CI: only run pending-updates on master

This job takes a few minutes and isn't useful unless it's being ran for master, or is being actively worked on. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Jon Mason <jon.mason@arm.com>
arm-systemready/ir-acs: Update URL
2026-07-18 04:27:08 +00:00 · 2025-11-05 09:35:03 -05:00 · 2025-09-08 10:00:15 -04:00 · 2025-04-29 11:00:13 -04:00 · 2025-04-29 11:00:13 -04:00 · 2025-04-04 13:55:39 -04:00
279 changed files with 11860 additions and 6884 deletions
@@ -1,2 +0,0 @@
-[b4]
-	send-series-to = meta-arm@lists.yoctoproject.org
@@ -1,4 +1,4 @@
-image: ${MIRROR_GHCR}/siemens/kas/kas:4.4
+image: ${MIRROR_GHCR}/siemens/kas/kas:4.3.2

 variables:
  # These are needed as the k8s executor doesn't respect the container
@@ -34,14 +34,13 @@ stages:
  interruptible: true
  variables:
    KAS_WORK_DIR: $CI_PROJECT_DIR/work
-    KAS_BUILD_DIR: $KAS_WORK_DIR/build
    KAS_REPO_REF_DIR: $CACHE_DIR/repos
    SSTATE_DIR: $CACHE_DIR/sstate
    DL_DIR: $CACHE_DIR/downloads
    BB_LOGCONFIG: $CI_PROJECT_DIR/ci/logging.yml
    TOOLCHAIN_DIR: $CACHE_DIR/toolchains
-    IMAGE_DIR: $KAS_BUILD_DIR/tmp/deploy/images
-    TOOLCHAIN_LINK_DIR: $KAS_BUILD_DIR/toolchains
+    IMAGE_DIR: $CI_PROJECT_DIR/work/build/tmp/deploy/images
+    TOOLCHAIN_LINK_DIR: $CI_PROJECT_DIR/work/build/toolchains
  before_script:
    - echo KAS_WORK_DIR = $KAS_WORK_DIR
    - echo SSTATE_DIR = $SSTATE_DIR
@@ -76,17 +75,13 @@ stages:
    - echo KASFILES=$KASFILES
    - kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES
    - kas build $KASFILES
-    - ./ci/check-warnings $KAS_BUILD_DIR/warnings.log
-    - kas shell ci/base.yml:lockfile.yml --command "$CI_PROJECT_DIR/ci/junit.sh $KAS_WORK_DIR/build"
-
+    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
  artifacts:
    name: "logs"
    when: always
    paths:
-      - $KAS_BUILD_DIR/tmp*/work*/**/temp/log.do_*.*
-      - $KAS_BUILD_DIR/tmp*/work*/**/testimage/*
-    reports:
-      junit: $KAS_BUILD_DIR/tmp/log/oeqa/junit.xml
+      - $CI_PROJECT_DIR/work/build/tmp*/work*/**/temp/log.do_*.*
+      - $CI_PROJECT_DIR/work/build/tmp*/work*/**/testimage/*

 #
 # Prep stage, update repositories once.
@@ -116,7 +111,7 @@ update-repos:
 # Build stage, the actual build jobs
 #
 # Available options for building are
-#  DISTRO: [poky, poky-altcfg, poky-tiny]
+#  DISTRO: [poky, poky-tiny]
 #  KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
 #  TOOLCHAINS: [gcc, clang, external-gccarm]
 #  TCLIBC: [glibc, musl]
@@ -124,7 +119,6 @@ update-repos:
 #  TS: [none, trusted-services]
 #  VIRT: [none, xen]
 #  TESTING: testimage
-#  SECUREDEBUG: [none, secure-debug]

 arm-systemready-ir-acs:
  extends: .build
@@ -134,7 +128,7 @@ arm-systemready-ir-acs:
      # arm-systemready-ir-acs must be specified after fvp-base for ordering
      # purposes for the jobs-to-kas output. It is not enough to just have it
      # in the job name because fvp-base.yml overwrites the target.
-      - PLATFORM: [fvp-base, corstone1000-fvp]
+      - PLATFORM: fvp-base
        ARM_SYSTEMREADY_IR_ACS: arm-systemready-ir-acs
  tags:
    - ${ACS_TAG}
@@ -166,7 +160,6 @@ corstone1000-mps3:
      - FIRMWARE: corstone1000-firmware-only
        TESTING: [none, tftf]
      - FIRMWARE: none
-        SECUREDEBUG: [none, secure-debug]

 documentation:
  extends: .setup
@@ -197,10 +190,22 @@ fvp-base:
    matrix:
      - TS: [none, fvp-base-ts]
        TESTING: testimage
-      - FIRMWARE: [u-boot, edk2]
-        TESTING: testimage
+      - FIRMWARE: edk2
      - SYSTEMREADY_FIRMWARE: arm-systemready-firmware

+arm-systemready-ir-acs:
+  extends: .build
+  timeout: 12h
+  parallel:
+    matrix:
+      # arm-systemready-ir-acs must be specified after fvp-base for ordering
+      # purposes for the jobs-to-kas output. It is not enough to just have it
+      # in the job name because fvp-base.yml overwrites the target.
+      - PLATFORM: [fvp-base, corstone1000-fvp]
+        ARM_SYSTEMREADY_IR_ACS: arm-systemready-ir-acs
+  tags:
+    - ${ACS_TAG}
+
 fvps:
  extends: .build

@@ -242,8 +247,19 @@ musca-b1:
 musca-s1:
  extends: .build

+n1sdp:
+  extends: .build
+  parallel:
+    matrix:
+      - TESTING: [none, n1sdp-ts, n1sdp-optee, tftf]
+
 pending-updates:
  extends: .setup
+  # Only run this job for the default branch (master), or if forced with
+  # BUILD_FORCE_PENDING_UPDATES.
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $BUILD_FORCE_PENDING_UPDATES != null
  artifacts:
    paths:
      - update-report
@@ -265,10 +281,6 @@ qemuarm64-secureboot:
        TCLIBC: [glibc, musl]
        TS: [none, qemuarm64-secureboot-ts]
        TESTING: testimage
-      - TOOLCHAINS: [gcc, clang]
-        TS: [none, qemuarm64-secureboot-ts]
-        UEFISB: [none, uefi-secureboot]
-        TESTING: testimage
      - KERNEL: linux-yocto-dev
        TESTING: testimage

@@ -332,8 +344,6 @@ sbsa-ref:
      - KERNEL: [linux-yocto, linux-yocto-rt]
        TOOLCHAINS: [gcc, clang]
        TESTING: testimage
-      - DISTRO: poky-altcfg
-        TESTING: testimage
      - KERNEL: linux-yocto-dev
        TESTING: testimage

@@ -8,7 +8,7 @@ This repository contains the Arm layers for OpenEmbedded.

 * meta-arm-bsp

-  This layer contains machines for Arm reference platforms, for example FVP Base, Corstone1000, and Juno.
+  This layer contains machines for Arm reference platforms, for example FVP Base, N1SDP, and Juno.

 * meta-arm-toolchain

@@ -19,23 +19,19 @@ Other Directories

 * ci

-  This directory contains gitlab continuous integration configuration files (KAS yaml files) as well as scripts needed for this.
-
-* documentation
-
-  This directory contains information on the files in this repository, building, and other relevant documents.
+  This directory contains gitlab continuous integration configuration files (KAS yaml files) as well as scripts needed for this

 * kas

-  This directory contains KAS yaml files to describe builds for systems not used in CI.
+  This directory contains KAS yaml files to describe builds for systems not used in CI

 * scripts

-  This directory contains scripts used in running the CI tests.
+  This directory contains scripts used in running the CI tests

 Mailing List
 ------------
-To interact with the meta-arm developer community, please email the meta-arm mailing list at <meta-arm@lists.yoctoproject.org>.
+To interact with the meta-arm developer community, please email the meta-arm mailing list at meta-arm@lists.yoctoproject.org
 Currently, it is configured to only allow emails to members from those subscribed.
 To subscribe to the meta-arm mailing list, please go to
 https://lists.yoctoproject.org/g/meta-arm
@@ -46,51 +42,32 @@ Currently, we only accept patches from the meta-arm mailing list.  For general
 information on how to submit a patch, please read
 https://www.openembedded.org/wiki/How_to_submit_a_patch_to_OpenEmbedded

-E-mail <meta-arm@lists.yoctoproject.org> with patches created using this process. You can configure git-send-email to automatically use this address for the meta-arm repository with the following git command:
+E-mail meta-arm@lists.yoctoproject.org with patches created using this process. You can configure git-send-email to automatically use this address for the meta-arm repository with the following git command:

-`$ git config --local --add sendemail.to meta-arm@lists.yoctoproject.org`
+$ git config --local --add sendemail.to meta-arm@lists.yoctoproject.org

 Commits and patches added should follow the OpenEmbedded patch guidelines:

 https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines

 The component being changed in the shortlog should be prefixed with the layer name (without the meta- prefix), for example:
->  arm-bsp/trusted-firmware-a: decrease frobbing level

->  arm-toolchain/gcc: enable foobar v2
+  arm-bsp/trusted-firmware-a: decrease frobbing level

-All contributions are under the [MIT License](/COPYING.MIT).
-
-For a quick start guide on how to build and use meta-arm, go to [quick-start.md](/documentation/quick-start.md).
-
-For information on the continuous integration done on meta-arm and how to use it, go to [continuous-integration-and-kas.md](/documentation/continuous-integration-and-kas.md).
-
-Backporting
--------------
-Backporting patches to older releases may be done upon request, but only after a version of the patch has been accepted into the master branch.  This is done by adding the branch name to email subject line.  This should be between the square brackets (e.g., "[" and "]"), and before or after the "PATCH".  For example,
-> [nanbield PATCH] arm/linux-yocto: backport patch to fix 6.5.13 networking issues
-
-Automatic backporting will be done to all branches if the "Fixes: <SHA>" wording is added to the patch commit message.  This is similar to how the Linux kernel community does their LTS kernel backporting.  For more information see the "Fixes" portion of
-https://www.kernel.org/doc/html/latest/process/submitting-patches.html#submittingpatches
+  arm-toolchain/gcc: enable foobar v2

 Releases and Release Schedule
 --------------
 We follow the Yocto Project release methodology, schedule, and stable/LTS support timelines.  For more information on these, please reference:
-* https://docs.yoctoproject.org/ref-manual/release-process.html
-* https://wiki.yoctoproject.org/wiki/Releases
-* https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS
-
-For more in-depth information on the meta-arm release and branch methodology, go to </documentation/releases.md>.
+https://docs.yoctoproject.org/ref-manual/release-process.html
+https://wiki.yoctoproject.org/wiki/Releases
+https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS

 Reporting bugs
 --------------
-E-mail <meta-arm@lists.yoctoproject.org> with the error encountered and the steps
+E-mail meta-arm@lists.yoctoproject.org with the error encountered and the steps
 to reproduce the issue.

-Security and Reporting Security Issues
--------------
-For information on the security of meta-arm and how to report issues, please consult [SECURITY.md](/SECURITY.md).
-
 Maintainer(s)
 -------------
 * Jon Mason <jon.mason@arm.com>
@@ -18,7 +18,7 @@ number), please contact the meta-arm mailing list at
 meta-arm@lists.yoctoproject.org and arm-security@arm.com.

 If you are dealing with a not-yet released or urgent issue, please send a mail
-to the maintainers \(see [README.md](/README.md)\) and arm-security@arm.com, including as much
+to the maintainers (see README.md) and arm-security@arm.com, including as much
 detail as possible.  Encrypted emails using PGP are welcome.

 For more information, please visit https://developer.arm.com/support/arm-security-updates/report-security-vulnerabilities.
@@ -27,20 +27,11 @@ For more information, please visit https://developer.arm.com/support/arm-securit
 ## Branches maintained with security fixes

 meta-arm follows the Yocto release model, so see
-[Stable release and LTS](https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS)
-for detailed info regarding the policies and maintenance of stable
+[https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and
+LTS] for detailed info regarding the policies and maintenance of stable
 branches.

-The [Release page](https://wiki.yoctoproject.org/wiki/Releases) contains a list of all
+The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all
 releases of the Yocto Project. Versions in grey are no longer actively maintained with
 security patches, but well-tested patches may still be accepted for them for
 significant issues.
-
-
-# Disclaimer
-
-Arm reference solutions are Arm public example software projects that track and
-pull upstream components, incorporating their respective security fixes
-published over time. Arm partners are responsible for ensuring that the
-components they use contain all the required security fixes, if and when they
-deploy a product derived from Arm reference solutions.
@@ -7,7 +7,7 @@ distro: poky

 defaults:
  repos:
-    branch: styhead
+    branch: scarthgap

 repos:
  meta-arm:
@@ -29,7 +29,6 @@ env:
 local_conf_header:
  base: |
    CONF_VERSION = "2"
-    BB_SERVER_TIMEOUT = "300"
  setup: |
    PACKAGE_CLASSES = "package_ipk"
    PACKAGECONFIG:remove:pn-qemu-system-native = "gtk+ sdl"
@@ -10,3 +10,12 @@ repos:
 local_conf_header:
  toolchain: |
    TOOLCHAIN = "clang"
+    PREFERRED_PROVIDER_llvm = "clang"
+    PREFERRED_PROVIDER_llvm-native = "clang-native"
+    PREFERRED_PROVIDER_nativesdk-llvm = "nativesdk-clang"
+    PROVIDES:pn-clang = "llvm"
+    PROVIDES:pn-clang-native = "llvm-native"
+    PROVIDES:pn-nativesdk-clang = "nativesdk-llvm"
+    # This is needed to stop bitbake getting confused about what clang/llvm is
+    # being used, see https://github.com/kraj/meta-clang/pull/766
+    BBMASK += "/meta/recipes-devtools/llvm/llvm.*\.bb"
@@ -15,3 +15,5 @@ local_conf_header:

    QB_DEFAULT_BIOS = "QEMU_EFI.fd"
    WKS_FILE ?= "efi-disk.wks.in"
+  failing_tests: |
+    TEST_SUITES:remove = "xorg"
@@ -9,5 +9,5 @@ header:
 machine: fvp-base

 target:
-  - core-image-full-cmdline
+  - core-image-sato
  - boot-wrapper-aarch64
@@ -7,3 +7,8 @@ local_conf_header:
  testimagefvp: |
    LICENSE_FLAGS_ACCEPTED += "Arm-FVP-EULA"
    IMAGE_CLASSES += "fvpboot"
+  failing_tests: |
+    # This fails but we can't add to the ignorelist from meta-arm yet
+    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
+    TEST_SUITES:remove = "parselogs"
+    TEST_SUITES:remove = "xorg"
@@ -14,8 +14,5 @@ local_conf_header:
  bootloader: |
    # If running genericarm64 in a qemu we need to manually build the bootloader
    EXTRA_IMAGEDEPENDS += "virtual/bootloader"
-  sshpregen: |
-    # Allow the use of the pregen keys as this is CI so safe
-    COMPATIBLE_MACHINE:pn-ssh-pregen-hostkeys:genericarm64 = "genericarm64"

 machine: genericarm64
@@ -2,7 +2,7 @@
 set -u -e

 BASENAME=arm-gnu-toolchain
-VER=${VER:-13.3.rel1}
+VER=${VER:-13.2.Rel1}
 HOST_ARCH=${HOST_ARCH:-$(uname -m)}

 # Use the standard kas container locations if nothing is passed into the script
@@ -1,15 +0,0 @@
-#! /bin/bash
-
-# $ ci/junit.sh <build directory>
-#
-# If there is a OEQA test report in JSON format present in the build directory,
-# transform it to JUnit XML using resulttool.
-
-set -e -u
-
-BUILDDIR=$1
-JSON=$BUILDDIR/tmp/log/oeqa/testresults.json
-
-if test -f $JSON; then
-    resulttool junit $JSON
-fi
@@ -0,0 +1,14 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
+
+header:
+  version: 14
+
+# Config specific for the optee-xtests
+local_conf_header:
+  optee-test: |
+    # Include ARM FFA
+    MACHINE_FEATURES:append = " arm-ffa"
+    # Include trusted services
+    TEST_SUITES:append = " trusted_services"
+    # Include Optee xtests
+    IMAGE_INSTALL:append = " optee-test"
@@ -0,0 +1,16 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
+
+header:
+  version: 14
+  includes:
+    - ci/meta-openembedded.yml
+
+local_conf_header:
+  trusted_services: |
+    TEST_SUITES:append = " trusted_services"
+    # Include TS Crypto, TS Protected Storage, TS Internal and Trusted Storage SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its"
+    # Include TS demo/test tools into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests"
+    # Include TS PSA Arch tests into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"
@@ -2,7 +2,11 @@

 header:
  version: 14
+  includes:
+    - ci/base.yml
+
+machine: n1sdp

 local_conf_header:
-  fvp-multicore: |
-    MACHINE_FEATURES += "corstone1000_fvp_smp"
+  unsupported_trusted_services: |
+    MACHINE_FEATURES:remove = "ts-smm-gateway"
@@ -1,4 +0,0 @@
-header:
-  version: 14
-
-distro: poky-altcfg
@@ -8,9 +8,8 @@ header:
 local_conf_header:
  trusted_services: |
    TEST_SUITES:append = " trusted_services"
-    # Include TS Crypto, TS Protected Storage, and TS Internal Trusted Storage and SPs into optee-os image
-    # FIXME - remove TS SMM Gateway due to QEMU v9.0.0 test failures
-    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its"
+    # Include TS Crypto, TS Protected Storage, TS Internal Trusted Storage and SMM-Gateway SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its ts-smm-gateway"
    # Include TS demo/test tools into image
    IMAGE_INSTALL:append = " packagegroup-ts-tests"
    # Include TS PSA Arch tests into image
@@ -1,8 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
-
-header:
-  version: 14
-
-local_conf_header:
-  secure-debug: |
-    MACHINE_FEATURES += "secure-debug"
@@ -1,37 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
-
-# UEFI Secure Boot: A mechanism to ensure that only trusted software is executed
-# during the boot process.
-
-header:
-  version: 14
-  includes:
-    - ci/meta-openembedded.yml
-    - ci/meta-secure-core.yml
-
-local_conf_header:
-  uefi_secureboot: |
-    SBSIGN_KEYS_DIR = "${TOPDIR}/sbkeys"
-    BB_ENV_PASSTHROUGH_ADDITIONS = "SBSIGN_KEYS_DIR"
-
-    # Detected by passing kernel parameter
-    QB_KERNEL_ROOT = ""
-
-    # kernel is in the image, should not be loaded separately
-    QB_DEFAULT_KERNEL = "none"
-
-    WKS_FILE = "efi-disk.wks.in"
-    KERNEL_IMAGETYPE = "Image"
-
-    MACHINE_FEATURES:append = " efi uefi-secureboot"
-
-    EFI_PROVIDER = "systemd-boot"
-
-    # Use systemd as the init system
-    INIT_MANAGER = "systemd"
-    DISTRO_FEATURES:append = " systemd"
-    DISTRO_FEATURES_NATIVE:append = " systemd"
-
-    IMAGE_INSTALL:append = " systemd systemd-boot util-linux coreutils"
-
-    TEST_SUITES:append = " uefi_secureboot"
@@ -1,67 +0,0 @@
-# **CI for Yocto Project and meta-arm**
-# **CI for Yocto Project**
-The Yocto Project has an autobuilder that performs nightly builds and image tests on all of the defined QEMU machines, including qemuarm and qemuarm64  Also, it currently runs builds on the hardware reference platforms including genericarm64 and meta-arm mahines fvp-base and sbsa-ref.  More information on the autobuilder can be found at <https://autobuilder.yoctoproject.org/>.
-
-More information on the image tests can be found at <https://wiki.yoctoproject.org/wiki/Image_tests>.
-
-The Yocto Project also has the ability to have individual package tests, ptests.  For more information on those, go to <https://wiki.yoctoproject.org/wiki/Ptest>.
-# **CI for meta-arm**
-meta-arm is using the Gitlab CI infrastructure.  This is currently being done internal to Arm, but an external version can be seen at <https://gitlab.com/jonmason00/meta-arm/-/pipelines>.
-
-This CI is constantly being expanded to provide increased coverage of the software and hardware supported in meta-arm.  All platforms are required to add a kas file and `.gitlab-ci.yml` entry as part of the initial patch series.  More information on kas can be found at <https://github.com/siemens/kas>.
-
-To this end, it would be wise to run kas locally to verify everything works prior to pushing to the CI build system.
-## **Running kas locally**
-### **Install kas**
-kas can be installed with pip, for example:
-```
-$ pip3 install --user kas
-```
-
-See <https://kas.readthedocs.io/en/latest/userguide/getting-started.html> for information on the dependencies and more.
-
-This assumes that the kas path ($HOME/.local/bin) is in $PATH.  If not, the user will need to manually add this or the kas command will not be found.
-
-### **Run kas locally**
-```
-$ cd ~/meta-arm/
-$ kas build kas/juno.yml
-```
-
-By default kas will create a build directory under meta-arm to contain the checked out layers, build directory, and downloads.  You can change this by setting environment variables.  DL\_DIR and SSTATE\_DIR are respected so these can point at existing directories, and setting KAS\_WORK\_DIR to the directory where repositories are already cloned will save having to re-fetch.  This can look something like:
-```
-$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/qemuarm64.yml:ci/testimage.yml
-```
-
-See the [quick start guide](/documentation/quick-start.md) for more information on how to set this up.
-
-## **Locked Revisions in CI with lockfiles**
-The CI in meta-arm will generate a kas "lock file" when it starts to ensure that all of the builds checkout the same revision of the various different layers that are used. If this isn't done then there's a chance that a layer will be modified upstream during the CI, which results in some builds failing and some builds passing.
-
-This lock file is saved as an artefact of the update-repos job by the CI, and only generated if it doesn't already exist in the repository.  This can be used to force specific revisions of layers to be used instead of HEAD, which can be useful if upstream changes are causing problems in development.
-
-The lockfile.yml can be downloaded manually, but there's a script in meta-arm to fetch the lock file for the latest successful build of the specified branch:
-
-```
-$ ./ci/download-lockfile.py --help
-usage: download-lockfile.py [-h] server project refspec
-
-positional arguments:
-  server      GitLab server name
-  project     meta-arm project name
-  refspec     Branch/commit
-
-$ ./ci/download-lockfile.py https://gitlab.com/jonmason00/meta-arm master
-Fetched lockfile.yml
-Commit this lockfile.yml to the top-level of the meta-arm repository and the CI will use it automatically.
-```
-# **Relevant Links for kas, CI, and testing**
-<https://github.com/siemens/kas.git>
-
-<https://wiki.yoctoproject.org/wiki/Oe-selftest>
-
-<https://wiki.yoctoproject.org/wiki/Image_tests>
-
-<https://wiki.yoctoproject.org/wiki/Ptest>
-
-<https://wiki.yoctoproject.org/wiki/BSP_Test_Plan>
@@ -1,105 +0,0 @@
-# **Yocto Project quick start for Arm system software developers**
-If you want to read the The Yocto Project official quick start documentation, go to <https://docs.yoctoproject.org/brief-yoctoprojectqs/index.html>
-
-If that looks like too much reading, then here is how to do it even faster!
-# **Step 0: Install build deps and kas**
-```
-$ sudo apt install gawk wget git diffstat unzip texinfo gcc build-essential chrpath socat cpio python3 python3-pip python3-pexpect xz-utils debianutils iputils-ping python3-git python3-jinja2 libegl1-mesa libsdl1.2-dev python3-subunit mesa-common-dev zstd liblz4-tool file locales libacl1
-
-$ pip install kas
-```
-OR, if you prefer to use a docker will all that stuff already installed:
-
-```
-$ sudo docker run -it --name kas-test --volume /mnt/yocto/:/builds/persist ghcr.io/siemens/kas/kas /bin/bash
-```
-
-> **_NOTE:_**
-> the “--volume” is the directory where your persistent stuff (like downloads and build artifacts) will go to help speed up your builds and can be sharable amongst your builds/containers.  If you want to go completely clean-room, feel free to remove it
-# **Step 1: clone meta-arm and build meta-arm**
-```
-$ git clone https://git.yoctoproject.org/meta-arm
-$ cd meta-arm/
-$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/fvp-base.yml:ci/testimage.yml
-```
-> **_NOTE:_**
-> “ci/testimage.yml” will cause the build to run some basic system tests.  If you don’t care about verifying basic functionality, then remove it and it should be faster (a few less programs will be added to the system image and the 2-3mins that it takes to run the test will not happen).
-
-> **_NOTE:_**
-> You may wish to add the Yocto Project SSTATE Mirror (especially the first time) to speed up the build by downloading the build fragments (built by the Yocto Project autobuilder) from the internet.  This can be done by adding "ci/sstate-mirror.yml" in kas or adding the relevant lines to your local.conf.  Using the above example:
-
-```
-$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/fvp-base.yml:ci/sstate-mirror.yml
-```
-
-> **_NOTE:_**
-> This only fetches the parts necessary for your build and may take several minutes depending on your internet connection speed.  Also, it only fetches what is available.  There may still be a need to build things depending on your configuration.
-
-For more information on kas and various commands, please reference <https://kas.readthedocs.io/en/latest/>.
-
-Depending on what software you are building, fvp-base might not be the machine you want to build for.
-The following website provides an EXTREMELY rough way to tell what software is in what machines, and what versions are being run:
-<https://gitlab.com/jonmason00/meta-arm/-/jobs/artifacts/master/file/update-report/index.html?job=pending-updates>
-
-If, as an example, we’re wanting to develop trusted-firmware-a; then fvp-base will work for us. 
-
-### **Okay, you are done!  VICTORY!**
-### **Oh, you actually wanted to mess around with the system software source code?**
-# **Step 2: use devtool to get your source**
-Setup your environment via the (non-kas) Yocto Project tools
-
-```
-$ source poky/oe-init-build-env
-```
-
-Use devtool to checkout the version of software being used on the machine above (in the above example, this will be trusted-firmware-a for fvp-base).
-
-```
-$ devtool modify trusted-firmware-a
-```
-
-This will download the source, hopefully in git (depending on how the Yocto Project recipe was written), and should print a path at the end where the source code was checked out.  In the trusted-firmware-a example, I got:
-
-> /builder/meta-arm/build/workspace/sources/trusted-firmware-a
-
-Inside of that directory, you should see the relevant source code.  In this example, it is a standard git tree.  So, you can add remotes, checkout different SHAs, etc
-
-Ok, so you are set with your changes and want to build them.
-
-```
-$ devtool build trusted-firmware-a
-```
-
-This should build the software in question, but it is not yet integrated into a system image.  To do that, run:
-
-```
-$ devtool build-image core-image-sato
-```
-
-The image should match the image being used on your machine above.  Most of them in meta-arm are set to core-image-sato.  
-
-Also, if you used testimage above, it will run testimage now
-### **Okay, you are done!  VICTORY!**
-# **Step 3.  Testing your patches outside of devtool**
-At this point I will assume you have a patch and want to add it to the base recipe.  Using the above example, in the devtool directory:
-```
-$ git format-patch -1
-0001-example.patch
-$ mv 0001-example.patch ~/meta-arm/meta-arm/recipes-bsp/trusted-firmware-a/files/
-$ cd ~/meta-arm
-$ devtool reset trusted-firmware-a
-$ echo ‘SRC_URI:append = " file://0001-example.patch" >> meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_2.10.3.bb
-```
-
-> **_NOTE:_**
-> there is a space before the “file” and yes it matters very much
-
-At this point, you can go back using kas and verify that the patch works in a clean-ish tree.
-
-```
-$ SSTATE_DIR=/builds/persist/sstate DL_DIR=/builds/persist/downloads kas build ci/fvp-base.yml:ci/testimage.yml
-```
-
-There is obviously much more that can be done and other ways to do similar things.
-
-## **If there are issues or questions then please ask them on the #meta-arm irc channel on libera.chat**
@@ -1,43 +0,0 @@
-# **meta-arm Releases and Branching**
-## **Release and Branching background**
-The Yocto Project releases twice a year (April and October): "stable" releases are made every six months and have a lifetime of seven months to allow for migration, while "long term support" (LTS) releases are picked every two years starting from Dunfell in April 2020. The standard practice for all Yocto Compatible layers is to create a "named" branch consistent with the code name of that release. For example, the “dunfell” release of the Yocto Project will have a branch named “dunfell” in the official git repository, and layers compatible with dunfell will have a branch named “dunfell”. Thus, a customer can easily organize a collection of appropriate layers to make a product.
-
-In the Yocto Project, these named branches are “stable”, and only take bug fixes or security-critical upgrades. Active development occurs on the master branch. However, this methodology can be problematic if mimicked with the compatible layers. Companies, like Arm, may not wish to release a snapshot of the relevant “master” branches under active development, due to the amount of testing, fixing, and hardening necessary to make a product from a non-stable release. Also, changes to keep the master branch of a layer working with the upstream master branch of the Yocto Project may result in that branch no longer being compatible with named branches (e.g., it might not be possible to mix and match master and dunfell). So, a decision must be made on the branching policy of meta-arm.
-
-## **Adding new Hardware or Software features**
-There are many different ways to resolve this issue. After some discussion, the best solution for us is to allow new hardware enablement (and relevant software features) to be included in LTS named branches (not just bug fixes). This will allow for a more stable software platform for software to be developed, tested, and released. Also, the single branch allows for focused testing (limiting the amount of resources needed for CI/CD), lessens/eliminates code diverging on various branches, and lessens confusion on which branch to use. The risk of making this choice is a potentially non-stable branch which will require more frequent testing to lessen the risk, and not following the “stable” methodology of the core Yocto Project layers (though it is not uncommon for BSP layers to behave this way).
-
-## **Process**
-The process for patches intended on being integrated into only the master branch is the normal internal process of pushing for code review and CI, approval and integration into upstream meta-arm master branch. 
-For patches intended on being included in an LTS named branch, the preferred process is to upstream via the master branch, rebase the patch (or series against the intended LTS branch) and send email with the release name in the subject line after the "PATCH" (e.g., "[PATCH dunfell] Add foo to bar").
-
-If there is a time crunch and the preferred way above cannot be completed in time, upstreaming via the LTS branch can occur. This follows the normal process above but without the master integration step.  However, any patches upstreamed in this manner must be pushed to master in a timely fashion (after the time crunch). Nagging emails will be sent and managers will be involved as the time grows.
-
-## **Testing**
-See [continuous-integration-and-kas.md](/documentation/continuous-integration-and-kas.md) for information how the layer is tested and what tests are run. It is presumed that all code will be compiled as part of the CI process of the gerrit code review. Also, testing on virtual platforms and code conformity checks will be run when enabled in the process.
-
-## **Branching strategy and releases**
-Named branches for meta-arm will be released as close as possible to the release of the YP LTS release. Meta-arm named branches will be created from the meta-arm master branch.
-
-To minimize the additional work of maintaining multiple branches it is assumed that there will only be two active development branches at any given time: master and the most recent Long Term Stable (LTS) as the named branch. All previous named LTS branches will be EOLed when a new LTS has been released. Any branches that are EOLed will still exist in the meta-arm, but bug fix patches will be accepted. Limited to no testing will occur on EOL’ed branches. Exceptions to this can be made, but must be sized appropriately and agreed to by the relevant parties.
-
-Named branch release will coincide with Yocto Project releases. These non-LTS branches will be bug fix only and will be EOLed on the next release (similar to the YP branching behavior).
-
-### **Branch transitions**
-When YP is approaching release, meta-arm will attempt to stabilize master so that the releases can coincide. 
-* T-6 weeks - Email is sent to meta-arm mailing list notifying of upcoming code freeze of features to meta-arm
-* T-4 weeks - Code freeze to meta-arm. Only bug fixes are taken at this point.
-* T-0 - Official upstream release occurs. With no outstanding critical bugs, a new named branch is created based on the current meta-arm master branch. Previous named branches are now frozen and will not accept new patches (but will continue to be present for reference and legacy usage).
-
-## **Tagging**
-### **Branch Tagging**
-When each branch is released, a git tag with the Yocto Project version number will be added.  For example, `4.3`.  Also, this tag version number will be prepended with "yocto" in a duplicate tag (e.g., "yocto-4.3").
-
-Conciding with the Yocto Project release schedule, every branch which has one or more changes added to it in the previous 6 months will get a minor versioned tag (e.g., "4.3.1" and "yocto-4.3.1").
-
-### **BSP Release Tagging**
-BSP releases for those boards supported in meta-arm-bsp maybe have an additional tag to denote their software releases.  The tag will consist of the board name (in all capital letters), year, and month.  For example, "CORSTONE1000-2023.11".
-The release schedule for this is outside the standard Yocto Project release candence, but is generally encouraged to be as close to these releases as possible.  Similarily, it is recommended the BSP releases be based on the latest LTS branch.
-
-# **Relevant Links**
-<https://wiki.yoctoproject.org/wiki/Releases>
@@ -4,10 +4,10 @@ The `runfvp` tool in meta-arm makes it easy to run Yocto Project disk images ins

