENDS += "trusted-firmware-a virtual/bootloader firmware-image-juno"
@@ -20,4 +20,4 @@ QB_GRAPHICS = "-nographic -vga none"
 QB_MEM = "512k"
 QB_RNG = ""

-TFM_PLATFORM = "arm/musca_b1/sse_200"
+TFM_PLATFORM = "arm/musca_b1"
@@ -19,7 +19,7 @@ WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"

 # Use kernel provided by yocto
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "5.19%"
+PREFERRED_VERSION_linux-yocto ?= "6.1%"

 # RTL8168E Gigabit Ethernet Controller is attached to the PCIe interface
 MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "linux-firmware-rtl8168"
@@ -29,9 +29,10 @@ EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"

 #UEFI EDK2 firmware
 EXTRA_IMAGEDEPENDS += "edk2-firmware"
+PREFERRED_VERSION_edk2-firmware ?= "202211"

 #optee
-PREFERRED_VERSION_optee-os ?= "3.18.%"
+PREFERRED_VERSION_optee-os ?= "3.20.%"

 #grub-efi
 EFI_PROVIDER ?= "grub-efi"
@@ -5,3 +5,27 @@
 #@DESCRIPTION: Machine configuration for TC1

 require conf/machine/include/tc.inc
+
+TEST_TARGET = "OEFVPSerialTarget"
+TEST_SUITES = "linuxboot"
+
+# FVP Config
+FVP_PROVIDER ?= "fvp-tc1-native"
+FVP_EXE ?= "FVP_TC1"
+
+# FVP Parameters
+FVP_CONFIG[css.scp.ROMloader.fname] ?= "${DEPLOY_DIR_IMAGE}/scp_romfw.bin"
+FVP_CONFIG[css.trustedBootROMloader.fname] ?= "${DEPLOY_DIR_IMAGE}/bl1-tc.bin"
+FVP_CONFIG[board.flashloader0.fname] ?= "${DEPLOY_DIR_IMAGE}/fip_gpt-tc.bin"
+
+#FVP_CONFIG[board.hostbridge.userNetworking] ?= "true"
+#FVP_CONFIG[board.hostbridge.userNetPorts] ?= "8022=22"
+#smsc ethernet takes a very long time to come up.  disable now to prevent testimage timeout
+#FVP_CONFIG[board.smsc_91c111.enabled] ?= "1"
+
+FVP_CONSOLE = "terminal_s1"
+FVP_TERMINALS[soc.terminal_s0] ?= "Secure Console"
+FVP_TERMINALS[soc.terminal_s1] ?= "Console"
+
+# Boot image
+FVP_DATA ?= "board.dram=${DEPLOY_DIR_IMAGE}/fitImage-core-image-minimal-tc1-tc1@0x20000000"
@@ -1,5 +1,5 @@
 ..
- # Copyright (c) 2022, Arm Limited.
+ # Copyright (c) 2022-2023, Arm Limited.
 #
 # SPDX-License-Identifier: MIT

@@ -10,6 +10,72 @@ Change Log
 This document contains a summary of the new features, changes and
 fixes in each release of Corstone-1000 software stack.

+***************
+Version 2023.06
+***************
+
+Changes
+=======
+
+- GPT support (in TF-M, TF-A, U-boot)
+- Use TF-M BL1 code as the ROM code instead of MCUboot (the next stage bootloader BL2 remains to be MCUboot)
+- Secure Enclave uses CC312 OTP as the provisioning backend in FVP and FPGA
+- NVMXIP block storage support in U-Boot
+- Upgrading the SW stack recipes
+- Upgrades for the U-Boot FF-A driver and MM communication
+
+Corstone-1000 components versions
+=================================
+
+-------------------------------------------+--------------------------------------------+
+| arm-ffa-tee                               | 1.1.2-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| arm-ffa-user                              | 5.0.1-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| corstone1000-external-sys-tests           | 1.0+gitAUTOINC+2945cd92f7-r0               |
+-------------------------------------------+--------------------------------------------+
+| external-system                           | 0.1.0+gitAUTOINC+8c9dca74b1-r0             |
+-------------------------------------------+--------------------------------------------+
+| linux-yocto                               | 6.1.25+gitAUTOINC+36901b5b29_581dc1aa2f-r0 |
+-------------------------------------------+--------------------------------------------+
+| u-boot                                    | 2023.01-r0                                 |
+-------------------------------------------+--------------------------------------------+
+| optee-client                              | 3.18.0-r0                                  |
+-------------------------------------------+--------------------------------------------+
+| optee-os                                  | 3.20.0-r0                                  |
+-------------------------------------------+--------------------------------------------+
+| trusted-firmware-a                        | 2.8.0-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| trusted-firmware-m                        | 1.7.0-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| ts-newlib                                 | 4.1.0-r0                                   |
+-------------------------------------------+--------------------------------------------+
+| ts-psa-{crypto, iat, its. ps}-api-test    | 38cb53a4d9                                 |
+-------------------------------------------+--------------------------------------------+
+| ts-sp-{se-proxy, smm-gateway}             | 08b3d39471                                 |
+-------------------------------------------+--------------------------------------------+
+
+Yocto distribution components versions
+======================================
+
+-------------------------------------------+--------------------------------+
+| meta-arm                                  | mickledore                     |
+-------------------------------------------+--------------------------------+
+| poky                                      | mickledore                     |
+-------------------------------------------+--------------------------------+
+| meta-openembedded                         | mickledore                     |
+-------------------------------------------+--------------------------------+
+| busybox                                   | 1.36.0-r0                      |
+-------------------------------------------+--------------------------------+
+| musl                                      | 1.2.3+gitAUTOINC+7d756e1c04-r0 |
+-------------------------------------------+--------------------------------+
+| gcc-arm-none-eabi-native                  | 11.2-2022.02                   |
+-------------------------------------------+--------------------------------+
+| gcc-cross-aarch64                         | 12.2.rel1-r0                   |
+-------------------------------------------+--------------------------------+
+| openssl                                   | 3.1.0-r0                       |
+-------------------------------------------+--------------------------------+
+
 ******************
 Version 2022.11.23
 ******************
@@ -25,7 +91,7 @@ Changes
 - Upgrades for the U-Boot FF-A driver and MM communication

 Corstone-1000 components versions
-=======================================
+=================================

 +-------------------------------------------+------------+
 | arm-ffa-tee                               | 1.1.1      |
@@ -56,7 +122,7 @@ Corstone-1000 components versions
 +-------------------------------------------+------------+

 Yocto distribution components versions
-=======================================
+======================================

 +-------------------------------------------+---------------------+
 | meta-arm                                  | langdale            |
@@ -161,4 +227,4 @@ Changes

 --------------

-*Copyright (c) 2022, Arm Limited. All rights reserved.*
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*
@@ -1,5 +1,5 @@
 ..
- # Copyright (c) 2022, Arm Limited.
+ # Copyright (c) 2022-2023, Arm Limited.
 #
 # SPDX-License-Identifier: MIT

@@ -19,6 +19,28 @@ intended for safety-critical applications. Should Your Software or Your Hardware
 prove defective, you assume the entire cost of all necessary servicing, repair
 or correction.

+***********************
+Release notes - 2023.06
+***********************
+
+Known Issues or Limitations
+---------------------------
+ - FPGA supports Linux distro install and boot through installer. However, FVP only supports openSUSE raw image installation and boot.
+ - Due to the performance uplimit of MPS3 FPGA and FVP, some Linux distros like Fedora Rawhide can not boot on Corstone-1000 (i.e. user may experience timeouts or boot hang).
+ - PSA Crypto tests (psa-crypto-api-test command) take 30 minutes to complete for FVP and 1 hour for MPS3.
+ - Corstone-1000 SoC on FVP doesn't have a secure debug peripheral. It does on the MPS3 .
+ - The following limitations listed in the previous release are still applicable:
+
+   - UEFI Compliant - Boot from network protocols must be implemented -- FAILURE
+
+   - Known limitations regarding ACS tests - see previous release's notes.
+
+Platform Support
+-----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v2
+   https://developer.arm.com/downloads/-/download-fpga-images
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.19_21
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps

 **************************
 Release notes - 2022.11.23
@@ -174,4 +196,4 @@ For all security issues, contact Arm by email at arm-security@arm.com.

 --------------

-*Copyright (c) 2022, Arm Limited. All rights reserved.*
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*
@@ -1,5 +1,5 @@
 ..
- # Copyright (c) 2022, Arm Limited.
+ # Copyright (c) 2022-2023, Arm Limited.
 #
 # SPDX-License-Identifier: MIT

@@ -9,16 +9,16 @@ Software architecture


 *****************
-ARM corstone1000
+Arm Corstone-1000
 *****************

-ARM corstone1000 is a reference solution for IoT devices. It is part of
+Arm Corstone-1000 is a reference solution for IoT devices. It is part of
 Total Solution for IoT which consists of hardware and software reference
 implementation.

-Corstone1000 software plus hardware reference solution is PSA Level-2 ready
+Corstone-1000 software plus hardware reference solution is PSA Level-2 ready
 certified (`PSA L2 Ready`_) as well as System Ready IR certified(`SRIR cert`_).
-More information on the corstone1000 subsystem product and design can be
+More information on the Corstone-1000 subsystem product and design can be
 found at:
 `Arm corstone1000 Software`_ and `Arm corstone1000 Technical Overview`_.

@@ -31,12 +31,12 @@ present in the user-guide document.
 Design Overview
 ***************

-The software architecture of corstone1000 platform is a reference
+The software architecture of Corstone-1000 platform is a reference
 implementation of Platform Security Architecture (`PSA`_) which provides
 framework to build secure IoT devices.

 The base system architecture of the platform is created from three
-different tyes of systems: Secure Enclave, Host and External System.
+different types of systems: Secure Enclave, Host and External System.
 Each subsystem provides different functionality to overall SoC.


@@ -50,9 +50,9 @@ cryptographic functions. It is based on an Cortex-M0+ processor,
 CC312 Cryptographic Accelerator and peripherals, such as watchdog and
 secure flash. Software running on the Secure Enclave is isolated via
 hardware for enhanced security. Communication with the Secure Encalve
-is achieved using Message Hnadling Units (MHUs) and shared memory.
-On system power on, the Secure Enclaves boots first. Its software
-comprises of two boot loading stages, both based on mcuboot, and
+is achieved using Message Handling Units (MHUs) and shared memory.
+On system power on, the Secure Enclave boots first. Its software
+comprises of a  ROM code (TF-M BL1), Mcuboot BL2, and
 TrustedFirmware-M(`TF-M`_) as runtime software. The software design on 
 Secure Enclave follows Firmware Framework for M class
 processor (`FF-M`_) specification.
@@ -66,7 +66,7 @@ The boot process follows Trusted Boot Base Requirement (`TBBR`_).
 The Host Subsystem is taken out of reset by the Secure Enclave system
 during its final stages of the initialization. The Host subsystem runs
 FF-A Secure Partitions(based on `Trusted Services`_) and OPTEE-OS
-(`OPTEE-OS`_) in the secure world, and u-boot(`u-boot repo`_) and
+(`OPTEE-OS`_) in the secure world, and U-Boot(`U-Boot repo`_) and
 linux (`linux repo`_) in the non-secure world. The communication between
 non-secure and the secure world is performed via FF-A messages.

@@ -75,7 +75,7 @@ functionality. The system is based on Cortex-M3 and run RTX RTOS.
 Communictaion between external system and Host(cortex-A35) is performed
 using MHU as transport mechanism and rpmsg messaging system.

-Overall, the corstone1000 architecture is designed to cover a range
+Overall, the Corstone-1000 architecture is designed to cover a range
 of Power, Performance, and Area (PPA) applications, and enable extension
 for use-case specific applications, for example, sensors, cloud
 connectivitiy, and edge computing.
@@ -85,13 +85,13 @@ Secure Boot Chain
 *****************

 For the security of a device, it is essential that only authorized
-software should run on the device. The corstone1000 boot uses a
+software should run on the device. The Corstone-1000 boot uses a
 Secure Boot Chain process where an already authenticated image verifies
 and loads the following software in the chain. For the boot chain
 process to work, the start of the chain should be trusted, forming the
 Root of Trust (RoT) of the device. The RoT of the device is immutable in
 nature and encoded into the device by the device owner before it
-is deployed into the field. In Corstone1000, the BL1 image of the secure
+is deployed into the field. In Corstone-1000, the BL1 image of the secure
 enclave and content of the CC312 OTP (One Time Programmable) memory
 forms the RoT. The BL1 image exists in ROM (Read Only Memory).

@@ -99,18 +99,20 @@ forms the RoT. The BL1 image exists in ROM (Read Only Memory).
   :width: 870
   :alt: SecureBootChain

-It is a lengthy chain to boot the software on corstone1000. On power on,
+It is a lengthy chain to boot the software on Corstone-1000. On power on,
 the secure enclave starts executing BL1 code from the ROM which is the RoT
 of the device. Authentication of an image involves the steps listed below:

 - Load image from flash to dynamic RAM.
- The public key present in the image header is validated by comparing with the hash. Depending on the image, the hash of the public key is either stored in the OTP or part of the software which is being already verfied in the previous stages.
+- The public key present in the image header is validated by comparing with the hash.
+  Depending on the image, the hash of the public key is either stored in the OTP or part
+  of the software which is being already verified in the previous stages.
 - The image is validated using the public key.

 In the secure enclave, BL1 authenticates the BL2 and passes the execution
-control. BL2 authenticates the initial boot loader of the host (Host BL2)
+control. BL2 authenticates the initial boot loader of the host (Host TF-A BL2)
 and TF-M. The execution control is now passed to TF-M. TF-M being the run
-time executable of secure enclaves initializes itself and, in the end,
+time executable of secure enclave which initializes itself and, at the end,
 brings the host CPU out of rest. The host follows the boot standard defined
 in the `TBBR`_ to authenticate the secure and non-secure software.

@@ -118,10 +120,10 @@ in the `TBBR`_ to authenticate the secure and non-secure software.
 Secure Services
 ***************

-corstone1000 is unique in providing a secure environment to run a secure
-workload. The platform has Trustzone technology in the Host subsystem but
+Corstone-1000 is unique in providing a secure environment to run a secure
+workload. The platform has TrustZone technology in the Host subsystem but
 it also has hardware isolated secure enclave environment to run such secure
-workloads. In corstone1000, known Secure Services such as Crypto, Protected
+workloads. In Corstone-1000, known Secure Services such as Crypto, Protected
 Storage, Internal Trusted Storage and Attestation are available via PSA
 Functional APIs in TF-M. There is no difference for a user communicating to
 these services which are running on a secure enclave instead of the
@@ -137,7 +139,7 @@ flow path for such calls.
 The SE Proxy SP (Secure Enclave Proxy Secure Partition) is a proxy partition
 managed by OPTEE which forwards such calls to the secure enclave. The
 solution relies on OpenAMP which uses shared memory and MHU interrupts as
-a doorbell for communication between two cores. corstone1000 implements
+a doorbell for communication between two cores. Corstone-1000 implements
 isolation level 2. Cortex-M0+ MPU (Memory Protection Unit) is used to implement
 isolation level 2.

@@ -147,7 +149,7 @@ lower latency vs higher security. Services running on a secure enclave are
 secure by real hardware isolation but have a higher latency path. In the
 second scenario, the services running on the secure world of the host
 subsystem have lower latency but virtual hardware isolation created by
-Trustzone technology.
+TrustZone technology.


 **********************
@@ -156,14 +158,14 @@ Secure Firmware Update

 Apart from always booting the authorized images, it is also essential that
 the device only accepts the authorized images in the firmware update
-process. corstone1000 supports OTA (Over the Air) firmware updates and
+process. Corstone-1000 supports OTA (Over the Air) firmware updates and
 follows Platform Security Firmware Update sepcification (`FWU`_).