 ## Running images with `runfvp`

-To build images with the FVP integration, the `fvpboot` image class needs to be inherited.  If the machine does not do this explicitly it can be done in `local.conf`:
+To build images with the FVP integration, the `fvpboot` class needs to be inherited.  If the machine does not do this explicitly it can be done in `local.conf`:

 ```
-IMAGE_CLASSES += "fvpboot"
+INHERIT += "fvpboot"
 ```

 The class will download the correct FVP and write a `.fvpconf` configuration file when an image is built.
@@ -37,11 +37,13 @@ Other steps depend on your machine/platform definition:

 2. optee-os might require platform specific OP-TEE build parameters (for example what SEL the SPM Core is implemented at).
   You can find examples in `meta-arm/recipes-security/optee/optee-os_%.bbappend` for qemuarm64-secureboot machine
-   and in `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc` for the Corstone1000 platform.
+   and in `meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc` and `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc`
+   for N1SDP and Corstone1000 platforms accordingly.

 3. trusted-firmware-a might require platform specific TF-A build parameters (SPD and SPMC details on the platform).
   See `meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend` for qemuarm64-secureboot machine
-   and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for theCorstone1000 platform.
+   and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-n1sdp.inc` and
+   `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for N1SDP and Corstone1000 platforms.

 4. Trusted Services supports an SPMC agonistic binary format. To build SPs to this format the `TS_ENV` variable is to be
   set to `sp`. The resulting SP binaries should be able to boot under any FF-A v1.1 compliant SPMC implementation.
@@ -2,7 +2,6 @@ header:
  version: 13
  includes:
    - kas/arm-systemready-firmware.yml
-    - kas/arm-systemready-linux-distros-unattended-installation.yml

 target:
  - arm-systemready-linux-distros-debian
@@ -5,7 +5,7 @@ distro: poky

 defaults:
  repos:
-    branch: styhead
+    branch: scarthgap

 repos:
  meta-arm:
@@ -16,14 +16,14 @@ repos:

  poky:
    url: https://git.yoctoproject.org/git/poky
-    commit: 5465094be9a61a1639e1dab6d2b4ebea2bee7440
+    commit: c5df9c829a549ca002c36afd6bdf23639831502e
    layers:
      meta:
      meta-poky:

  meta-openembedded:
    url: https://git.openembedded.org/meta-openembedded
-    commit: 461d85a1831318747af5abe86da193bcde3fd9b4
+    commit: 6de0ab744341ad61b0661aa28d78dc6767ce0786
    layers:
      meta-oe:
      meta-python:
@@ -31,7 +31,7 @@ repos:

  meta-secure-core:
    url: https://github.com/wind-river/meta-secure-core.git
-    commit: 59d7e90542947c342098863b9998693ac79352b0
+    commit: 13cb4867fb1245581c80da3b94b72c4b4f15d67e
    layers:
      meta-secure-core-common:
      meta-signing-key:
@@ -14,7 +14,7 @@ machine: fvp-base

 defaults:
  repos:
-    refspec: master
+    refspec: scarthgap

 repos:
  meta-arm:
@@ -9,7 +9,7 @@ BBFILE_COLLECTIONS += "meta-arm-bsp"
 BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
 BBFILE_PRIORITY_meta-arm-bsp = "5"

-LAYERSERIES_COMPAT_meta-arm-bsp = "styhead"
+LAYERSERIES_COMPAT_meta-arm-bsp = "nanbield scarthgap"

 LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
 # This won't be used by layerindex-fetch, but works everywhere else
@@ -9,8 +9,7 @@ TFM_PLATFORM_IS_FVP = "TRUE"

 # testimage config
 TEST_TARGET = "OEFVPTarget"
-TEST_TARGET_IP = "127.0.0.1:2222"
-DEFAULT_TEST_SUITES:append = " fvp_boot fvp_devices"
+TEST_SUITES = "fvp_boot"

 # FVP Config
 FVP_PROVIDER ?= "fvp-corstone1000-native"
@@ -10,19 +10,16 @@ ARM_SYSTEMREADY_FIRMWARE = "trusted-firmware-a:do_deploy"
 ARM_SYSTEMREADY_ACS_CONSOLE = "default"
 EXTRA_IMAGEDEPENDS = "${ARM_SYSTEMREADY_FIRMWARE}"

-MACHINE_FEATURES = "efi vfat"
+MACHINE_FEATURES = "efi"

 IMAGE_NAME_SUFFIX = ""
 IMAGE_FSTYPES += "wic"
 WKS_FILE ?= "efi-disk.wks.in"

 SERIAL_CONSOLES = "115200;ttyAMA0"
-# FIXME -  This is being upstreamed.  Remove once that has occurred.
-KERNEL_CONSOLE ?= "${@','.join(d.getVar('SERIAL_CONSOLES').split(' ')[0].split(';')[::-1]) or 'ttyS0'}"

 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-KERNEL_DTB_NAME = "fvp-base-revc.dtb"
-KERNEL_DEVICETREE = "arm/${KERNEL_DTB_NAME}"
+KERNEL_DEVICETREE = "arm/fvp-base-revc.dtb"
 KERNEL_IMAGETYPE = "Image"

 EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
@@ -30,7 +27,7 @@ EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
 # FVP u-boot configuration
 UBOOT_MACHINE = "vexpress_fvp_defconfig"

-EFI_PROVIDER ?= "${@bb.utils.contains("DISTRO_FEATURES", "systemd", "systemd-boot", "grub-efi", d)}"
+EFI_PROVIDER ?= "grub-efi"

 # As this is a virtual target that will not be used in the real world there is
 # no need for real SSH keys.
@@ -65,4 +62,4 @@ FVP_TERMINALS[bp.terminal_0] ?= "Console"
 FVP_TERMINALS[bp.terminal_1] ?= ""
 FVP_TERMINALS[bp.terminal_2] ?= ""
 FVP_TERMINALS[bp.terminal_3] ?= ""
-FVP_CONFIG[bp.secure_memory] ?= "1"
+FVP_CONFIG[bp.secure_memory] ?= "1"
@@ -3,18 +3,18 @@ require conf/machine/include/arm/armv8a/tune-cortexa35.inc
 MACHINEOVERRIDES =. "corstone1000:"

 # TF-M
-PREFERRED_VERSION_trusted-firmware-m ?= "2.1.%"
+PREFERRED_VERSION_trusted-firmware-m ?= "2.0.%"

 # TF-A
 TFA_PLATFORM = "corstone1000"
-PREFERRED_VERSION_trusted-firmware-a ?= "2.11.%"
+PREFERRED_VERSION_trusted-firmware-a ?= "2.10.%"
 PREFERRED_VERSION_tf-a-tests ?= "2.10.%"

 TFA_BL2_BINARY = "bl2-corstone1000.bin"
 TFA_FIP_BINARY = "fip-corstone1000.bin"

 # optee
-PREFERRED_VERSION_optee-os ?= "4.2.%"
+PREFERRED_VERSION_optee-os ?= "4.1.%"

 # Trusted Services
 TS_PLATFORM = "arm/corstone1000"
@@ -34,7 +34,7 @@ IMAGE_CMD:wic[vardeps] += "GRUB_LINUX_APPEND"

 # Linux kernel
 PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
-PREFERRED_VERSION_linux-yocto ?= "6.10.%"
+PREFERRED_VERSION_linux-yocto ?= "6.6.%"
 KERNEL_IMAGETYPE = "Image"
 KERNEL_IMAGETYPE:firmware = "Image.gz"
 # add FF-A support in the kernel
@@ -0,0 +1,51 @@
+# Configuration for Arm N1SDP development board
+
+#@TYPE: Machine
+#@NAME: N1SDP machine
+#@DESCRIPTION: Machine configuration for N1SDP
+
+require conf/machine/include/arm/armv8-2a/tune-neoversen1.inc
+
+KERNEL_IMAGETYPE = "Image"
+
+IMAGE_FSTYPES += "wic wic.gz wic.bmap tar.bz2 ext4"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+# Set default WKS
+WKS_FILE ?= "n1sdp-efidisk.wks"
+IMAGE_EFI_BOOT_FILES ?= "n1sdp-multi-chip.dtb n1sdp-single-chip.dtb"
+WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
+
+# Use kernel provided by yocto
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+PREFERRED_VERSION_linux-yocto ?= "6.6%"
+
+# RTL8168E Gigabit Ethernet Controller is attached to the PCIe interface
+MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "linux-firmware-rtl8168"
+
+# TF-A
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+TFA_PLATFORM = "n1sdp"
+PREFERRED_VERSION_trusted-firmware-a ?= "2.10.%"
+PREFERRED_VERSION_tf-a-tests ?= "2.10.%"
+
+# SCP
+EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"
+
+#UEFI EDK2 firmware
+EXTRA_IMAGEDEPENDS += "edk2-firmware"
+PREFERRED_VERSION_edk2-firmware ?= "202311"
+
+#optee
+PREFERRED_VERSION_optee-os ?= "4.1.%"
+PREFERRED_VERSION_optee-os-tadevkit ?= "4.1.%"
+PREFERRED_VERSION_optee-test ?= "4.1.%"
+PREFERRED_VERSION_optee-client ?= "4.1.%"
+
+#grub-efi
+EFI_PROVIDER ?= "grub-efi"
+MACHINE_FEATURES += "efi"
+
+# SD-Card firmware
+EXTRA_IMAGEDEPENDS += "sdcard-image-n1sdp"
@@ -11,69 +11,6 @@ This document contains a summary of the new features, changes and
 fixes in each release of Corstone-1000 software stack.


-***************
-Version 2024.11
-***************
-
-Changes
-=======
-
- Implementation of a replication strategy for FWU metadata in TF-M according to the FWU specification.
- Upgrade to metadata version 2 in TF-M.
- Increase the ITS and PS memory size in Secure Flash for TF-M.
- SW components upgrades.
- Bug fixes.
-
-Corstone-1000 components versions
-=================================
-
-+-------------------------------------------+-----------------------------------------------------+
-| linux-yocto                               |                   6.10.14                           |
-+-------------------------------------------+-----------------------------------------------------+
-| u-boot                                    |                   2023.07.02                        |
-+-------------------------------------------+-----------------------------------------------------+
-| external-system                           |                   0.1.0                             |
-+-------------------------------------------+-----------------------------------------------------+
-| optee-client                              |                   4.2.0                             |
-+-------------------------------------------+-----------------------------------------------------+
-| optee-os                                  |                   4.2.0                             |
-+-------------------------------------------+-----------------------------------------------------+
-| trusted-firmware-a                        |                   2.11.0                            |
-+-------------------------------------------+-----------------------------------------------------+
-| trusted-firmware-m                        |                   2.1.0                             |
-+-------------------------------------------+-----------------------------------------------------+
-| libts                                     |                   602be60719                        |
-+-------------------------------------------+-----------------------------------------------------+
-| ts-newlib                                 |                   4.1.0                             |
-+-------------------------------------------+-----------------------------------------------------+
-| ts-psa-{crypto, iat, its. ps}-api-test    |                   74dc6646ff                        |
-+-------------------------------------------+-----------------------------------------------------+
-| ts-sp-{se-proxy, smm-gateway}             |                   602be60719                        |
-+-------------------------------------------+-----------------------------------------------------+
-
-Yocto distribution components versions
-======================================
-
-+-------------------------------------------+------------------------------+
-| meta-arm                                  | styhead                      |
-+-------------------------------------------+------------------------------+
-| poky                                      | 5465094be9                   |
-+-------------------------------------------+------------------------------+
-| meta-openembedded                         | 461d85a183                   |
-+-------------------------------------------+------------------------------+
-| meta-secure-core                          | 59d7e90542                   |
-+-------------------------------------------+------------------------------+
-| busybox                                   |                   1.36.1     |
-+-------------------------------------------+------------------------------+
-| musl                                      |                   1.2.5      |
-+-------------------------------------------+------------------------------+
-| gcc-arm-none-eabi                         |          13.3.rel1           |
-+-------------------------------------------+------------------------------+
-| gcc-cross-aarch64                         |                   14.2.0     |
-+-------------------------------------------+------------------------------+
-| openssl                                   |                   3.3.1      |
-+-------------------------------------------+------------------------------+
-
 ***************
 Version 2024.06
 ***************
@@ -10,19 +10,15 @@
 # add these directories to sys.path here. If the directory is relative to the
 # documentation root, use os.path.abspath to make it absolute, like shown here.
 #
+# import os
+# import sys
 # sys.path.insert(0, os.path.abspath('.'))

-import os
-import sys
-
-# Append the documentation directory to the path, so we can import variables
-sys.path.append(os.path.dirname(__file__))
-

 # -- Project information -----------------------------------------------------

 project = 'corstone1000'
-copyright = '2020-2024, Arm Limited'
+copyright = '2020-2022, Arm Limited'
 author = 'Arm Limited'


@@ -32,7 +28,6 @@ author = 'Arm Limited'
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
 extensions = [
-    'sphinx_rtd_theme',
 ]

 # Add any paths that contain templates here, relative to this directory.
@@ -51,16 +46,6 @@ exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store', 'docs/infra']
 #
 html_theme = 'sphinx_rtd_theme'

-# Define the canonical URL if you are using a custom domain on Read the Docs
-html_baseurl = os.environ.get("READTHEDOCS_CANONICAL_URL", "")
-
-# Tell Jinja2 templates the build is running on Read the Docs
-if os.environ.get("READTHEDOCS", "") == "True":
-    if "html_context" not in globals():
-        html_context = {}
-    html_context["READTHEDOCS"] = True
-
-
 # Add any paths that contain custom static files (such as style sheets) here,
 # relative to this directory. They are copied after the builtin static files,
 # so a file named "default.css" will overwrite the builtin "default.css".
@@ -19,12 +19,6 @@ intended for safety-critical applications. Should Your Software or Your Hardware
 prove defective, you assume the entire cost of all necessary servicing, repair
 or correction.

-***********************
-Release notes - 2024.11
-***********************
-
-The same notes as the 2024.06 release still apply.
-
 ***********************
 Release notes - 2024.06
 ***********************
@@ -44,6 +38,16 @@ Platform Support
 - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.23_25
   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps

+SystemReady IR v2.0 Certification Milestone
+-------------------------------------------
+
+As of this release, Corstone-1000 has achieved `SystemReady IR v2.0 certification <https://www.arm.com/architecture/system-architectures/systemready-certification-program/ve>`__.
+This milestone confirms compliance with the SystemReady IR requirements, ensuring broader compatibility and reliability for deployment.
+
+Applied patch `313ad2a0e600 <https://git.yoctoproject.org/meta-arm/commit/?h=scarthgap&id=313ad2a0e600655d9bfbe53646e356372ff02644>`__ to address compatibility requirements for SystemReady IR v2.0.
+
+This update is included in tag `CORSTONE1000-2024.06-systemready-ir-v2.0 <https://git.yoctoproject.org/meta-arm/tag/?h=CORSTONE1000-2024.06-systemready-ir-v2.0>`__ and builds on the `CORSTONE1000-2024.06` release.
+
 ***********************
 Release notes - 2023.11
 ***********************
@@ -4,7 +4,7 @@
 # SPDX-License-Identifier: MIT

 ######################
-Software Architecture
+Software architecture
 ######################


@@ -20,7 +20,7 @@ Corstone-1000 software plus hardware reference solution is PSA Level-2 ready
 certified (`PSA L2 Ready`_) as well as System Ready IR certified(`SRIR cert`_).
 More information on the Corstone-1000 subsystem product and design can be
 found at:
-`Arm Corstone-1000 Software`_ and `Arm Corstone-1000 Technical Overview`_.
+`Arm corstone1000 Software`_ and `Arm corstone1000 Technical Overview`_.

 This readme explicitly focuses on the software part of the solution and
 provides internal details on the software components. The reference
@@ -57,7 +57,7 @@ TrustedFirmware-M(`TF-M`_) as runtime software. The software design on
 Secure Enclave follows Firmware Framework for M class
 processor (`FF-M`_) specification.

-The Host System is based on ARM Cortex-A35 processor with standardized
+The Host System is based on ARM Cotex-A35 processor with standardized
 peripherals to allow for the booting of a Linux OS. The Cortex-A35 has
 the TrustZone technology that allows secure and non-secure security
 states in the processor. The software design in the Host System follows
@@ -213,18 +213,15 @@ Image (the initramfs bundle). The new images are accepted in the form of a UEFI

 When Firmware update is triggered, U-Boot verifies the capsule by checking the
 capsule signature, version number and size. Then it signals the Secure Enclave
-that can start writing UEFI capsule into the flash.
-
-Once this operation finishes, Secure Enclave resets the entire system.
+that can start writing UEFI capsule into the flash. Once this operation finishes
+,Secure Enclave resets the entire system.
 The Metadata Block in the flash has the below firmware update state machine.
 TF-M runs an OTA service that is responsible for accepting and updating the
 images in the flash. The communication between the UEFI Capsule update
 subsystem and the OTA service follows the same data path explained above.
 The OTA service writes the new images to the passive bank after successful
 capsule verification. It changes the state of the system to trial state and
-triggers the reset.
-
-Boot loaders in Secure Enclave and Host read the Metadata
+triggers the reset. Boot loaders in Secure Enclave and Host read the Metadata
 block to get the information on the boot bank. In the successful trial stage,
 the acknowledgment from the host moves the state of the system from trial to
 regular. Any failure in the trial stage or system hangs leads to a system
@@ -261,17 +258,17 @@ calls are forwarded to the Secure Enclave as explained above.
 ***************
 References
 ***************
-`ARM Corstone-1000 Search`_
+`ARM corstone1000 Search`_

 `Arm security features`_

 --------------

-*Copyright (c) 2022-2024, Arm Limited. All rights reserved.*
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*

-.. _Arm Corstone-1000 Technical Overview: https://developer.arm.com/documentation/102360/0000
-.. _Arm Corstone-1000 Software: https://developer.arm.com/Tools%20and%20Software/Corstone-1000%20Software
-.. _Arm Corstone-1000 Search: https://developer.arm.com/search#q=corstone-1000
+.. _Arm corstone1000 Technical Overview: https://developer.arm.com/documentation/102360/0000
+.. _Arm corstone1000 Software: https://developer.arm.com/Tools%20and%20Software/Corstone-1000%20Software
+.. _Arm corstone1000 Search: https://developer.arm.com/search#q=corstone-1000
 .. _Arm security features: https://www.arm.com/architecture/security-features/platform-security
 .. _linux repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
 .. _FF-A: https://developer.arm.com/documentation/den0077/latest
@@ -0,0 +1,78 @@
+# N1SDP Development Platform Support in meta-arm-bsp
+
+## Overview
+The N1SDP provides access to the Arm Neoverse N1 SoC. The N1SDP enables software development for key enterprise technology
+and general Arm software development. The N1SDP consists of the N1 board containing the N1 SoC.
+The N1 SoC contains two dual-core Arm Neoverse N1 processor clusters.
+
+The system demonstrates Arm technology in the context of Cache-Coherent Interconnect for Accelerators (CCIX) protocol by:
+
+- Running coherent traffic between the N1 SoC and an accelerator card.
+- Coherent communication between two N1 SoCs.
+- Enabling development of CCIX-enabled FPGA accelerators.
+
+Further information on N1SDP can be found at
+https://community.arm.com/developer/tools-software/oss-platforms/w/docs/458/neoverse-n1-sdp
+
+## Configuration:
+In the local.conf file, MACHINE should be set as follow:
+MACHINE ?= "n1sdp"
+
+## Building
+```bash$ bitbake core-image-minimal```
+
+## Running
+
+# Update Firmware on SD card:
+
+(*) To use n1sdp board in single chip mode, flash:
+    n1sdp-board-firmware_primary.tar.gz firmware.
+
+(*) To use n1sdp board in multi chip mode, flash:
+    n1sdp-board-firmware_primary.tar.gz firmware to primary board,
+    n1sdp-board-firmware_secondary.tar.gz firmware to secondary board.
+
+The SD card content is generated during the build here:
+  tmp/deploy/images/n1sdp/n1sdp-board-firmware_primary.tar.gz
+  tmp/deploy/images/n1sdp/n1sdp-board-firmware_secondary.tar.gz
+
+
+Its content must be written on the N1SDP firmware SD card.
+To do this:
+- insert the sdcard of the N1SDP in an SD card reader and mount it:
+```bash$ sudo mount /dev/sdx1 /mnt```
+(replace sdx by the device of the SD card)
+
+- erase its content and put the new one:
+```bash$ sudo rm -rf /mnt/*```
+```bash$ sudo tar --no-same-owner -xzf tmp/deploy/images/n1sdp/n1sdp-board-firmware_primary.tar.gz -C /mnt/```
+```bash$ sudo umount /mnt```
+
+- reinsert the SD card in the N1SDP board
+
+Firmware tarball contains iofpga configuration files, scp and uefi binaries.
+
+**NOTE**:
+If the N1SDP board was manufactured after November 2019 (Serial Number greater
+than 36253xxx), a different PMIC firmware image must be used to prevent
+potential damage to the board. More details can be found in [1].
+The `MB/HBI0316A/io_v123f.txt` file located in the microSD needs to be updated.
+To update it, set the PMIC image (300k_8c2.bin) to be used in the newer models
+by running the following commands on your host PC:
+
+    $ sudo umount /dev/sdx1
+    $ sudo mount /dev/sdx1 /mnt
+    $ sudo sed -i '/^MBPMIC: pms_0V85.bin/s/^/;/g' /mnt/MB/HBI0316A/io_v123f.txt
+    $ sudo sed -i '/^;MBPMIC: 300k_8c2.bin/s/^;//g' /mnt/MB/HBI0316A/io_v123f.txt
+    $ sudo umount /mnt
+
+# Prepare an USB hard drive:
+
+Grub boot partition is placed on first partition of the *.wic image,
+Linux root file system is placed on the second partition of the *.wic image:
+  tmp/deploy/images/n1sdp/core-image-minimal-n1sdp.wic
+
+This *.wic image should be copied to USB stick with simple dd call.
+
+
+[1]: https://community.arm.com/developer/tools-software/oss-platforms/w/docs/604/notice-potential-damage-to-n1sdp-boards-if-using-latest-firmware-release
@@ -16,4 +16,4 @@