 As standardized into `FWU`_, the external flash is divided into two
 banks of which one bank has currently running images and the other bank is
 used for staging new images.  There are four updatable units, i.e. Secure
 Enclave's BL2 and TF-M, and Host's FIP (Firmware Image Package) and Kernel
-Image. The new images are accepted in the form of a UEFI capsule.
+Image (the initramfs bundle). The new images are accepted in the form of a UEFI capsule.


 .. image:: images/ExternalFlash.png
@@ -194,13 +196,13 @@ guarantee the availability of the device.


 ******************************
-UEFI Runtime Support in u-boot
+UEFI Runtime Support in U-Boot
 ******************************

 Implementation of UEFI boottime and runtime APIs require variable storage.
-In corstone1000, these UEFI variables are stored in the Protected Storage
+In Corstone-1000, these UEFI variables are stored in the Protected Storage
 service. The below diagram presents the data flow to store UEFI variables.
-The u-boot implementation of the UEFI subsystem uses the FF-A driver to
+The U-Boot implementation of the UEFI subsystem uses the U-Boot FF-A driver to
 communicate with the SMM Service in the secure world. The backend of the
 SMM service uses the proxy PS from the SE Proxy SP. From there on, the PS
 calls are forwarded to the secure enclave as explained above.
@@ -215,11 +217,12 @@ calls are forwarded to the secure enclave as explained above.
 References
 ***************
 `ARM corstone1000 Search`_
+
 `Arm security features`_

 --------------

-*Copyright (c) 2022, Arm Limited. All rights reserved.*
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*

 .. _Arm corstone1000 Technical Overview: https://developer.arm.com/documentation/102360/0000
 .. _Arm corstone1000 Software: https://developer.arm.com/Tools%20and%20Software/Corstone-1000%20Software
@@ -236,4 +239,4 @@ References
 .. _TBBR: https://developer.arm.com/documentation/den0006/latest
 .. _TF-M: https://www.trustedfirmware.org/projects/tf-m/
 .. _Trusted Services: https://www.trustedfirmware.org/projects/trusted-services/
-.. _u-boot repo: https://github.com/u-boot/u-boot.git
+.. _U-Boot repo: https://github.com/u-boot/u-boot.git
@@ -1,5 +1,5 @@
 ..
- # Copyright (c) 2022, Arm Limited.
+ # Copyright (c) 2022-2023, Arm Limited.
 #
 # SPDX-License-Identifier: MIT

@@ -15,21 +15,35 @@ The Yocto Project relies on the `Bitbake <https://docs.yoctoproject.org/bitbake.
 tool as its build tool. Please see `Yocto Project documentation <https://docs.yoctoproject.org/>`__
 for more information.

-
 Prerequisites
 -------------
-These instructions assume your host PC is running Ubuntu Linux 18.04 or 20.04 LTS, with at least 32GB of free disk space and 16GB of RAM as minimum requirement. The following instructions expect that you are using a bash shell. All the paths stated in this document are absolute paths.

-The following prerequisites must be available on the host system. To resolve these dependencies, run:
+This guide assumes that your host PC is running Ubuntu 20.04 LTS, with at least
+32GB of free disk space and 16GB of RAM as minimum requirement.

-::
+The following prerequisites must be available on the host system:

-    sudo apt-get update
-    sudo apt-get install gawk wget git-core diffstat unzip texinfo gcc-multilib \
-     build-essential chrpath socat cpio python3 python3-pip python3-pexpect \
-     xz-utils debianutils iputils-ping python3-git libegl1-mesa libsdl1.2-dev \
-     xterm zstd liblz4-tool picocom
-    sudo apt-get upgrade libstdc++6
+- Git 1.8.3.1 or greater
+- tar 1.28 or greater
+- Python 3.8.0 or greater.
+- gcc 8.0 or greater.
+- GNU make 4.0 or greater
+
+Please follow the steps described in the Yocto mega manual:
+
+- `Compatible Linux Distribution <https://docs.yoctoproject.org/singleindex.html#compatible-linux-distribution>`__
+- `Build Host Packages <https://docs.yoctoproject.org/singleindex.html#build-host-packages>`__
+
+Targets
+-------
+
+- `Arm Corstone-1000 Ecosystem FVP (Fixed Virtual Platform) <https://developer.arm.com/downloads/-/arm-ecosystem-fvps>`__
+- `Arm Corstone-1000 for MPS3 <https://developer.arm.com/documentation/dai0550/latest/>`__
+
+Yocto stable branch
+-------------------
+
+Corstone-1000 software stack is built on top of Yocto mickledore.

 Provided components
 -------------------
@@ -44,6 +58,8 @@ The Yocto machine config files for the Corstone-1000 FVP and FPGA targets are:
 - ``<_workspace>/meta-arm/meta-arm-bsp/conf/machine/corstone1000-fvp.conf``
 - ``<_workspace>/meta-arm/meta-arm-bsp/conf/machine/corstone1000-mps3.conf``

+**NOTE:** All the paths stated in this document are absolute paths.
+
 *****************
 Software for Host
 *****************
@@ -52,50 +68,52 @@ Trusted Firmware-A
 ==================
 Based on `Trusted Firmware-A <https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git>`__

-+----------+---------------------------------------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bbappend |
-+----------+---------------------------------------------------------------------------------------------------+
-| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.7.bb           |
-+----------+---------------------------------------------------------------------------------------------------+
+----------+-----------------------------------------------------------------------------------------------------+
+| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.8.%.bbappend |
+----------+-----------------------------------------------------------------------------------------------------+
+| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.8.0.bb           |
+----------+-----------------------------------------------------------------------------------------------------+

 OP-TEE
 ======
 Based on `OP-TEE <https://git.trustedfirmware.org/OP-TEE/optee_os.git>`__

 +----------+------------------------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.18.0.bbappend |
+| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-security/optee/optee-os_3.20.0.bbappend |
 +----------+------------------------------------------------------------------------------------+
-| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-security/optee/optee-os_3.18.0.bb           |
+| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-security/optee/optee-os_3.20.0.bb           |
 +----------+------------------------------------------------------------------------------------+

 U-Boot
-=======
-Based on `U-Boot <https://gitlab.com/u-boot>`__
+======
+Based on `U-Boot repo`_

-+----------+---------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend |
-+----------+---------------------------------------------------------------------+
-| Recipe   | <_workspace>/poky/meta/recipes-bsp/u-boot/u-boot_2022.07.bb         |
-+----------+---------------------------------------------------------------------+
+----------+-------------------------------------------------------------------------+
+| bbappend | <_workspace>/meta-arm/meta-arm/recipes-bsp/u-boot/u-boot_%.bbappend     |
+----------+-------------------------------------------------------------------------+
+| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/u-boot/u-boot_%.bbappend |
+----------+-------------------------------------------------------------------------+
+| Recipe   | <_workspace>/poky/meta/recipes-bsp/u-boot/u-boot_2023.01.bb             |
+----------+-------------------------------------------------------------------------+

 Linux
 =====
 The distro is based on the `poky-tiny <https://wiki.yoctoproject.org/wiki/Poky-Tiny>`__
 distribution which is a Linux distribution stripped down to a minimal configuration.

-The provided distribution is based on busybox and built using muslibc. The
+The provided distribution is based on busybox and built using musl libc. The
 recipe responsible for building a tiny version of Linux is listed below.

 +-----------+----------------------------------------------------------------------------------------------+
 | bbappend  | <_workspace>/meta-arm/meta-arm-bsp/recipes-kernel/linux/linux-yocto_%.bbappend               |
 +-----------+----------------------------------------------------------------------------------------------+
-| Recipe    | <_workspace>/poky/meta/recipes-kernel/linux/linux-yocto_5.19.bb                              |
+| Recipe    | <_workspace>/poky/meta/recipes-kernel/linux/linux-yocto_6.1.bb                               |
 +-----------+----------------------------------------------------------------------------------------------+
 | defconfig | <_workspace>/meta-arm/meta-arm-bsp/recipes-kernel/linux/files/corstone1000/defconfig         |
 +-----------+----------------------------------------------------------------------------------------------+

 External System Tests
-=======================
+=====================
 Based on `Corstone-1000/applications <https://git.gitlab.arm.com/arm-reference-solutions/corstone1000/applications>`__

 +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
@@ -109,15 +127,15 @@ Software for Boot Processor (a.k.a Secure Enclave)
 **************************************************
 Based on `Trusted Firmware-M <https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git>`__

-+----------+-------------------------------------------------------------------------------------------------+
-| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m_%.bbappend |
-+----------+-------------------------------------------------------------------------------------------------+
-| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.6.0.bb       |
-+----------+-------------------------------------------------------------------------------------------------+
+----------+-----------------------------------------------------------------------------------------------------+
+| bbappend | <_workspace>/meta-arm/meta-arm-bsp/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.7.%.bbappend |
+----------+-----------------------------------------------------------------------------------------------------+
+| Recipe   | <_workspace>/meta-arm/meta-arm/recipes-bsp/trusted-firmware-m/trusted-firmware-m_1.7.0.bb           |
+----------+-----------------------------------------------------------------------------------------------------+

-**************************************************
+********************************
 Software for the External System
-**************************************************
+********************************

 RTX
 ====
@@ -150,7 +168,7 @@ In the top directory of the workspace ``<_workspace>``, run:

 ::

-    git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2022.11.23
+    git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2023.06

 To build a Corstone-1000 image for MPS3 FPGA, run:

@@ -173,46 +191,47 @@ Once the build is successful, all output binaries will be placed in the followin
 - ``<_workspace>/build/tmp/deploy/images/corstone1000-mps3/`` folder for FPGA build.

 Everything apart from the Secure Enclave ROM firmware and External System firmware, is bundled into a single binary, the
-``corstone1000-image-corstone1000-{mps3,fvp}.wic.nopt`` file.
+``corstone1000-image-corstone1000-{mps3,fvp}.wic`` file.

 The output binaries run in the Corstone-1000 platform are the following:
 - The Secure Enclave ROM firmware: ``<_workspace>/build/tmp/deploy/images/corstone1000-{mps3,fvp}/bl1.bin``
 - The External System firmware: ``<_workspace>/build/tmp/deploy/images/corstone1000-{mps3,fvp}/es_flashfw.bin``
- - The flash image: ``<_workspace>/build/tmp/deploy/images/corstone1000-{mps3,fvp}/corstone1000-image-corstone1000-{mps3,fvp}.wic.nopt``
+ - The flash image: ``<_workspace>/build/tmp/deploy/images/corstone1000-{mps3,fvp}/corstone1000-image-corstone1000-{mps3,fvp}.wic``

 Flash the firmware image on FPGA
 --------------------------------

-The user should download the FPGA bit file image ``AN550:  Arm® Corstone™-1000 for MPS3 Version 1``
+The user should download the FPGA bit file image ``AN550:  Arm® Corstone™-1000 for MPS3 Version 2.0``
 from `this link <https://developer.arm.com/tools-and-software/development-boards/fpga-prototyping-boards/download-fpga-images>`__
-and under the section ``Arm® Corstone™-1000 for MPS3``.
+and under the section ``Arm® Corstone™-1000 for MPS3``. The download is available after logging in.

 The directory structure of the FPGA bundle is shown below.

 ::

-    Boardfiles
-    ├── MB
-    │   ├── BRD_LOG.TXT
-    │   ├── HBI0309B
-    │   │   ├── AN550
-    │   │   │   ├── AN550_v1.bit
-    │   │   │   ├── an550_v1.txt
-    │   │   │   └── images.txt
-    │   │   ├── board.txt
-    │   │   └── mbb_v210.ebf
-    │   └── HBI0309C
-    │       ├── AN550
-    │       │   ├── AN550_v1.bit
-    │       │   ├── an550_v1.txt
-    │       │   └── images.txt
-    │       ├── board.txt
-    │       └── mbb_v210.ebf
-    ├── SOFTWARE
-    │   ├── ES0.bin
-    │   ├── SE.bin
-    │   └── an550_st.axf
-    └── config.txt
+   Boardfiles
+   ├── config.txt
+   ├── MB
+   │   ├── BRD_LOG.TXT
+   │   ├── HBI0309B
+   │   │   ├── AN550
+   │   │   │   ├── AN550_v2.bit
+   │   │   │   ├── an550_v2.txt
+   │   │   │   └── images.txt
+   │   │   ├── board.txt
+   │   │   └── mbb_v210.ebf
+   │   └── HBI0309C
+   │       ├── AN550
+   │       │   ├── AN550_v2.bit
+   │       │   ├── an550_v2.txt
+   │       │   └── images.txt
+   │       ├── board.txt
+   │       └── mbb_v210.ebf
+   └── SOFTWARE
+        ├── an550_st.axf
+        ├── bl1.bin
+        ├── cs1000.bin
+        └── ES0.bin

 Depending upon the MPS3 board version (printed on the MPS3 board) you should update the images.txt file
 (in corresponding HBI0309x folder. Boardfiles/MB/HBI0309<board_revision>/AN550/images.txt) so that the file points to the images under SOFTWARE directory.
@@ -242,7 +261,7 @@ stack can be seen below;
  IMAGE0FILE: \SOFTWARE\bl1.bin
   
  IMAGE1PORT: 0
-  IMAGE1ADDRESS: 0x00_0010_0000
+  IMAGE1ADDRESS: 0x00_0000_0000
  IMAGE1UPDATE: AUTOQSPI
  IMAGE1FILE: \SOFTWARE\cs1000.bin
   
@@ -256,10 +275,9 @@ OUTPUT_DIR = ``<_workspace>/build/tmp/deploy/images/corstone1000-mps3``
 1. Copy ``bl1.bin`` from OUTPUT_DIR directory to SOFTWARE directory of the FPGA bundle.
 2. Copy ``es_flashfw.bin`` from OUTPUT_DIR directory to SOFTWARE directory of the FPGA bundle
   and rename the binary to ``es0.bin``.
-3. Copy ``corstone1000-image-corstone1000-mps3.wic.nopt`` from OUTPUT_DIR directory to SOFTWARE
-   directory of the FPGA bundle and rename the wic.nopt image to ``cs1000.bin``.
+3. Copy ``corstone1000-image-corstone1000-mps3.wic`` from OUTPUT_DIR directory to SOFTWARE
+   directory of the FPGA bundle and rename the wic image to ``cs1000.bin``.

-   
 **NOTE:** Renaming of the images are required because MCC firmware has
 limitation of 8 characters before .(dot) and 3 characters after .(dot).

@@ -274,7 +292,7 @@ be ttyUSB0, ttyUSB1, ttyUSB2, ttyUSB3 and it might be different on Windows machi
  - ttyUSB0 for MCC, OP-TEE and Secure Partition
  - ttyUSB1 for Boot Processor (Cortex-M0+)
  - ttyUSB2 for Host Processor (Cortex-A35)
-  - ttyUSB3 for External System Processor (Cortex-M3) 
+  - ttyUSB3 for External System Processor (Cortex-M3)

 Run following commands to open serial port terminals on Linux:

@@ -285,12 +303,26 @@ Run following commands to open serial port terminals on Linux:
  sudo picocom -b 115200 /dev/ttyUSB2  # in another terminal.
  sudo picocom -b 115200 /dev/ttyUSB3  # in another terminal.

+**NOTE:** The MPS3 expects an ethernet cable to be plugged in, otherwise it will
+wait for the network for a considerable amount of time, printing the following
+logs:
+
+::
+
+  Generic PHY 40100000.ethernet-ffffffff:01: attached PHY driver (mii_bus:phy_addr=40100000.ethernet-ffffffff:01, irq=POLL)
+  smsc911x 40100000.ethernet eth0: SMSC911x/921x identified at 0xffffffc008e50000, IRQ: 17
+  Waiting up to 100 more seconds for network.
+
 Once the system boot is completed, you should see console
 logs on the serial port terminals. Once the HOST(Cortex-A35) is
 booted completely, user can login to the shell using
 **"root"** login.

-If system does not boot and only the ttyUSB1 logs are visible, please follow the steps in `Clean Secure Flash Before Testing (applicable to FPGA only)`_ under `SystemReady-IR tests`_ section. The previous image used in FPGA (MPS3) might have filled the Secure Flash completely. The best practice is to clean the secure flash in this case.
+If system does not boot and only the ttyUSB1 logs are visible, please follow the
+steps in `Clean Secure Flash Before Testing (applicable to FPGA only)`_ under
+`SystemReady-IR tests`_ section. The previous image used in FPGA (MPS3) might
+have filled the Secure Flash completely. The best practice is to clean the
+secure flash in this case.


 Running the software on FVP
@@ -321,7 +353,7 @@ To run the FVP using the runfvp command, please run the following command:

 When the script is executed, three terminal instances will be launched, one for the boot processor
 (aka Secure Enclave) processing element and two for the Host processing element. Once the FVP is
-executing, the Boot Processor will start to boot, wherein the relevant memory contents of the .wic.nopt
+executing, the Boot Processor will start to boot, wherein the relevant memory contents of the .wic
 file are copied to their respective memory locations within the model, enforce firewall policies
 on memories and peripherals and then, bring the host out of reset.

@@ -337,11 +369,11 @@ Login using the username root.
 The External System can be released out of reset on demand using the systems-comms-tests command.

 SystemReady-IR tests
-------------------------
+--------------------

-*********************
+*************
 Testing steps
-*********************
+*************

 **NOTE**: Running the SystemReady-IR tests described below requires the user to
 work with USB sticks. In our testing, not all USB stick models work well with
@@ -359,7 +391,7 @@ erase the SecureEnclave flash cleanly and prepare a clean board environment for
 the testing.

 Clean Secure Flash Before Testing (applicable to FPGA only)
-==================================================================
+===========================================================

 To prepare a clean board environment with clean secure flash for the testing,
 the user should prepare an image that erases the secure flash cleanly during
@@ -368,17 +400,17 @@ boot. Run following commands to build such image.
 ::

  cd <_workspace>
-  git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2022.11.23
-  git clone https://git.gitlab.arm.com/arm-reference-solutions/systemready-patch.git -b CORSTONE1000-2022.11.23
-  cp -f systemready-patch/embedded-a/corstone1000/erase_flash/0001-arm-bsp-trusted-firmware-m-corstone1000-Clean-Secure.patch meta-arm
+  git clone https://git.yoctoproject.org/git/meta-arm -b CORSTONE1000-2023.06
+  git clone https://git.gitlab.arm.com/arm-reference-solutions/systemready-patch.git -b CORSTONE1000-2023.06
+  cp -f systemready-patch/embedded-a/corstone1000/erase_flash/0001-embedded-a-corstone1000-clean-secure-flash.patch meta-arm
  cd meta-arm
-  git apply 0001-arm-bsp-trusted-firmware-m-corstone1000-Clean-Secure.patch
+  git apply 0001-embedded-a-corstone1000-clean-secure-flash.patch
  cd ..
  kas build meta-arm/kas/corstone1000-mps3.yml

 Replace the bl1.bin and cs1000.bin files on the SD card with following files:
  - The ROM firmware: <_workspace>/build/tmp/deploy/images/corstone1000-mps3/bl1.bin
-  - The flash image: <_workspace>/build/tmp/deploy/images/corstone1000-mps3/corstone1000-image-corstone1000-mps3.wic.nopt
+  - The flash image: <_workspace>/build/tmp/deploy/images/corstone1000-mps3/corstone1000-image-corstone1000-mps3.wic

 Now reboot the board. This step erases the Corstone-1000 SecureEnclave flash
 completely, the user should expect following message from TF-M log (can be seen
@@ -394,10 +426,16 @@ Then the user should follow "Building the software stack" to build a clean
 software stack and flash the FPGA as normal. And continue the testing.

 Run SystemReady-IR ACS tests
-=============================
+============================
+
+Architecture Compliance Suite (ACS) is used to ensure architectural compliance
+across different implementations of the architecture. Arm Enterprise ACS
+includes a set of examples of the invariant behaviors that are provided by a
+set of specifications for enterprise systems (For example: SBSA, SBBR, etc.),
+so that implementers can verify if these behaviours have been interpreted correctly.

 ACS image contains two partitions. BOOT partition and RESULT partition.
-Following packages are under BOOT partition
+Following test suites and bootable applications are under BOOT partition:

 * SCT
 * FWTS
@@ -406,12 +444,30 @@ Following packages are under BOOT partition
 * grub
 * uefi manual capsule application

+BOOT partition contains the following:
+
+::
+
+    ├── EFI
+    │   └── BOOT
+    │       ├── app
+    │       ├── bbr
+    │       ├── bootaa64.efi
+    │       ├── bsa
+    │       ├── debug
+    │       ├── Shell.efi
+    │       └── startup.nsh
+    ├── grub
+    ├── grub.cfg
+    ├── Image
+    └── ramdisk-busybox.img
+
 RESULT partition is used to store the test results.
-PLEASE MAKE SURE THAT THE RESULT PARTITION IS EMPTY BEFORE YOU START THE TESTING. OTHERWISE THE TEST RESULTS
+**NOTE**: PLEASE MAKE SURE THAT THE RESULT PARTITION IS EMPTY BEFORE YOU START THE TESTING. OTHERWISE THE TEST RESULTS
 WILL NOT BE CONSISTENT

 FPGA instructions for ACS image
-================================
+===============================

 This section describes how the user can build and run Architecture Compliance
 Suite (ACS) tests on Corstone-1000.
@@ -449,10 +505,11 @@ Once the USB stick with ACS image is prepared, the user should make sure that
 ensure that only the USB stick with the ACS image is connected to the board,
 and then boot the board.

-The FPGA will reset multiple times during the test, and it might take approx. 24-36 hours to finish the test. At the end of test, the FPGA host terminal will halt showing a shell prompt. Once test is finished the result can be copied following above instructions.
+The FPGA will reset multiple times during the test, and it might take approx. 24-36 hours to finish the test.
+

 FVP instructions for ACS image and run
-============================================
+======================================

 Download ACS image from:
 - ``https://gitlab.arm.com/systemready/acs/arm-systemready/-/tree/linux-5.17-rc7/IR/prebuilt_images/v22.04_1.0-Linux-v5.17-rc7``
@@ -487,7 +544,7 @@ Once test is finished, the FVP can be stoped, and result can be copied following
 instructions.

 Common to FVP and FPGA
-===========================
+======================

 U-Boot should be able to boot the grub bootloader from
 the 1st partition and if grub is not interrupted, tests are executed
@@ -496,14 +553,13 @@ automatically in the following sequence:
 - SCT
 - UEFI BSA
 - FWTS
- - BSA Linux

 The results can be fetched from the ``acs_results`` folder in the RESULT partition of the USB stick (FPGA) / SD Card (FVP).

 #####################################################

 Manual capsule update and ESRT checks
---------------------------------------------------------------------
+-------------------------------------

 The following section describes running manual capsule update with the ``direct`` method.

@@ -518,63 +574,86 @@ incorrect capsule (corrupted or outdated) which fails to boot to the host softwa
 Check the "Run SystemReady-IR ACS tests" section above to download and unpack the ACS image file
 - ``ir_acs_live_image.img.xz``

-Download edk2 under <_workspace> :
+Download edk2 under <_workspace>:

 ::

  git clone https://github.com/tianocore/edk2.git
+  cd edk2
+  git checkout f2188fe5d1553ad1896e27b2514d2f8d0308da8a

-*********************
+Download systemready-patch repo under <_workspace>:
+::
+
+  git clone https://git.gitlab.arm.com/arm-reference-solutions/systemready-patch.git -b CORSTONE1000-2023.06
+
+*******************
 Generating Capsules
-*********************
-
-The capsule binary size (wic.nopt file) should be less than 15 MB.
-
-Based on the user's requirement, the user can change the firmware version
-number given to ``--fw-version`` option (the version number needs to be >= 1).
+*******************

 Generating FPGA Capsules
 ========================

 ::

-   <_workspace>/edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \
-   cs1k_cap_mps3_v5 --fw-version 5 --lsv 0 --guid \
-   e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
-   0 --verbose <_workspace>/build/tmp/deploy/images/corstone1000-mps3/corstone1000-image-corstone1000-mps3.wic.nopt
+   cd <_workspace>/build/tmp/deploy/images/corstone1000-mps3/
+   sh <_workspace>/systemready-patch/embedded-a/corstone1000/capsule_gen/capsule_gen.sh -d mps3
+
+This will generate a file called "corstone1000_image.nopt" which will be used to
+generate a UEFI capsule.

 ::

-   <_workspace>/edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \
-   cs1k_cap_mps3_v6 --fw-version 6 --lsv 0 --guid \
-   e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
-   0 --verbose <_workspace>/build/tmp/deploy/images/corstone1000-mps3/corstone1000-image-corstone1000-mps3.wic.nopt
+   cd <_workspace>
+   edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o cs1k_cap_mps3_v6 --fw-version 6 \
+   --lsv 0 --guid    e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index  0 \
+   --verbose build/tmp/deploy/images/corstone1000-mps3/corstone1000_image.nopt
+
+   edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o cs1k_cap_mps3_v5 --fw-version 5 \
+   --lsv 0 --guid    e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index  0 \
+   --verbose build/tmp/deploy/images/corstone1000-mps3/corstone1000_image.nopt

 Generating FVP Capsules
-========================
+=======================

 ::

-   <_workspace>/edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \
-   cs1k_cap_fvp_v6 --fw-version 6 --lsv 0 --guid \
-   e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
-   0 --verbose <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.wic.nopt
+   cd <_workspace>/build/tmp/deploy/images/corstone1000-fvp/
+   sh <_workspace>/systemready-patch/embedded-a/corstone1000/capsule_gen/capsule_gen.sh -d fvp
+
+This will generate a file called "corstone1000_image.nopt" which will be used to
+generate a UEFI capsule.
+

 ::

-   <_workspace>/edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o \
-   cs1k_cap_fvp_v5 --fw-version 5 --lsv 0 --guid \
-   e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
-   0 --verbose <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.wic.nopt
+   cd <_workspace>
+   edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o cs1k_cap_fvp_v6 \
+   --fw-version 6 --lsv 0 --guid    e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
+   0 --verbose build/tmp/deploy/images/corstone1000-fvp/corstone1000_image.nopt

-*********************
+   edk2/BaseTools/BinWrappers/PosixLike/GenerateCapsule -e -o cs1k_cap_fvp_v5 --fw-version 5 \
+   --lsv 0 --guid    e2bb9c06-70e9-4b14-97a3-5a7913176e3f --verbose --update-image-index \
+   0 --verbose build/tmp/deploy/images/corstone1000-fvp/corstone1000_image.nopt
+
+
+Common Notes for FVP and FPGA
+=============================
+
+The capsule binary size (wic file) should be less than 15 MB.
+
+Based on the user's requirement, the user can change the firmware version
+number given to ``--fw-version`` option (the version number needs to be >= 1).
+
+
+****************
 Copying Capsules
-*********************
+****************

 Copying the FPGA capsules
 =========================

-The user should prepare a USB stick as explained in ACS image section (see above).
+The user should prepare a USB stick as explained in ACS image section `FPGA instructions for ACS image`_.
 Place the generated ``cs1k_cap`` files in the root directory of the boot partition
 in the USB stick. Note: As we are running the direct method, the ``cs1k_cap`` file
 should not be under the EFI/UpdateCapsule directory as this may or may not trigger
@@ -612,7 +691,7 @@ Then, unmount the IR image:

 **NOTE:**

-Size of first partition in the image file is calculated in the following way. The data is
+The size of first partition in the image file is calculated in the following way. The data is
 just an example and might vary with different ir_acs_live_image.img files.

 ::
@@ -632,21 +711,21 @@ During this section we will be using the capsule with the higher version (cs1k_c
 and the capsule with the lower version (cs1k_cap_<fvp/mps3>_v5) for the negative scenario.

 Running the FVP with the IR prebuilt image
-==============================================
+==========================================

 Run the FVP with the IR prebuilt image:

 ::

-   <_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C "board.msd_mmc.p_mmc_file ${<path-to-img>/ir_acs_live_image.img}" 
+   <_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C "board.msd_mmc.p_mmc_file=${<path-to-img>/ir_acs_live_image.img}"

 Running the FPGA with the IR prebuilt image
-==============================================
+===========================================

 Insert the prepared USB stick then Power cycle the MPS3 board.

 Executing capsule update for FVP and FPGA
-==============================================
+=========================================

 Reach u-boot then interrupt the boot  to reach the EFI shell.

@@ -687,14 +766,14 @@ Then, reboot manually:
   Shell> reset

 FPGA: Select Corstone-1000 Linux kernel boot
-==============================================
+============================================

 Remove the USB stick before u-boot is reached so the Corstone-1000 kernel will be detected and used for booting.

 **NOTE:** Otherwise, the execution ends up in the ACS live image.

 FVP: Select Corstone-1000 Linux kernel boot
-==============================================
+===========================================

 Interrupt the u-boot shell.

@@ -708,15 +787,14 @@ Run the following commands in order to run the Corstone-1000 Linux kernel and be

 ::

-   $ run retrieve_kernel_load_addr
   $ unzip $kernel_addr 0x90000000
   $ loadm 0x90000000 $kernel_addr_r 0xf00000
   $ bootefi $kernel_addr_r $fdtcontroladdr


-***********************
+*********************
 Capsule update status
-***********************
+*********************

 Positive scenario
 =================
@@ -733,7 +811,8 @@ correctly.
  SysTick_Handler: counted = 30, expiring on = 360
  ...
  metadata_write: success: active = 1, previous = 0
-  accept_full_capsule: exit: fwu state is changed to regular
+  flash_full_capsule: exit
+  corstone1000_fwu_flash_image: exit: ret = 0
  ...


@@ -775,15 +854,19 @@ see appropriate logs in the secure enclave terminal.
  ...  
    uefi_capsule_retrieve_images: image 0 at 0xa0000070, size=15654928
    uefi_capsule_retrieve_images: exit
-    flash_full_capsule: enter: image = 0x0xa0000070, size = 15654928, version = 10
+    flash_full_capsule: enter: image = 0x0xa0000070, size = 7764541, version = 5
    ERROR: flash_full_capsule: version error
    private_metadata_write: enter: boot_index = 1
    private_metadata_write: success
    fmp_set_image_info:133 Enter
    FMP image update: image id = 0
-    FMP image update: status = 1version=11 last_attempt_version=10.
+    FMP image update: status = 1version=6 last_attempt_version=5.
    fmp_set_image_info:157 Exit.
    corstone1000_fwu_flash_image: exit: ret = -1
+    fmp_get_image_info:232 Enter
+    pack_image_info:207 ImageInfo size = 105, ImageName size = 34, ImageVersionName
+    size = 36
+    fmp_get_image_info:236 Exit
  ...