 *A summary of how to deploy or execute the image*

-*For example, an overview of FVP arguments*
+*For example, an overview of the N1SDP SD structure, or FVP arguments*
@@ -1,8 +0,0 @@
-psci: failed to boot CPU1 (-95)
-CPU1: failed to boot: -95
-psci: failed to boot CPU2 (-95)
-CPU2: failed to boot: -95
-psci: failed to boot CPU3 (-95)
-CPU3: failed to boot: -95
-ARM FF-A: Notification setup failed -95, not enabled
-ARM FF-A: Failed to register driver sched callback -95
@@ -1 +0,0 @@
-basic-mmio-gpio: Failed to locate of_node [id: -2]
@@ -53,11 +53,9 @@ TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
 RE_IMAGE_OFFSET = "0x1000"

 # Offsets for the .nopt image generation
-# These offset values have to be aligned with those in
-# meta-arm/meta-arm-bsp/wic/corstone1000-flash-firmware.wks.in
-TFM_OFFSET = "147456"
-FIP_OFFSET = "475136"
-KERNEL_OFFSET = "2572288"
+TFM_OFFSET = "102400"
+FIP_OFFSET = "479232"
+KERNEL_OFFSET = "2576384"

 do_sign_images() {
    # Sign TF-A BL2
@@ -14,7 +14,7 @@ COMPATIBLE_MACHINE = "juno"

 LINARO_RELEASE = "19.06"

-SRC_URI = "http://releases.linaro.org/members/arm/platforms/${LINARO_RELEASE}/juno-latest-oe-uboot.zip;subdir=${S} \
+SRC_URI = "http://releases.linaro.org/members/arm/platforms/${LINARO_RELEASE}/juno-latest-oe-uboot.zip;subdir=${UNPACK_DIR} \
    file://images-r0.txt \
    file://images-r1.txt \
    file://images-r2.txt \
@@ -23,8 +23,7 @@ SRC_URI = "http://releases.linaro.org/members/arm/platforms/${LINARO_RELEASE}/ju
 SRC_URI[md5sum] = "01b662b81fa409d55ff298238ad24003"
 SRC_URI[sha256sum] = "b8a3909bb3bc4350a8771b863193a3e33b358e2a727624a77c9ecf13516cec82"

-FIRMWARE_DIR = "juno-firmware-${LINARO_RELEASE}"
-S = "${UNPACKDIR}/${FIRMWARE_DIR}"
+UNPACK_DIR = "juno-firmware-${LINARO_RELEASE}"

 inherit deploy nopackages

@@ -34,23 +33,23 @@ do_compile[noexec] = "1"
 # The ${D} is used as a temporary directory and we don't generate any
 # packages for this recipe.
 do_install() {
-    cp -a ${S} ${D}/
+    cp -a ${WORKDIR}/${UNPACK_DIR} ${D}
    cp -f ${RECIPE_SYSROOT}/firmware/bl1-juno.bin \
-        ${D}/${FIRMWARE_DIR}/SOFTWARE/bl1.bin
+        ${D}/${UNPACK_DIR}/SOFTWARE/bl1.bin

    cp -f ${RECIPE_SYSROOT}/firmware/fip-juno.bin \
-        ${D}/${FIRMWARE_DIR}/SOFTWARE/fip.bin
+        ${D}/${UNPACK_DIR}/SOFTWARE/fip.bin

    cp -f ${RECIPE_SYSROOT}/firmware/scp_romfw_bypass.bin \
-        ${D}/${FIRMWARE_DIR}/SOFTWARE/scp_bl1.bin
+        ${D}/${UNPACK_DIR}/SOFTWARE/scp_bl1.bin

    # u-boot environment file
-    cp -f ${UNPACKDIR}/uEnv.txt ${D}/${FIRMWARE_DIR}/SOFTWARE/
+    cp -f ${WORKDIR}/uEnv.txt ${D}/${UNPACK_DIR}/SOFTWARE/

    # Juno images list file
-    cp -f ${UNPACKDIR}/images-r0.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262B/images.txt
-    cp -f ${UNPACKDIR}/images-r1.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262C/images.txt
-    cp -f ${UNPACKDIR}/images-r2.txt ${D}/${FIRMWARE_DIR}/SITE1/HBI0262D/images.txt
+    cp -f ${WORKDIR}/images-r0.txt ${D}/${UNPACK_DIR}/SITE1/HBI0262B/images.txt
+    cp -f ${WORKDIR}/images-r1.txt ${D}/${UNPACK_DIR}/SITE1/HBI0262C/images.txt
+    cp -f ${WORKDIR}/images-r2.txt ${D}/${UNPACK_DIR}/SITE1/HBI0262D/images.txt
 }

 do_deploy() {
@@ -60,18 +59,18 @@ do_deploy() {
    # task.
    for f in ${KERNEL_DEVICETREE}; do
        install -m 755 -c ${DEPLOY_DIR_IMAGE}/$(basename $f) \
-            ${D}/${FIRMWARE_DIR}/SOFTWARE/
+            ${D}/${UNPACK_DIR}/SOFTWARE/.
    done

    if [ "${INITRAMFS_IMAGE_BUNDLE}" -eq 1 ]; then
        cp -L -f ${DEPLOY_DIR_IMAGE}/Image.gz-initramfs-juno.bin \
-            ${D}/${FIRMWARE_DIR}/SOFTWARE/Image
+            ${D}/${UNPACK_DIR}/SOFTWARE/Image
    else
-        cp -L -f ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE} ${D}/${FIRMWARE_DIR}/SOFTWARE/
+        cp -L -f ${DEPLOY_DIR_IMAGE}/${KERNEL_IMAGETYPE} ${D}/${UNPACK_DIR}/SOFTWARE/
    fi

    # Compress the files
-    tar -C ${D}/${FIRMWARE_DIR} -zcvf ${WORKDIR}/${PN}.tar.gz ./
+    tar -C ${D}/${UNPACK_DIR} -zcvf ${WORKDIR}/${PN}.tar.gz ./

    # Deploy the compressed archive to the deploy folder
    install -D -p -m0644 ${WORKDIR}/${PN}.tar.gz ${DEPLOYDIR}/${PN}.tar.gz
@@ -0,0 +1,37 @@
+SUMMARY = "Board Firmware binaries for N1SDP"
+SECTION = "firmware"
+
+LICENSE = "STM-SLA0044-Rev5"
+LIC_FILES_CHKSUM = "file://LICENSES/MB/STM.TXT;md5=1b74d8c842307d03c116f2d71cbf868a"
+
+inherit deploy
+
+INHIBIT_DEFAULT_DEPS = "1"
+
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+COMPATIBLE_MACHINE = "n1sdp"
+
+SRC_URI = "git://git.gitlab.arm.com/arm-reference-solutions/board-firmware.git;protocol=https;branch=n1sdp"
+
+SRCREV = "70ba494265eee76747faff38264860c19e214540"
+PV .= "+git"
+
+S = "${WORKDIR}/git"
+
+INSTALL_DIR = "/n1sdp-board-firmware_source"
+
+do_install() {
+    rm -rf ${S}/SOFTWARE
+    install -d ${D}${INSTALL_DIR}
+    cp -Rp --no-preserve=ownership ${S}/* ${D}${INSTALL_DIR}
+}
+
+FILES:${PN}-staticdev += " ${INSTALL_DIR}/LIB/sensor.a"
+FILES:${PN} = "${INSTALL_DIR}"
+SYSROOT_DIRS += "${INSTALL_DIR}"
+
+do_deploy() {
+    install -d ${DEPLOYDIR}${INSTALL_DIR}
+    cp -Rp --no-preserve=ownership ${S}/* ${DEPLOYDIR}${INSTALL_DIR}
+}
+addtask deploy after do_install before do_build
@@ -0,0 +1,85 @@
+SUMMARY = "Firmware image recipe for generating SD-Card artifacts."
+
+inherit deploy nopackages
+
+DEPENDS = "trusted-firmware-a \
+           virtual/control-processor-firmware \
+           n1sdp-board-firmware"
+
+LICENSE = "MIT"
+PACKAGE_ARCH = "${MACHINE_ARCH}"
+COMPATIBLE_MACHINE = "n1sdp"
+RM_WORK_EXCLUDE += "${PN}"
+do_configure[noexec] = "1"
+do_compile[noexec] = "1"
+do_install[noexec] = "1"
+
+FIRMWARE_DIR = "n1sdp-board-firmware_source"
+PRIMARY_DIR = "${WORKDIR}/n1sdp-board-firmware_primary"
+SECONDARY_DIR = "${WORKDIR}/n1sdp-board-firmware_secondary"
+
+SOC_BINARIES = "mcp_fw.bin scp_fw.bin mcp_rom.bin scp_rom.bin"
+
+prepare_package() {
+    cd ${WORKDIR}
+
+    # Master/Primary
+    cp -av ${RECIPE_SYSROOT}/${FIRMWARE_DIR}/* ${PRIMARY_DIR}
+    mkdir -p ${PRIMARY_DIR}/SOFTWARE/
+
+    # Copy FIP binary
+    cp -v ${RECIPE_SYSROOT}/firmware/fip.bin ${PRIMARY_DIR}/SOFTWARE/
+
+    # Copy SOC binaries
+    for f in ${SOC_BINARIES}; do
+        cp -v ${RECIPE_SYSROOT}/firmware/${f} ${PRIMARY_DIR}/SOFTWARE/
+    done
+
+    sed -i -e 's|^C2C_ENABLE.*|C2C_ENABLE: TRUE            ;C2C enable TRUE/FALSE|' \
+        ${PRIMARY_DIR}/MB/HBI0316A/io_v123f.txt
+    sed -i -e 's|^C2C_SIDE.*|C2C_SIDE: MASTER            ;C2C side SLAVE/MASTER|' \
+        ${PRIMARY_DIR}/MB/HBI0316A/io_v123f.txt
+    sed -i -e 's|.*SOCCON: 0x1170.*PLATFORM_CTRL.*|SOCCON: 0x1170 0x00000100   ;SoC SCC PLATFORM_CTRL|' \
+        ${PRIMARY_DIR}/MB/HBI0316A/io_v123f.txt
+
+    # Update load address for trusted boot
+    sed -i -e '/^IMAGE4ADDRESS:/ s|0x60200000|0x64200000|' ${PRIMARY_DIR}/MB/HBI0316A/images.txt
+    sed -i -e '/^IMAGE4UPDATE:/ s|FORCE   |SCP_AUTO|' ${PRIMARY_DIR}/MB/HBI0316A/images.txt
+    sed -i -e '/^IMAGE4FILE: \\SOFTWARE\\/s|uefi.bin|fip.bin |' ${PRIMARY_DIR}/MB/HBI0316A/images.txt
+
+    # Slave/Secondary
+    cp -av ${RECIPE_SYSROOT}/${FIRMWARE_DIR}/* ${SECONDARY_DIR}
+    mkdir -p ${SECONDARY_DIR}/SOFTWARE/
+
+    # Copy SOC binaries
+    for f in ${SOC_BINARIES}; do
+        cp -v ${RECIPE_SYSROOT}/firmware/${f} ${SECONDARY_DIR}/SOFTWARE/
+    done
+
+    sed -i -e 's|^C2C_ENABLE.*|C2C_ENABLE: TRUE            ;C2C enable TRUE/FALSE|' \
+        ${SECONDARY_DIR}/MB/HBI0316A/io_v123f.txt
+    sed -i -e 's|^C2C_SIDE.*|C2C_SIDE: SLAVE             ;C2C side SLAVE/MASTER|' \
+        ${SECONDARY_DIR}/MB/HBI0316A/io_v123f.txt
+    sed -i -e 's|.*SOCCON: 0x1170.*PLATFORM_CTRL.*|SOCCON: 0x1170 0x00000101   ;SoC SCC PLATFORM_CTRL|' \
+        ${SECONDARY_DIR}/MB/HBI0316A/io_v123f.txt
+    sed -i -e '/^TOTALIMAGES:/ s|5|4|' ${SECONDARY_DIR}/MB/HBI0316A/images.txt
+    sed -i -e 's|^IMAGE4|;&|' ${SECONDARY_DIR}/MB/HBI0316A/images.txt
+}
+
+do_deploy() {
+    # prepare Master & Slave packages
+    prepare_package
+
+    for dir in ${PRIMARY_DIR} ${SECONDARY_DIR}; do
+        dir_name=$(basename ${dir})
+        mkdir -p ${D}/${dir_name}
+        cp -av ${dir} ${D}
+
+        # Compress the files
+        tar -C ${D}/${dir_name} -zcvf ${DEPLOYDIR}/${dir_name}.tar.gz ./
+    done
+}
+do_deploy[dirs] += "${PRIMARY_DIR} ${SECONDARY_DIR}"
+do_deploy[cleandirs] += "${PRIMARY_DIR} ${SECONDARY_DIR}"
+do_deploy[umask] = "022"
+addtask deploy after do_prepare_recipe_sysroot
@@ -0,0 +1,35 @@
+# N1SDP specific SCP configurations and build instructions
+
+COMPATIBLE_MACHINE:n1sdp = "n1sdp"
+
+SCP_LOG_LEVEL = "INFO"
+
+DEPENDS += "fiptool-native"
+DEPENDS += "trusted-firmware-a"
+DEPENDS += "n1sdp-board-firmware"
+
+# The n1sdp sensor library is needed for building SCP N1SDP Platform
+# https://github.com/ARM-software/SCP-firmware/tree/master/product/n1sdp
+EXTRA_OECMAKE:append = " \
+    -DSCP_N1SDP_SENSOR_LIB_PATH=${RECIPE_SYSROOT}/n1sdp-board-firmware_source/LIB/sensor.a \
+"
+
+do_install:append() {
+   fiptool \
+       create \
+       --scp-fw "${D}/firmware/scp_ramfw.bin" \
+       --blob uuid=cfacc2c4-15e8-4668-82be-430a38fad705,file="${RECIPE_SYSROOT}/firmware/bl1.bin" \
+       "scp_fw.bin"
+
+   # This UUID is FIP_UUID_MCP_BL2 in SCP-Firmware.
+   fiptool \
+       create \
+       --blob uuid=54464222-a4cf-4bf8-b1b6-cee7dade539e,file="${D}/firmware/mcp_ramfw.bin" \
+       "mcp_fw.bin"
+
+   install "scp_fw.bin" "${D}/firmware/scp_fw.bin"
+   install "mcp_fw.bin" "${D}/firmware/mcp_fw.bin"
+
+   ln -sf "scp_romfw.bin" "${D}/firmware/scp_rom.bin"
+   ln -sf "mcp_romfw.bin" "${D}/firmware/mcp_rom.bin"
+}
@@ -3,6 +3,7 @@
 MACHINE_SCP_REQUIRE ?= ""

 MACHINE_SCP_REQUIRE:juno = "scp-firmware-juno.inc"
+MACHINE_SCP_REQUIRE:n1sdp = "scp-firmware-n1sdp.inc"
 MACHINE_SCP_REQUIRE:sgi575 = "scp-firmware-sgi575.inc"
 MACHINE_SCP_REQUIRE:tc = "scp-firmware-tc.inc"

@@ -6,7 +6,7 @@ Subject: [PATCH] fix(corstone1000): pass spsr value explicitly
 Passes spsr value for BL32 (OPTEE) explicitly between different boot
 stages.

-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/30116/2]
+Upstream-Status: Pending
 Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
 ---
 .../corstone1000/common/corstone1000_bl2_mem_params_desc.c     | 3 ++-
@@ -0,0 +1,54 @@
+From 684b8f88238f522b52eb102485762e02e6b1671a Mon Sep 17 00:00:00 2001
+From: Emekcan Aras <Emekcan.Aras@arm.com>
+Date: Fri, 23 Feb 2024 13:17:59 +0000
+Subject: [PATCH] fix(spmd): remove EL3 interrupt registration
+
+This configuration should not be done for corstone1000 and similar
+platforms. GICv2 systems only support EL3 interrupts and can have SEL1 component
+as SPMC.
+
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+Upstream-Status: Inappropriate [Discussions of fixing this in a better way is ongoing in upstream]
+---
+ services/std_svc/spmd/spmd_main.c | 24 ------------------------
+ 1 file changed, 24 deletions(-)
+
+diff --git a/services/std_svc/spmd/spmd_main.c b/services/std_svc/spmd/spmd_main.c
+index 066571e9b..313f05bf3 100644
+--- a/services/std_svc/spmd/spmd_main.c
+++ b/services/std_svc/spmd/spmd_main.c
+@@ -580,30 +580,6 @@ static int spmd_spmc_init(void *pm_addr)
+ 		panic();
+ 	}
+ 
+-	/*
+-	 * Permit configurations where the SPM resides at S-EL1/2 and upon a
+-	 * Group0 interrupt triggering while the normal world runs, the
+-	 * interrupt is routed either through the EHF or directly to the SPMD:
+-	 *
+-	 * EL3_EXCEPTION_HANDLING=0: the Group0 interrupt is routed to the SPMD
+-	 *                   for handling by spmd_group0_interrupt_handler_nwd.
+-	 *
+-	 * EL3_EXCEPTION_HANDLING=1: the Group0 interrupt is routed to the EHF.
+-	 *
+-	 */
+-#if (EL3_EXCEPTION_HANDLING == 0)
+-	/*
+-	 * Register an interrupt handler routing Group0 interrupts to SPMD
+-	 * while the NWd is running.
+-	 */
+-	rc = register_interrupt_type_handler(INTR_TYPE_EL3,
+-					     spmd_group0_interrupt_handler_nwd,
+-					     flags);
+-	if (rc != 0) {
+-		panic();
+-	}
+-#endif
+-
+ 	return 0;
+ }
+ 
+-- 
+2.25.1
+
+
@@ -9,7 +9,7 @@ for BL32 image, this patch removes NS_SHARED_RAM region which is not currently u
 corstone1000 platform.

 Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/30117/2]
+Upstream-Status: Pending
 ---
 .../corstone1000/common/corstone1000_plat.c   |  1 -
 .../common/include/platform_def.h             | 19 +------------------
@@ -1,161 +0,0 @@
-From dcc9cf5111c41edc691f007bd97548d96f5efddb Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Thu, 9 May 2024 16:59:34 +0000
-Subject: [PATCH] feat(corstone1000): add multicore support for fvp
-
-This changeset adds the multicore support for the Corstone-1000 FVP.
-It adds the PSCI CPU_ON and CPU_ON_FINISH power domain functionalities
-for the secondary cores.
-
-Upstream-Status: Backport [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/29176]
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
- .../common/corstone1000_helpers.S             | 26 +++++++++++
- .../corstone1000/common/corstone1000_pm.c     | 43 ++++++++++++++++++-
- .../common/include/platform_def.h             | 15 ++++++-
- plat/arm/board/corstone1000/platform.mk       |  7 +++
- 4 files changed, 89 insertions(+), 2 deletions(-)
-
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_helpers.S b/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-index cbe27c3b5..90dc4fee6 100644
--- a/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-+++ b/plat/arm/board/corstone1000/common/corstone1000_helpers.S
-@@ -21,8 +21,34 @@
- 	 * --------------------------------------------------------------------
- 	 */
- func plat_secondary_cold_boot_setup
-+#if defined(CORSTONE1000_FVP_MULTICORE)
-+
-+	/* Calculate the address of our hold entry */
-+	bl	plat_my_core_pos
-+	lsl	x0, x0, #CORSTONE1000_SECONDARY_CORE_HOLD_SHIFT
-+	mov_imm	x2, CORSTONE1000_SECONDARY_CORE_HOLD_BASE
-+	
-+	/* Set the wait state for the secondary core */
-+	mov_imm	x3, CORSTONE1000_SECONDARY_CORE_STATE_WAIT
-+	str	x3, [x2, x0]
-+	dmb	ish
-+
-+	/* Poll until the primary core signals to go  */
-+poll_mailbox:
-+	ldr	x1, [x2, x0]
-+	cmp	x1, #CORSTONE1000_SECONDARY_CORE_STATE_WAIT
-+	beq	1f
-+	mov_imm	x0, PLAT_ARM_TRUSTED_MAILBOX_BASE
-+	ldr	x1, [x0]
-+	br	x1
-+1:
-+	wfe
-+	b	poll_mailbox
-+#else
- cb_panic:
- 	b	cb_panic
-+#endif
-+
- endfunc plat_secondary_cold_boot_setup
- 
- 	/* ---------------------------------------------------------------------
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_pm.c b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-index a52e945bf..979243317 100644
--- a/plat/arm/board/corstone1000/common/corstone1000_pm.c
-+++ b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-@@ -33,10 +33,51 @@ static void __dead2 corstone1000_system_reset(void)
- 		wfi();
- 	}
- }
-+#if defined(CORSTONE1000_FVP_MULTICORE)
-+int corstone1000_validate_ns_entrypoint(uintptr_t entrypoint)
-+{
-+	/*
-+	 * Check if the non secure entrypoint lies within the non
-+	 * secure DRAM.
-+	 */
-+	if ((entrypoint >= ARM_NS_DRAM1_BASE) && (entrypoint < (ARM_NS_DRAM1_BASE + ARM_NS_DRAM1_SIZE))) {
-+		return PSCI_E_SUCCESS;
-+	}
-+	return PSCI_E_INVALID_ADDRESS;
-+}
-+
-+int corstone1000_pwr_domain_on(u_register_t mpidr)
-+{
-+	int core_index = plat_core_pos_by_mpidr(mpidr);
-+	uint64_t *secondary_core_hold_base = (uint64_t *)CORSTONE1000_SECONDARY_CORE_HOLD_BASE;
- 
-+	/* Validate the core index */
-+	if ((core_index < 0) || (core_index > PLATFORM_CORE_COUNT)) {
-+		return PSCI_E_INVALID_PARAMS;
-+	}
-+	secondary_core_hold_base[core_index] = CORSTONE1000_SECONDARY_CORE_STATE_GO;
-+	dsbish();
-+	sev();
-+
-+	return PSCI_E_SUCCESS;
-+}
-+
-+void corstone1000_pwr_domain_on_finish(const psci_power_state_t *target_state)
-+{
-+	(void)target_state;
-+	plat_arm_gic_init();
-+}
-+#endif
- plat_psci_ops_t plat_arm_psci_pm_ops = {
-+#if defined(CORSTONE1000_FVP_MULTICORE)
-+	.pwr_domain_on = corstone1000_pwr_domain_on,
-+	.pwr_domain_on_finish = corstone1000_pwr_domain_on_finish,
-+	.validate_ns_entrypoint = corstone1000_validate_ns_entrypoint,
-+	.system_reset = corstone1000_system_reset,
-+#else
-+	.validate_ns_entrypoint = NULL,
- 	.system_reset = corstone1000_system_reset,
-	.validate_ns_entrypoint = NULL
-+#endif
- };
- 
- const plat_psci_ops_t *plat_arm_psci_override_pm_ops(plat_psci_ops_t *ops)
-diff --git a/plat/arm/board/corstone1000/common/include/platform_def.h b/plat/arm/board/corstone1000/common/include/platform_def.h
-index b9a1d43df..c4839ccf3 100644
--- a/plat/arm/board/corstone1000/common/include/platform_def.h
-+++ b/plat/arm/board/corstone1000/common/include/platform_def.h
-@@ -249,7 +249,20 @@
-  */
- #define ARM_LOCAL_STATE_OFF	U(2)
- 
-#define PLAT_ARM_TRUSTED_MAILBOX_BASE	ARM_TRUSTED_SRAM_BASE
-+#define PLAT_ARM_TRUSTED_MAILBOX_BASE   ARM_TRUSTED_SRAM_BASE
-+
-+#if defined(CORSTONE1000_FVP_MULTICORE)
-+/* The secondary core entrypoint address points to bl31_warm_entrypoint
-+ * and the address size is 8 bytes */
-+#define CORSTONE1000_SECONDARY_CORE_ENTRYPOINT_ADDRESS_SIZE 	UL(0x8)
-+
-+#define CORSTONE1000_SECONDARY_CORE_HOLD_BASE         (PLAT_ARM_TRUSTED_MAILBOX_BASE + \
-+						CORSTONE1000_SECONDARY_CORE_ENTRYPOINT_ADDRESS_SIZE)
-+#define CORSTONE1000_SECONDARY_CORE_STATE_WAIT ULL(0)
-+#define CORSTONE1000_SECONDARY_CORE_STATE_GO   ULL(1)
-+#define CORSTONE1000_SECONDARY_CORE_HOLD_SHIFT ULL(3)
-+#endif
-+
- #define PLAT_ARM_NSTIMER_FRAME_ID	U(1)
- 
- #define PLAT_ARM_NS_IMAGE_BASE		(BL33_BASE)
-diff --git a/plat/arm/board/corstone1000/platform.mk b/plat/arm/board/corstone1000/platform.mk
-index fd08803e8..45092ace9 100644
--- a/plat/arm/board/corstone1000/platform.mk
-+++ b/plat/arm/board/corstone1000/platform.mk
-@@ -31,6 +31,13 @@ override NEED_BL31	:=	yes
- NEED_BL32		?=	yes
- override NEED_BL33	:=	yes
- 
-+ENABLE_MULTICORE	:=	0
-+ifneq ($(filter ${TARGET_PLATFORM}, fvp),)
-+ifeq (${ENABLE_MULTICORE},1)
-+$(eval $(call add_define,CORSTONE1000_FVP_MULTICORE))
-+endif
-+endif
-+
- # Add CORSTONE1000_WITH_BL32 as a preprocessor define (-D option)
- ifeq (${NEED_BL32},yes)
- $(eval $(call add_define,CORSTONE1000_WITH_BL32))
-- 
-2.25.1
-
@@ -9,7 +9,7 @@ before the reset. This causes a race condition especially in FVP after reset.
 This adds proper sequence before resetting the platform.

 Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/30118/2]
+Upstream-Status: Pending
 ---
 plat/arm/board/corstone1000/common/corstone1000_pm.c | 9 +++++++++
 1 file changed, 9 insertions(+)
@@ -1,28 +0,0 @@
-From 8070bf4a89492727b6da3fb7bdec61748eae1d7d Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Tue, 2 Jul 2024 12:49:12 +0000
-Subject: [PATCH] fix(corstone1000): include platform header file
-
-Include platform.h file in order to remove compiler warnings
-
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/29727]
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
- plat/arm/board/corstone1000/common/corstone1000_pm.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/plat/arm/board/corstone1000/common/corstone1000_pm.c b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-index 979243317..9babe5b11 100644
--- a/plat/arm/board/corstone1000/common/corstone1000_pm.c
-+++ b/plat/arm/board/corstone1000/common/corstone1000_pm.c
-@@ -8,6 +8,7 @@
- #include <plat/arm/common/plat_arm.h>
- #include <platform_def.h>
- #include <drivers/arm/gicv2.h>
-+#include <plat/common/platform.h>
- /*******************************************************************************
-  * Export the platform handlers via plat_arm_psci_pm_ops. The ARM Standard
-  * platform layer will take care of registering the handlers with PSCI.
-- 
-2.34.1
-
@@ -0,0 +1,64 @@
+From b79d3cf319cc5698311ef83247110c93d3c2de2c Mon Sep 17 00:00:00 2001
+Message-Id: <b79d3cf319cc5698311ef83247110c93d3c2de2c.1695834344.git.diego.sueiro@arm.com>
+From: Diego Sueiro <diego.sueiro@arm.com>
+Date: Wed, 27 Sep 2023 18:05:26 +0100
+Subject: [PATCH] fdts/fvp-base: Add stdout-path and virtio net and rng nodes
+
+Upstream-Status: Pending
+Signed-off-by: Diego Sueiro <diego.sueiro@arm.com>
+---
+ fdts/fvp-base-psci-common.dtsi |  8 ++++++--
+ fdts/rtsm_ve-motherboard.dtsi  | 12 ++++++++++++
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/fdts/fvp-base-psci-common.dtsi b/fdts/fvp-base-psci-common.dtsi
+index 79cf37d3b0..b1ba5ce703 100644
+--- a/fdts/fvp-base-psci-common.dtsi
+++ b/fdts/fvp-base-psci-common.dtsi
+@@ -30,7 +30,9 @@
+ #if (ENABLE_RME == 1)
+ 	chosen { bootargs = "console=ttyAMA0 earlycon=pl011,0x1c090000 root=/dev/vda ip=on";};
+ #else
+-	chosen {};
+	chosen {
+		stdout-path = &v2m_serial0;
+	};
+ #endif
+ 
+ 	aliases {
+@@ -243,6 +245,8 @@
+ 				<0 0 39 &gic 0 GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>,
+ 				<0 0 40 &gic 0 GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>,
+ 				<0 0 41 &gic 0 GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>,
+-				<0 0 42 &gic 0 GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>;
+				<0 0 42 &gic 0 GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>,
+				<0 0 44 &gic 0 GIC_SPI 44 IRQ_TYPE_LEVEL_HIGH>,
+				<0 0 46 &gic 0 GIC_SPI 46 IRQ_TYPE_LEVEL_HIGH>;
+ 	};
+ };
+diff --git a/fdts/rtsm_ve-motherboard.dtsi b/fdts/rtsm_ve-motherboard.dtsi
+index 0a824b349a..21a083a51a 100644
+--- a/fdts/rtsm_ve-motherboard.dtsi
+++ b/fdts/rtsm_ve-motherboard.dtsi
+@@ -230,6 +230,18 @@
+ 					interrupts = <42>;
+ 				};
+ 
+				virtio@150000 {
+					compatible = "virtio,mmio";
+					reg = <0x150000 0x200>;
+					interrupts = <44>;
+				};
+
+				virtio@200000 {
+					compatible = "virtio,mmio";
+					reg = <0x200000 0x200>;
+					interrupts = <46>;
+				};
+
+ 				rtc@170000 {
+ 					compatible = "arm,pl031", "arm,primecell";
+ 					reg = <0x170000 0x1000>;
+-- 
+2.39.1
+
@@ -0,0 +1,42 @@
+From 2d305094f8f500362079e9e7637d46129bf980e4 Mon Sep 17 00:00:00 2001
+From: Adam Johnston <adam.johnston@arm.com>
+Date: Tue, 25 Jul 2023 16:05:51 +0000
+Subject: [PATCH] n1sdp: Reserve OP-TEE memory from NWd
+
+The physical memory which is used to run OP-TEE on the N1SDP is known
+to the secure world via TOS_FW_CONFIG, but it may not be known to the
+normal world.
+
+As a precaution, explicitly reserve this memory via NT_FW_CONFIG to
+prevent the normal world from using it. This is not required on most
+platforms as the Trusted OS is run from secure RAM.
+
+Upstream-Status: Pending (not yet submitted to upstream)
+Signed-off-by: Adam Johnston <adam.johnston@arm.com>
+Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+---
+ plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts b/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts
+index da5e04ddb6..b7e2d4e86f 100644
+--- a/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts
+++ b/plat/arm/board/n1sdp/fdts/n1sdp_nt_fw_config.dts
+@@ -20,4 +20,16 @@
+ 		local-ddr-size = <0x0>;
+ 		remote-ddr-size = <0x0>;
+ 	};
+
+	reserved-memory {
+		#address-cells = <2>;
+		#size-cells = <2>;
+		ranges;
+
+		optee@0xDE000000 {
+			compatible = "removed-dma-pool";
+			reg = <0x0 0xDE000000 0x0 0x02000000>;
+			no-map;
+		};
+	};
+ };
+\ No newline at end of file
@@ -0,0 +1,46 @@
+From cc0153b56d634aa80b740be5afed15bedb94a2c9 Mon Sep 17 00:00:00 2001
+From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+Date: Tue, 23 Jan 2024 14:19:39 +0000
+Subject: [PATCH] n1sdp patch tests to skip
+
+Upstream-Status: Pending
+Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
+---
+ plat/arm/n1sdp/tests_to_skip.txt | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/plat/arm/n1sdp/tests_to_skip.txt b/plat/arm/n1sdp/tests_to_skip.txt
+index b6e87bf..1848408 100644
+--- a/plat/arm/n1sdp/tests_to_skip.txt
+++ b/plat/arm/n1sdp/tests_to_skip.txt
+@@ -11,7 +11,7 @@ SMMUv3 tests
+ PSCI CPU Suspend in OSI mode
+ 
+ # PSCI is enabled but not tested
+-PSCI STAT/Stats test cases after system suspend
+PSCI STAT
+ PSCI System Suspend Validation
+ 
+ # Disable FF-A Interrupt tests as TWDOG is not supported by TC platform
+@@ -25,9 +25,14 @@ FF-A Interrupt
+ # files in TFTF, since the port was done purely to test the spectre workaround
+ # performance impact. Once that was done no further work was done on the port.
+ 
+-Timer framework Validation/Target timer to a power down cpu
+-Timer framework Validation/Test scenario where multiple CPUs call same timeout
+-Timer framework Validation/Stress test the timer framework
+Timer framework Validation
+ PSCI Affinity Info/Affinity info level0 powerdown
+ PSCI CPU Suspend
+-PSCI STAT/for valid composite state CPU suspend
+Framework Validation/NVM serialisation
+Framework Validation/Events API
+Boot requirement tests
+CPU Hotplug
+ARM_ARCH_SVC/SMCCC_ARCH_WORKAROUND_1 test
+ARM_ARCH_SVC/SMCCC_ARCH_WORKAROUND_2 test
+ARM_ARCH_SVC/SMCCC_ARCH_WORKAROUND_3 test
+FF-A Power management
+-- 
+2.34.1
+
@@ -0,0 +1,30 @@
+From 15dab90c3cb8e7677c4f953c2269e8ee1afa01b0 Mon Oct 2 13:45:43 2023
+From: Mariam Elshakfy <mariam.elshakfy@arm.com>
+Date: Mon, 2 Oct 2023 13:45:43 +0000
+Subject: [PATCH] Modify BL32 Location to DDR4
+
+Since OP-TEE start address is changed to run
+from DDR4, this patch changes BL32 entrypoint
+to the correct one.
+
+Upstream-Status: Pending (not yet submitted to upstream)
+Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+---
+ plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts b/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts
+index ed870803c..797dfe3a4 100644
+--- a/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts
+++ b/plat/arm/board/n1sdp/fdts/n1sdp_optee_spmc_manifest.dts
+@@ -22,8 +22,8 @@
+ 		maj_ver = <0x1>;
+ 		min_ver = <0x0>;
+ 		exec_state = <0x0>;
+-		load_address = <0x0 0x08000000>;
+-		entrypoint = <0x0 0x08000000>;
+		load_address = <0x0 0xDE000000>;
+		entrypoint = <0x0 0xDE000000>;
+ 		binary_size = <0x2000000>;
+ 	};
+ 
@@ -0,0 +1,28 @@
+From 9a1d11b9fbadf740c73aee6dca4fd0370b38e4a8 Tue Oct 3 13:49:13 2023
+From: Mariam Elshakfy <mariam.elshakfy@arm.com>
+Date: Tue, 3 Oct 2023 13:49:13 +0000
+Subject: [PATCH] Modify SPMC Base to DDR4
+
+Since OP-TEE start address is changed to run
+from DDR4, this patch changes SPMC base to 
+the correct one.
+
+Upstream-Status: Pending (not yet submitted to upstream)
+Signed-off-by: Mariam Elshakfy <mariam.elshakfy@arm.com>
+---
+ plat/arm/board/n1sdp/include/platform_def.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plat/arm/board/n1sdp/include/platform_def.h b/plat/arm/board/n1sdp/include/platform_def.h
+index b3799a7b2..b12c61b61 100644
+--- a/plat/arm/board/n1sdp/include/platform_def.h
+++ b/plat/arm/board/n1sdp/include/platform_def.h
+@@ -118,7 +118,7 @@
+ 
+ #define PLAT_ARM_MAX_BL31_SIZE		UL(0x40000)
+ 
+-#define PLAT_ARM_SPMC_BASE		U(0x08000000)
+#define PLAT_ARM_SPMC_BASE		U(0xDE000000)
+ #define PLAT_ARM_SPMC_SIZE		UL(0x02000000)  /* 32 MB */
+ 
+ 
@@ -0,0 +1,45 @@
+From 051c723a6463a579b05dcaa81f204516737a3645 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@arm.com>
+Date: Wed, 9 Aug 2023 15:56:03 -0400
+Subject: [PATCH] Binutils 2.39 now warns when a segment has RXW
+ permissions[1]:
+
+aarch64-none-elf-ld.bfd: warning: bl31.elf has a LOAD segment with RWX
+permissions
+
+However, TF-A passes --fatal-warnings to LD, so this is a build failure.
+
+There is a ticket filed upstream[2], so until that is resolved just
+remove --fatal-warnings.
+
+[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
+[2] https://developer.trustedfirmware.org/T996
+
+Upstream-Status: Inappropriate
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 1ddb7b84417d..9eae30c923ec 100644
+--- a/Makefile
+++ b/Makefile
+@@ -425,7 +425,7 @@ TF_LDFLAGS		+=	$(TF_LDFLAGS_$(ARCH))
+ # LD = gcc (used when GCC LTO is enabled)
+ else ifneq ($(findstring gcc,$(notdir $(LD))),)
+ # Pass ld options with Wl or Xlinker switches
+-TF_LDFLAGS		+=	-Wl,--fatal-warnings -O1
+TF_LDFLAGS		+=	-O1
+ TF_LDFLAGS		+=	-Wl,--gc-sections
+ ifeq ($(ENABLE_LTO),1)
+ 	ifeq (${ARCH},aarch64)
+@@ -442,7 +442,7 @@ TF_LDFLAGS		+=	$(subst --,-Xlinker --,$(TF_LDFLAGS_$(ARCH)))
+ 
+ # LD = gcc-ld (ld) or llvm-ld (ld.lld) or other
+ else
+-TF_LDFLAGS		+=	--fatal-warnings -O1
+TF_LDFLAGS		+=	-O1
+ TF_LDFLAGS		+=	--gc-sections
+ # ld.lld doesn't recognize the errata flags,
+ # therefore don't add those in that case
@@ -0,0 +1,33 @@
+From 6635341615a5bcb36ce71479ee30dae1599081e2 Mon Sep 17 00:00:00 2001
+From: Anton Antonov <anrton.antonov@arm.com>
+Date: Wed, 9 Aug 2023 15:56:03 -0400
+Subject: [PATCH] Binutils 2.39 now warns when a segment has RXW
+ permissions[1]:
+
+aarch64-poky-linux-musl-ld: tftf.elf has a LOAD segment with RWX permissions
+
+There is a ticket filed upstream[2], so until that is resolved just
+disable the warning
+
+[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
+[2] https://developer.trustedfirmware.org/T996
+
+Upstream-Status: Inappropriate
+Signed-off-by: Anton Antonov <anrton.antonov@arm.com>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index 286a47c7d454..3481187b62cf 100644
+--- a/Makefile
+++ b/Makefile
+@@ -246,7 +246,7 @@ TFTF_SOURCES		:= ${FRAMEWORK_SOURCES}	${TESTS_SOURCES} ${PLAT_SOURCES} ${LIBC_SR
+ TFTF_INCLUDES		+= ${PLAT_INCLUDES}
+ TFTF_CFLAGS		+= ${COMMON_CFLAGS}
+ TFTF_ASFLAGS		+= ${COMMON_ASFLAGS}
+-TFTF_LDFLAGS		+= ${COMMON_LDFLAGS}
+TFTF_LDFLAGS		+= ${COMMON_LDFLAGS} --no-warn-rwx-segments
+ TFTF_EXTRA_OBJS 	:=
+ 
+ ifneq (${BP_OPTION},none)
@@ -7,11 +7,11 @@ LICENSE = "BSD-3-Clause"

 SRC_URI_TRUSTED_FIRMWARE_A ?= "git://git.trustedfirmware.org/TF-A/trusted-firmware-a.git;protocol=https"
 SRC_URI = "${SRC_URI_TRUSTED_FIRMWARE_A};destsuffix=fiptool-${PV};branch=${SRCBRANCH}"
-LIC_FILES_CHKSUM = "file://docs/license.rst;md5=b5fbfdeb6855162dded31fadcd5d4dc5"
+LIC_FILES_CHKSUM = "file://docs/license.rst;md5=b2c740efedc159745b9b31f88ff03dde"

-# Use fiptool from TF-A v2.11.0
-SRCREV = "f2735ebccf5173f74c0458736ec526276106097e"
-SRCBRANCH = "master"
+# Use fiptool from TF-A v2.8.6
+SRCREV = "ff0bd5f9bb2ba2f31fb9cec96df917747af9e92d"
+SRCBRANCH = "lts-v2.8"

 DEPENDS += "openssl-native"

@@ -22,7 +22,7 @@ EXTRA_OEMAKE = "V=1 HOSTCC='${BUILD_CC}' OPENSSL_DIR=${STAGING_DIR_NATIVE}/${pre
 do_compile () {
    # This is still needed to have the native fiptool executing properly by
    # setting the RPATH
-    sed -i '/^LDOPTS/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/fiptool/Makefile
+    sed -i '/^LDLIBS/ s,$, \$\{BUILD_LDFLAGS},' ${S}/tools/fiptool/Makefile
    sed -i '/^INCLUDE_PATHS/ s,$, \$\{BUILD_CFLAGS},' ${S}/tools/fiptool/Makefile

    oe_runmake fiptool
@@ -1,6 +1,16 @@
 # Machine specific TFAs

+FILESEXTRAPATHS:prepend := "${THISDIR}/files:"
+
 COMPATIBLE_MACHINE:corstone1000 = "corstone1000"
 EXTRA_OEMAKE:append:corstone1000 = " DEBUG=0"
 EXTRA_OEMAKE:append:corstone1000 = " LOG_LEVEL=30"
 TFTF_MODE:corstone1000 = "release"
+
+COMPATIBLE_MACHINE:n1sdp = "n1sdp"
+EXTRA_OEMAKE:append:n1sdp = " DEBUG=1"
+EXTRA_OEMAKE:append:n1sdp = " LOG_LEVEL=50"
+TFTF_MODE:n1sdp = "debug"
+SRC_URI:append:n1sdp = " \
+			file://0001-n1sdp-tftf-tests-to-skip.patch \
+			"
@@ -9,9 +9,9 @@ COMPATIBLE_MACHINE ?= "invalid"

 SRC_URI_TRUSTED_FIRMWARE_A_TESTS ?= "git://git.trustedfirmware.org/TF-A/tf-a-tests.git;protocol=https"
 SRC_URI = "${SRC_URI_TRUSTED_FIRMWARE_A_TESTS};branch=${SRCBRANCH} \
-          "
-SRCBRANCH = "master"
-SRCREV = "fd053b75cde9c2aa1a5b979a2b544890510d4f52"
+          file://tf-a-tests-no-warn-rwx-segments.patch"
+SRCBRANCH = "lts-v2.8"
+SRCREV = "85442d2943440718c2c2c9c5c690202b4b4f5725"

 DEPENDS += "optee-os"

@@ -37,7 +37,6 @@ EXTRA_OEMAKE += "BUILD_BASE=${B} PLAT=${TFA_PLATFORM}"
 # Requires CROSS_COMPILE set by hand as there is no configure script
 export CROSS_COMPILE="${TARGET_PREFIX}"

-LDFLAGS[unexport] = "1"
 do_compile() {
    oe_runmake -C ${S} tftf
 }
@@ -6,10 +6,9 @@ FILESEXTRAPATHS:prepend := "${THISDIR}/files/corstone1000:"
 SRC_URI:append = " \
 	file://0001-Fix-FF-A-version-in-SPMC-manifest.patch \
 	file://0002-fix-corstone1000-pass-spsr-value-explicitly.patch \
-	file://0003-fix-corstone1000-remove-unused-NS_SHARED_RAM-region.patch \
-	file://0004-fix-corstone1000-clean-the-cache-and-disable-interru.patch \
-	file://0005-feat-corstone1000-Add-multicore-support-for-FVP-plat.patch \
-	file://0006-feat-corstone1000-include-platform-header-file.patch \
+	file://0003-fix-spmd-remove-EL3-interrupt-registration.patch \
+	file://0004-fix-corstone1000-remove-unused-NS_SHARED_RAM-region.patch \
+	file://0005-fix-corstone1000-clean-the-cache-and-disable-interru.patch \
       "

 TFA_DEBUG = "1"
@@ -26,13 +25,13 @@ TFA_SPMD_SPM_AT_SEL2 = "0"
 # BL2 loads BL32 (optee). So, optee needs to be built first:
 DEPENDS += "optee-os"

-# Note: Regarding the build option: LOG_LEVEL.
+# Note: Regarding the build option: LOG_LEVEL. 
 # There seems to be an issue when setting it
-# to 50 (LOG_LEVEL_VERBOSE), where the kernel
+# to 50 (LOG_LEVEL_VERBOSE), where the kernel 
 # tee driver sends yielding requests to OP-TEE
 # at a faster pace than OP-TEE processes them,
-# as the processing time is consumed by logging
-# in TF-A. When this issue occurs, booting halts
+# as the processing time is consumed by logging 
+# in TF-A. When this issue occurs, booting halts 
 # as soon as optee driver starts initialization.
 # Therefore, it's not currently recommended to
 # set LOG_LEVEL to 50 at all.
@@ -55,4 +54,3 @@ EXTRA_OEMAKE:append = " \
                        BL32=${RECIPE_SYSROOT}/${nonarch_base_libdir}/firmware/tee-pager_v2.bin \
                        FVP_USE_GIC_DRIVER=FVP_GICV2 \
                        "
-EXTRA_OEMAKE:append:corstone1000-fvp = "${@bb.utils.contains('MACHINE_FEATURES', 'corstone1000_fvp_smp', ' ENABLE_MULTICORE=1', '', d)}"
@@ -7,6 +7,7 @@
 FILESEXTRAPATHS:prepend := "${THISDIR}/files/:${THISDIR}/files/fvp-base"

 SRC_URI:append = " \
+    file://0001-fdts-fvp-base-Add-stdout-path-and-virtio-net-and-rng.patch \
    file://optee_spmc_maifest.dts;subdir=git/plat/arm/board/fvp/fdts \
 "