@@ -825,54 +908,96 @@ In the Linux command-line run the following:
   lowest_supported_fw_ver:	0

 Linux distros tests
----------------------------------
+-------------------

-***************************************************************************************
-Debian/OpenSUSE install and boot (applicable to FPGA only)
-***************************************************************************************
+*************************************************************
+Debian install and boot preparation (applicable to FPGA only)
+*************************************************************

-To test Linux distro install and boot, the user should prepare two empty USB sticks (minimum size should be 4GB and formatted with FAT32).
+There is a known issue in the `Shim 15.7 <https://salsa.debian.org/efi-team/shim/-/tree/upstream/15.7?ref_type=tags>`__
+provided with the Debian installer image (see below). This bug causes a fatal
+error when attempting to boot media installer for Debian, and it resets the MPS3 before installation starts.
+A patch to be applied to the Corstone-1000 stack (only applicable when
+installing Debian) is provided to
+`Skip the Shim <https://gitlab.arm.com/arm-reference-solutions/systemready-patch/-/blob/CORSTONE1000-2023.06/embedded-a/corstone1000/shim/0001-arm-bsp-u-boot-corstone1000-Skip-the-shim-by-booting.patch>`__.
+This patch makes U-Boot automatically bypass the Shim and run grub and allows
+the user to proceed with a normal installation. If at the moment of reading this
+document the problem is solved in the Shim, the user is encouraged to try the
+corresponding new installer image. Otherwise, please apply the patch as
+indicated by the instructions listed below. These instructions assume that the
+user has already built the stack by following the build steps of this
+documentation.
+
+::
+
+  cd <_workspace>
+  git clone https://git.gitlab.arm.com/arm-reference-solutions/systemready-patch.git -b CORSTONE1000-2023.06
+  cp -f systemready-patch/embedded-a/corstone1000/shim/0001-arm-bsp-u-boot-corstone1000-Skip-the-shim-by-booting.patch meta-arm
+  cd meta-arm
+  git am 0001-arm-bsp-u-boot-corstone1000-Skip-the-shim-by-booting.patch
+  cd ..
+  kas shell meta-arm/kas/corstone1000-mps3.yml -c="bitbake u-boot trusted-firmware-a corstone1000-image -c cleansstate; bitbake corstone1000-image"
+
+Please update the cs1000.bin on the SD card with the newly generated wic file.
+
+*************************************************
+Debian/openSUSE install (applicable to FPGA only)
+*************************************************
+
+To test Linux distro install and boot, the user should prepare two empty USB
+sticks (minimum size should be 4GB and formatted with FAT32).

 Download one of following Linux distro images:
- - Debian installer image: https://cdimage.debian.org/cdimage/weekly-builds/arm64/iso-dvd/
- - OpenSUSE Tumbleweed installer image: http://download.opensuse.org/ports/aarch64/tumbleweed/iso/
-   - The user should look for a DVD Snapshot like openSUSE-Tumbleweed-DVD-aarch64-Snapshot<date>-Media.iso
+ - `Debian 12.0.0 installer image <https://cdimage.debian.org/debian-cd/current/arm64/iso-dvd/debian-12.0.0-arm64-DVD-1.iso>`__
+ - `OpenSUSE Tumbleweed installer image <http://download.opensuse.org/ports/aarch64/tumbleweed/iso/>`__

-Once the .iso file is downloaded, the .iso file needs to be flashed to your USB drive.
+**NOTE:** For OpenSUSE Tumbleweed, the user should look for a DVD Snapshot like
+openSUSE-Tumbleweed-DVD-aarch64-Snapshot<date>-Media.iso

-In the given example here, we assume the USB device is ``/dev/sdb`` (the user
-should use `lsblk` command to confirm). Be cautious here and don't confuse your
-host PC's own hard drive with the USB drive. Then copy the contents of an iso
-file into the first USB stick, run:
+Once the iso file is downloaded, the iso file needs to be flashed to your USB
+drive. This can be done with your development machine.
+
+In the example given below, we assume the USB device is ``/dev/sdb`` (the user
+should use the `lsblk` command to confirm).
+
+**NOTE:** Please don't confuse your host PC's own hard drive with the USB drive.
+Then, copy the contents of the iso file into the first USB stick by running the
+following command in the development machine:

 ::

  sudo dd if=<path-to-iso_file> of=/dev/sdb iflag=direct oflag=direct status=progress bs=1M; sync;

-Boot the MSP3 board with the first USB stick connected. Open following minicom sessions:
+Unplug the first USB stick from the development machine and connect it to the
+MSP3 board. At this moment, only the first USB stick should be connected. Open
+the following picocom sessions in your development machine:

 ::

  sudo picocom -b 115200 /dev/ttyUSB0  # in one terminal
  sudo picocom -b 115200 /dev/ttyUSB2  # in another terminal.

-Now plug in the second USB stick (once installation screen is visible), the distro installation process will start. The installation prompt can be seen in ttyUSB2. If installer does not start, please try to reboot the board with both USB sticks connected and repeat the process.
+When the installation screen is visible in ttyUSB2, plug in the second USB stick
+in the MPS3 and start the distro installation process. If the installer does not
+start, please try to reboot the board with both USB sticks connected and repeat
+the process.

 **NOTE:** Due to the performance limitation of Corstone-1000 MPS3 FPGA, the
 distro installation process can take up to 24 hours to complete.

-Once installation is complete, unplug the first USB stick and reboot the board.
-After successfully installing and booting the Linux distro, the user should see
-a login prompt:
+*******************************************************
+Debian install clarifications (applicable to FPGA only)
+*******************************************************

-::
+As the installation process for Debian is different than the one for openSUSE,
+Debian may need some extra steps, that are indicated below:

-  debian login:
+During Debian installation, please answer the following question:
+ - "Force GRUB installation to the EFI removable media path?" Yes
+ - "Update NVRAM variables to automatically boot into Debian?" No

-Login with the username root.
-
-**NOTE:** The Debian installer has a known issue "Install the GRUB bootloader - unable to install " and these are the steps to
-follow on the subsequent popups to solve the issue during the installation:
+If the grub installation fails, these are the steps to follow on the subsequent
+popups:

 1. Select "Continue", then "Continue" again on the next popup
 2. Scroll down and select "Execute a shell"
@@ -898,19 +1023,59 @@ follow on the subsequent popups to solve the issue during the installation:
 7. Select "Continue without boot loader", then select "Continue" on the next popup
 8. At this stage, the installation should proceed as normal.

-***************************************************************************************
-OpenSUSE Raw image install and boot (applicable to FVP only)
-***************************************************************************************
+*****************************************************************
+Debian/openSUSE boot after installation (applicable to FPGA only)
+*****************************************************************

-Steps to download openSUSE Tumbleweed raw image:
-  - Go to: http://download.opensuse.org/ports/aarch64/tumbleweed/appliances/
-  - The user should look for a Tumbleweed-ARM-JeOS-efi.aarch64-* Snapshot, for example, ``openSUSE-Tumbleweed-ARM-JeOS-efi.aarch64-<date>-Snapshot<date>.raw.xz``
+Once the installation is complete, unplug the first USB stick and reboot the
+board.
+The board will then enter recovery mode, from which the user can access a shell
+after entering the password for the root user. Proceed to edit the following
+files accordingly:
+
+::
+
+  vi /etc/systemd/system.conf
+  DefaultDeviceTimeoutSec=infinity
+
+The file to be editted next is different depending on the installed distro:
+
+::
+
+  vi /etc/login.defs # Only applicable to Debian
+  vi /usr/etc/login.defs # Only applicable to openSUSE
+  LOGIN_TIMEOUT   180
+
+To make sure the changes are applied, please run:
+
+::
+
+  systemctl daemon-reload
+
+After applying the previous commands, please reboot the board. The user should
+see a login prompt after booting, for example, for debian:
+
+::
+
+  debian login:
+
+Login with the username root and its corresponding password (already set at
+installation time).
+
+************************************************************
+OpenSUSE Raw image install and boot (applicable to FVP only)
+************************************************************
+
+Steps to download OpenSUSE Tumbleweed raw image:
+  - Under `OpenSUSE Tumbleweed appliances <http://download.opensuse.org/ports/aarch64/tumbleweed/appliances/>`__
+  - The user should look for a Tumbleweed-ARM-JeOS-efi.aarch64-* Snapshot, for example,
+    ``openSUSE-Tumbleweed-ARM-JeOS-efi.aarch64-<date>-Snapshot<date>.raw.xz``

 Once the .raw.xz file is downloaded, the raw image file needs to be extracted:

 ::

-       unxz <file-name.raw.xz>
+   unxz <file-name.raw.xz>


 The above command will generate a file ending with extension .raw image. Now, use the following command
@@ -918,23 +1083,23 @@ to run FVP with raw image installation process.

 ::

-<_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C board.msd_mmc.p_mmc_file="${openSUSE raw image file path}" 
+   <_workspace>/meta-arm/scripts/runfvp --terminals=xterm <_workspace>/build/tmp/deploy/images/corstone1000-fvp/corstone1000-image-corstone1000-fvp.fvpconf -- -C board.msd_mmc.p_mmc_file="${openSUSE raw image file path}"

 After successfully installing and booting the Linux distro, the user should see
 a openSUSE login prompt.

 ::

-      localhost login:
+   localhost login:

 Login with the username 'root' and password 'linux'.

 PSA API tests
----------------------
+-------------

-***************************************************************************************
+***********************************************************
 Run PSA API test commands (applicable to both FPGA and FVP)
-***************************************************************************************
+***********************************************************

 When running PSA API test commands (aka PSA Arch Tests) on MPS3 FPGA, the user should make sure there is no
 USB stick connected to the board. Power on the board and boot the board to
@@ -948,7 +1113,7 @@ First, load FF-A TEE kernel module:

 ::

-  insmod /lib/modules/5.19.14-yocto-standard/extra/arm-ffa-tee.ko
+  insmod /lib/modules/6.1.32-yocto-standard/extra/arm-ffa-tee.ko

 Then, check whether the FF-A TEE driver is loaded correctly by using the following command:

@@ -960,7 +1125,7 @@ The output should be:

 ::

-   arm_ffa_tee 16384 - - Live 0xffffffc0004f0000 (O)
+   arm_ffa_tee 16384 - - Live 0xffffffc000510000 (O)

 Now, run the PSA API tests in the following order:

@@ -971,15 +1136,17 @@ Now, run the PSA API tests in the following order:
  psa-its-api-test
  psa-ps-api-test

-External System tests
-----------------------------------
+**NOTE:** The psa-crypto-api-test takes between 30 minutes to 1 hour to run.

-***************************************************************************************
+External System tests
+---------------------
+
+**************************************************************
 Running the External System test command (systems-comms-tests)
-***************************************************************************************
+**************************************************************

 Test 1: Releasing the External System out of reset
-===================================================
+==================================================

 Run this command in the Linux command-line:

@@ -1004,7 +1171,7 @@ The output on the External System terminal should be:
   MHUv2 module 'MHU1_SE' started

 Test 2: Communication
-=============================================
+=====================

 Test 2 releases the External System out of reset if not already done. Then, it performs communication between host and External System.

@@ -1014,7 +1181,7 @@ After running Test 1, run this command in the Linux command-line:

  systems-comms-tests 2

-Additional output on the External System terminal will be printed:  
+Additional output on the External System terminal will be printed:

 ::

@@ -1058,13 +1225,13 @@ The output on the Host terminal should be:


 Tests results
-----------------------------------
+-------------

-As a reference for the end user, reports for various tests for `Corstone-1000 software (CORSTONE1000-2022.11.23) <https://git.yoctoproject.org/meta-arm/tag/?h=CORSTONE1000-2022.11.23>`__
-can be found in `here <https://gitlab.arm.com/arm-reference-solutions/arm-reference-solutions-test-report/-/tree/master/embedded-a/corstone1000>`__.
+As a reference for the end user, reports for various tests for `Corstone-1000 software (CORSTONE1000-2023.06) <https://git.yoctoproject.org/meta-arm/tag/?h=CORSTONE1000-2023.06>`__
+can be found `here <https://gitlab.arm.com/arm-reference-solutions/arm-reference-solutions-test-report/-/tree/master/embedded-a/corstone1000>`__.

 Running the software on FVP on Windows
---------------------------------------------------------------
+--------------------------------------

 If the user needs to run the Corstone-1000 software on FVP on Windows. The user
 should follow the build instructions in this document to build on Linux host
@@ -1073,6 +1240,7 @@ and launch the FVP binary.

 --------------

-*Copyright (c) 2022, Arm Limited. All rights reserved.*
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*

 .. _Arm Ecosystem FVPs: https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+.. _U-Boot repo: https://github.com/u-boot/u-boot.git
@@ -1,61 +0,0 @@
-# Armv7-A Base Platform FVP Support in meta-arm-bsp
-
-## How to build and run
-
-### Configuration:
-In the local.conf file, MACHINE should be set as follows:
-MACHINE ?= "fvp-base-arm32"
-
-### Build:
-```bash$ bitbake core-image-minimal```
-
-### Run:
-To Run the Fixed Virtual Platform simulation tool you must download "Armv8-A
-Base Platform FVP" from Arm developer (This might require the user to
-register) from this address:
-https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
-and install it on your host PC.
-
-Fast Models Fixed Virtual Platforms (FVP) Reference Guide:
-https://developer.arm.com/docs/100966/latest
-
-Armv8‑A Foundation Platform User Guide:
-https://developer.arm.com/docs/100961/latest/
-
-
-Once done, do the following to build and run an image:
-```bash$ bitbake core-image-minimal```
-```bash$ export YOCTO_DEPLOY_IMGS_DIR="<yocto-build-dir/tmp/deploy/images/fvp-base-arm32>"```
-```bash$ cd <path-to-Base_RevC_AEMv8A_pkg-dir/models/Linux64_GCC-X.X/>```
-```
-bash$ ./FVP_Base_RevC-2xAEMv8A -C bp.virtio_net.enabled=1 \
-         -C cache_state_modelled=0 \
-         -C bp.secureflashloader.fname=${YOCTO_DEPLOY_IMGS_DIR}/bl1-fvp.bin \
-         -C bp.flashloader0.fname=${YOCTO_DEPLOY_IMGS_DIR}/fip-fvp.bin \
-         --data cluster0.cpu0=${YOCTO_DEPLOY_IMGS_DIR}/Image@0x80080000 \
-         -C bp.virtioblockdevice.image_path=${YOCTO_DEPLOY_IMGS_DIR}/core-image-minimal-fvp-base-arm32.wic \
-         -C cluster0.cpu0.CONFIG64=0 \
-         -C cluster0.cpu1.CONFIG64=0 \
-         -C cluster0.cpu2.CONFIG64=0 \
-         -C cluster0.cpu3.CONFIG64=0 \
-         -C cluster1.cpu0.CONFIG64=0 \
-         -C cluster1.cpu1.CONFIG64=0 \
-         -C cluster1.cpu2.CONFIG64=0 \
-         -C cluster1.cpu3.CONFIG64=0 \
-
-```
-
-
-If you have built a configuration without a ramdisk, you can use the following
-command in U-boot to start Linux:
-```fvp32# bootz 0x80080000 - 0x82000000```
-
-## Devices supported in the kernel
- serial
- virtio disk
- network
- watchdog
- rtc
-
-## Devices not supported or not functional
-None
@@ -3,45 +3,22 @@
 ## Howto Build and Run

 ### Configuration:
-In the local.conf file, MACHINE should be set as follow:
-MACHINE ?= "fvp-base"
+In the local.conf file, `MACHINE` should be set:
+```
+MACHINE = "fvp-base"
+```

 ### Build:
-```bash$ bitbake core-image-minimal```
+```
+$ bitbake core-image-base
+```

 ### Run:
-To Run the Fixed Virtual Platform simulation tool you must download "Armv8-A
-Base Platform FVP" from Arm developer (This might require the user to
-register) from this address:
-https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
-and install it on your host PC.
+The `fvp-base` machine has support for the `runfvp` script, so running is simple:

-Fast Models Fixed Virtual Platforms (FVP) Reference Guide:
-https://developer.arm.com/docs/100966/latest
-
-Armv8‑A Foundation Platform User Guide:
-https://developer.arm.com/docs/100961/latest/
-
-
-Once done, do the following to build and run an image:
-```bash$ bitbake core-image-minimal```
-```bash$ export YOCTO_DEPLOY_IMGS_DIR="<yocto-build-dir/tmp/deploy/images/fvp-base>"```
-```bash$ cd <path-to-Base_RevC_AEMv8A_pkg-dir/models/Linux64_GCC-X.X/>```
 ```
-bash$ ./FVP_Base_RevC-2xAEMv8A -C bp.virtio_net.enabled=1 \
-         -C cache_state_modelled=0 \
-         -C bp.secureflashloader.fname=${YOCTO_DEPLOY_IMGS_DIR}/bl1-fvp.bin \
-         -C bp.flashloader0.fname=${YOCTO_DEPLOY_IMGS_DIR}/fip-fvp.bin \
-         --data cluster0.cpu0=${YOCTO_DEPLOY_IMGS_DIR}/Image@0x80080000 \
-         --data cluster0.cpu0=${YOCTO_DEPLOY_IMGS_DIR}/fvp-base-gicv3-psci-custom.dtb@0x83000000 \
-         -C bp.virtioblockdevice.image_path=${YOCTO_DEPLOY_IMGS_DIR}/core-image-minimal-fvp-base.wic
+$ runfvp tmp/deploy/images/fvp-base/core-image-base-fvp-base.fvpconf
 ```
-
-
-If you have built a configuration without a ramdisk, you can use the following
-command in U-boot to start Linux:
-```VExpress64# booti 0x80080000 - 0x83000000```
-
 ## Devices supported in the kernel
 - serial
 - virtio disk
@@ -1,4 +1,4 @@
-From 3e7cfbe39a2a053d2a6b0d928cc172ed9d1c6da8 Mon Sep 17 00:00:00 2001
+From 545f6950ae4dc55b4974986aa9629adb16eaf4e1 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 May 2021 07:25:00 +0100
 Subject: [PATCH] aarch64: Rename labels and prepare for lower EL booting
@@ -18,10 +18,10 @@ Signed-off-by: Jaxson Han <jaxson.han@arm.com>
 3 files changed, 27 insertions(+), 14 deletions(-)

 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index 27ba449..84e1646 100644
+index d682ba5..fab694e 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -21,18 +21,30 @@ ASM_FUNC(_start)
+@@ -34,18 +34,30 @@ ASM_FUNC(_start)
 
 	/*
 	 * EL3 initialisation
@@ -56,7 +56,7 @@ index 27ba449..84e1646 100644
 	orr	x0, x0, #(1 << 0)		// Non-secure EL1
 	orr	x0, x0, #(1 << 8)		// HVC enable
 
-@@ -124,7 +136,7 @@ ASM_FUNC(_start)
+@@ -145,7 +157,7 @@ ASM_FUNC(_start)
 
 	bl	gic_secure_init
 
@@ -65,7 +65,7 @@ index 27ba449..84e1646 100644
 
 err_invalid_id:
 	b	.
-@@ -151,7 +163,7 @@ ASM_FUNC(jump_kernel)
+@@ -172,7 +184,7 @@ ASM_FUNC(jump_kernel)
 	bl	find_logical_id
 	bl	setup_stack		// Reset stack pointer
 
@@ -74,7 +74,7 @@ index 27ba449..84e1646 100644
 	cmp	w0, #0			// Prepare Z flag
 
 	mov	x0, x20
-@@ -160,7 +172,7 @@ ASM_FUNC(jump_kernel)
+@@ -181,7 +193,7 @@ ASM_FUNC(jump_kernel)
 	mov	x3, x23
 
 	b.eq	1f
@@ -83,7 +83,7 @@ index 27ba449..84e1646 100644
 
 1:	mov	x4, #SPSR_KERNEL
 
-@@ -178,5 +190,5 @@ ASM_FUNC(jump_kernel)
+@@ -199,5 +211,5 @@ ASM_FUNC(jump_kernel)
 
 	.data
 	.align 3
@@ -1,4 +1,4 @@
-From 26f9b5354c2de9cc052531096ff92b04c3a3846f Mon Sep 17 00:00:00 2001
+From bad32d3fc127a421be416b17e4f7d6d514f06abb Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 May 2021 07:25:00 +0100
 Subject: [PATCH] aarch64: Prepare for EL1 booting
@@ -15,10 +15,10 @@ Reviewed-by: Andre Przywara <andre.przywara@arm.com>
 2 files changed, 6 insertions(+), 1 deletion(-)

 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index 84e1646..b589744 100644
+index fab694e..5105b41 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -156,10 +156,14 @@ ASM_FUNC(jump_kernel)
+@@ -177,10 +177,14 @@ ASM_FUNC(jump_kernel)
 	ldr	x0, =SCTLR_EL1_KERNEL
 	msr	sctlr_el1, x0
 
@@ -35,7 +35,7 @@ index 84e1646..b589744 100644
 	bl	setup_stack		// Reset stack pointer
 
 diff --git a/arch/aarch64/include/asm/cpu.h b/arch/aarch64/include/asm/cpu.h
-index 63eb1c3..b1003f4 100644
+index 49d3f86..3767da3 100644
 --- a/arch/aarch64/include/asm/cpu.h
 +++ b/arch/aarch64/include/asm/cpu.h
@@ -11,6 +11,7 @@
@@ -1,4 +1,4 @@
-From ce628de7699dd6401ddf713efaa49872e2733619 Mon Sep 17 00:00:00 2001
+From 252cbd36e51414b60ab68306f9c38e358709494d Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 May 2021 07:25:00 +0100
 Subject: [PATCH] aarch64: Prepare for lower EL booting
@@ -17,11 +17,11 @@ Reviewed-by: Andre Przywara <andre.przywara@arm.com>
 1 file changed, 13 insertions(+), 2 deletions(-)

 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index b589744..6b45afc 100644
+index 5105b41..243198d 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -130,7 +130,16 @@ el3_init:
- 	mov	x0, #ZCR_EL3_LEN_MASK		// SVE: Enable full vector len
+@@ -151,7 +151,16 @@ el3_init:
+ 	mov	x0, #ZCR_EL3_LEN_MAX		// SVE: Enable full vector len
 	msr	ZCR_EL3, x0			// for EL2.
 
 -1:
@@ -38,7 +38,7 @@ index b589744..6b45afc 100644
 	ldr	x0, =COUNTER_FREQ
 	msr	cntfrq_el0, x0
 
-@@ -178,7 +187,7 @@ ASM_FUNC(jump_kernel)
+@@ -199,7 +208,7 @@ ASM_FUNC(jump_kernel)
 	b.eq	1f
 	br	x19			// Keep current EL
 
@@ -47,7 +47,7 @@ index b589744..6b45afc 100644
 
 	/*
 	 * If bit 0 of the kernel address is set, we're entering in AArch32
-@@ -196,3 +205,5 @@ ASM_FUNC(jump_kernel)
+@@ -217,3 +226,5 @@ ASM_FUNC(jump_kernel)
 	.align 3
 flag_keep_el:
 	.long 0
@@ -1,4 +1,4 @@
-From 483d363bf825082b6db6de3c57d169e741861891 Mon Sep 17 00:00:00 2001
+From bff110a95a5e4c9db2d61e629b4aa4b84530201e Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 May 2021 07:25:00 +0100
 Subject: [PATCH] gic-v3: Prepare for gicv3 with EL2
@@ -1,4 +1,4 @@
-From be814863cdd5f61d9a16eec012d500550053c8c6 Mon Sep 17 00:00:00 2001
+From ba955efb35ce1d41b562190d7c2fbcbcf8ef97ff Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 May 2021 07:25:00 +0100
 Subject: [PATCH] aarch64: Prepare for booting with EL2
@@ -15,10 +15,10 @@ Reviewed-by: Andre Przywara <andre.przywara@arm.com>
 2 files changed, 17 insertions(+), 1 deletion(-)

 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index 6b45afc..908764a 100644
+index 243198d..3593ca5 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -195,10 +195,18 @@ ASM_FUNC(jump_kernel)
+@@ -216,10 +216,18 @@ ASM_FUNC(jump_kernel)
 	 */
 	bfi	x4, x19, #5, #1
 
@@ -1,4 +1,4 @@
-From 81df76f8d94cb6c31c01739b078a72bdb8497441 Mon Sep 17 00:00:00 2001
+From 8e44fac113d935affed1550480631f3fe7f30584 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 May 2021 07:25:00 +0100
 Subject: [PATCH] aarch64: Introduce EL2 boot code for Armv8-R AArch64
@@ -36,10 +36,10 @@ Signed-off-by: Jaxson Han <jaxson.han@arm.com>
 2 files changed, 92 insertions(+), 2 deletions(-)

 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index 908764a..def9192 100644
+index 3593ca5..a219ea7 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -24,16 +24,24 @@ ASM_FUNC(_start)
+@@ -37,16 +37,24 @@ ASM_FUNC(_start)
 	 * Boot sequence
 	 * If CurrentEL == EL3, then goto EL3 initialisation and drop to
 	 *   lower EL before entering the kernel.
@@ -66,7 +66,7 @@ index 908764a..def9192 100644
 	mov	w0, #1
 	ldr	x1, =flag_keep_el
 	str	w0, [x1]
-@@ -139,6 +147,85 @@ el3_init:
+@@ -160,6 +168,85 @@ el3_init:
 	str	w0, [x1]
 	b	el_max_init
 
@@ -152,7 +152,7 @@ index 908764a..def9192 100644
 el_max_init:
 	ldr	x0, =COUNTER_FREQ
 	msr	cntfrq_el0, x0
-@@ -148,6 +235,7 @@ el_max_init:
+@@ -169,6 +256,7 @@ el_max_init:
 	b	start_el_max
 
 err_invalid_id:
@@ -161,7 +161,7 @@ index 908764a..def9192 100644
 
 	/*
 diff --git a/arch/aarch64/include/asm/cpu.h b/arch/aarch64/include/asm/cpu.h
-index b1003f4..91f803c 100644
+index 3767da3..3c0e00d 100644
 --- a/arch/aarch64/include/asm/cpu.h
 +++ b/arch/aarch64/include/asm/cpu.h
@@ -25,6 +25,7 @@
@@ -172,7 +172,7 @@ index b1003f4..91f803c 100644
 #define SPSR_EL2H		(9 << 0)	/* EL2 Handler mode */
 #define SPSR_HYP		(0x1a << 0)	/* M[3:0] = hyp, M[4] = AArch32 */
 
-@@ -43,6 +44,7 @@
+@@ -50,6 +51,7 @@
 #else
 #define SCTLR_EL1_KERNEL	SCTLR_EL1_RES1
 #define SPSR_KERNEL		(SPSR_A | SPSR_D | SPSR_I | SPSR_F | SPSR_EL2H)
@@ -1,4 +1,4 @@
-From f5a31b4f4ea8daaa0d337d5a2322ddb1912083fc Mon Sep 17 00:00:00 2001
+From 0b9a966b8a28961b078215ee7169e32a976d5e7d Mon Sep 17 00:00:00 2001
 From: Qi Feng <qi.feng@arm.com>
 Date: Wed, 26 May 2021 17:52:01 +0800
 Subject: [PATCH] Allow --enable-psci to choose between smc and hvc
@@ -40,7 +40,7 @@ Signed-off-by: Huifeng Zhang <Huifeng.Zhang@arm.com>
 2 files changed, 14 insertions(+), 10 deletions(-)

 diff --git a/Makefile.am b/Makefile.am
-index f941b07..88a27de 100644
+index 5731a19..fc66662 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -50,11 +50,11 @@ endif
@@ -1,4 +1,4 @@
-From 3f4614e02f0f8d2522510578da2752f8e3511bb3 Mon Sep 17 00:00:00 2001
+From 521c121eccb386aca7c75d92528e495546adccec Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Mon, 25 Oct 2021 17:09:13 +0800
 Subject: [PATCH] aarch64: Disable CNTPCT_EL0 trap for v8-R64
@@ -24,10 +24,10 @@ Change-Id: I4147e66341c8153312021e6f2ab67d0037246da1
 1 file changed, 12 insertions(+)

 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index def9192..6dbd5cc 100644
+index a219ea7..27b1139 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -219,6 +219,18 @@ el2_init:
+@@ -240,6 +240,18 @@ el2_init:
 	orr	x0, x0, #(1 << 41)		// HCR_EL2.API
 
 1:	msr	hcr_el2, x0
@@ -1,4 +1,4 @@
-From 2851f0e6c1216894b9498d7b91256bb1ef49e544 Mon Sep 17 00:00:00 2001
+From 780df234d98db81485b1f351f902a68def35c9d4 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 2 Nov 2021 15:10:28 +0800
 Subject: [PATCH] lds: Mark the mem range
@@ -1,4 +1,4 @@
-From fadf04f44b679d85e55b2e5f220fecbebb52ad03 Mon Sep 17 00:00:00 2001
+From b3762b6c5a56bf594bc5cb63d145e8efd86e106e Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 28 Dec 2021 17:02:17 +0800
 Subject: [PATCH] common: Introduce the libfdt
@@ -1,4 +1,4 @@
-From 0f2c7ca446063be6b193fbf870d38c0af19e15c5 Mon Sep 17 00:00:00 2001
+From e2eff4f80e65cb3fcbe6345b5376a6bf7de7e2cc Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 28 Dec 2021 17:28:25 +0800
 Subject: [PATCH] common: Add essential libc functions
@@ -1,4 +1,4 @@
-From de5d2b6c200ae5dd8113751e58bf7cf5844eec5a Mon Sep 17 00:00:00 2001
+From f4d5cf4c3424598a2b3bb391717313b70c79ea28 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 28 Dec 2021 17:42:48 +0800
 Subject: [PATCH] Makefile: Add the libfdt to the Makefile system
@@ -17,7 +17,7 @@ Change-Id: I472bc28cdc5cde3b22461a4b7d7a3752ae382b4b
 1 file changed, 9 insertions(+), 2 deletions(-)

 diff --git a/Makefile.am b/Makefile.am
-index 88a27de..5e8668a 100644
+index fc66662..ab2c3a9 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -36,6 +36,9 @@ PSCI_CPU_OFF	:= 0x84000002
@@ -30,10 +30,10 @@ index 88a27de..5e8668a 100644
 ARCH_OBJ	:= boot.o stack.o utils.o
 
 if BOOTWRAPPER_32
-@@ -125,11 +128,12 @@ CHOSEN_NODE	:= chosen {						\
- CPPFLAGS	+= $(INITRD_FLAGS)
- CFLAGS		+= -I$(top_srcdir)/include/ -I$(top_srcdir)/$(ARCH_SRC)/include/
+@@ -127,11 +130,12 @@ CFLAGS		+= -I$(top_srcdir)/include/ -I$(top_srcdir)/$(ARCH_SRC)/include/
 CFLAGS		+= -Wall -fomit-frame-pointer
+ CFLAGS		+= -ffreestanding -nostdlib
+ CFLAGS		+= -fno-stack-protector
 +CFLAGS 		+= -fno-stack-protector
 CFLAGS		+= -ffunction-sections -fdata-sections
 CFLAGS		+= -fno-pic -fno-pie
@@ -44,7 +44,7 @@ index 88a27de..5e8668a 100644
 
 # Don't lookup all prerequisites in $(top_srcdir), only the source files. When
 # building outside the source tree $(ARCH_SRC) needs to be created.
-@@ -150,10 +154,13 @@ $(ARCH_SRC):
+@@ -152,10 +156,13 @@ $(ARCH_SRC):
 $(COMMON_SRC):
 	$(MKDIR_P) $@
 