@@ -0,0 +1,41 @@
+# N1SDP specific TFA support
+
+# Align with N1SDP-2023.06.22 Manifest
+SRCREV_tfa  = "31f60a968347497562b0129134928d7ac4767710"
+PV .= "+git"
+
+COMPATIBLE_MACHINE = "n1sdp"
+TFA_BUILD_TARGET   = "all fip"
+TFA_INSTALL_TARGET = "bl1 bl2 bl31 n1sdp-multi-chip n1sdp-single-chip n1sdp_fw_config n1sdp_tb_fw_config fip"
+TFA_DEBUG          = "1"
+TFA_MBEDTLS        = "1"
+TFA_UBOOT          = "0"
+TFA_UEFI          ?= "1"
+
+FILESEXTRAPATHS:prepend := "${THISDIR}/files/n1sdp:"
+
+SRC_URI:append = " \
+    file://0001-Reserve-OP-TEE-memory-from-nwd.patch \
+    file://0002-Modify-BL32-Location-to-DDR4.patch \
+    file://0003-Modify-SPMC-Base-to-DDR4.patch \
+    "
+
+TFA_ROT_KEY= "plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem"
+
+# Enabling Secure-EL1 Payload Dispatcher (SPD)
+TFA_SPD = "spmd"
+# Cortex-A35 supports Armv8.0-A (no S-EL2 execution state).
+# So, the SPD SPMC component should run at the S-EL1 execution state
+TFA_SPMD_SPM_AT_SEL2 = "0"
+
+# BL2 loads BL32 (optee). So, optee needs to be built first:
+DEPENDS += "optee-os"
+
+EXTRA_OEMAKE:append = "\
+                    TRUSTED_BOARD_BOOT=1 \
+		    GENERATE_COT=1 \
+		    CREATE_KEYS=1 \
+		    ARM_ROTPK_LOCATION="devel_rsa" \
+		    ROT_KEY="${TFA_ROT_KEY}" \
+		    BL32=${RECIPE_SYSROOT}/${nonarch_base_libdir}/firmware/tee-pager_v2.bin \
+		    "
@@ -6,6 +6,7 @@ MACHINE_TFA_REQUIRE ?= ""
 MACHINE_TFA_REQUIRE:corstone1000 = "trusted-firmware-a-corstone1000.inc"
 MACHINE_TFA_REQUIRE:fvp-base = "trusted-firmware-a-fvp-base.inc"
 MACHINE_TFA_REQUIRE:juno = "trusted-firmware-a-juno.inc"
+MACHINE_TFA_REQUIRE:n1sdp = "trusted-firmware-a-n1sdp.inc"
 MACHINE_TFA_REQUIRE:sbsa-ref = "trusted-firmware-a-sbsa-ref.inc"
 MACHINE_TFA_REQUIRE:sgi575 = "trusted-firmware-a-sgi575.inc"
 MACHINE_TFA_REQUIRE:tc = "trusted-firmware-a-tc.inc"
@@ -1,97 +0,0 @@
-From 6ac0d4ce58c1a957c5f086e8c32268fdfc3ea531 Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <emekcan.aras@arm.com>
-Date: Thu, 26 Oct 2023 11:46:04 +0100
-Subject: [PATCH 1/9] Platform: Corstone1000: Align capsule UEFI structs
-
-The UEFI capsules are generated using the U-Boot mkeficapsule tool.
-U-Boot uses packed struct for the UEFI and FMP structures, see [1].
-The structs have to be aligned in the TF-M side parser to avoid
-crashes.
-
-[1] https://github.com/u-boot/u-boot/blob/u-boot-2023.07.y/include/efi_api.h#L245
-
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [6ac0d4ce58c1a957c5f086e8c32268fdfc3ea531]
---
- .../fw_update_agent/uefi_capsule_parser.c       | 17 +++++++++--------
- 1 file changed, 9 insertions(+), 8 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c b/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c
-index c706c040a..44566e08d 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c
-@@ -1,10 +1,11 @@
- /*
- * Copyright (c) 2021, Arm Limited. All rights reserved.
-+ * Copyright (c) 2021-2024, Arm Limited. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  *
-  */
- 
-+#include "cmsis_compiler.h"
- #include "uefi_capsule_parser.h"
- #include "fwu_agent.h"
- #include <string.h>
-@@ -29,21 +30,21 @@ Update Capsule Structure (UEFI spec 2.9 1004)
-             Payload n (item_offset[embedded_driver_count + payload_item_count -1])
- */
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     struct efi_guid         capsule_guid;
-     uint32_t                header_size;
-     uint32_t                flags;
-     uint32_t                capsule_image_size;
- } efi_capsule_header_t;
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     uint32_t                version;
-     uint16_t                embedded_driver_count;
-     uint16_t                payload_item_count;
-     uint64_t                item_offset_list[];
- } efi_firmware_management_capsule_header_t;
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     uint32_t                version;
-     struct efi_guid         update_image_type_id;
-     uint8_t                 update_image_index;
-@@ -54,7 +55,7 @@ typedef struct {
-     uint64_t                image_capsule_support; //introduced in v3
- } efi_firmware_management_capsule_image_header_t;
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     uint32_t                signature;
-     uint32_t                header_size;
-     uint32_t                fw_version;
-@@ -63,20 +64,20 @@ typedef struct {
- 
- #define ANYSIZE_ARRAY 0
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     uint32_t                dwLength;
-     uint16_t                wRevision;
-     uint16_t                wCertificateType;
-     uint8_t                 bCertificate[ANYSIZE_ARRAY];
- } WIN_CERTIFICATE;
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     WIN_CERTIFICATE         hdr;
-     struct efi_guid         cert_type;
-     uint8_t                 cert_data[ANYSIZE_ARRAY];
- } win_certificate_uefi_guid_t;
- 
-typedef struct {
-+typedef __PACKED_STRUCT {
-     uint64_t                    monotonic_count;
-     win_certificate_uefi_guid_t   auth_info;
- } efi_firmware_image_authentication_t;
-- 
-2.25.1
-
@@ -0,0 +1,274 @@
+From eb096e4c03b80f9f31e5d15ca06e5a38e4112664 Mon Sep 17 00:00:00 2001
+From: Bence Balogh <bence.balogh@arm.com>
+Date: Tue, 7 Nov 2023 20:25:49 +0100
+Subject: [PATCH 1/2] platform: corstone1000: Update MPU configuration
+
+In Armv6-M the MPU requires the regions to be aligned with
+region sizes.
+The commit aligns the different code/data sections using the
+alignment macros. The code/data sections can be covered by
+multiple MPU regions in order to save memory.
+
+Small adjustments had to be made in the memory layout in order to
+not overflow the flash:
+- Decreased TFM_PARTITION_SIZE
+- Increased S_UNPRIV_DATA_SIZE
+
+Added checks to the MPU configuration function for checking the
+MPU constraints:
+- Base address has to be aligned to the size
+- The minimum MPU region size is 0x100
+- The MPU can have 8 regions at most
+
+Change-Id: I059468e8aba0822bb354fd1cd4987ac2bb1f34d1
+Signed-off-by: Bence Balogh <bence.balogh@arm.com>
+Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/25393]
+
+---
+ .../target/arm/corstone1000/CMakeLists.txt    | 19 +++++
+ .../arm/corstone1000/create-flash-image.sh    |  8 +-
+ .../arm/corstone1000/partition/flash_layout.h |  2 +-
+ .../arm/corstone1000/partition/region_defs.h  |  6 +-
+ .../arm/corstone1000/tfm_hal_isolation.c      | 83 +++++++++++++++----
+ 5 files changed, 93 insertions(+), 25 deletions(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
+index e6cf15b11..8817f514c 100644
+--- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
+@@ -22,6 +22,25 @@ target_compile_definitions(platform_region_defs
+     INTERFACE
+         $<$<BOOL:${TFM_S_REG_TEST}>:TFM_S_REG_TEST>
+ )
+
+# The Armv6-M MPU requires that the MPU regions be aligned to the region sizes.
+# The minimal region size is 0x100 bytes.
+#
+# The alignments have to be a power of two and ideally bigger than the section size (which
+# can be checked in the map file).
+# In some cases the alignment value is smaller than the actual section
+# size to save memory. In that case, multiple MPU region has to be configured to cover it.
+#
+# To save memory, the attributes are set to XN_EXEC_OK and AP_RO_PRIV_UNPRIV for
+# the SRAM so the PSA_ROT_LINKER_CODE, TFM_UNPRIV_CODE and APP_ROT_LINKER_CODE don't have to
+# be aligned. The higher-priority regions will overwrite these attributes if needed.
+# The RAM is also located in the SRAM so it has to be configured to overwrite these default
+# attributes.
+target_compile_definitions(platform_region_defs
+    INTERFACE
+        TFM_LINKER_APP_ROT_LINKER_DATA_ALIGNMENT=0x2000
+        TFM_LINKER_SP_META_PTR_ALIGNMENT=0x100
+)
+ #========================= Platform common defs ===============================#
+ 
+ # Specify the location of platform specific build dependencies.
+diff --git a/platform/ext/target/arm/corstone1000/create-flash-image.sh b/platform/ext/target/arm/corstone1000/create-flash-image.sh
+index 2522d3674..a6be61384 100755
+--- a/platform/ext/target/arm/corstone1000/create-flash-image.sh
+++ b/platform/ext/target/arm/corstone1000/create-flash-image.sh
+@@ -8,7 +8,7 @@
+ 
+ ######################################################################
+ # This script is to create a flash gpt image for corstone platform
+-# 
+#
+ #  Flash image layout:
+ #       |------------------------------|
+ #       |        Protective MBR        |
+@@ -82,15 +82,15 @@ sgdisk  --mbrtogpt \
+         --new=4:56:+4K --typecode=4:$PRIVATE_METADATA_TYPE_UUID --partition-guid=4:$(uuidgen) --change-name=4:'private_metadata_replica_1' \
+         --new=5:64:+4k --typecode=5:$PRIVATE_METADATA_TYPE_UUID --partition-guid=5:$(uuidgen) --change-name=5:'private_metadata_replica_2' \
+         --new=6:72:+100k --typecode=6:$SE_BL2_TYPE_UUID --partition-guid=6:$(uuidgen) --change-name=6:'bl2_primary' \
+-        --new=7:272:+376K --typecode=7:$TFM_TYPE_UUID --partition-guid=7:$(uuidgen) --change-name=7:'tfm_primary' \
+        --new=7:272:+368K --typecode=7:$TFM_TYPE_UUID --partition-guid=7:$(uuidgen) --change-name=7:'tfm_primary' \
+         --new=8:32784:+100k --typecode=8:$SE_BL2_TYPE_UUID --partition-guid=8:$(uuidgen) --change-name=8:'bl2_secondary' \
+-        --new=9:32984:+376K --typecode=9:$TFM_TYPE_UUID --partition-guid=9:$(uuidgen) --change-name=9:'tfm_secondary' \
+        --new=9:32984:+368K --typecode=9:$TFM_TYPE_UUID --partition-guid=9:$(uuidgen) --change-name=9:'tfm_secondary' \
+         --new=10:65496:65501  --partition-guid=10:$(uuidgen) --change-name=10:'reserved_2' \
+         $IMAGE
+ 
+ [ $? -ne 0 ] && echo "Error occurs while writing the GPT layout" && exit 1
+ 
+-# Write partitions 
+# Write partitions
+ # conv=notrunc avoids truncation to keep the geometry of the image.
+ dd if=$BIN_DIR/bl2_signed.bin of=${IMAGE}  seek=72 conv=notrunc
+ dd if=$BIN_DIR/tfm_s_signed.bin of=${IMAGE} seek=272 conv=notrunc
+diff --git a/platform/ext/target/arm/corstone1000/partition/flash_layout.h b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
+index 568c8de28..7fffd94c6 100644
+--- a/platform/ext/target/arm/corstone1000/partition/flash_layout.h
+++ b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
+@@ -134,7 +134,7 @@
+ 
+ /* Bank configurations */
+ #define BANK_PARTITION_SIZE             (0xFE0000)   /* 15.875 MB */
+-#define TFM_PARTITION_SIZE              (0x5E000)    /* 376 KB */
+#define TFM_PARTITION_SIZE              (0x5C000)    /* 368 KB */
+ 
+ /************************************************************/
+ /* Bank : Images flash offsets are with respect to the bank */
+diff --git a/platform/ext/target/arm/corstone1000/partition/region_defs.h b/platform/ext/target/arm/corstone1000/partition/region_defs.h
+index 99e822f51..64ab786e5 100644
+--- a/platform/ext/target/arm/corstone1000/partition/region_defs.h
+++ b/platform/ext/target/arm/corstone1000/partition/region_defs.h
+@@ -1,8 +1,10 @@
+ /*
+- * Copyright (c) 2017-2022 Arm Limited. All rights reserved.
+ * Copyright (c) 2017-2023 Arm Limited. All rights reserved.
+  * Copyright (c) 2021-2023 Cypress Semiconductor Corporation (an Infineon company)
+  * or an affiliate of Cypress Semiconductor Corporation. All rights reserved.
+  *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+  * Licensed under the Apache License, Version 2.0 (the "License");
+  * you may not use this file except in compliance with the License.
+  * You may obtain a copy of the License at
+@@ -53,7 +55,7 @@
+ 
+ #define S_DATA_START            (SRAM_BASE + TFM_PARTITION_SIZE)
+ #define S_DATA_SIZE             (SRAM_SIZE - TFM_PARTITION_SIZE)
+-#define S_UNPRIV_DATA_SIZE      (0x2160)
+#define S_UNPRIV_DATA_SIZE      (0x4000)
+ #define S_DATA_LIMIT            (S_DATA_START + S_DATA_SIZE - 1)
+ #define S_DATA_PRIV_START       (S_DATA_START + S_UNPRIV_DATA_SIZE)
+ 
+diff --git a/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c b/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+index 01f7687bc..98e795dde 100644
+--- a/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+++ b/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2020-2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2020-2023, Arm Limited. All rights reserved.
+  * Copyright (c) 2022 Cypress Semiconductor Corporation (an Infineon
+  * company) or an affiliate of Cypress Semiconductor Corporation. All rights
+  * reserved.
+@@ -14,9 +14,11 @@
+ #include "tfm_hal_isolation.h"
+ #include "mpu_config.h"
+ #include "mmio_defs.h"
+#include "flash_layout.h"
+ 
+ #define PROT_BOUNDARY_VAL \
+     ((1U << HANDLE_ATTR_PRIV_POS) & HANDLE_ATTR_PRIV_MASK)
+#define MPU_REGION_MIN_SIZE (0x100)
+ 
+ #ifdef CONFIG_TFM_ENABLE_MEMORY_PROTECT
+ 
+@@ -31,20 +33,38 @@ REGION_DECLARE(Image$$, TFM_SP_META_PTR, $$ZI$$Base);
+ REGION_DECLARE(Image$$, TFM_SP_META_PTR, $$ZI$$Limit);
+ #endif /* CONFIG_TFM_PARTITION_META */
+ 
+-static void configure_mpu(uint32_t rnr, uint32_t base, uint32_t limit,
+-                          uint32_t is_xn_exec, uint32_t ap_permissions)
+static enum tfm_hal_status_t configure_mpu(uint32_t rnr, uint32_t base,
+                          uint32_t limit, uint32_t is_xn_exec, uint32_t ap_permissions)
+ {
+-    uint32_t size; /* region size */
+    uint32_t rbar_size_field; /* region size as it is used in the RBAR */
+     uint32_t rasr; /* region attribute and size register */
+     uint32_t rbar; /* region base address register */
+ 
+-    size = get_rbar_size_field(limit - base);
+    rbar_size_field = get_rbar_size_field(limit - base);
+
+    /* The MPU region's base address has to be aligned to the region
+     * size for a valid MPU configuration */
+    if ((base % (1 << (rbar_size_field + 1))) != 0) {
+        return TFM_HAL_ERROR_INVALID_INPUT;
+    }
+
+    /* The MPU supports only 8 memory regions */
+    if (rnr > 7) {
+        return TFM_HAL_ERROR_INVALID_INPUT;
+    }
+
+    /* The minimum size for a region is 0x100 bytes */
+    if((limit - base) < MPU_REGION_MIN_SIZE) {
+        return TFM_HAL_ERROR_INVALID_INPUT;
+    }
+ 
+     rasr = ARM_MPU_RASR(is_xn_exec, ap_permissions, TEX, NOT_SHAREABLE,
+-            NOT_CACHEABLE, NOT_BUFFERABLE, SUB_REGION_DISABLE, size);
+            NOT_CACHEABLE, NOT_BUFFERABLE, SUB_REGION_DISABLE, rbar_size_field);
+     rbar = base & MPU_RBAR_ADDR_Msk;
+ 
+     ARM_MPU_SetRegionEx(rnr, rbar, rasr);
+
+    return TFM_HAL_SUCCESS;
+ }
+ 
+ #endif /* CONFIG_TFM_ENABLE_MEMORY_PROTECT */
+@@ -56,33 +76,60 @@ enum tfm_hal_status_t tfm_hal_set_up_static_boundaries(
+     uint32_t rnr = TFM_ISOLATION_REGION_START_NUMBER; /* current region number */
+     uint32_t base; /* start address */
+     uint32_t limit; /* end address */
+    enum tfm_hal_status_t ret;
+ 
+     ARM_MPU_Disable();
+ 
+-    /* TFM Core unprivileged code region */
+-    base = (uint32_t)&REGION_NAME(Image$$, TFM_UNPRIV_CODE_START, $$RO$$Base);
+-    limit = (uint32_t)&REGION_NAME(Image$$, TFM_UNPRIV_CODE_END, $$RO$$Limit);
+-
+-    configure_mpu(rnr++, base, limit, XN_EXEC_OK, AP_RO_PRIV_UNPRIV);
+-
+-    /* RO region */
+-    base = (uint32_t)&REGION_NAME(Image$$, TFM_APP_CODE_START, $$Base);
+-    limit = (uint32_t)&REGION_NAME(Image$$, TFM_APP_CODE_END, $$Base);
+    /* Armv6-M MPU allows region overlapping. The region with the higher RNR
+     * will decide the attributes.
+     *
+     * The default attributes are set to XN_EXEC_OK and AP_RO_PRIV_UNPRIV for the
+     * whole SRAM so the PSA_ROT_LINKER_CODE, TFM_UNPRIV_CODE and APP_ROT_LINKER_CODE
+     * don't have to be aligned and memory space can be saved.
+     * This region has the lowest RNR so the next regions can overwrite these
+     * attributes if it's needed.
+     */
+    base = SRAM_BASE;
+    limit = SRAM_BASE + SRAM_SIZE;
+
+    ret = configure_mpu(rnr++, base, limit,
+                            XN_EXEC_OK, AP_RW_PRIV_UNPRIV);
+    if (ret != TFM_HAL_SUCCESS) {
+        return ret;
+    }
+ 
+-    configure_mpu(rnr++, base, limit, XN_EXEC_OK, AP_RO_PRIV_UNPRIV);
+ 
+     /* RW, ZI and stack as one region */
+     base = (uint32_t)&REGION_NAME(Image$$, TFM_APP_RW_STACK_START, $$Base);
+     limit = (uint32_t)&REGION_NAME(Image$$, TFM_APP_RW_STACK_END, $$Base);
+ 
+-    configure_mpu(rnr++, base, limit, XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+    /* The section size can be bigger than the alignment size, else the code would
+     * not fit into the memory. Because of this, the sections can use multiple MPU
+     * regions. */
+    do {
+        ret = configure_mpu(rnr++, base, base + TFM_LINKER_APP_ROT_LINKER_DATA_ALIGNMENT,
+                                XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+        if (ret != TFM_HAL_SUCCESS) {
+            return ret;
+        }
+        base += TFM_LINKER_APP_ROT_LINKER_DATA_ALIGNMENT;
+    } while (base < limit);
+
+ 
+ #ifdef CONFIG_TFM_PARTITION_META
+     /* TFM partition metadata pointer region */
+     base = (uint32_t)&REGION_NAME(Image$$, TFM_SP_META_PTR, $$ZI$$Base);
+     limit = (uint32_t)&REGION_NAME(Image$$, TFM_SP_META_PTR, $$ZI$$Limit);
+ 
+-    configure_mpu(rnr++, base, limit, XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+    do {
+        ret = configure_mpu(rnr++, base, base + TFM_LINKER_SP_META_PTR_ALIGNMENT,
+                                XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+        if (ret != TFM_HAL_SUCCESS) {
+            return ret;
+        }
+        base += TFM_LINKER_SP_META_PTR_ALIGNMENT;
+    } while (base < limit);
+
+ #endif
+ 
+     arm_mpu_enable();
@@ -1,69 +0,0 @@
-From 47c54e8e79df52f40057c3d4be9411447d2787c2 Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <Emekcan.Aras@arm.com>
-Date: Wed, 21 Feb 2024 07:44:25 +0000
-Subject: [PATCH 2/9] Platform: Corstone1000: Fix NV counter writing
-
-The BL1 writes the PLAT_NV_COUNTER_BL1_0 NV counter directly without
-updating the private metadata. Because of this the update_nv_counters()
-function should not update the PLAT_NV_COUNTER_BL1_0 from the metadata.
-
-The tfm_plat_set_nv_counter() had a typo and wrote the
-priv_metadata->nv_counter[FWU_BL2_NV_COUNTER] to every NV counter.
-
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [47c54e8e79df52f40057c3d4be9411447d2787c2]
---
- .../corstone1000/fw_update_agent/fwu_agent.c   | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-index 9a9926a3d..b2f31e166 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-@@ -1120,12 +1120,13 @@ static enum fwu_agent_error_t update_nv_counters(
- 
-     FWU_LOG_MSG("%s: enter\n\r", __func__);
- 
-    for (int i = 0; i <= FWU_MAX_NV_COUNTER_INDEX; i++) {
-+    /* The FWU_BL2_NV_COUNTER (0) is not mirrored in the private metadata. It is
-+     * directly updated in the bl1_2_validate_image_at_addr() function, in
-+     * tfm/bl1/bl1_2/main.c.
-+     * Because of this, the index starts from FWU_TFM_NV_COUNTER (1). */
-+    for (int i = FWU_TFM_NV_COUNTER; i <= FWU_MAX_NV_COUNTER_INDEX; i++) {
- 
-         switch (i) {
-            case FWU_BL2_NV_COUNTER:
-                tfm_nv_counter_i = PLAT_NV_COUNTER_BL1_0;
-                break;
-             case FWU_TFM_NV_COUNTER:
-                 tfm_nv_counter_i = PLAT_NV_COUNTER_BL2_0;
-                 break;
-@@ -1140,18 +1141,21 @@ static enum fwu_agent_error_t update_nv_counters(
-         err = tfm_plat_read_nv_counter(tfm_nv_counter_i,
-                         sizeof(security_cnt), (uint8_t *)&security_cnt);
-         if (err != TFM_PLAT_ERR_SUCCESS) {
-+            FWU_LOG_MSG("%s: couldn't read NV counter\n\r", __func__);
-             return FWU_AGENT_ERROR;
-         }
- 
-         if (priv_metadata->nv_counter[i] < security_cnt) {
-+            FWU_LOG_MSG("%s: staged NV counter is smaller than current value\n\r", __func__);
-             return FWU_AGENT_ERROR;
-         } else if (priv_metadata->nv_counter[i] > security_cnt) {
-            FWU_LOG_MSG("%s: updaing index = %u nv counter = %u->%u\n\r",
-+            FWU_LOG_MSG("%s: updating index = %u nv counter = %u->%u\n\r",
-                         __func__, i, security_cnt,
-                        priv_metadata->nv_counter[FWU_BL2_NV_COUNTER]);
-+                        priv_metadata->nv_counter[i]);
-             err = tfm_plat_set_nv_counter(tfm_nv_counter_i,
-                                    priv_metadata->nv_counter[FWU_BL2_NV_COUNTER]);
-+                                    priv_metadata->nv_counter[i]);
-             if (err != TFM_PLAT_ERR_SUCCESS) {
-+                FWU_LOG_MSG("%s: couldn't write NV counter\n\r", __func__);
-                 return FWU_AGENT_ERROR;
-             }
-         }
-- 
-2.25.1
-
@@ -0,0 +1,76 @@
+From ca7696bca357cfd71a34582c65a7c7c08828b6dc Mon Sep 17 00:00:00 2001
+From: Bence Balogh <bence.balogh@arm.com>
+Date: Mon, 18 Dec 2023 14:00:14 +0100
+Subject: [PATCH 2/2] platform: corstone1000: Cover S_DATA with MPU
+
+The S_DATA has to be covered with MPU regions to override the
+other MPU regions with smaller RNR values.
+
+Change-Id: I45fec65f51241939314941e25d287e6fdc82777c
+Signed-off-by: Bence Balogh <bence.balogh@arm.com>
+Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/25583]
+
+---
+ .../target/arm/corstone1000/CMakeLists.txt    |  8 +++++++
+ .../arm/corstone1000/tfm_hal_isolation.c      | 22 +++++++++++++++++++
+ 2 files changed, 30 insertions(+)
+
+diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
+index 8817f514c..541504368 100644
+--- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
+@@ -40,6 +40,14 @@ target_compile_definitions(platform_region_defs
+     INTERFACE
+         TFM_LINKER_APP_ROT_LINKER_DATA_ALIGNMENT=0x2000
+         TFM_LINKER_SP_META_PTR_ALIGNMENT=0x100
+
+        # The RAM MPU Region block sizes are calculated manually. The RAM has to be covered
+        # with the MPU regions. These regions also have to be the power of 2 and
+        # the start addresses have to be aligned to these sizes. The sizes can be calculated
+        # from the S_DATA_START and S_DATA_SIZE defines.
+        RAM_MPU_REGION_BLOCK_1_SIZE=0x4000
+        RAM_MPU_REGION_BLOCK_2_SIZE=0x20000
+
+ )
+ #========================= Platform common defs ===============================#
+ 
+diff --git a/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c b/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+index 98e795dde..39b19c535 100644
+--- a/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+++ b/platform/ext/target/arm/corstone1000/tfm_hal_isolation.c
+@@ -15,6 +15,7 @@
+ #include "mpu_config.h"
+ #include "mmio_defs.h"
+ #include "flash_layout.h"
+#include "region_defs.h"
+ 
+ #define PROT_BOUNDARY_VAL \
+     ((1U << HANDLE_ATTR_PRIV_POS) & HANDLE_ATTR_PRIV_MASK)
+@@ -132,6 +133,27 @@ enum tfm_hal_status_t tfm_hal_set_up_static_boundaries(
+ 
+ #endif
+ 
+    /* Set the RAM attributes. It is needed because the first region overlaps the whole
+     * SRAM and it has to be overridden.
+     * The RAM_MPU_REGION_BLOCK_1_SIZE and RAM_MPU_REGION_BLOCK_2_SIZE are calculated manually
+     * and added to the platform_region_defs compile definitions.
+     */
+    base = S_DATA_START;
+    limit = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE;
+    ret = configure_mpu(rnr++, base, limit,
+                            XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+    if (ret != TFM_HAL_SUCCESS) {
+        return ret;
+    }
+
+    base = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE;
+    limit = S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE + RAM_MPU_REGION_BLOCK_2_SIZE;
+    ret = configure_mpu(rnr++, base, limit,
+                            XN_EXEC_NOT_OK, AP_RW_PRIV_UNPRIV);
+    if (ret != TFM_HAL_SUCCESS) {
+        return ret;
+    }
+
+     arm_mpu_enable();
+ 
+ #endif /* CONFIG_TFM_ENABLE_MEMORY_PROTECT */
@@ -0,0 +1,78 @@
+From 6807d4b30f7d4ed32d3c54dfcaf3ace63eaa4f02 Mon Sep 17 00:00:00 2001
+From: Emekcan Aras <emekcan.aras@arm.com>
+Date: Thu, 26 Oct 2023 11:46:04 +0100
+Subject: [PATCH] platform: corstone1000: align capsule update structs
+
+U-boot mkefitool creates capsule image without packed and byte-aligned
+structs. This patch aligns the capsule-update structures and avoids
+crashes in case of unaligned pointer access.
+
+Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
+Upstream-Status: Pending
+---
+ .../fw_update_agent/uefi_capsule_parser.c          | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c b/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c
+index c706c040ac..9f8d12ad4e 100644
+--- a/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c
+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/uefi_capsule_parser.c
+@@ -34,14 +34,14 @@ typedef struct {
+     uint32_t                header_size;
+     uint32_t                flags;
+     uint32_t                capsule_image_size;
+-} efi_capsule_header_t;
+} efi_capsule_header_t __attribute__((packed, aligned(1)));
+
+ typedef struct {
+     uint32_t                version;
+     uint16_t                embedded_driver_count;
+     uint16_t                payload_item_count;
+     uint64_t                item_offset_list[];
+-} efi_firmware_management_capsule_header_t;
+} efi_firmware_management_capsule_header_t __attribute__((packed, aligned(1)));
+
+ typedef struct {
+     uint32_t                version;
+@@ -52,14 +52,14 @@ typedef struct {
+     uint32_t                update_vendorcode_size;
+     uint64_t                update_hardware_instance; //introduced in v2
+     uint64_t                image_capsule_support; //introduced in v3
+-} efi_firmware_management_capsule_image_header_t;
+} efi_firmware_management_capsule_image_header_t __attribute__((packed, aligned(1)));
+
+ typedef struct {
+     uint32_t                signature;
+     uint32_t                header_size;
+     uint32_t                fw_version;
+     uint32_t                lowest_supported_version;
+-} fmp_payload_header_t;
+} fmp_payload_header_t __attribute__((packed, aligned(1)));
+
+ #define ANYSIZE_ARRAY 0
+
+@@ -68,18 +68,18 @@ typedef struct {
+     uint16_t                wRevision;
+     uint16_t                wCertificateType;
+     uint8_t                 bCertificate[ANYSIZE_ARRAY];
+-} WIN_CERTIFICATE;
+} WIN_CERTIFICATE __attribute__((packed, aligned(1)));
+
+ typedef struct {
+     WIN_CERTIFICATE         hdr;
+     struct efi_guid         cert_type;
+     uint8_t                 cert_data[ANYSIZE_ARRAY];
+-} win_certificate_uefi_guid_t;
+} win_certificate_uefi_guid_t __attribute__((packed, aligned(1)));
+
+ typedef struct {
+     uint64_t                    monotonic_count;
+     win_certificate_uefi_guid_t   auth_info;
+-} efi_firmware_image_authentication_t;
+} efi_firmware_image_authentication_t __attribute__((packed, aligned(1)));
+
+
+ enum uefi_capsule_error_t uefi_capsule_retrieve_images(void* capsule_ptr,
+--
+2.25.1
+
@@ -1,41 +0,0 @@
-From 2a7e418afc96a9c897d3511fd47dbe596f880074 Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <emekcan.aras@arm.com>
-Date: Wed, 17 Apr 2024 11:34:45 +0000
-Subject: [PATCH 4/9] Platform: CS1000: Increase ITS max asset size
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Increases the max asset size for ITS to enable Parsec services and
-tests.
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
-Signed-off-by: Vikas Katariya <vikas.katariya@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [2a7e418afc96a9c897d3511fd47dbe596f880074]
---
- platform/ext/target/arm/corstone1000/config_tfm_target.h | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/config_tfm_target.h b/platform/ext/target/arm/corstone1000/config_tfm_target.h
-index 2c7341afd..9522379cd 100644
--- a/platform/ext/target/arm/corstone1000/config_tfm_target.h
-+++ b/platform/ext/target/arm/corstone1000/config_tfm_target.h
-@@ -1,5 +1,5 @@
- /*
- * Copyright (c) 2022, Arm Limited. All rights reserved.
-+ * Copyright (c) 2022-2024, Arm Limited. All rights reserved.
-  *
-  * SPDX-License-Identifier: BSD-3-Clause
-  *
-@@ -20,4 +20,7 @@
- /* The maximum number of assets to be stored in the Protected Storage area. */
- #define PS_NUM_ASSETS        20
- 
-+/* The maximum size of asset to be stored in the Internal Trusted Storage area. */
-+#define ITS_MAX_ASSET_SIZE   2048
-+
- #endif /* __CONFIG_TFM_TARGET_H__ */
-- 
-2.25.1
-
@@ -0,0 +1,33 @@
+From 001e5bea183bc78352ac3ba6283d9d7912bb6ea5 Mon Sep 17 00:00:00 2001
+From: Emekcan Aras <Emekcan.Aras@arm.com>
+Date: Wed, 21 Feb 2024 07:44:25 +0000
+Subject: [PATCH] Platform: Corstone1000: skip the first nv counter
+
+It skips doing a sanity check the BL2 nv counter after the capsule
+update since the tfm bl1 does not sync metadata and nv counters in OTP during
+the boot anymore.
+
+Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
+Upstream-Status: Pending
+
+---
+ .../ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c     | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
+index 2e6de255b..2e6cf8047 100644
+--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
+@@ -1125,7 +1125,7 @@ static enum fwu_agent_error_t update_nv_counters(
+ 
+     FWU_LOG_MSG("%s: enter\n\r", __func__);
+ 
+-    for (int i = 0; i <= FWU_MAX_NV_COUNTER_INDEX; i++) {
+    for (int i = 1; i <= FWU_MAX_NV_COUNTER_INDEX; i++) {
+ 
+         switch (i) {
+             case FWU_BL2_NV_COUNTER:
+-- 
+2.25.1
+
+
@@ -1,38 +0,0 @@
-From 85e7e9f52177c9617b8554fbacac34c8c591f549 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Fri, 5 Jul 2024 21:18:08 +0200
-Subject: [PATCH 5/9] Platform: CS1000: Increase RSE_COMMS buffer size
-
-This was needed because the UEFI variable index size was increased in
-the Host side software stack. The RSE_COMMS buffer has to be increased
-to accomodate the bigger messages.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [85e7e9f52177c9617b8554fbacac34c8c591f549]
---
- .../ext/target/arm/corstone1000/rse_comms/rse_comms.h    | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h b/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h
-index 41e5c2bc3..720a60b62 100644
--- a/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h
-+++ b/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h
-@@ -15,8 +15,13 @@
- extern "C" {
- #endif
- 
-/* size suits to fit the largest message too (EFI variables) */
-#define RSE_COMMS_PAYLOAD_MAX_SIZE (0x2100)
-+/*
-+ * The size suits to fit the largest message too (EFI variables)
-+ * This size is defined by the Host's software stack.
-+ * The size was chosen by monitoring the messages that are coming
-+ * from the Trusted Services SE Proxy partition.
-+ */
-+#define RSE_COMMS_PAYLOAD_MAX_SIZE (0x43C0)
- 
- /*
-  * Allocated for each client request.
-- 
-2.25.1
-
@@ -1,7 +1,7 @@
-From a32e7195a4fc1c9d890f9e22a795443d01dc1e8f Mon Sep 17 00:00:00 2001
+From 3d35eb08fe0cea5c4b882c448f44530bb45c05f0 Mon Sep 17 00:00:00 2001
 From: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
 Date: Tue, 2 Apr 2024 13:04:56 +0000
-Subject: [PATCH 03/10] platform: corstone1000: add unique guid for mps3
+Subject: [PATCH] platform: corstone1000: add unique guid for mps3

 This patch sets unique GUID for Corstone1000 FVP and MPS3

@@ -12,7 +12,7 @@ Signed-off-by: Anusmita Dutta Mazumder <anusmita.duttamazumder@arm.com>
 1 file changed, 7 insertions(+), 1 deletion(-)

 diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-index 003ab9faf8..5768df19b8 100644
+index 2e6cf80470..be04e0e5df 100644
 --- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
 +++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
@@ -113,13 +113,19 @@ enum fwu_agent_state_t {
@@ -37,5 +37,5 @@ index 003ab9faf8..5768df19b8 100644
 #define IMAGE_NOT_ACCEPTED      (0)
 #define BANK_0                  (0)
 -- 
-2.25.1
+2.38.1

@@ -1,42 +0,0 @@
-From 8ca9620a000ba182ebb51c51f49e2b97622f3404 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Wed, 15 May 2024 22:37:51 +0200
-Subject: [PATCH 6/9] Platform: CS1000: Increase buffers for EFI vars
-
-The UEFI variables are stored in the Protected Storage. The size of
-the variables metadata have been increased in the Host software stack
-so the related buffer sizes have to be increased:
-
- The PS_MAX_ASSET_SIZE needs to be big enough to store the variables.
- The CRYPTO_ENGINE_BUF_SIZE needs to be increased because the encryption
-  of the bigger PS assets requires bigger buffer.
- The CRYPTO_IOVEC_BUFFER_SIZE needs to be increased because the PS
-  assets are passed through the IOVEC buffer between the crypto and
-  PS partition during encryption.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [8ca9620a000ba182ebb51c51f49e2b97622f3404]
---
- platform/ext/target/arm/corstone1000/config_tfm_target.h | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/platform/ext/target/arm/corstone1000/config_tfm_target.h b/platform/ext/target/arm/corstone1000/config_tfm_target.h
-index 9522379cd..0b410dfd4 100644
--- a/platform/ext/target/arm/corstone1000/config_tfm_target.h
-+++ b/platform/ext/target/arm/corstone1000/config_tfm_target.h
-@@ -23,4 +23,12 @@
- /* The maximum size of asset to be stored in the Internal Trusted Storage area. */
- #define ITS_MAX_ASSET_SIZE   2048
- 
-+/* The maximum asset size to be stored in the Protected Storage */
-+#define PS_MAX_ASSET_SIZE   2592
-+
-+/* This is needed to be able to process the EFI variables during PS writes. */
-+#define CRYPTO_ENGINE_BUF_SIZE 0x5000
-+
-+/* This is also has to be increased to fit the EFI variables into the iovecs. */
-+#define CRYPTO_IOVEC_BUFFER_SIZE    6000
- #endif /* __CONFIG_TFM_TARGET_H__ */
-- 
-2.25.1
-
@@ -1,15 +1,14 @@
-From 4b5a9546205e484ac7f53cee369b1db9a7bf2279 Mon Sep 17 00:00:00 2001
+From 1410dc5504d60219279581b1cf6442f81551cfe7 Mon Sep 17 00:00:00 2001
 From: Emekcan Aras <Emekcan.Aras@arm.com>
 Date: Wed, 3 Apr 2024 13:37:40 +0100
-Subject: [PATCH 3/9] Platform: Corstone1000: Enable firewall in FVP
+Subject: [PATCH] Platform: Corstone1000: Enable host firewall in FVP

-Enables host firewall and MPU setup for FVP. It also fixes secure RAM
-configuration and disables access rights to secure RAM from normal world
-for both MPS3 and FVP.
+Enables host firewall and mpu setup for FVP. It also fixes secure-ram
+configuration and disable access rights to secure ram from both normal world
+for both mps3 and fvp.

 Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [4b5a9546205e484ac7f53cee369b1db9a7bf2279]
+Upstream-Status: Pending [Not submitted to upstream yet]
 ---
 .../Device/Include/platform_base_address.h    |  2 +-
 .../arm/corstone1000/bl1/boot_hal_bl1_1.c     | 42 ++++---------------
@@ -17,7 +16,7 @@ Upstream-Status: Backport [4b5a9546205e484ac7f53cee369b1db9a7bf2279]
 3 files changed, 11 insertions(+), 35 deletions(-)

 diff --git a/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h b/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h
-index 416f0ebcdb..101cad9e7c 100644
+index 416f0ebcd..101cad9e7 100644
 --- a/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h
 +++ b/platform/ext/target/arm/corstone1000/Device/Include/platform_base_address.h
@@ -67,7 +67,7 @@
@@ -30,7 +29,7 @@ index 416f0ebcdb..101cad9e7c 100644
 #define CORSTONE1000_HOST_BASE_SYSTEM_CONTROL_BASE (0x7A010000U) /* Host SCB                          */
 #define CORSTONE1000_EXT_SYS_RESET_REG             (0x7A010310U) /* external system (cortex-M3)       */
 diff --git a/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c b/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c
-index 45d6768215..2f693d2b1b 100644
+index a5fee66af..7988c2392 100644
 --- a/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c
 +++ b/platform/ext/target/arm/corstone1000/bl1/boot_hal_bl1_1.c
@@ -35,7 +35,7 @@ REGION_DECLARE(Image$$, ER_DATA, $$Base)[];
@@ -160,7 +159,7 @@ index 45d6768215..2f693d2b1b 100644
 #if defined(TFM_BL1_LOGGING) || defined(TEST_BL1_1) || defined(TEST_BL1_2)
     stdio_init();
 diff --git a/platform/ext/target/arm/corstone1000/bl2/flash_map_bl2.c b/platform/ext/target/arm/corstone1000/bl2/flash_map_bl2.c
-index 2b1cdfa199..06cc3f0f52 100644
+index 2b1cdfa19..06cc3f0f5 100644
 --- a/platform/ext/target/arm/corstone1000/bl2/flash_map_bl2.c
 +++ b/platform/ext/target/arm/corstone1000/bl2/flash_map_bl2.c
@@ -70,7 +70,7 @@ int boot_get_image_exec_ram_info(uint32_t image_id,
@@ -175,3 +174,4 @@ index 2b1cdfa199..06cc3f0f52 100644
 -- 
 2.25.1

+
@@ -1,202 +0,0 @@
-From c731d187fbe9fc1e10ad8ecfb3d04bb480bc86b6 Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <Emekcan.Aras@arm.com>
-Date: Mon, 8 Apr 2024 16:04:45 +0100
-Subject: [PATCH 7/9] Plaform: Corstone1000: Switch to metadata v2
-
-This upgrades metadata data structs from v1 to v2 as described in PSA
-FWU Specification:
-https://developer.arm.com/documentation/den0118/latest/
-
-The TrustedFirmware-A v2.11 release supports only the metadata v2. The
-structs in TF-M side had to be aligned to keep the compatibility.
-
-Signed-off-by: Emekcan Aras <Emekcan.Aras@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [c731d187fbe9fc1e10ad8ecfb3d04bb480bc86b6]
---
- .../corstone1000/fw_update_agent/fwu_agent.c  | 86 +++++++++++++++----
- 1 file changed, 69 insertions(+), 17 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-index b2f31e166..5fddd3238 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-@@ -26,6 +26,15 @@
- #include "platform.h"
- #endif
- 
-+#define FWU_METADATA_VERSION		2
-+#define FWU_FW_STORE_DESC_OFFSET	0x20
-+#define NR_OF_MAX_FW_BANKS		4
-+
-+/*
-+ * Metadata version 2 data structures defined by PSA_FW update specification
-+ * at https://developer.arm.com/documentation/den0118/latest/
-+ */
-+
- /* Properties of image in a bank */
- struct fwu_image_properties {
- 
-@@ -58,6 +67,28 @@ struct fwu_image_entry {
- 
- } __packed;
- 
-+struct fwu_fw_store_descriptor {
-+
-+       /* Number of Banks */
-+       uint8_t num_banks;
-+
-+       /* Reserved */
-+       uint8_t reserved;
-+
-+       /* Number of images per bank */
-+       uint16_t num_images;
-+
-+       /* Size of image_entry(all banks) in bytes */
-+       uint16_t img_entry_size;
-+
-+       /* Size of image bank info structure in bytes */
-+       uint16_t bank_info_entry_size;
-+
-+       /* Array of fwu_image_entry structs */
-+       struct fwu_image_entry img_entry[NR_OF_IMAGES_IN_FW_BANK];
-+
-+} __packed;
-+
- struct fwu_metadata {
- 
-         /* Metadata CRC value */
-@@ -72,8 +103,23 @@ struct fwu_metadata {
-         /* Previous bank index with which device booted successfully */
-         uint32_t previous_active_index;
- 
-        /* Image entry information */
-        struct fwu_image_entry img_entry[NR_OF_IMAGES_IN_FW_BANK];
-+        /* Size of the entire metadata in bytes */
-+        uint32_t metadata_size;
-+
-+        /* Offset of the image descriptor structure */
-+        uint16_t desc_offset;
-+
-+        /* Reserved */
-+        uint16_t reserved1;
-+
-+        /* Bank state: It's not used in corstone1000 at the moment.Currently
-+	     * not used by any sw componenets such as u-boot and TF-A */
-+        uint8_t bank_state[NR_OF_MAX_FW_BANKS];
-+
-+        /* Reserved */
-+        uint32_t reserved2;
-+
-+        struct fwu_fw_store_descriptor fw_desc;
- 
- } __packed;
- 
-@@ -607,23 +653,29 @@ enum fwu_agent_error_t fwu_metadata_provision(void)
- 
-     memset(&_metadata, 0, sizeof(struct fwu_metadata));
- 
-    _metadata.version = 1;
-+    _metadata.version = FWU_METADATA_VERSION;
-     _metadata.active_index = BANK_0;
-     _metadata.previous_active_index = BANK_1;
-+    _metadata.desc_offset= FWU_FW_STORE_DESC_OFFSET;
- 
-+    _metadata.fw_desc.num_banks = NR_OF_FW_BANKS;
-+    _metadata.fw_desc.num_images = NR_OF_IMAGES_IN_FW_BANK;
-+    _metadata.fw_desc.img_entry_size = sizeof(struct fwu_image_entry) * NR_OF_IMAGES_IN_FW_BANK;
-+    _metadata.fw_desc.bank_info_entry_size = sizeof(struct fwu_image_properties) * NR_OF_FW_BANKS;
-     /* bank 0 is the place where images are located at the
-      * start of device lifecycle */
- 
-     for (int i = 0; i < NR_OF_IMAGES_IN_FW_BANK; i++) {
- 
-        _metadata.img_entry[i].img_props[BANK_0].accepted = IMAGE_ACCEPTED;
-        _metadata.img_entry[i].img_props[BANK_0].version = image_version;
-+        _metadata.fw_desc.img_entry[i].img_props[BANK_0].accepted = IMAGE_ACCEPTED;
-+        _metadata.fw_desc.img_entry[i].img_props[BANK_0].version = image_version;
- 
-        _metadata.img_entry[i].img_props[BANK_1].accepted = IMAGE_NOT_ACCEPTED;
-        _metadata.img_entry[i].img_props[BANK_1].version = INVALID_VERSION;
-+        _metadata.fw_desc.img_entry[i].img_props[BANK_1].accepted = IMAGE_NOT_ACCEPTED;
-+        _metadata.fw_desc.img_entry[i].img_props[BANK_1].version = INVALID_VERSION;
-     }
- 
-    /* Calculate CRC32 for fwu metadata */
-+    /* Calculate CRC32 for fwu metadata. The first filed in the _metadata has to be the crc_32.
-+     * This should be omited from the calculation. */
-     _metadata.crc_32 = crc32((uint8_t *)&_metadata.version,
-                              sizeof(struct fwu_metadata) - sizeof(uint32_t));
- 
-@@ -685,7 +737,7 @@ static enum fwu_agent_state_t get_fwu_agent_state(
-     }
- 
-     for (int i = 0; i < NR_OF_IMAGES_IN_FW_BANK; i++) {
-        if ((metadata_ptr->img_entry[i].img_props[boot_index].accepted)
-+        if ((metadata_ptr->fw_desc.img_entry[i].img_props[boot_index].accepted)
-                 == (IMAGE_NOT_ACCEPTED)) {
-             return FWU_AGENT_STATE_TRIAL;
-         }
-@@ -760,7 +812,7 @@ static enum fwu_agent_error_t flash_full_capsule(
-     }
- 
-     if (version <=
-            (metadata->img_entry[IMAGE_0].img_props[active_index].version)) {
-+            (metadata->fw_desc.img_entry[IMAGE_0].img_props[active_index].version)) {
-         FWU_LOG_MSG("ERROR: %s: version error\n\r",__func__);
-         return FWU_AGENT_ERROR;
-     }
-@@ -791,9 +843,9 @@ static enum fwu_agent_error_t flash_full_capsule(
- 
-     /* Change system state to trial bank state */
-     for (int i = 0; i < NR_OF_IMAGES_IN_FW_BANK; i++) {
-        metadata->img_entry[i].img_props[previous_active_index].accepted =
-+        metadata->fw_desc.img_entry[i].img_props[previous_active_index].accepted =
-                                                         IMAGE_NOT_ACCEPTED;
-        metadata->img_entry[i].img_props[previous_active_index].version = version;
-+        metadata->fw_desc.img_entry[i].img_props[previous_active_index].version = version;
-     }
-     metadata->active_index = previous_active_index;
-     metadata->previous_active_index = active_index;
-@@ -900,7 +952,7 @@ static enum fwu_agent_error_t accept_full_capsule(
-     FWU_LOG_MSG("%s: enter\n\r", __func__);
- 
-     for (int i = 0; i < NR_OF_IMAGES_IN_FW_BANK; i++) {
-        metadata->img_entry[i].img_props[active_index].accepted =
-+        metadata->fw_desc.img_entry[i].img_props[active_index].accepted =
-                                                             IMAGE_ACCEPTED;
-     }
- 
-@@ -990,7 +1042,7 @@ static enum fwu_agent_error_t fwu_select_previous(
- 
-     index = metadata->previous_active_index;
-     for (int i = 0; i < NR_OF_IMAGES_IN_FW_BANK; i++) {
-        if (metadata->img_entry[i].img_props[index].accepted != IMAGE_ACCEPTED)
-+        if (metadata->fw_desc.img_entry[i].img_props[index].accepted != IMAGE_ACCEPTED)
-         {
-             FWU_ASSERT(0);
-         }
-@@ -1211,7 +1263,7 @@ enum fwu_agent_error_t corstone1000_fwu_host_ack(void)
-         /* firmware update failed, revert back to previous bank */
- 
-         priv_metadata.fmp_last_attempt_version =
-         _metadata.img_entry[IMAGE_0].img_props[_metadata.active_index].version;
-+         _metadata.fw_desc.img_entry[IMAGE_0].img_props[_metadata.active_index].version;
- 
-         priv_metadata.fmp_last_attempt_status = LAST_ATTEMPT_STATUS_ERROR_UNSUCCESSFUL;
- 
-@@ -1222,9 +1274,9 @@ enum fwu_agent_error_t corstone1000_fwu_host_ack(void)
-         /* firmware update successful */
- 
-         priv_metadata.fmp_version =
-         _metadata.img_entry[IMAGE_0].img_props[_metadata.active_index].version;
-+         _metadata.fw_desc.img_entry[IMAGE_0].img_props[_metadata.active_index].version;
-         priv_metadata.fmp_last_attempt_version =
-         _metadata.img_entry[IMAGE_0].img_props[_metadata.active_index].version;
-+         _metadata.fw_desc.img_entry[IMAGE_0].img_props[_metadata.active_index].version;
- 
-         priv_metadata.fmp_last_attempt_status = LAST_ATTEMPT_STATUS_SUCCESS;
- 
-- 
-2.25.1
-
@@ -0,0 +1,27 @@
+From 2edf197735bd0efb1428c1710443dddcb376d930 Mon Sep 17 00:00:00 2001
+From: Emekcan Aras <emekcan.aras@arm.com>
+Date: Wed, 17 Apr 2024 11:34:45 +0000
+Subject: [PATCH] platform: corstone1000: Increase ITS max asset size
+
+Increases the max asset size for ITS to enable parsec services & tests
+
+Upstream-Status: Pending
+Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
+Signed-off-by: Vikas Katariya <vikas.katariya@arm.com>
+---
+ platform/ext/target/arm/corstone1000/config_tfm_target.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/platform/ext/target/arm/corstone1000/config_tfm_target.h b/platform/ext/target/arm/corstone1000/config_tfm_target.h
+index 2c7341afd4..2eb0924770 100644
+--- a/platform/ext/target/arm/corstone1000/config_tfm_target.h
+++ b/platform/ext/target/arm/corstone1000/config_tfm_target.h
+@@ -20,4 +20,8 @@
+ /* The maximum number of assets to be stored in the Protected Storage area. */
+ #define PS_NUM_ASSETS        20
+ 
+/* The maximum size of asset to be stored in the Internal Trusted Storage area. */
+#undef ITS_MAX_ASSET_SIZE
+#define ITS_MAX_ASSET_SIZE   2048
+
+ #endif /* __CONFIG_TFM_TARGET_H__ */
@@ -1,37 +0,0 @@
-From 3794ba29b66641ebecbd4dd3d9a2a2e8caeb690a Mon Sep 17 00:00:00 2001
-From: Ali Can Ozaslan <ali.oezaslan@arm.com>
-Date: Mon, 15 Jul 2024 13:03:24 +0000
-Subject: [PATCH 8/9] Platform: CS1000: Increase flash PS area size
-
-Previously, approximately only 2MB was used out of the 8MB SE Flash.
-The aim of this commit is to increase the size of PS storage in SE
-Flash.
-Increasing the size minimize the possibilities of it to run out
-of memory as it is not cleared on reset or reprogramming of the device.
-
-The FLASH_PS_AREA_SIZE is increased to 6MB so now 7MB of the SE Flash
-is used. The remaining 1MB is allocated for future uses.
-
-Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [3794ba29b66641ebecbd4dd3d9a2a2e8caeb690a]
---
- platform/ext/target/arm/corstone1000/partition/flash_layout.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/partition/flash_layout.h b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-index a181a7168..07b4cdea7 100644
--- a/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-+++ b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-@@ -192,7 +192,7 @@
- 
- #define FLASH_PS_AREA_OFFSET            (FLASH_ITS_AREA_OFFSET + \
-                                          FLASH_ITS_AREA_SIZE)
-#define FLASH_PS_AREA_SIZE              (16 * SECURE_FLASH_SECTOR_SIZE)
-+#define FLASH_PS_AREA_SIZE              (96 * SECURE_FLASH_SECTOR_SIZE)
- 
- /* OTP_definitions */
- #define FLASH_OTP_NV_COUNTERS_AREA_OFFSET (FLASH_PS_AREA_OFFSET + \
-- 
-2.25.1
-
@@ -0,0 +1,28 @@
+From 21b0c9f028b6b04fa2f027510ec90969735f4dd1 Mon Sep 17 00:00:00 2001
+From: Bence Balogh <bence.balogh@arm.com>
+Date: Wed, 17 Apr 2024 19:31:03 +0200
+Subject: [PATCH] platform: corstone1000: Increase RSE_COMMS buffer size
+
+Signed-off-by: Bence Balogh <bence.balogh@arm.com>
+Upstream-Status: Pending
+---
+ platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h b/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h
+index 6d79dd3bf..f079f6504 100644
+--- a/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h
+++ b/platform/ext/target/arm/corstone1000/rse_comms/rse_comms.h
+@@ -16,7 +16,7 @@ extern "C" {
+ #endif
+ 
+  /* size suits to fit the largest message too (EFI variables) */
+-#define RSE_COMMS_PAYLOAD_MAX_SIZE (0x2100)
+#define RSE_COMMS_PAYLOAD_MAX_SIZE (0x43C0)
+ 
+ /*
+  * Allocated for each client request.
+-- 
+2.25.1
+
+
@@ -1,21 +1,22 @@
-From 60ab8bbf85e9e84afd23948a71cf84c69f4aad7a Mon Sep 17 00:00:00 2001
+From a8aeaafd6c26d6bc3066164d12aabc5cb754fe1c Mon Sep 17 00:00:00 2001
 From: Ali Can Ozaslan <ali.oezaslan@arm.com>
 Date: Wed, 15 May 2024 12:12:15 +0000
-Subject: [PATCH 07/10] CC312: alignment of cc312 differences between fvp and
- mps3 corstone1000 platforms
+Subject: [PATCH] CC312: alignment of cc312 differences between fvp and mps3
+ corstone1000 platforms

-Configures CC312 mps3 model same as predefined cc312 FVP
+Configures CC312 mps3 model same as predefined cc312 FVP 
 configuration while keeping debug ports closed.

 Signed-off-by: Ali Can Ozaslan <ali.oezaslan@arm.com>

 Upstream-Status: Inappropriate [Requires an aligment cc3xx with mps3 hw and fvp sw models]
+
 ---
 lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c | 3 +++
 1 file changed, 3 insertions(+)