@@ -1,4 +1,4 @@
-From 5b8cb5192dbd0332e027e8999c3afe4433983291 Mon Sep 17 00:00:00 2001
+From f0ece5e8cac761a76a86df7204bae7c6ef09215f Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Wed, 29 Dec 2021 10:50:21 +0800
 Subject: [PATCH] platform: Add print_hex func
@@ -1,4 +1,4 @@
-From b447242cd2457bec20d47fe6a8a5758d97a3bde3 Mon Sep 17 00:00:00 2001
+From f4704146e1af9f6e0a2220db6b39a328c813fac1 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Wed, 19 Jan 2022 16:19:02 +0800
 Subject: [PATCH] common: Add mem usage to /memreserve/
@@ -20,7 +20,7 @@ Change-Id: I2ea80cdf736a910fa2c3deb622e21d50f04be960
 create mode 100644 common/device_tree.c

 diff --git a/Makefile.am b/Makefile.am
-index 5e8668a..734de92 100644
+index ab2c3a9..e905602 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -34,7 +34,7 @@ endif
@@ -1,4 +1,4 @@
-From 8271c21bcff260295203214b7b8c87cdb8236453 Mon Sep 17 00:00:00 2001
+From 5995f83592aea874f5b423538e36675e2204582b Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 4 Jan 2022 17:01:55 +0800
 Subject: [PATCH] boot: Add the --enable-keep-el compile option
@@ -23,7 +23,7 @@ Change-Id: I3ba9c87cf0b59d163ca433f74c9e3a46e5ca2c63
 4 files changed, 20 insertions(+), 1 deletion(-)

 diff --git a/Makefile.am b/Makefile.am
-index 734de92..054becd 100644
+index e905602..6604baa 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -33,6 +33,10 @@ PSCI_CPU_ON	:= 0xc4000003
@@ -38,10 +38,10 @@ index 734de92..054becd 100644
 COMMON_OBJ	:= boot.o bakery_lock.o platform.o lib.o device_tree.o
 
 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index 6dbd5cc..157c097 100644
+index 27b1139..c079d22 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -233,7 +233,11 @@ el2_init:
+@@ -254,7 +254,11 @@ el2_init:
 	msr	cnthctl_el2, x0
 	isb
 
@@ -53,7 +53,7 @@ index 6dbd5cc..157c097 100644
 	ldr	x1, =spsr_to_elx
 	str	w0, [x1]
 	// fall through
-@@ -313,5 +317,5 @@ ASM_FUNC(jump_kernel)
+@@ -334,5 +338,5 @@ ASM_FUNC(jump_kernel)
 	.align 3
 flag_keep_el:
 	.long 0
@@ -1,4 +1,4 @@
-From dd3e3f414d0e6ed1643c2e2ccac676b7fc1dc7a9 Mon Sep 17 00:00:00 2001
+From 0c0695cd3160ccdb95bae29b7668918015c0b6aa Mon Sep 17 00:00:00 2001
 From: Peter Hoyes <Peter.Hoyes@arm.com>
 Date: Tue, 1 Feb 2022 11:28:46 +0000
 Subject: [PATCH] Makefile: Change COUNTER_FREQ to 100 MHz
@@ -17,7 +17,7 @@ Change-Id: Ia9ad0f8ee488d1a887791f1fa1d8f3bf9c5887fd
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/Makefile.am b/Makefile.am
-index 40bc5d6..b48173c 100644
+index 6604baa..cc6504e 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -13,7 +13,7 @@ SCRIPT_DIR	:= $(top_srcdir)/scripts
@@ -29,6 +29,3 @@ index 40bc5d6..b48173c 100644
 
 CPU_IDS		:= $(shell perl -I $(SCRIPT_DIR) $(SCRIPT_DIR)/findcpuids.pl $(KERNEL_DTB))
 NR_CPUS         := $(shell echo $(CPU_IDS) | tr ',' ' ' | wc -w)
-- 
-2.25.1
-
@@ -1,4 +1,4 @@
-From 6923f2a0c59cf92ba5ad50ec1d658a357b4ba5d7 Mon Sep 17 00:00:00 2001
+From fa73d885be85eee4369b292ec601e7b024a68807 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 2 Nov 2021 10:48:39 +0800
 Subject: [PATCH] PSCI: Apply flush cache after setting branch_data
@@ -47,6 +47,3 @@ index 945780b..6efc695 100644
 	return PSCI_RET_SUCCESS;
 }
 
-- 
-2.25.1
-
@@ -1,4 +1,4 @@
-From ed46e83df2400b1b3f3364169aacf787bd91bd45 Mon Sep 17 00:00:00 2001
+From 9da48e3433b919868650cd60e28827273a42c63b Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 25 Jan 2022 14:56:36 +0800
 Subject: [PATCH] PSCI: Add function call entry point
@@ -69,6 +69,3 @@ index 6efc695..8fdefb5 100644
 void __noreturn psci_first_spin(unsigned int cpu)
 {
 	if (cpu == MPIDR_INVALID)
-- 
-2.25.1
-
@@ -1,4 +1,4 @@
-From 36b5fa3f4db49ac7aef42ff1d58a895226c7e96c Mon Sep 17 00:00:00 2001
+From 7c5e40d9f8699a55ac2187c035429c643e6d0ef0 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Tue, 2 Nov 2021 15:10:28 +0800
 Subject: [PATCH] lds: Rearrange and mark the sections
@@ -56,6 +56,3 @@ index ab98ddf..85451f9 100644
 	PROVIDE(firmware_end = .);
 
 	ASSERT(etext <= (PHYS_OFFSET + TEXT_LIMIT), ".text overflow!")
-- 
-2.25.1
-
@@ -1,4 +1,4 @@
-From 8bdbb64d13f14d40546b71dbcfee2b2a8ea002a5 Mon Sep 17 00:00:00 2001
+From 3c1140c29c39561848056fb4b9a03042b00279f3 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Wed, 29 Dec 2021 15:17:38 +0800
 Subject: [PATCH] common: Provide firmware info using libfdt
@@ -340,6 +340,3 @@ index 4d0876c..7f7befc 100644
 +
 +	dt_dump_all(fw_node);
 +}
-- 
-2.25.1
-
@@ -1,4 +1,4 @@
-From 6dfc937d1ae54d2ae9f8c60ca29ba73ca14dc8c4 Mon Sep 17 00:00:00 2001
+From b1105e862e8f770fc195bc20e9c64d231dd32f66 Mon Sep 17 00:00:00 2001
 From: Jaxson Han <jaxson.han@arm.com>
 Date: Wed, 29 Dec 2021 15:33:17 +0800
 Subject: [PATCH] boot: Enable firmware node initialization
@@ -29,7 +29,7 @@ Change-Id: Ib274485a34d26215595fd0cd737be86610289817
 3 files changed, 12 insertions(+), 2 deletions(-)

 diff --git a/Makefile.am b/Makefile.am
-index 054becd..b01809c 100644
+index cc6504e..fbe6b81 100644
 --- a/Makefile.am
 +++ b/Makefile.am
@@ -23,7 +23,7 @@ DEFINES		+= -DCPU_IDS=$(CPU_IDS)
@@ -41,20 +41,20 @@ index 054becd..b01809c 100644
 
 if KERNEL_32
 DEFINES		+= -DKERNEL_32
-@@ -132,7 +132,7 @@ CHOSEN_NODE	:= chosen {						\
- CPPFLAGS	+= $(INITRD_FLAGS)
- CFLAGS		+= -I$(top_srcdir)/include/ -I$(top_srcdir)/$(ARCH_SRC)/include/
+@@ -134,7 +134,7 @@ CFLAGS		+= -I$(top_srcdir)/include/ -I$(top_srcdir)/$(ARCH_SRC)/include/
 CFLAGS		+= -Wall -fomit-frame-pointer
+ CFLAGS		+= -ffreestanding -nostdlib
+ CFLAGS		+= -fno-stack-protector
 -CFLAGS 		+= -fno-stack-protector
 +CFLAGS 		+= -fno-stack-protector -fno-builtin
 CFLAGS		+= -ffunction-sections -fdata-sections
 CFLAGS		+= -fno-pic -fno-pie
 LDFLAGS		+= --gc-sections
 diff --git a/arch/aarch64/boot.S b/arch/aarch64/boot.S
-index 157c097..f310387 100644
+index c079d22..daaa674 100644
 --- a/arch/aarch64/boot.S
 +++ b/arch/aarch64/boot.S
-@@ -240,6 +240,10 @@ el2_init:
+@@ -261,6 +261,10 @@ el2_init:
 #endif
 	ldr	x1, =spsr_to_elx
 	str	w0, [x1]
@@ -65,7 +65,7 @@ index 157c097..f310387 100644
 	// fall through
 
 el_max_init:
-@@ -319,3 +323,5 @@ flag_keep_el:
+@@ -340,3 +344,5 @@ flag_keep_el:
 	.long 0
 ASM_DATA(spsr_to_elx)
 	.long 0
@@ -93,6 +93,3 @@ index ee2bea0..38b2dca 100644
 
 		*mbox = (unsigned long)&entrypoint;
 		sevl();
-- 
-2.25.1
-
@@ -1,7 +1,7 @@
-From c8bd941579fb062359b683b184b851eea2ddb761 Mon Sep 17 00:00:00 2001
+From f526797b83113cc64e3e658c22d8a5d269896a2a Mon Sep 17 00:00:00 2001
 From: Ben Horgan <ben.horgan@arm.com>
 Date: Fri, 4 Mar 2022 16:48:14 +0000
-Subject: [PATCH 1/5] feat: emulate cntp timer register accesses using cnthps
+Subject: [PATCH] feat: emulate cntp timer register accesses using cnthps

 Upstream-Status: Inappropriate [Experimental feature]
 Signed-off-by: Ben Horgan <ben.horgan@arm.com>
@@ -19,10 +19,10 @@ Change-Id: I67508203273baf3bd8e6be2d99717028db945715
 create mode 100644 src/arch/aarch64/hypervisor/timer_el1.h

 diff --git a/Makefile b/Makefile
-index c9fb16f..6371a8a 100644
+index 95cab9a5..21cca938 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -59,7 +59,8 @@ CHECKPATCH := $(CURDIR)/third_party/linux/scripts/checkpatch.pl \
+@@ -60,7 +60,8 @@ CHECKPATCH := $(CURDIR)/third_party/linux/scripts/checkpatch.pl \
 # debug_el1.c : uses XMACROS, which checkpatch doesn't understand.
 # perfmon.c : uses XMACROS, which checkpatch doesn't understand.
 # feature_id.c : uses XMACROS, which checkpatch doesn't understand.
@@ -33,7 +33,7 @@ index c9fb16f..6371a8a 100644
 OUT ?= out/$(PROJECT)
 OUT_DIR = out/$(PROJECT)
 diff --git a/src/arch/aarch64/hypervisor/BUILD.gn b/src/arch/aarch64/hypervisor/BUILD.gn
-index 6068d1e..de1a414 100644
+index 6068d1e8..de1a414d 100644
 --- a/src/arch/aarch64/hypervisor/BUILD.gn
 +++ b/src/arch/aarch64/hypervisor/BUILD.gn
@@ -45,6 +45,7 @@ source_set("hypervisor") {
@@ -45,10 +45,10 @@ index 6068d1e..de1a414 100644
   ]
 
 diff --git a/src/arch/aarch64/hypervisor/cpu.c b/src/arch/aarch64/hypervisor/cpu.c
-index c6cebdd..cb41e6e 100644
+index bcf5ffce..d2df77d8 100644
 --- a/src/arch/aarch64/hypervisor/cpu.c
 +++ b/src/arch/aarch64/hypervisor/cpu.c
-@@ -91,13 +91,20 @@ void arch_regs_reset(struct vcpu *vcpu)
+@@ -98,13 +98,20 @@ void arch_regs_reset(struct vcpu *vcpu)
 	if (is_primary) {
 		/*
 		 * cnthctl_el2 is redefined when VHE is enabled.
@@ -72,7 +72,7 @@ index c6cebdd..cb41e6e 100644
 	}
 
 diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
-index cd64d68..c9068c5 100644
+index 4bd8a3b4..4c1b6e48 100644
 --- a/src/arch/aarch64/hypervisor/handler.c
 +++ b/src/arch/aarch64/hypervisor/handler.c
@@ -34,6 +34,7 @@
@@ -83,7 +83,7 @@ index cd64d68..c9068c5 100644
 
 /**
  * Hypervisor Fault Address Register Non-Secure.
-@@ -1276,6 +1277,11 @@ void handle_system_register_access(uintreg_t esr_el2)
+@@ -1277,6 +1278,11 @@ void handle_system_register_access(uintreg_t esr_el2)
 			inject_el1_unknown_exception(vcpu, esr_el2);
 			return;
 		}
@@ -97,7 +97,7 @@ index cd64d68..c9068c5 100644
 		return;
 diff --git a/src/arch/aarch64/hypervisor/timer_el1.c b/src/arch/aarch64/hypervisor/timer_el1.c
 new file mode 100644
-index 0000000..c30e554
+index 00000000..c30e5543
 --- /dev/null
 +++ b/src/arch/aarch64/hypervisor/timer_el1.c
@@ -0,0 +1,104 @@
@@ -207,7 +207,7 @@ index 0000000..c30e554
 +}
 diff --git a/src/arch/aarch64/hypervisor/timer_el1.h b/src/arch/aarch64/hypervisor/timer_el1.h
 new file mode 100644
-index 0000000..04a43b6
+index 00000000..04a43b6c
 --- /dev/null
 +++ b/src/arch/aarch64/hypervisor/timer_el1.h
@@ -0,0 +1,20 @@
@@ -232,7 +232,7 @@ index 0000000..04a43b6
 +bool timer_el1_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
 +			      uintreg_t esr);
 diff --git a/src/arch/aarch64/msr.h b/src/arch/aarch64/msr.h
-index cd6778b..55e7833 100644
+index cd6778b4..55e78330 100644
 --- a/src/arch/aarch64/msr.h
 +++ b/src/arch/aarch64/msr.h
@@ -126,3 +126,11 @@
@@ -247,6 +247,4 @@ index cd6778b..55e7833 100644
 +#define MSR_CNTHPS_CTL_EL2 S3_4_C14_C5_1
 +#define MSR_CNTHPS_CVAL_EL2 S3_4_C14_C5_2
 +#define MSR_CNTHPS_TVAL_EL2 S3_4_C14_C5_0
-- 
-2.17.1

@@ -1,4 +1,4 @@
-From e918cc5179241e1d35ba4b465b035b74b88e55d2 Mon Sep 17 00:00:00 2001
+From 613dea068fa546956717ce0b60328e39d451f661 Mon Sep 17 00:00:00 2001
 From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
 Date: Fri, 29 Apr 2022 20:07:50 +0100
 Subject: [PATCH] tc: increase heap pages
@@ -6,14 +6,14 @@ Subject: [PATCH] tc: increase heap pages
 Upstream-Status: Pending
 Signed-off-by: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
 ---
- /BUILD.gn | 2 +-
+ BUILD.gn | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-diff --git a//BUILD.gn b//BUILD.gn
-index 5d84d13..4ea0890 100644
--- a//BUILD.gn
-+++ b//BUILD.gn
-@@ -233,7 +233,7 @@ aarch64_toolchains("secure_tc") {
+diff --git a/BUILD.gn b/BUILD.gn
+index 6b9b383..62ba763 100644
+--- a/BUILD.gn
+++ b/BUILD.gn
+@@ -235,7 +235,7 @@ aarch64_toolchains("secure_tc") {
   gicd_base_address = "0x30000000"
   gicr_base_address = "0x30080000"
   gicr_frames = 8
@@ -1,7 +1,7 @@
-From 380f2cf944dd5db36c168a11d31a46ad14cdcb6d Mon Sep 17 00:00:00 2001
+From 97a8ca1835f5d9512dacda497540d5523e56c7dd Mon Sep 17 00:00:00 2001
 From: Arunachalam Ganapathy <arunachalam.ganapathy@arm.com>
 Date: Tue, 26 Apr 2022 14:43:58 +0100
-Subject: [PATCH 4/5] feat: emulate interrupt controller register access
+Subject: [PATCH] feat: emulate interrupt controller register access