 diff --git a/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c b/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c
-index 31e4332bed..4b08c02526 100644
+index 31e4332be..4d7e6fa61 100644
 --- a/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c
 +++ b/lib/ext/cryptocell-312-runtime/host/src/cc3x_lib/cc_lib.c
@@ -207,6 +207,9 @@ CClibRetCode_t CC_LibInit(CCRndContext_t *rndContext_ptr, CCRndWorkBuff_t  *rndW
@@ -28,6 +29,3 @@ index 31e4332bed..4b08c02526 100644
     /* turn off the DFA since Cerberus doen't support it */
     reg = CC_HAL_READ_REGISTER(CC_REG_OFFSET(HOST_RGF, HOST_AO_LOCK_BITS));
     CC_REG_FLD_SET(0, HOST_AO_LOCK_BITS, HOST_FORCE_DFA_ENABLE, reg, 0x0);
-- 
-2.25.1
-
@@ -1,119 +0,0 @@
-From 1eb9bc330bf387ff26a6df93d3b8c843174dc40b Mon Sep 17 00:00:00 2001
-From: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
-Date: Thu, 9 May 2024 13:20:57 +0000
-Subject: [PATCH 10/10] platform: CS1000: Add multicore support for FVP
-
-This changeset adds the support to enable the secondary cores for
-the Corstone-1000 FVP
-
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/29242]
-Signed-off-by: Harsimran Singh Tungal <harsimransingh.tungal@arm.com>
---
- .../target/arm/corstone1000/CMakeLists.txt    |  6 +++
- .../corstone1000/Device/Config/device_cfg.h   |  6 +++
- .../arm/corstone1000/tfm_hal_multi_core.c     | 38 ++++++++++++++++++-
- 3 files changed, 48 insertions(+), 2 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-index 95e3f57b4f..e46123cc6f 100644
--- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
-+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-@@ -381,6 +381,12 @@ target_sources(tfm_psa_rot_partition_ns_agent_mailbox
-         tfm_hal_multi_core.c
- )
- 
-+if (PLATFORM_IS_FVP)
-+target_compile_definitions(tfm_psa_rot_partition_ns_agent_mailbox
-+    PUBLIC
-+    	$<$<BOOL:${ENABLE_MULTICORE}>:CORSTONE1000_FVP_MULTICORE>
-+)
-+endif()
- #========================= tfm_spm ============================================#
- 
- target_sources(tfm_spm
-diff --git a/platform/ext/target/arm/corstone1000/Device/Config/device_cfg.h b/platform/ext/target/arm/corstone1000/Device/Config/device_cfg.h
-index 222905d3dd..9d48f119ed 100644
--- a/platform/ext/target/arm/corstone1000/Device/Config/device_cfg.h
-+++ b/platform/ext/target/arm/corstone1000/Device/Config/device_cfg.h
-@@ -45,5 +45,11 @@
- /* CFI Controller */
- #define CFI_S
- 
-+/* Total number of host cores */
-+#if CORSTONE1000_FVP_MULTICORE
-+#define PLATFORM_HOST_MAX_CORE_COUNT 4
-+#else
-+#define PLATFORM_HOST_MAX_CORE_COUNT 1
-+#endif
- 
- #endif  /* __DEVICE_CFG_H__ */
-diff --git a/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c b/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c
-index f0e2bc333a..ce72e50c9b 100644
--- a/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c
-+++ b/platform/ext/target/arm/corstone1000/tfm_hal_multi_core.c
-@@ -11,9 +11,14 @@
- #include "tfm_hal_multi_core.h"
- #include "fwu_agent.h"
- 
-#define HOST_SYS_RST_CTRL_OFFSET 0x0
-+#define HOST_SYS_RST_CTRL_OFFSET     0x000
-+#define HOST_CPU_PE0_CONFIG_OFFSET   0x010
-+#define HOST_CPU_PE1_CONFIG_OFFSET   0x020
-+#define HOST_CPU_PE2_CONFIG_OFFSET   0x030
-+#define HOST_CPU_PE3_CONFIG_OFFSET   0x040
-+#define HOST_CPU_BOOT_MASK_OFFSET    0x300
- #define HOST_CPU_CORE0_WAKEUP_OFFSET 0x308
-#define HOST_CPU_PE0_CONFIG_OFFSET 0x010
-+
- #define AA64nAA32_MASK (1 << 3)
- 
- #ifdef EXTERNAL_SYSTEM_SUPPORT
-@@ -53,9 +58,29 @@ void tfm_hal_boot_ns_cpu(uintptr_t start_addr)
-     volatile uint32_t *PE0_CONFIG =
-                         (uint32_t *)(CORSTONE1000_HOST_BASE_SYSTEM_CONTROL_BASE
-                                      + HOST_CPU_PE0_CONFIG_OFFSET);
-+#if CORSTONE1000_FVP_MULTICORE
-+    volatile uint32_t *PE1_CONFIG =
-+                        (uint32_t *)(CORSTONE1000_HOST_BASE_SYSTEM_CONTROL_BASE
-+                                     + HOST_CPU_PE1_CONFIG_OFFSET);
-+    volatile uint32_t *PE2_CONFIG =
-+                        (uint32_t *)(CORSTONE1000_HOST_BASE_SYSTEM_CONTROL_BASE
-+                                     + HOST_CPU_PE2_CONFIG_OFFSET);
-+    volatile uint32_t *PE3_CONFIG =
-+                        (uint32_t *)(CORSTONE1000_HOST_BASE_SYSTEM_CONTROL_BASE
-+                                     + HOST_CPU_PE3_CONFIG_OFFSET);
-+    volatile uint32_t *CPU_BOOT_MASK =
-+                        (uint32_t *)(CORSTONE1000_HOST_BASE_SYSTEM_CONTROL_BASE
-+		                     + HOST_CPU_BOOT_MASK_OFFSET);
- 
-+    *CPU_BOOT_MASK = 0xf;
-+#endif
-     /* Select host CPU architecture as AArch64 */
-     *PE0_CONFIG |= AA64nAA32_MASK; /* 0b1 – AArch64 */
-+#if CORSTONE1000_FVP_MULTICORE
-+    *PE1_CONFIG |= AA64nAA32_MASK; /* 0b1 – AArch64 */
-+    *PE2_CONFIG |= AA64nAA32_MASK; /* 0b1 – AArch64 */
-+    *PE3_CONFIG |= AA64nAA32_MASK; /* 0b1 – AArch64 */
-+#endif
- 
-     /* wakeup CORE0 before bringing it out of reset */
-     *reset_ctl_wakeup_reg = 0x1;
-@@ -63,6 +88,15 @@ void tfm_hal_boot_ns_cpu(uintptr_t start_addr)
-     /* Clear HOST_SYS_RST_CTRL register to bring host out of RESET */
-     *reset_ctl_reg = 0;
- 
-+#if CORSTONE1000_FVP_MULTICORE
-+    /* Wake up secondary cores.
-+     * This should be done after bringing the primary core out of reset. */
-+    for(int core_index=1; core_index < PLATFORM_HOST_MAX_CORE_COUNT; core_index++)
-+    {
-+	    *reset_ctl_wakeup_reg = (0x1 << core_index);
-+    }
-+#endif
-+
-     (void) start_addr;
- 
- #ifdef EXTERNAL_SYSTEM_SUPPORT
-- 
-2.25.1
-
@@ -1,36 +0,0 @@
-From 939a39a0705ed2571fe5b842a9d5f80036f71a12 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Fri, 2 Aug 2024 22:02:55 +0200
-Subject: [PATCH 9/9] Platform: CS1000: Fix Bank offsets
-
-The BANK_0_PARTITION_OFFSET and BANK_1_PARTITION_OFFSET are used for
-erasing the banks during capsule update. The fwu_agent erases the flash
-using them as starting addresses. The BL2 (MCUBoot) should also
-be erased during capsule update.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [939a39a0705ed2571fe5b842a9d5f80036f71a12]
---
- .../ext/target/arm/corstone1000/partition/flash_layout.h    | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/partition/flash_layout.h b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-index 07b4cdea7..f42dda809 100644
--- a/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-+++ b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-@@ -109,10 +109,8 @@
- #define FWU_PRIVATE_METADATA_REPLICA_2_OFFSET   (FWU_PRIVATE_METADATA_REPLICA_1_OFFSET + \
-                                                  FWU_METADATA_FLASH_SECTOR_SIZE)
- 
-#define BANK_0_PARTITION_OFFSET         (SE_BL2_BANK_0_OFFSET + \
-                                         SE_BL2_PARTITION_SIZE)
-#define BANK_1_PARTITION_OFFSET         (SE_BL2_BANK_1_OFFSET + \
-                                         SE_BL2_PARTITION_SIZE)
-+#define BANK_0_PARTITION_OFFSET         (SE_BL2_BANK_0_OFFSET)
-+#define BANK_1_PARTITION_OFFSET         (SE_BL2_BANK_1_OFFSET)
- 
- /* BL1: mcuboot flashmap configurations */
- #define FLASH_AREA_8_ID                 (1)
-- 
-2.25.1
-
@@ -0,0 +1,45 @@
+From d7725e629c9ba93523589cc9d8af3186db19d4e8 Mon Sep 17 00:00:00 2001
+From: Bence Balogh <bence.balogh@arm.com>
+Date: Wed, 15 May 2024 22:37:51 +0200
+Subject: [PATCH] Platform: corstone1000: Increase buffers for EFI vars
+
+The UEFI variables are stored in the Protected Storage. The size of
+the variables metadata have been increased so the related buffer sizes
+have to be increased.
+
+Signed-off-by: Bence Balogh <bence.balogh@arm.com>
+Upstream-Status: Pending
+---
+ .../ext/target/arm/corstone1000/config_tfm_target.h | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/platform/ext/target/arm/corstone1000/config_tfm_target.h b/platform/ext/target/arm/corstone1000/config_tfm_target.h
+index 2eb0924770..6ee823a7dc 100644
+--- a/platform/ext/target/arm/corstone1000/config_tfm_target.h
+++ b/platform/ext/target/arm/corstone1000/config_tfm_target.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2022, Arm Limited. All rights reserved.
+ * Copyright (c) 2022-2024, Arm Limited. All rights reserved.
+  *
+  * SPDX-License-Identifier: BSD-3-Clause
+  *
+@@ -24,4 +24,15 @@
+ #undef ITS_MAX_ASSET_SIZE
+ #define ITS_MAX_ASSET_SIZE   2048
+ 
+/* The maximum asset size to be stored in the Protected Storage */
+#undef PS_MAX_ASSET_SIZE
+#define PS_MAX_ASSET_SIZE   2592
+
+/* This is needed to be able to process the EFI variables during PS writes. */
+#undef CRYPTO_ENGINE_BUF_SIZE
+#define CRYPTO_ENGINE_BUF_SIZE 0x5000
+
+/* This is also has to be increased to fit the EFI variables into the iovecs. */
+#undef CRYPTO_IOVEC_BUFFER_SIZE
+#define CRYPTO_IOVEC_BUFFER_SIZE    6000
+ #endif /* __CONFIG_TFM_TARGET_H__ */
+-- 
+2.25.1
+
@@ -1,111 +0,0 @@
-From ddd4abdb3893e284a35303e4a5ac7b6ad2ed8320 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Tue, 16 Jul 2024 21:04:49 +0200
-Subject: [PATCH] Platform: CS1000: Increase BL2 partition size
-
-Enabling secure debug increases the BL2 code size considerably. This
-patch increases the BL2 partition size to enable secure debug feature
-on Corstone-1000. The TF-M partition size has to be decreased for this.
-The RAM_MPU_REGION_BLOCK_1_SIZE had to be aligned with the changes to
-fully cover the S_DATA.
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/30406]
---
- .../ext/target/arm/corstone1000/CMakeLists.txt     |  9 ++++++---
- .../target/arm/corstone1000/create-flash-image.sh  | 14 ++++++++------
- .../arm/corstone1000/partition/flash_layout.h      |  4 ++--
- 3 files changed, 16 insertions(+), 11 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-index b13dc26c0e..3ba26e0de7 100644
--- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
-+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-@@ -44,10 +44,13 @@ target_compile_definitions(platform_region_defs
-         # The RAM MPU Region block sizes are calculated manually. The RAM has to be covered
-         # with the MPU regions. These regions also have to be the power of 2 and
-         # the start addresses have to be aligned to these sizes. The sizes can be calculated
-        # from the S_DATA_START and S_DATA_SIZE defines.
-        RAM_MPU_REGION_BLOCK_1_SIZE=0x4000
-+        # from the S_DATA_START and S_DATA_SIZE defines the following way:
-+        # S_DATA_SIZE = RAM_MPU_REGION_BLOCK_1_SIZE + RAM_MPU_REGION_BLOCK_2_SIZE
-+        # And the following constraints have to be taken:
-+        # S_DATA_START % RAM_MPU_REGION_BLOCK_1_SIZE = 0
-+        # (S_DATA_START + RAM_MPU_REGION_BLOCK_1_SIZE) % RAM_MPU_REGION_BLOCK_2_SIZE = 0
-+        RAM_MPU_REGION_BLOCK_1_SIZE=0x10000
-         RAM_MPU_REGION_BLOCK_2_SIZE=0x20000
-
- )
- #========================= Platform common defs ===============================#
- 
-diff --git a/platform/ext/target/arm/corstone1000/create-flash-image.sh b/platform/ext/target/arm/corstone1000/create-flash-image.sh
-index a6be61384f..06f0d1ec9a 100755
--- a/platform/ext/target/arm/corstone1000/create-flash-image.sh
-+++ b/platform/ext/target/arm/corstone1000/create-flash-image.sh
-@@ -1,6 +1,6 @@
- #!/bin/bash
- #-------------------------------------------------------------------------------
-# Copyright (c) 2023, Arm Limited. All rights reserved.
-+# Copyright (c) 2023-2024, Arm Limited. All rights reserved.
- #
- # SPDX-License-Identifier: BSD-3-Clause
- #
-@@ -65,6 +65,8 @@ FWU_METADATA_TYPE_UUID="8A7A84A0-8387-40F6-AB41-A8B9A5A60D23"
- PRIVATE_METADATA_TYPE_UUID="ECB55DC3-8AB7-4A84-AB56-EB0A9974DB42"
- SE_BL2_TYPE_UUID="64BD8ADB-02C0-4819-8688-03AB4CAB0ED9"
- TFM_TYPE_UUID="D763C27F-07F6-4FF0-B2F3-060CB465CD4E"
-+SE_BL2_PARTITION_SIZE="+144k"
-+TFM_S_PARTITION_SIZE="+320K"
- 
- # Create the image
- rm -f $IMAGE
-@@ -81,10 +83,10 @@ sgdisk  --mbrtogpt \
-         --new=3:48:+4K --typecode=3:$FWU_METADATA_TYPE_UUID --partition-guid=3:$(uuidgen) --change-name=3:'Bkup-FWU-Metadata' \
-         --new=4:56:+4K --typecode=4:$PRIVATE_METADATA_TYPE_UUID --partition-guid=4:$(uuidgen) --change-name=4:'private_metadata_replica_1' \
-         --new=5:64:+4k --typecode=5:$PRIVATE_METADATA_TYPE_UUID --partition-guid=5:$(uuidgen) --change-name=5:'private_metadata_replica_2' \
-        --new=6:72:+100k --typecode=6:$SE_BL2_TYPE_UUID --partition-guid=6:$(uuidgen) --change-name=6:'bl2_primary' \
-        --new=7:272:+368K --typecode=7:$TFM_TYPE_UUID --partition-guid=7:$(uuidgen) --change-name=7:'tfm_primary' \
-        --new=8:32784:+100k --typecode=8:$SE_BL2_TYPE_UUID --partition-guid=8:$(uuidgen) --change-name=8:'bl2_secondary' \
-        --new=9:32984:+368K --typecode=9:$TFM_TYPE_UUID --partition-guid=9:$(uuidgen) --change-name=9:'tfm_secondary' \
-+        --new=6:72:$SE_BL2_PARTITION_SIZE --typecode=6:$SE_BL2_TYPE_UUID --partition-guid=6:$(uuidgen) --change-name=6:'bl2_primary' \
-+        --new=7:360:$TFM_S_PARTITION_SIZE --typecode=7:$TFM_TYPE_UUID --partition-guid=7:$(uuidgen) --change-name=7:'tfm_primary' \
-+        --new=8:32784:$SE_BL2_PARTITION_SIZE --typecode=8:$SE_BL2_TYPE_UUID --partition-guid=8:$(uuidgen) --change-name=8:'bl2_secondary' \
-+        --new=9:33072:$TFM_S_PARTITION_SIZE --typecode=9:$TFM_TYPE_UUID --partition-guid=9:$(uuidgen) --change-name=9:'tfm_secondary' \
-         --new=10:65496:65501  --partition-guid=10:$(uuidgen) --change-name=10:'reserved_2' \
-         $IMAGE
- 
-@@ -93,7 +95,7 @@ sgdisk  --mbrtogpt \
- # Write partitions
- # conv=notrunc avoids truncation to keep the geometry of the image.
- dd if=$BIN_DIR/bl2_signed.bin of=${IMAGE}  seek=72 conv=notrunc
-dd if=$BIN_DIR/tfm_s_signed.bin of=${IMAGE} seek=272 conv=notrunc
-+dd if=$BIN_DIR/tfm_s_signed.bin of=${IMAGE} seek=360 conv=notrunc
- 
- # Print the gpt table
- sgdisk -p $IMAGE
-diff --git a/platform/ext/target/arm/corstone1000/partition/flash_layout.h b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-index 9fc1d9fa63..73c430ce57 100644
--- a/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-+++ b/platform/ext/target/arm/corstone1000/partition/flash_layout.h
-@@ -92,7 +92,7 @@
- #define FLASH_DEV_NAME_BL1              FLASH_DEV_NAME
- 
- /* Static Configurations of the Flash */
-#define SE_BL2_PARTITION_SIZE           (0x18000)    /* 96 KB */
-+#define SE_BL2_PARTITION_SIZE           (0x24000)    /* 144 KB */
- #define SE_BL2_BANK_0_OFFSET            (0x9000)  /* 72nd LBA */
- #define SE_BL2_BANK_1_OFFSET            (0x1002000)  /* 32784th LBA */
- 
-@@ -137,7 +137,7 @@
- 
- /* Bank configurations */
- #define BANK_PARTITION_SIZE             (0xFE0000)   /* 15.875 MB */
-#define TFM_PARTITION_SIZE              (0x5C000)    /* 368 KB */
-+#define TFM_PARTITION_SIZE              (0x50000)    /* 320 KB */
- 
- /************************************************************/
- /* Bank : Images flash offsets are with respect to the bank */
-- 
-2.25.1
-
@@ -1,7 +1,7 @@
-From 898d3c148521b331302c587e658d7e0a4f645c77 Mon Sep 17 00:00:00 2001
+From 78db43f80676f8038b35edd6674d22fb5ff85c12 Mon Sep 17 00:00:00 2001
 From: Bence Balogh <bence.balogh@arm.com>
 Date: Mon, 27 May 2024 17:11:31 +0200
-Subject: [PATCH 09/10] corstone1000: Remove reset after capsule update
+Subject: [PATCH] corstone1000: Remove reset after capsule update