 This emulates ICC_SGI1R_EL1 and ICC_IGRPEN1_EL1 register

@@ -16,10 +16,10 @@ Upstream-Status: Inappropriate [Experimental feature]
 4 files changed, 97 insertions(+)

 diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
-index c9068c5..b9aa5d8 100644
+index 4c1b6e48..cd5146bd 100644
 --- a/src/arch/aarch64/hypervisor/handler.c
 +++ b/src/arch/aarch64/hypervisor/handler.c
-@@ -1282,6 +1282,11 @@ void handle_system_register_access(uintreg_t esr_el2)
+@@ -1283,6 +1283,11 @@ void handle_system_register_access(uintreg_t esr_el2)
 			inject_el1_unknown_exception(vcpu, esr_el2);
 			return;
 		}
@@ -32,7 +32,7 @@ index c9068c5..b9aa5d8 100644
 		inject_el1_unknown_exception(vcpu, esr_el2);
 		return;
 diff --git a/src/arch/aarch64/hypervisor/perfmon.c b/src/arch/aarch64/hypervisor/perfmon.c
-index f13b035..05e216c 100644
+index f13b0354..05e216c8 100644
 --- a/src/arch/aarch64/hypervisor/perfmon.c
 +++ b/src/arch/aarch64/hypervisor/perfmon.c
@@ -116,6 +116,10 @@
@@ -131,7 +131,7 @@ index f13b035..05e216c 100644
 +	return true;
 +}
 diff --git a/src/arch/aarch64/hypervisor/perfmon.h b/src/arch/aarch64/hypervisor/perfmon.h
-index 81669ba..c90d45b 100644
+index 81669ba1..c90d45bf 100644
 --- a/src/arch/aarch64/hypervisor/perfmon.h
 +++ b/src/arch/aarch64/hypervisor/perfmon.h
@@ -70,3 +70,8 @@ bool perfmon_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
@@ -144,7 +144,7 @@ index 81669ba..c90d45b 100644
 +bool intr_ctrl_el1_process_access(struct vcpu *vcpu, ffa_vm_id_t vm_id,
 +				  uintreg_t esr);
 diff --git a/src/arch/aarch64/msr.h b/src/arch/aarch64/msr.h
-index 55e7833..82aa884 100644
+index 55e78330..82aa8846 100644
 --- a/src/arch/aarch64/msr.h
 +++ b/src/arch/aarch64/msr.h
@@ -134,3 +134,6 @@
@@ -154,6 +154,4 @@ index 55e7833..82aa884 100644
 +
 +#define ICC_IGRPEN1_EL1 S3_0_C12_C12_7
 +#define ICC_SGI1R_EL1 S3_0_C12_C11_5
-- 
-2.17.1

@@ -1,4 +1,4 @@
-From c235511a06a54bcccec97b3067c1004d3957b1d8 Mon Sep 17 00:00:00 2001
+From 1fef5bd2504ce3a203c56a3b66dba773cd4893c6 Mon Sep 17 00:00:00 2001
 From: Davidson K <davidson.kumaresan@arm.com>
 Date: Thu, 8 Sep 2022 10:47:10 +0530
 Subject: [PATCH] feat(vhe): enable vhe and disable branch protection for TC
@@ -29,6 +29,3 @@ index 62ba763..f26ce03 100644
 +    enable_vhe = "1"
   }
 }
-- 
-2.34.1
-
@@ -1,4 +1,4 @@
-From 1e24b45a8ff34af45dda45c57f8403452d384f99 Mon Sep 17 00:00:00 2001
+From 1c4d28493faed6cf189c75fa91d19131e6a34e04 Mon Sep 17 00:00:00 2001
 From: Olivier Deprez <olivier.deprez@arm.com>
 Date: Mon, 8 Aug 2022 19:14:23 +0200
 Subject: [PATCH] feat: disable alignment check for EL0 partitions
@@ -40,7 +40,7 @@ Upstream-Status: Submitted [https://review.trustedfirmware.org/c/hafnium/hafnium
 8 files changed, 59 insertions(+), 30 deletions(-)

 diff --git a/src/arch/aarch64/hypervisor/cpu.c b/src/arch/aarch64/hypervisor/cpu.c
-index d2df77d..a000159 100644
+index d2df77d8..a000159b 100644
 --- a/src/arch/aarch64/hypervisor/cpu.c
 +++ b/src/arch/aarch64/hypervisor/cpu.c
@@ -115,7 +115,9 @@ void arch_regs_reset(struct vcpu *vcpu)
@@ -69,7 +69,7 @@ index d2df77d..a000159 100644
 		r->lazy.vttbr_el2 = pa_addr(table) | ((uint64_t)vm_id << 48);
 #if SECURE_WORLD == 1
 diff --git a/src/arch/aarch64/hypervisor/exceptions.S b/src/arch/aarch64/hypervisor/exceptions.S
-index 539e196..d3732f8 100644
+index 539e196d..d3732f86 100644
 --- a/src/arch/aarch64/hypervisor/exceptions.S
 +++ b/src/arch/aarch64/hypervisor/exceptions.S
@@ -20,6 +20,9 @@
@@ -147,7 +147,7 @@ index 539e196..d3732f8 100644
 	ret
 #endif
 diff --git a/src/arch/aarch64/hypervisor/feature_id.c b/src/arch/aarch64/hypervisor/feature_id.c
-index ed3bf8f..57f3262 100644
+index ed3bf8f1..57f32627 100644
 --- a/src/arch/aarch64/hypervisor/feature_id.c
 +++ b/src/arch/aarch64/hypervisor/feature_id.c
@@ -175,7 +175,7 @@ void feature_set_traps(struct vm *vm, struct arch_regs *regs)
@@ -177,7 +177,7 @@ index ed3bf8f..57f3262 100644
 		vm->arch.tid3_masks.id_aa64isar1_el1 &= ~ID_AA64ISAR1_EL1_GPI;
 		vm->arch.tid3_masks.id_aa64isar1_el1 &= ~ID_AA64ISAR1_EL1_GPA;
 diff --git a/src/arch/aarch64/hypervisor/handler.c b/src/arch/aarch64/hypervisor/handler.c
-index cd5146b..8a3d628 100644
+index cd5146bd..8a3d6289 100644
 --- a/src/arch/aarch64/hypervisor/handler.c
 +++ b/src/arch/aarch64/hypervisor/handler.c
@@ -272,9 +272,9 @@ noreturn void sync_current_exception_noreturn(uintreg_t elr, uintreg_t spsr)
@@ -241,7 +241,7 @@ index cd5146b..8a3d628 100644
 
 #if SECURE_WORLD == 1
 diff --git a/src/arch/aarch64/inc/hf/arch/types.h b/src/arch/aarch64/inc/hf/arch/types.h
-index 6379d73..6b8b24f 100644
+index 6379d73e..6b8b24f1 100644
 --- a/src/arch/aarch64/inc/hf/arch/types.h
 +++ b/src/arch/aarch64/inc/hf/arch/types.h
@@ -79,8 +79,13 @@ struct arch_regs {
@@ -261,7 +261,7 @@ index 6379d73..6b8b24f 100644
 	/*
 	 * System registers.
 diff --git a/src/arch/aarch64/mm.c b/src/arch/aarch64/mm.c
-index 8ee65ca..487ae35 100644
+index 8ee65ca0..487ae353 100644
 --- a/src/arch/aarch64/mm.c
 +++ b/src/arch/aarch64/mm.c
@@ -886,7 +886,7 @@ bool arch_mm_init(paddr_t table)
@@ -274,7 +274,7 @@ index 8ee65ca..487ae35 100644
 			     (0 << 30) |	    /* SA. */
 			     (0 << 29) |	    /* SW. */
 diff --git a/src/arch/aarch64/sysregs.c b/src/arch/aarch64/sysregs.c
-index e8c154b..087ba4e 100644
+index e8c154b1..087ba4ed 100644
 --- a/src/arch/aarch64/sysregs.c
 +++ b/src/arch/aarch64/sysregs.c
@@ -159,7 +159,7 @@ uintreg_t get_cptr_el2_value(void)
@@ -303,7 +303,7 @@ index e8c154b..087ba4e 100644
 	sctlr_el2_value |= SCTLR_EL2_SA;
 	sctlr_el2_value |= SCTLR_EL2_I;
 diff --git a/src/arch/aarch64/sysregs.h b/src/arch/aarch64/sysregs.h
-index babd237..6fdab58 100644
+index babd2375..6fdab58e 100644
 --- a/src/arch/aarch64/sysregs.h
 +++ b/src/arch/aarch64/sysregs.h
@@ -668,7 +668,7 @@ uintreg_t get_mdcr_el2_value(void);
@@ -315,6 +315,4 @@ index babd237..6fdab58 100644
 
 /**
  * Branch Target Identification mechanism support in AArch64 state.
-- 
-2.34.1

@@ -1,4 +1,4 @@
-From 02c8afc4f7315b4e12098ffeb8bd5e64e4891e78 Mon Sep 17 00:00:00 2001
+From 4b59905d2fec01cc17038b1c167b4e57e7835adf Mon Sep 17 00:00:00 2001
 From: Davidson K <davidson.kumaresan@arm.com>
 Date: Thu, 7 Oct 2021 12:20:08 +0530
 Subject: [PATCH] feat(vhe): set STAGE1_NS while mapping memory from NWd to SWd
@@ -17,7 +17,7 @@ Upstream-Status: Pending [Not submitted to upstream yet]
 1 file changed, 12 insertions(+)

 diff --git a/src/ffa_memory.c b/src/ffa_memory.c
-index 048cca9..8910cc7 100644
+index 048cca9c..8910cc79 100644
 --- a/src/ffa_memory.c
 +++ b/src/ffa_memory.c
@@ -2483,6 +2483,18 @@ struct ffa_value ffa_memory_retrieve(struct vm_locked to_locked,
@@ -39,6 +39,3 @@ index 048cca9..8910cc7 100644
 	ret = ffa_retrieve_check_update(
 		to_locked, memory_region->sender, share_state->fragments,
 		share_state->fragment_constituent_counts,
-- 
-2.34.1
-
@@ -9,15 +9,15 @@ PV = "2.7+git${SRCPV}"

 FILESEXTRAPATHS:prepend:tc := "${THISDIR}/files/tc:"

-SRC_URI:remove = "file://0001-Fix-build-with-clang-15.patch"
+SRC_URI:remove = "file://0003-Fix-build-with-clang-15.patch"

 SRC_URI:append = " \
        file://0001-feat-emulate-cntp-timer-register-accesses-using-cnth.patch \
        file://0002-feat-emulate-interrupt-controller-register-access.patch \
-        file://0003-tc-increase-heap-pages.patch;patchdir=project/reference \
-        file://0004-feat-disable-alignment-check-for-EL0-partitions.patch \
-        file://0005-feat-vhe-set-STAGE1_NS-while-mapping-memory-from-NWd.patch \
-        file://0006-feat-vhe-enable-vhe-and-disable-branch-protection-fo.patch;patchdir=project/reference \
+        file://0003-feat-disable-alignment-check-for-EL0-partitions.patch \
+        file://0004-feat-vhe-set-STAGE1_NS-while-mapping-memory-from-NWd.patch \
+        file://0001-tc-increase-heap-pages.patch;patchdir=project/reference \
+        file://0002-feat-vhe-enable-vhe-and-disable-branch-protection-fo.patch;patchdir=project/reference \
        "

 do_compile() {
@@ -6,16 +6,16 @@ LICENSE = "MIT"
 COMPATIBLE_MACHINE = "corstone1000"

 inherit image
-inherit wic_nopt tfm_sign_image
+inherit tfm_sign_image
 inherit  uefi_capsule

 PACKAGE_INSTALL = ""

-IMAGE_FSTYPES += "wic wic.nopt uefi_capsule"
+IMAGE_FSTYPES += "wic uefi_capsule"

 UEFI_FIRMWARE_BINARY = "${PN}-${MACHINE}.${CAPSULE_IMGTYPE}"
 UEFI_CAPSULE_CONFIG = "${THISDIR}/files/${PN}-capsule-update-image.json"
-CAPSULE_IMGTYPE = "wic.nopt"
+CAPSULE_IMGTYPE = "wic"

 do_sign_images() {
    # Sign TF-A BL2
@@ -24,7 +24,8 @@ do_sign_images() {

    # Update BL2 in the FIP image
    cp ${RECIPE_SYSROOT}/firmware/${TFA_FIP_BINARY} .
-    fiptool update --tb-fw ${TFM_IMAGE_SIGN_DIR}/signed_${TFA_BL2_BINARY} \
+    fiptool update --tb-fw \
+        ${TFM_IMAGE_SIGN_DEPLOY_DIR}/signed_${TFA_BL2_BINARY} \
        ${TFM_IMAGE_SIGN_DIR}/${TFA_FIP_BINARY}

    # Sign the FIP image
@@ -13,7 +13,8 @@ COMPATIBLE_MACHINE = "n1sdp"

 SRC_URI = "git://git.gitlab.arm.com/arm-reference-solutions/board-firmware.git;protocol=https;branch=n1sdp"

-SRCREV = "6d5253584a9c2fdc2edbdc39bf6f2436215d1382"
+SRCREV = "70ba494265eee76747faff38264860c19e214540"
+PV .= "+git${SRCPV}"

 S = "${WORKDIR}/git"

@@ -10,7 +10,7 @@ do_install:append() {
    for TYPE in ${FW_INSTALL}; do
        if [ "$TYPE" = "romfw_bypass" ]; then
            install -D "${B}/${TYPE}/${FW_TARGETS}/bin/${SCP_PLATFORM}-bl1-bypass.bin" "${D}/firmware/${FW}_${TYPE}.bin"
-            install -D "${B}/${TYPE}/${FW_TARGETS}/bin/${SCP_PLATFORM}-bl1-bypass" "${D}/firmware/${FW}_${TYPE}.elf"
+            install -D "${B}/${TYPE}/${FW_TARGETS}/bin/${SCP_PLATFORM}-bl1-bypass.elf" "${D}/firmware/${FW}_${TYPE}.elf"
        fi
    done
 }
@@ -3,9 +3,6 @@
 SCP_PLATFORM  = "n1sdp"
 SCP_LOG_LEVEL = "INFO"

-SRCREV  = "de7e464ecd77130147103cf48328099c2d0e6289"
-PV .= "+git${SRCPV}"
-
 COMPATIBLE_MACHINE:n1sdp = "n1sdp"

 DEPENDS += "fiptool-native"
@@ -0,0 +1,167 @@
+From 360aa32846a97e775750e06865d462c6258179fa Mon Sep 17 00:00:00 2001
+From: Mohamed Omar Asaker <mohamed.omarasaker@arm.com>
+Date: Mon, 9 Jan 2023 13:59:06 +0000
+Subject: [PATCH] feat(corstone1000): bl2 loads fip based on metadata
+
+Previously bl2 was reading the boot_index directly with a hard coded
+address and then set the fip image spec with fip offsets base based on
+the boot_index value.
+This commit removes this logic and rely on PSA_FWU_SUPPORT
+which reads the fip partition based on the active firmware bank written in
+metadata.
+
+Note: fip partition contains signature area at the begining. Hence, the fip
+image starts at fip partition + fip signature area size.
+
+Upstream-Status: Pending
+Signed-off-by: Mohamed Omar Asaker <mohamed.omarasaker@arm.com>
+
+%% original patch: 0002-feat-corstone1000-bl2-loads-fip-based-on-metadata.patch
+---
+ bl2/bl2_main.c                                |  4 +++
+ .../corstone1000/common/corstone1000_plat.c   | 32 ++++++-------------
+ .../common/include/platform_def.h             | 12 +++----
+ tools/cert_create/Makefile                    |  4 +--
+ tools/fiptool/Makefile                        |  4 +--
+ 5 files changed, 24 insertions(+), 32 deletions(-)
+
+diff --git a/bl2/bl2_main.c b/bl2/bl2_main.c
+index 5da803795..f25dc3029 100644
+--- a/bl2/bl2_main.c
+++ b/bl2/bl2_main.c
+@@ -86,6 +86,10 @@ void bl2_main(void)
+ 	/* Perform remaining generic architectural setup in S-EL1 */
+ 	bl2_arch_setup();
+ 
+#if ARM_GPT_SUPPORT
+	partition_init(GPT_IMAGE_ID);
+#endif
+
+ #if PSA_FWU_SUPPORT
+ 	fwu_init();
+ #endif /* PSA_FWU_SUPPORT */
+diff --git a/plat/arm/board/corstone1000/common/corstone1000_plat.c b/plat/arm/board/corstone1000/common/corstone1000_plat.c
+index 0235f8b84..7f9708a82 100644
+--- a/plat/arm/board/corstone1000/common/corstone1000_plat.c
+++ b/plat/arm/board/corstone1000/common/corstone1000_plat.c
+@@ -33,36 +33,17 @@ const mmap_region_t plat_arm_mmap[] = {
+ static void set_fip_image_source(void)
+ {
+ 	const struct plat_io_policy *policy;
+-	/*
+-	 * metadata for firmware update is written at 0x0000 offset of the flash.
+-	 * PLAT_ARM_BOOT_BANK_FLAG contains the boot bank that TF-M is booted.
+-	 * As per firmware update spec, at a given point of time, only one bank
+-	 * is active. This means, TF-A should boot from the same bank as TF-M.
+-	 */
+-	volatile uint32_t *boot_bank_flag = (uint32_t *)(PLAT_ARM_BOOT_BANK_FLAG);
+-
+-	if (*boot_bank_flag > 1) {
+-		VERBOSE("Boot_bank is set higher than possible values");
+-	}
+-
+-	VERBOSE("Boot bank flag = %u.\n\r", *boot_bank_flag);
+ 
+ 	policy = FCONF_GET_PROPERTY(arm, io_policies, FIP_IMAGE_ID);
+ 
+ 	assert(policy != NULL);
+ 	assert(policy->image_spec != 0UL);
+ 
+	/* FIP Partition contains Signature area at the begining which TF-A doesn't expect */
+ 	io_block_spec_t *spec = (io_block_spec_t *)policy->image_spec;
+	spec->offset += FIP_SIGNATURE_AREA_SIZE;
+	spec->length -= FIP_SIGNATURE_AREA_SIZE;
+ 
+-	if ((*boot_bank_flag) == 0) {
+-		VERBOSE("Booting from bank 0: fip offset = 0x%lx\n\r",
+-						PLAT_ARM_FIP_BASE_BANK0);
+-		spec->offset = PLAT_ARM_FIP_BASE_BANK0;
+-	} else {
+-		VERBOSE("Booting from bank 1: fip offset = 0x%lx\n\r",
+-						PLAT_ARM_FIP_BASE_BANK1);
+-		spec->offset = PLAT_ARM_FIP_BASE_BANK1;
+-	}
+ }
+ 
+ void bl2_platform_setup(void)
+@@ -75,6 +56,13 @@ void bl2_platform_setup(void)
+ 	set_fip_image_source();
+ }
+ 
+void bl2_early_platform_setup2(u_register_t arg0, u_register_t arg1,
+			       u_register_t arg2, u_register_t arg3)
+{
+	arm_bl2_early_platform_setup((uintptr_t)arg0, (meminfo_t *)arg1);
+	NOTICE("CS1k: early at bl2_platform_setup\n");
+}
+
+ /* corstone1000 only has one always-on power domain and there
+  * is no power control present
+  */
+diff --git a/plat/arm/board/corstone1000/common/include/platform_def.h b/plat/arm/board/corstone1000/common/include/platform_def.h
+index 584d485f3..0bfab05a4 100644
+--- a/plat/arm/board/corstone1000/common/include/platform_def.h
+++ b/plat/arm/board/corstone1000/common/include/platform_def.h
+@@ -173,16 +173,16 @@
+ 
+ /* NOR Flash */
+ 
+-#define PLAT_ARM_BOOT_BANK_FLAG		UL(0x08002000)
+-#define PLAT_ARM_FIP_BASE_BANK0		UL(0x081EF000)
+-#define PLAT_ARM_FIP_BASE_BANK1		UL(0x0916F000)
+-#define PLAT_ARM_FIP_MAX_SIZE		UL(0x1ff000)  /* 1.996 MB */
+-
+ #define PLAT_ARM_NVM_BASE		V2M_FLASH0_BASE
+ #define PLAT_ARM_NVM_SIZE		(SZ_32M)  /* 32 MB */
+#define PLAT_ARM_FIP_MAX_SIZE		UL(0x1ff000)  /* 1.996 MB */
+ 
+-#define PLAT_ARM_FLASH_IMAGE_BASE	PLAT_ARM_FIP_BASE_BANK0
+#define PLAT_ARM_FLASH_IMAGE_BASE	UL(0x08000000)
+ #define PLAT_ARM_FLASH_IMAGE_MAX_SIZE	PLAT_ARM_FIP_MAX_SIZE
+#define PLAT_ARM_FIP_OFFSET_IN_GPT	(0x86000)
+
+/* FIP Information */
+#define FIP_SIGNATURE_AREA_SIZE         (0x1000)      /* 4 KB */
+ 
+ /*
+  * Some data must be aligned on the biggest cache line size in the platform.
+diff --git a/tools/cert_create/Makefile b/tools/cert_create/Makefile
+index ca548b836..32b5486a0 100644
+--- a/tools/cert_create/Makefile
+++ b/tools/cert_create/Makefile
+@@ -69,8 +69,8 @@ INC_DIR += -I ./include -I ${PLAT_INCLUDE} -I ${OPENSSL_DIR}/include
+ # directory. However, for a local build of OpenSSL, the built binaries are
+ # located under the main project directory (i.e.: ${OPENSSL_DIR}, not
+ # ${OPENSSL_DIR}/lib/).
+-LIB_DIR := -L ${OPENSSL_DIR}/lib -L ${OPENSSL_DIR}
+-LIB := -lssl -lcrypto
+LIB_DIR := -L ${OPENSSL_DIR}/lib -L ${OPENSSL_DIR} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS}
+LIB := -lssl -lcrypto ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS}
+ 
+ HOSTCC ?= gcc
+ 
+diff --git a/tools/fiptool/Makefile b/tools/fiptool/Makefile
+index e6aeba95b..7c047479e 100644
+--- a/tools/fiptool/Makefile
+++ b/tools/fiptool/Makefile
+@@ -29,7 +29,7 @@ endif
+ # directory. However, for a local build of OpenSSL, the built binaries are
+ # located under the main project directory (i.e.: ${OPENSSL_DIR}, not
+ # ${OPENSSL_DIR}/lib/).
+-LDLIBS := -L${OPENSSL_DIR}/lib -L${OPENSSL_DIR} -lcrypto
+LDLIBS := -L${OPENSSL_DIR}/lib -L${OPENSSL_DIR} -lcrypto ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS} ${BUILD_LDFLAGS}
+ 
+ ifeq (${V},0)
+   Q := @
+@@ -37,7 +37,7 @@ else
+   Q :=
+ endif
+ 
+-INCLUDE_PATHS := -I../../include/tools_share  -I${OPENSSL_DIR}/include
+INCLUDE_PATHS := -I../../include/tools_share  -I${OPENSSL_DIR}/include ${BUILD_CFLAGS} ${BUILD_CFLAGS} ${BUILD_CFLAGS} ${BUILD_CFLAGS} ${BUILD_CFLAGS} ${BUILD_CFLAGS}
+ 
+ HOSTCC ?= gcc
+ 
+-- 
+2.25.1
+
@@ -0,0 +1,42 @@
+From 2d305094f8f500362079e9e7637d46129bf980e4 Mon Sep 17 00:00:00 2001
+From: Adam Johnston <adam.johnston@arm.com>
+Date: Tue, 25 Jul 2023 16:05:51 +0000
+Subject: [PATCH] n1sdp: Reserve OP-TEE memory from NWd
+
+The physical memory which is used to run OP-TEE on the N1SDP is known
+to the secure world via TOS_FW_CONFIG, but it may not be known to the
+normal world.
+
+As a precaution, explicitly reserve this memory via NT_FW_CONFIG to
+prevent the normal world from using it. This is not required on most
+platforms as the Trusted OS is run from secure RAM.
+
+Upstream-Status: Pending (not yet submitted to upstream)
+Signed-off-by: Adam Johnston <adam.johnston@arm.com>
+Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+---
+ plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts b/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts
+index da5e04ddb6..b7e2d4e86f 100644
+--- a/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts
+++ b/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts
+@@ -20,4 +20,16 @@
+ 		local-ddr-size = <0x0>;
+ 		remote-ddr-size = <0x0>;
+ 	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		optee@0xDE000000 {
+			compatible = "removed-dma-pool";
+			reg = <0x0 0xDE000000 0x0 0x02000000>;
+			no-map;
+		};
+	};
+ };
+\ No newline at end of file
@@ -0,0 +1,30 @@
+From 15dab90c3cb8e7677c4f953c2269e8ee1afa01b0 Mon Oct 2 13:45:43 2023
+From: Mariam Elshakfy <mariam.elshakfy@arm.com>
+Date: Mon, 2 Oct 2023 13:45:43 +0000
+Subject: [PATCH] Modify BL32 Location to DDR4
+
+Since OP-TEE start address is changed to run
+from DDR4, this patch changes BL32 entrypoint
+to the correct one.
+
+Upstream-Status: Pending (not yet submitted to upstream)
+Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+---
+ plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts b/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts
+index ed870803c..797dfe3a4 100644
+--- a/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts
+++ b/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts
+@@ -22,8 +22,8 @@
+ 		maj_ver = <0x1>;
+ 		min_ver = <0x0>;
+ 		exec_state = <0x0>;
+-		load_address = <0x0 0x08000000>;
+-		entrypoint = <0x0 0x08000000>;
+		load_address = <0x0 0xDE000000>;
+		entrypoint = <0x0 0xDE000000>;
+ 		binary_size = <0x2000000>;
+ 	};
+ 
@@ -0,0 +1,28 @@
+From 9a1d11b9fbadf740c73aee6dca4fd0370b38e4a8 Tue Oct 3 13:49:13 2023
+From: Mariam Elshakfy <mariam.elshakfy@arm.com>
+Date: Tue, 3 Oct 2023 13:49:13 +0000
+Subject: [PATCH] Modify SPMC Base to DDR4
+
+Since OP-TEE start address is changed to run
+from DDR4, this patch changes SPMC base to 
+the correct one.
+
+Upstream-Status: Pending (not yet submitted to upstream)
+Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+---
+ plat/arm/board/n1sdp/include/platform_def.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plat/arm/board/n1sdp/include/platform_def.h b/plat/arm/board/n1sdp/include/platform_def.h
+index b3799a7b2..b12c61b61 100644
+--- a/plat/arm/board/n1sdp/include/platform_def.h
+++ b/plat/arm/board/n1sdp/include/platform_def.h
+@@ -118,7 +118,7 @@
+ 
+ #define PLAT_ARM_MAX_BL31_SIZE		UL(0x40000)
+ 
+-#define PLAT_ARM_SPMC_BASE		U(0x08000000)
+#define PLAT_ARM_SPMC_BASE		U(0xDE000000)
+ #define PLAT_ARM_SPMC_SIZE		UL(0x02000000)  /* 32 MB */
+ 
+ 
@@ -0,0 +1,4 @@
+# Machine specific TFAs
+
+COMPATIBLE_MACHINE:corstone1000 = "corstone1000"
+SRCREV:corstone1000 = "5f591f67738a1bbe6b262c53d9dad46ed8bbcd67"
@@ -6,7 +6,8 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files/corstone1000:"

 SRC_URI:append = " \ 
 	file://0001-Fix-FF-A-version-in-SPMC-manifest.patch \
-	"
+    file://0002-feat-corstone1000-bl2-loads-fip-based-on-metadata.patch \
+    "

 TFA_DEBUG = "1"
 TFA_UBOOT ?= "1"
@@ -31,8 +32,12 @@ EXTRA_OEMAKE:append = " \
                        CREATE_KEYS=1 \
                        GENERATE_COT=1 \
                        TRUSTED_BOARD_BOOT=1 \
+                        ARM_GPT_SUPPORT=1 \
+                        PSA_FWU_SUPPORT=1 \
+                        NR_OF_IMAGES_IN_FW_BANK=4 \
                        COT=tbbr \
                        ARM_ROTPK_LOCATION=devel_rsa  \
+                        ERRATA_A35_855472=1 \
                        ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem \
                        BL32=${RECIPE_SYSROOT}/lib/firmware/tee-pager_v2.bin \
                        LOG_LEVEL=50 \
@@ -1,12 +0,0 @@
-# Armv7-A FVP specific TFA parameters
-
-COMPATIBLE_MACHINE = "fvp-base-arm32"
-TFA_PLATFORM = "fvp"
-TFA_UBOOT = "1"
-TFA_BUILD_TARGET = "dtbs bl1 bl32 fip"
-
-EXTRA_OEMAKE:append = " \
-    ARCH=aarch32 \
-    AARCH32_SP=sp_min \
-    "
-
@@ -8,5 +8,5 @@ COMPATIBLE_MACHINE = "fvp-base"
 TFA_PLATFORM = "fvp"
 TFA_DEBUG = "1"
 TFA_MBEDTLS = "1"
-TFA_UBOOT = "1"
+TFA_UBOOT ?= "1"
 TFA_BUILD_TARGET = "bl1 bl2 bl31 dtbs fip"
@@ -1,9 +1,5 @@
 # N1SDP specific TFA support

-# Align with post-N1SDP-2022.06.22 refresh
-SRCREV_tfa  = "1309c6c805190bd376c0561597653f3f8ecd0f58"
-PV .= "+git${SRCPV}"
-
 COMPATIBLE_MACHINE = "n1sdp"
 TFA_PLATFORM       = "n1sdp"
 TFA_BUILD_TARGET   = "all fip"
@@ -13,6 +9,14 @@ TFA_MBEDTLS        = "1"
 TFA_UBOOT          = "0"
 TFA_UEFI           = "1"

+FILESEXTRAPATHS:prepend := "${THISDIR}/files/n1sdp:"
+
+SRC_URI:append = " \ 
+    file://0001-Reserve-OP-TEE-memory-from-nwd.patch \
+    file://0002-Modify-BL32-Location-to-DDR4.patch \
+    file://0003-Modify-SPMC-Base-to-DDR4.patch \
+    "
+
 TFA_ROT_KEY= "plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem"

 # Enabling Secure-EL1 Payload Dispatcher (SPD)
@@ -6,7 +6,6 @@ MACHINE_TFA_REQUIRE ?= ""
 MACHINE_TFA_REQUIRE:corstone500 = "trusted-firmware-a-corstone500.inc"
 MACHINE_TFA_REQUIRE:corstone1000 = "trusted-firmware-a-corstone1000.inc"
 MACHINE_TFA_REQUIRE:fvp-base = "trusted-firmware-a-fvp.inc"
-MACHINE_TFA_REQUIRE:fvp-base-arm32 = "trusted-firmware-a-fvp-arm32.inc"
 MACHINE_TFA_REQUIRE:juno = "trusted-firmware-a-juno.inc"
 MACHINE_TFA_REQUIRE:n1sdp = "trusted-firmware-a-n1sdp.inc"
 MACHINE_TFA_REQUIRE:sgi575 = "trusted-firmware-a-sgi575.inc"
--- a/Show More
+++ b/Show More