 Signed-off-by: Bence Balogh <bence.balogh@arm.com>
 Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/29065]
@@ -1,42 +0,0 @@
-From 756cfad0cc05e7f4c02faa74aea14962aa54420c Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Wed, 31 Jul 2024 13:38:09 +0200
-Subject: [PATCH 2/3] CC312: ADAC: Add PSA_WANT_ALG_SHA_256 definition
-
-The bl2_mbedcrypto_config is linked to the psa_adac_cc312 target so
-the MCUBOOT_PSA_CRYPTO_CONFIG_FILEPATH and
-MCUBOOT_MBEDCRYPTO_CONFIG_FILEPATH configs are used for the ADAC driver
-too. The MCUBOOT_USE_PSA_CRYPTO is OFF by default, that means the
-MCUBOOT_PSA_CRYPTO_CONFIG_FILEPATH is not included during the build so
-the PSA_WANT_ALG_SHA_256 is not defined for the ADAC driver. Because
-of this, the PSA_HASH_MAX_SIZE is not set correctly for the sources
-of the psa_adac_cc312 target. This caused runtime issues.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/31131]
---
- platform/ext/accelerator/cc312/psa-adac/CMakeLists.txt | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/platform/ext/accelerator/cc312/psa-adac/CMakeLists.txt b/platform/ext/accelerator/cc312/psa-adac/CMakeLists.txt
-index cb0553b40a..d7f5a54f3c 100644
--- a/platform/ext/accelerator/cc312/psa-adac/CMakeLists.txt
-+++ b/platform/ext/accelerator/cc312/psa-adac/CMakeLists.txt
-@@ -1,5 +1,5 @@
- #-------------------------------------------------------------------------------
-# Copyright (c) 2020-2023, Arm Limited. All rights reserved.
-+# Copyright (c) 2020-2024, Arm Limited. All rights reserved.
- #
- # SPDX-License-Identifier: BSD-3-Clause
- #
-@@ -32,6 +32,7 @@ target_compile_options(psa_adac_cc312
-         -DCC_IOT
-         -DUSE_MBEDTLS_CRYPTOCELL
-         -D_INTERNAL_CC_NO_RSA_SCHEME_15_SUPPORT
-+        -DPSA_WANT_ALG_SHA_256
- )
- 
- target_link_libraries(psa_adac_cc312
-- 
-2.25.1
-
@@ -1,41 +0,0 @@
-From 8d6ed0ac3b1eee4b1e279993ec351e9bd80b68dc Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Wed, 31 Jul 2024 13:38:27 +0200
-Subject: [PATCH] Platform: CS1000: Add crypto configs for ADAC
-
-The psa_adac_psa_crypto target needs the MBEDTLS_CONFIG_FILE and
-MBEDTLS_PSA_CRYPTO_CONFIG_FILE defines in order to build correctly.
-The default crypto config files are used here.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Submitted [https://review.trustedfirmware.org/c/TF-M/trusted-firmware-m/+/31132]
---
- platform/ext/target/arm/corstone1000/CMakeLists.txt | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-index 530c4059d..3709bf3ec 100644
--- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
-+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-@@ -412,6 +412,18 @@ if (${PLATFORM_PSA_ADAC_SECURE_DEBUG})
-         PRIVATE
-             platform_bl2
-     )
-+
-+    target_compile_definitions(psa_adac_psa_crypto
-+        PRIVATE
-+            MBEDTLS_CONFIG_FILE="${CMAKE_SOURCE_DIR}/lib/ext/mbedcrypto/mbedcrypto_config/tfm_mbedcrypto_config_default.h"
-+            MBEDTLS_PSA_CRYPTO_CONFIG_FILE="${CMAKE_SOURCE_DIR}/lib/ext/mbedcrypto/mbedcrypto_config/crypto_config_default.h"
-+    )
-+
-+    target_link_libraries(psa_adac_psa_crypto
-+        PRIVATE
-+            psa_crypto_library_config
-+    )
-+
- endif()
- 
- find_package(Python3)
-- 
-2.25.1
-
@@ -1,27 +0,0 @@
-From 8f0cd9710be508adab91d8b5ab5aa2d39e89c287 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Wed, 31 Jul 2024 19:57:33 +0200
-Subject: [PATCH] Platform: CS1000: Fix platform name in logs
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Backport [c3fa68995b247c802589890c6ea3e721127b0c78]
---
- platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-index 8aacd877e4..f5baf08cb4 100644
--- a/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-+++ b/platform/ext/target/arm/corstone1000/bl2/boot_hal_bl2.c
-@@ -192,7 +192,7 @@ int32_t boot_platform_post_init(void)
-         }
- 
-         result = tfm_to_psa_adac_corstone1000_secure_debug(secure_debug_rotpk, 32);
-        BOOT_LOG_INF("%s: dipda_secure_debug is a %s.\r\n", __func__,
-+        BOOT_LOG_INF("%s: Corstone-1000 Secure Debug is a %s.\r\n", __func__,
-                 (result == 0) ? "success" : "failure");
- 
-     }
-- 
-2.25.1
-
@@ -1,451 +0,0 @@
-From 67e5aa83efce5f75df1c5d027e2d52f0da2eaba0 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Thu, 5 Sep 2024 17:21:50 +0200
-Subject: [PATCH 1/5] Platform: CS1000: Remove unused BL1 files
-
-These files are not referenced anywhere so removed them to prevent
-confusion.
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Pending [Not submitted to upstream yet]
---
- .../arm/corstone1000/bl1/CMakeLists.txt       | 345 ------------------
- .../arm/corstone1000/bl1/bl1_security_cnt.c   |  75 ----
- 2 files changed, 420 deletions(-)
- delete mode 100644 platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt
- delete mode 100644 platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c
-
-diff --git a/platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt b/platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt
-deleted file mode 100644
-index 5e140eecf6..0000000000
--- a/platform/ext/target/arm/corstone1000/bl1/CMakeLists.txt
-+++ /dev/null
-@@ -1,345 +0,0 @@
-#-------------------------------------------------------------------------------
-# Copyright (c) 2020-2024, Arm Limited. All rights reserved.
-#
-# SPDX-License-Identifier: BSD-3-Clause
-#
-#-------------------------------------------------------------------------------
-
-cmake_minimum_required(VERSION 3.15)
-cmake_policy(SET CMP0079 NEW)
-
-project("BL1 Bootloader" VERSION 0.0.1 LANGUAGES C ASM)
-
-# BL1 only loads the BL2 image, image number always equals 1
-set(BL1_IMAGE_NUMBER 1)
-
-# Version of BL2 image
-set(BL2_IMAGE_VERSION "0.1.0")
-
-add_executable(bl1)
-
-set_target_properties(bl1
-    PROPERTIES
-        SUFFIX ".axf"
-        RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}/bin"
-)
-
-target_link_options(bl1
-    PRIVATE
-        $<$<C_COMPILER_ID:GNU>:-Wl,-Map=${CMAKE_BINARY_DIR}/bin/bl1.map>
-)
-
-add_convert_to_bin_target(bl1)
-
-# bl2_mbedcrypto reused as it is, but it pulls the MCUBOOT_IMAGE_NUMBER=${MCUBOOT_IMAGE_NUMBER}
-# configuration, where image number is 3. (Coming from BL2 build). To not to collide with BL1's
-# build where image number is 1 mbedcrypto library is separated from the build of other source
-# files.
-target_link_libraries(bl1
-    PRIVATE
-        bl1_main
-        bl2_mbedcrypto
-        cmsis_stack_override
-        cmsis
-)
-
-# add_convert_to_bin_target(bl1) requires at least one source file added to bl1. This sources will
-# be built with wrong image number macro (value coming from BL2 config), so the start-up files
-# added here, as those not use this image number macro.
-target_sources(bl1
-    PRIVATE
-        $<$<C_COMPILER_ID:GNU>:${CMAKE_CURRENT_SOURCE_DIR}/../Device/Source/startup_corstone1000.c>
-)
-
-# Needed for the GCC startup files
-target_include_directories(bl1
-    PRIVATE
-        ${CMAKE_SOURCE_DIR}/platform/include
-        ../Device/Include
-)
-
-# target_add_scatter_file(bl1) cannot be used as it would add the platform_region_defs dependency
-# to bl1, again pulling the image number property matching with BL2 build, so scatter setup done
-# here by hand.
-target_link_options(bl1
-    PRIVATE
-        -T $<TARGET_OBJECTS:bl1_scatter>
-)
-
-add_library(bl1_scatter OBJECT)
-
-add_dependencies(bl1
-        bl1_scatter
-    )
-
-target_sources(bl1_scatter
-    PRIVATE
-        ../Device/Source/gcc/corstone1000_bl1.ld
-)
-
-set_source_files_properties(../Device/Source/gcc/corstone1000_bl1.ld
-    PROPERTIES
-    LANGUAGE C
-)
-
-target_compile_options(bl1_scatter
-    PRIVATE
-        -E
-        -P
-        -xc
-)
-
-target_compile_definitions(bl1_scatter
-    PRIVATE
-        MCUBOOT_IMAGE_NUMBER=${BL1_IMAGE_NUMBER}
-        BL1
-)
-
-target_include_directories(bl1_scatter
-    PRIVATE
-        ../partition
-)
-
-# Library to spearate build from bl2_mbedcrypto configurations
-add_library(bl1_main STATIC)
-
-target_compile_definitions(bl1_main
-    PRIVATE
-        MCUBOOT_IMAGE_NUMBER=${BL1_IMAGE_NUMBER}
-        BL1
-        BL2
-        $<$<BOOL:${PLATFORM_IS_FVP}>:PLATFORM_IS_FVP>
-)
-
-# Configurations based on bl2/CMakeLists.txt
-
-# Many files are reused form TF-M's bl2 directory
-set(BL2_SOURCE ${CMAKE_SOURCE_DIR}/bl2)
-
-target_sources(bl1_main
-    PRIVATE
-        ${BL2_SOURCE}/src/flash_map.c
-        ./provisioning.c
-)
-
-target_include_directories(bl1_main
-    PRIVATE
-        $<BUILD_INTERFACE:${BL2_SOURCE}/include>
-)
-
-# Include path needed for mbedcrypto headers
-target_include_directories(bl1_main
-    PRIVATE
-        $<BUILD_INTERFACE:${MBEDCRYPTO_PATH}/include>
-)
-
-# Configurations based on bl2/ext/mcuboot/CMakeLists.txt
-target_link_libraries(bl1_main
-    PRIVATE
-        mcuboot_config
-        bl2_mbedcrypto_config
-)
-
-target_include_directories(bl1_main
-    PRIVATE
-        $<BUILD_INTERFACE:${BL2_SOURCE}/ext/mcuboot/include>
-)
-
-target_sources(bl1_main
-    PRIVATE
-        ${BL2_SOURCE}/ext/mcuboot/bl2_main.c
-        ${BL2_SOURCE}/ext/mcuboot/keys.c
-        ${BL2_SOURCE}/ext/mcuboot/flash_map_legacy.c
-)
-
-# Configurations based on ${MCUBOOT_PATH}/boot/bootutil/CMakeLists.txt
-# add_subdirectory("${MCUBOOT_PATH}/boot/bootutil" bootutil) cannot work as we want to define different hal
-# functions compared to BL2
-target_sources(bl1_main
-    PRIVATE
-        ${MCUBOOT_PATH}/boot/bootutil/src/loader.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/bootutil_misc.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/bootutil_public.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/image_validate.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/image_rsa.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/tlv.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/boot_record.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/swap_scratch.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/swap_move.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/swap_misc.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/encrypted.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/fault_injection_hardening.c
-        ${MCUBOOT_PATH}/boot/bootutil/src/fault_injection_hardening_delay_rng_mbedtls.c
-)
-
-target_include_directories(bl1_main
-    PRIVATE
-        $<BUILD_INTERFACE:${MCUBOOT_PATH}/boot/bootutil/include>
-        $<BUILD_INTERFACE:${MCUBOOT_PATH}/boot/bootutil/src>
-        $<BUILD_INTERFACE:${MCUBOOT_PATH}/boot>
-)
-
-# Configurations based on platform/CMakeLists.txt
-target_include_directories(bl1_main
-    PRIVATE
-        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/include>
-        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/ext/driver>
-        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/ext/common>
-        $<BUILD_INTERFACE:${CMAKE_SOURCE_DIR}/platform/ext>
-        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/platform/ext/accelerator/interface>
-)
-
-target_sources(bl1_main
-    PRIVATE
-        $<$<BOOL:${PLATFORM_DEFAULT_UART_STDOUT}>:${CMAKE_SOURCE_DIR}/platform/ext/common/uart_stdout.c>
-        $<$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>:${CMAKE_SOURCE_DIR}/platform/ext/common/template/nv_counters.c>
-        $<$<OR:$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>,$<BOOL:${PLATFORM_DEFAULT_OTP}>>:${CMAKE_SOURCE_DIR}/platform/ext/common/template/flash_otp_nv_counters_backend.c>
-        $<$<BOOL:${PLATFORM_DEFAULT_OTP}>:${CMAKE_SOURCE_DIR}/platform/ext/common/template/otp_flash.c>
-)
-
-target_link_libraries(bl1_main
-    PRIVATE
-        bl2_hal
-        cmsis
-)
-
-target_compile_definitions(bl1_main
-    PRIVATE
-        MCUBOOT_${MCUBOOT_UPGRADE_STRATEGY}
-        $<$<BOOL:${SYMMETRIC_INITIAL_ATTESTATION}>:SYMMETRIC_INITIAL_ATTESTATION>
-        $<$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>:PLATFORM_DEFAULT_NV_COUNTERS>
-        $<$<BOOL:${MCUBOOT_HW_KEY}>:MCUBOOT_HW_KEY>
-        MCUBOOT_FIH_PROFILE_${MCUBOOT_FIH_PROFILE}
-        $<$<BOOL:${PLATFORM_DEFAULT_NV_COUNTERS}>:PLATFORM_DEFAULT_NV_COUNTERS>
-        $<$<BOOL:${PLATFORM_DEFAULT_OTP}>:PLATFORM_DEFAULT_OTP>
-        $<$<BOOL:${OTP_NV_COUNTERS_RAM_EMULATION}>:OTP_NV_COUNTERS_RAM_EMULATION=1>
-        $<$<BOOL:${TFM_DUMMY_PROVISIONING}>:TFM_DUMMY_PROVISIONING>
-        $<$<BOOL:${PLATFORM_DEFAULT_OTP_WRITEABLE}>:OTP_WRITEABLE>
-)
-
-# Configurations based on cc312 cmake files
-target_compile_definitions(bl1_main
-    PRIVATE
-        $<$<BOOL:${CRYPTO_HW_ACCELERATOR_OTP_STATE}>:CRYPTO_HW_ACCELERATOR_OTP_${CRYPTO_HW_ACCELERATOR_OTP_STATE}>
-        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:CRYPTO_HW_ACCELERATOR>
-        $<$<BOOL:${ENABLE_FWU_AGENT_DEBUG_LOGS}>:ENABLE_FWU_AGENT_DEBUG_LOGS>
-)
-
-target_include_directories(bl1_main
-    PRIVATE
-        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/platform/ext/accelerator/cc312>
-        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/lib/ext/cryptocell-312-runtime/shared/include/mbedtls>
-        $<$<BOOL:${CRYPTO_HW_ACCELERATOR}>:${CMAKE_SOURCE_DIR}/lib/ext/cryptocell-312-runtime/shared/include/crypto_api/cc3x>
-        ../soft_crc
-)
-
-# Configurations based on platform level cmake files
-target_sources(bl1_main
-    PRIVATE
-        ../CMSIS_Driver/Driver_Flash.c
-        ../CMSIS_Driver/Driver_USART.c
-        ../Device/Source/device_definition.c
-        ../Device/Source/system_core_init.c
-        ../Native_Driver/firewall.c
-        ../Native_Driver/uart_pl011_drv.c
-        ../fw_update_agent/fwu_agent.c
-        ../soft_crc/soft_crc.c
-        ../Native_Driver/arm_watchdog_drv.c
-        ../Native_Driver/watchdog.c
-        bl1_boot_hal.c
-        bl1_flash_map.c
-        bl1_security_cnt.c
-        flash_map_extended.c
-        bl1_rotpk.c
-)
-
-if (PLATFORM_IS_FVP)
-target_sources(bl1_main
-    PRIVATE
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/strata/spi_strataflashj3_flash_lib.c
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/cfi/cfi_drv.c
-)
-else()
-target_sources(bl1_main
-    PRIVATE
-        ${PLATFORM_DIR}/ext/target/arm/drivers/qspi/xilinx_pg153_axi/xilinx_pg153_axi_qspi_controller_drv.c
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/n25q256a/spi_n25q256a_flash_lib.c
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/sst26vf064b/spi_sst26vf064b_flash_lib.c
-)
-endif()
-
-target_include_directories(bl1_main
-    PRIVATE
-        ../partition
-        ../Device/Include
-        ../.
-        ../CMSIS_Driver/Config
-        ../Device/Config
-        ../Native_Driver
-        ../fw_update_agent
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/common
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/cfi
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/strata
-        ${PLATFORM_DIR}/ext/target/arm/drivers/qspi/xilinx_pg153_axi
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/n25q256a
-        ${PLATFORM_DIR}/ext/target/arm/drivers/flash/sst26vf064b
-
-)
-
-############################### SIGNING BL2 image ##################################
-
-find_package(Python3)
-
-set(FLASH_AREA_NUM 8)
-configure_file(signing_layout.c.in ${CMAKE_CURRENT_BINARY_DIR}/signing_layout.c @ONLY)
-add_library(signing_layout_for_bl2 OBJECT ${CMAKE_CURRENT_BINARY_DIR}/signing_layout.c)
-
-target_compile_options(signing_layout_for_bl2
-    PRIVATE
-        $<$<C_COMPILER_ID:GNU>:-E\;-xc>
-        $<$<C_COMPILER_ID:ARMClang>:-E\;-xc>
-        $<$<C_COMPILER_ID:IAR>:--preprocess=ns\;$<TARGET_OBJECTS:signing_layout_s>>
-)
-target_compile_definitions(signing_layout_for_bl2
-    PRIVATE
-        MCUBOOT_IMAGE_NUMBER=${BL1_IMAGE_NUMBER}
-        BL1
-)
-
-target_include_directories(signing_layout_for_bl2
-    PRIVATE
-        ../partition
-)
-
-if (CONFIG_TFM_BOOT_STORE_MEASUREMENTS AND CONFIG_TFM_BOOT_STORE_ENCODED_MEASUREMENTS)
-    set(MCUBOOT_MEASURED_BOOT ON)
-endif()
-
-add_custom_target(bl2_signed_bin
-    ALL
-    SOURCES bl2_signed.bin
-)
-add_custom_command(OUTPUT bl2_signed.bin
-    DEPENDS $<TARGET_FILE_DIR:bl2>/bl2.bin
-    DEPENDS bl2_bin signing_layout_for_bl2
-    WORKING_DIRECTORY ${MCUBOOT_PATH}/scripts
-
-    #Sign secure binary image with provided secret key
-    COMMAND ${Python3_EXECUTABLE} ${BL2_SOURCE}/ext/mcuboot/scripts/wrapper/wrapper.py
-        -v ${BL2_IMAGE_VERSION}
-        --layout $<TARGET_OBJECTS:signing_layout_for_bl2>
-        -k ${MCUBOOT_KEY_S}
-        --public-key-format $<IF:$<BOOL:${MCUBOOT_HW_KEY}>,full,hash>
-        --align 1
-        --pad
-        --pad-header
-        -H 0x400
-        -s ${MCUBOOT_SECURITY_COUNTER_S}
-        -d \"\(0,${MCUBOOT_S_IMAGE_MIN_VER}\)\"
-        $<$<STREQUAL:${MCUBOOT_UPGRADE_STRATEGY},OVERWRITE_ONLY>:--overwrite-only>
-        $<$<BOOL:${MCUBOOT_ENC_IMAGES}>:-E${MCUBOOT_KEY_ENC}>
-        $<$<BOOL:${MCUBOOT_MEASURED_BOOT}>:--measured-boot-record>
-        $<TARGET_FILE_DIR:bl2>/bl2.bin
-        ${CMAKE_CURRENT_BINARY_DIR}/bl2_signed.bin
-    COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/bl2_signed.bin $<TARGET_FILE_DIR:bl2>
-)
-diff --git a/platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c b/platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c
-deleted file mode 100644
-index 32c1481cca..0000000000
--- a/platform/ext/target/arm/corstone1000/bl1/bl1_security_cnt.c
-+++ /dev/null
-@@ -1,75 +0,0 @@
-/*
- * Copyright (c) 2019-2021, Arm Limited. All rights reserved.
- *
- * SPDX-License-Identifier: BSD-3-Clause
- *
- */
-
-#include "bootutil/security_cnt.h"
-#include "tfm_plat_nv_counters.h"
-#include "tfm_plat_defs.h"
-#include "bootutil/fault_injection_hardening.h"
-#include <stdint.h>
-#include "tfm_plat_provisioning.h"
-#include "fwu_agent.h"
-
-fih_ret boot_nv_security_counter_init(void)
-{
-    FIH_DECLARE(fih_rc, FIH_FAILURE);
-
-    fih_rc = fih_ret_encode_zero_equality(tfm_plat_init_nv_counter());
-
-    FIH_RET(fih_rc);
-}
-
-fih_ret boot_nv_security_counter_get(uint32_t image_id, fih_int *security_cnt)
-{
-    FIH_DECLARE(fih_rc, FIH_FAILURE);
-    uint32_t security_cnt_soft;
-
-    /* Check if it's a null-pointer. */
-    if (!security_cnt) {
-        FIH_RET(FIH_FAILURE);
-    }
-
-    if (image_id != 0) {
-        FIH_RET(FIH_FAILURE);
-    }
-
-    fih_rc = fih_ret_encode_zero_equality(
-             tfm_plat_read_nv_counter(PLAT_NV_COUNTER_BL1_0,
-                                      sizeof(security_cnt_soft),
-                                      (uint8_t *)&security_cnt_soft));
-    *security_cnt = fih_int_encode(security_cnt_soft);
-
-    FIH_RET(fih_rc);
-}
-
-int32_t boot_nv_security_counter_update(uint32_t image_id,
-                                        uint32_t img_security_cnt)
-{
-    enum tfm_plat_err_t err;
-    enum fwu_agent_error_t fwu_err;
-
-    if (image_id != 0) {
-        return -1;
-    }
-
-    if (tfm_plat_provisioning_is_required()) {
-
-        err = tfm_plat_set_nv_counter(PLAT_NV_COUNTER_BL1_0, img_security_cnt);
-        if (err != TFM_PLAT_ERR_SUCCESS) {
-            return -1;
-        }
-
-    } else {
-
-        fwu_err = fwu_stage_nv_counter(FWU_BL2_NV_COUNTER, img_security_cnt);
-        if (fwu_err != FWU_AGENT_SUCCESS) {
-            return -1;
-        }
-
-    }
-
-    return 0;
-}
-- 
-2.25.1
-
@@ -1,61 +0,0 @@
-From 60793058794f0ac8ea35a69b2dddf97ccba1acdb Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Thu, 5 Sep 2024 21:29:07 +0200
-Subject: [PATCH 2/5] Platform: CS1000: Remove duplicated metadata write
-
-The metadata replica_2 was written twice which is not needed.
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Pending [Not submitted to upstream yet]
---
- .../corstone1000/fw_update_agent/fwu_agent.c  | 28 -------------------
- 1 file changed, 28 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-index d0028a56d8..2b69447dc5 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-@@ -499,20 +499,6 @@ static enum fwu_agent_error_t metadata_write(
-         return FWU_AGENT_ERROR;
-     }
- 
-    FWU_LOG_MSG("%s: enter: flash addr = %u, size = %d\n\r", __func__,
-                  FWU_METADATA_REPLICA_2_OFFSET, sizeof(struct fwu_metadata));
-
-    ret = FWU_METADATA_FLASH_DEV.EraseSector(FWU_METADATA_REPLICA_2_OFFSET);
-    if (ret != ARM_DRIVER_OK) {
-        return FWU_AGENT_ERROR;
-    }
-
-    ret = FWU_METADATA_FLASH_DEV.ProgramData(FWU_METADATA_REPLICA_2_OFFSET,
-                                p_metadata, sizeof(struct fwu_metadata));
-    if (ret < 0 || ret != sizeof(struct fwu_metadata)) {
-        return FWU_AGENT_ERROR;
-    }
-
-     FWU_LOG_MSG("%s: success: active = %u, previous = %d\n\r", __func__,
-                   p_metadata->active_index, p_metadata->previous_active_index);
-     return FWU_AGENT_SUCCESS;
-@@ -569,20 +555,6 @@ static enum fwu_agent_error_t metadata_write(
-         return FWU_AGENT_ERROR;
-     }
- 
-    FWU_LOG_MSG("%s: enter: flash addr = %u, size = %d\n\r", __func__,
-                  FWU_METADATA_REPLICA_2_OFFSET, sizeof(struct fwu_metadata));
-
-    ret = FWU_METADATA_FLASH_DEV.EraseSector(FWU_METADATA_REPLICA_2_OFFSET);
-    if (ret != ARM_DRIVER_OK) {
-        return FWU_AGENT_ERROR;
-    }
-
-    ret = FWU_METADATA_FLASH_DEV.ProgramData(FWU_METADATA_REPLICA_2_OFFSET,
-                                p_metadata, sizeof(struct fwu_metadata));
-    if (ret < 0 || ret != sizeof(struct fwu_metadata)) {
-        return FWU_AGENT_ERROR;
-    }
-
-     FWU_LOG_MSG("%s: success: active = %u, previous = %d\n\r", __func__,
-                   p_metadata->active_index, p_metadata->previous_active_index);
-     return FWU_AGENT_SUCCESS;
-- 
-2.25.1
-
@@ -1,193 +0,0 @@
-From 09827a44518b05a2cc58602dda18474973abfb83 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Thu, 5 Sep 2024 17:28:56 +0200
-Subject: [PATCH 3/5] Platform: CS1000: Fix compiler switch in BL1
-
-The fwu_agent.c used the "BL1" definition to check if the source file
-is building for the BL1 or for the TFM_S target.
-But the "BL1" definition is added to the build flags for every file
-that links against platform_region_defs, see
-tfm/cmake/spe-CMakeLists.cmake:
-
-target_compile_definitions(platform_region_defs
-    INTERFACE
-        $<$<BOOL:${BL1}>:BL1>
-       ....
-)
-
-This means the "#if BL1" condition was true for both cases.
-
-This commit:
- Adds a new definition that is only added to the
-  platform_bl1_1 target.
- Fixes the #elif with no expression error that came up.
- Moves the partition table loading because previously it was not
-  loaded during the runtime TFM_S execution, only in BL2.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Pending [Not submitted to upstream yet]
---
- .../target/arm/corstone1000/CMakeLists.txt    |  7 ++++
- .../corstone1000/fw_update_agent/fwu_agent.c  | 33 +++++++++----------
- 2 files changed, 23 insertions(+), 17 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/CMakeLists.txt b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-index 89db1732a9..f6880cba3c 100644
--- a/platform/ext/target/arm/corstone1000/CMakeLists.txt
-+++ b/platform/ext/target/arm/corstone1000/CMakeLists.txt
-@@ -144,6 +144,7 @@ target_sources(platform_s
-         partition/gpt.c
-         $<$<NOT:$<BOOL:${PLATFORM_DEFAULT_OTP}>>:${PLATFORM_DIR}/ext/accelerator/cc312/otp_cc312.c>
-         rse_comms_permissions_hal.c
-+        platform.c
- )
- 
- if (PLATFORM_IS_FVP)
-@@ -213,6 +214,12 @@ target_compile_definitions(platform_bl1_1
-         $<$<BOOL:${CRYPTO_HW_ACCELERATOR_OTP_PROVISIONING}>:CRYPTO_HW_ACCELERATOR_OTP_PROVISIONING>
-         MBEDTLS_CONFIG_FILE="${CMAKE_SOURCE_DIR}/lib/ext/mbedcrypto/mbedcrypto_config/tfm_mbedcrypto_config_default.h"
-         MBEDTLS_PSA_CRYPTO_CONFIG_FILE="${CMAKE_SOURCE_DIR}/lib/ext/mbedcrypto/mbedcrypto_config/crypto_config_default.h"
-+
-+        # This definition is only added to the bl1_main target. There are
-+        # files that are shared between the BL1 and TFM_S targets. This flag
-+        # can be used if the BL1 target needs different implementation than
-+        # the TFM_S target.
-+        BL1_BUILD
- )
- 
- target_include_directories(platform_bl1_1_interface
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-index 2b69447dc5..9890eeaf90 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-@@ -21,7 +21,7 @@
- #include "uefi_fmp.h"
- #include "uart_stdout.h"
- #include "soft_crc.h"
-#if !BL1
-+#ifndef BL1_BUILD
- #include "partition.h"
- #include "platform.h"
- #endif
-@@ -197,7 +197,7 @@ extern ARM_DRIVER_FLASH FWU_METADATA_FLASH_DEV;
- 
- #define HOST_ACK_TIMEOUT_SEC    (6 * 60) /* ~seconds, not exact */
- 
-#if BL1
-+#ifdef BL1_BUILD
- static enum fwu_agent_error_t private_metadata_read(
-         struct fwu_private_metadata* p_metadata)
- {
-@@ -220,7 +220,7 @@ static enum fwu_agent_error_t private_metadata_read(
- 
-     return FWU_AGENT_SUCCESS;
- }
-#elif
-+#else
- static enum fwu_agent_error_t private_metadata_read(
-         struct fwu_private_metadata* p_metadata)
- {
-@@ -253,7 +253,7 @@ static enum fwu_agent_error_t private_metadata_read(
- }
- #endif
- 
-#if BL1
-+#ifdef BL1_BUILD
- static enum fwu_agent_error_t private_metadata_write(
-         struct fwu_private_metadata* p_metadata)
- {
-@@ -280,7 +280,7 @@ static enum fwu_agent_error_t private_metadata_write(
-     FWU_LOG_MSG("%s: success\n\r", __func__);
-     return FWU_AGENT_SUCCESS;
- }
-#elif
-+#else
- static enum fwu_agent_error_t private_metadata_write(
-         struct fwu_private_metadata* p_metadata)
- {
-@@ -339,7 +339,7 @@ static enum fwu_agent_error_t metadata_validate(struct fwu_metadata *p_metadata)
-     return FWU_AGENT_SUCCESS;
- }
- 
-#if BL1
-+#ifdef BL1_BUILD
- static enum fwu_agent_error_t metadata_read_without_validation(struct fwu_metadata *p_metadata)
- {
-     int ret;
-@@ -362,7 +362,7 @@ static enum fwu_agent_error_t metadata_read_without_validation(struct fwu_metada
- 
-     return FWU_AGENT_SUCCESS;
- }
-#elif
-+#else
- static enum fwu_agent_error_t metadata_read_without_validation(struct fwu_metadata *p_metadata)
- {
-     uuid_t metadata_uuid = FWU_METADATA_TYPE_UUID;
-@@ -396,7 +396,7 @@ static enum fwu_agent_error_t metadata_read_without_validation(struct fwu_metada
- }
- #endif
- 
-#if BL1
-+#ifdef BL1_BUILD
- static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
- {
-     int ret;
-@@ -423,7 +423,7 @@ static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
- 
-     return FWU_AGENT_SUCCESS;
- }
-#elif
-+#else
- static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
- {
-     uuid_t metadata_uuid = FWU_METADATA_TYPE_UUID;
-@@ -461,7 +461,7 @@ static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
- #endif
- 
- 
-#if BL1
-+#ifdef BL1_BUILD
- static enum fwu_agent_error_t metadata_write(
-                         struct fwu_metadata *p_metadata)
- {
-@@ -503,7 +503,7 @@ static enum fwu_agent_error_t metadata_write(
-                   p_metadata->active_index, p_metadata->previous_active_index);
-     return FWU_AGENT_SUCCESS;
- }
-#elif
-+#else
- static enum fwu_agent_error_t metadata_write(
-                         struct fwu_metadata *p_metadata)
- {
-@@ -567,11 +567,15 @@ enum fwu_agent_error_t fwu_metadata_init(void)
-     enum fwu_agent_error_t ret;
-     ARM_FLASH_INFO* flash_info;
- 
-
-     if (is_initialized) {
-         return FWU_AGENT_SUCCESS;
-     }
- 
-+    #ifndef BL1_BUILD
-+    plat_io_storage_init();
-+    partition_init(PLATFORM_GPT_IMAGE);
-+    #endif
-+
-     /* Code assumes everything fits into a sector */
-     if (sizeof(struct fwu_metadata) > FWU_METADATA_FLASH_SECTOR_SIZE) {
-         return FWU_AGENT_ERROR;
-@@ -605,11 +609,6 @@ enum fwu_agent_error_t fwu_metadata_provision(void)
- 
-     FWU_LOG_MSG("%s: enter\n\r", __func__);
- 
-#if !BL1
-    plat_io_storage_init();
-    partition_init(PLATFORM_GPT_IMAGE);
-#endif
-
-     ret = fwu_metadata_init();
-     if (ret) {
-         return ret;
-- 
-2.25.1
-
@@ -1,370 +0,0 @@
-From 5fd2662e1f20b5c645ff0755e84424bae303fa45 Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Mon, 9 Sep 2024 09:42:58 +0200
-Subject: [PATCH] Platform: CS1000: Validate both metadata replicas
-
-According to the [1] both metadata replica integrity should be checked
-during the update agent initialization, and if one of the replica is
-corrupted then it should be fixed by copying the other replica.
-
-This commit:
- Adds the integrity check and correction to the
-  corstone1000_fwu_host_ack() function. This function is called when
-  the Host core has booted.
- Updates the metadata_read() function so both replica can be read.
- Adds metadata_write_replica() function to write metadata replicas
-  separately.
-
-[1] https://developer.arm.com/documentation/den0118/a/?lang=en
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Pending [Not submitted to upstream yet]
---
- .../corstone1000/fw_update_agent/fwu_agent.c  | 167 ++++++++++++------
- .../corstone1000/fw_update_agent/fwu_agent.h  |   7 +
- 2 files changed, 119 insertions(+), 55 deletions(-)
-
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-index 92b918c67..aad6208e0 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.c
-@@ -395,20 +395,33 @@ static enum fwu_agent_error_t metadata_read_without_validation(struct fwu_metada
- #endif
- 
- #ifdef BL1_BUILD
-static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
-+static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata, uint8_t replica_num)
- {
-     int ret;
-+    uint32_t replica_offset = 0;
- 
-    FWU_LOG_MSG("%s: enter: flash addr = %u, size = %d\n\r", __func__,
-                  FWU_METADATA_REPLICA_1_OFFSET, sizeof(struct fwu_metadata));
-+    FWU_LOG_MSG("%s: enter\n\r", __func__);
- 
-     if (!p_metadata) {
-         return FWU_AGENT_ERROR;
-     }
- 
-    ret = FWU_METADATA_FLASH_DEV.ReadData(FWU_METADATA_REPLICA_1_OFFSET,
-                                p_metadata, sizeof(struct fwu_metadata));
-    if (ret < 0 || ret != sizeof(struct fwu_metadata)) {
-+    if (replica_num == 1) {
-+        replica_offset = FWU_METADATA_REPLICA_1_OFFSET;
-+    } else if (replica_num == 2) {
-+        replica_offset = FWU_METADATA_REPLICA_2_OFFSET;
-+    } else {
-+        FWU_LOG_MSG("%s: replica_num must be 1 or 2\n\r", __func__);
-+        return FWU_AGENT_ERROR;
-+    }
-+
-+    FWU_LOG_MSG("%s: flash addr = %u, size = %d\n\r", __func__,
-+                  replica_offset, sizeof(*p_metadata));
-+
-+
-+    ret = FWU_METADATA_FLASH_DEV.ReadData(replica_offset,
-+                                p_metadata, sizeof(*p_metadata));
-+    if (ret < 0 || ret != sizeof(*p_metadata)) {
-         return FWU_AGENT_ERROR;
-     }
- 
-@@ -422,17 +435,27 @@ static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
-     return FWU_AGENT_SUCCESS;
- }
- #else
-static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
-+static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata, uint8_t replica_num)
- {
-     uuid_t metadata_uuid = FWU_METADATA_TYPE_UUID;
-     partition_entry_t *part;
-     int ret;
- 
-+    FWU_LOG_MSG("%s: enter\n\r", __func__);
-+
-     if (!p_metadata) {
-         return FWU_AGENT_ERROR;
-     }
- 
-    part = get_partition_entry_by_type(&metadata_uuid);
-+    if (replica_num == 1) {
-+        part = get_partition_entry_by_type(&metadata_uuid);
-+    } else if (replica_num == 2) {
-+        part = get_partition_replica_by_type(&metadata_uuid);
-+    } else {
-+        FWU_LOG_MSG("%s: replica_num must be 1 or 2\n\r", __func__);
-+        return FWU_AGENT_ERROR;
-+    }
-+
-     if (!part) {
-         FWU_LOG_MSG("%s: FWU metadata partition not found\n\r", __func__);
-         return FWU_AGENT_ERROR;
-@@ -461,39 +484,38 @@ static enum fwu_agent_error_t metadata_read(struct fwu_metadata *p_metadata)
- 
- #ifdef BL1_BUILD
- static enum fwu_agent_error_t metadata_write(
-                        struct fwu_metadata *p_metadata)
-+                        struct fwu_metadata *p_metadata, uint8_t replica_num)
- {
-     int ret;
-+    uint32_t replica_offset = 0;
- 
-    FWU_LOG_MSG("%s: enter: flash addr = %u, size = %d\n\r", __func__,
-                  FWU_METADATA_REPLICA_1_OFFSET, sizeof(struct fwu_metadata));
-+    FWU_LOG_MSG("%s: enter\n\r", __func__);
- 
-     if (!p_metadata) {
-         return FWU_AGENT_ERROR;
-     }
- 
-    ret = FWU_METADATA_FLASH_DEV.EraseSector(FWU_METADATA_REPLICA_1_OFFSET);
-    if (ret != ARM_DRIVER_OK) {
-        return FWU_AGENT_ERROR;
-    }
-
-    ret = FWU_METADATA_FLASH_DEV.ProgramData(FWU_METADATA_REPLICA_1_OFFSET,
-                                p_metadata, sizeof(struct fwu_metadata));
-    if (ret < 0 || ret != sizeof(struct fwu_metadata)) {
-+    if (replica_num == 1) {
-+        replica_offset = FWU_METADATA_REPLICA_1_OFFSET;
-+    } else if (replica_num == 2) {
-+        replica_offset = FWU_METADATA_REPLICA_2_OFFSET;
-+    } else {
-+        FWU_LOG_MSG("%s: replica_num must be 1 or 2\n\r", __func__);
-         return FWU_AGENT_ERROR;
-     }
- 
-     FWU_LOG_MSG("%s: enter: flash addr = %u, size = %d\n\r", __func__,
-                  FWU_METADATA_REPLICA_2_OFFSET, sizeof(struct fwu_metadata));
-+                  replica_offset, sizeof(*p_metadata));
- 
-    ret = FWU_METADATA_FLASH_DEV.EraseSector(FWU_METADATA_REPLICA_2_OFFSET);
-+
-+    ret = FWU_METADATA_FLASH_DEV.EraseSector(replica_offset);
-     if (ret != ARM_DRIVER_OK) {
-         return FWU_AGENT_ERROR;
-     }
- 
-    ret = FWU_METADATA_FLASH_DEV.ProgramData(FWU_METADATA_REPLICA_2_OFFSET,
-                                p_metadata, sizeof(struct fwu_metadata));
-    if (ret < 0 || ret != sizeof(struct fwu_metadata)) {
-+    ret = FWU_METADATA_FLASH_DEV.ProgramData(replica_offset,
-+                                p_metadata, sizeof(*p_metadata));
-+    if (ret < 0 || ret != sizeof(*p_metadata)) {
-         return FWU_AGENT_ERROR;
-     }
- 
-@@ -503,7 +525,7 @@ static enum fwu_agent_error_t metadata_write(
- }
- #else
- static enum fwu_agent_error_t metadata_write(
-                        struct fwu_metadata *p_metadata)
-+                        struct fwu_metadata *p_metadata, uint8_t replica_num)
- {
-     uuid_t metadata_uuid = FWU_METADATA_TYPE_UUID;
-     partition_entry_t *part;
-@@ -513,7 +535,15 @@ static enum fwu_agent_error_t metadata_write(
-         return FWU_AGENT_ERROR;
-     }
- 
-    part = get_partition_entry_by_type(&metadata_uuid);
-+    if (replica_num == 1) {
-+        part = get_partition_entry_by_type(&metadata_uuid);
-+    } else if (replica_num == 2) {
-+        part = get_partition_replica_by_type(&metadata_uuid);
-+    } else {
-+        FWU_LOG_MSG("%s: replica_num must be 1 or 2\n\r", __func__);
-+        return FWU_AGENT_ERROR;
-+    }
-+
-     if (!part) {
-         FWU_LOG_MSG("%s: FWU metadata partition not found\n\r", __func__);
-         return FWU_AGENT_ERROR;
-@@ -533,32 +563,51 @@ static enum fwu_agent_error_t metadata_write(
-         return FWU_AGENT_ERROR;
-     }
- 
-    part = get_partition_replica_by_type(&metadata_uuid);
-    if (!part) {
-        FWU_LOG_MSG("%s: FWU metadata replica partition not found\n\r", __func__);
-        return FWU_AGENT_ERROR;
-    }
-+    FWU_LOG_MSG("%s: success: active = %u, previous = %d\n\r", __func__,
-+                  p_metadata->active_index, p_metadata->previous_active_index);
-+    return FWU_AGENT_SUCCESS;
-+}
-+#endif
- 
-    FWU_LOG_MSG("%s: enter: flash addr = %u, size = %d\n\r", __func__,
-                  part->start, sizeof(struct fwu_metadata));
-+static enum fwu_agent_error_t metadata_write_both_replica(
-+                        struct fwu_metadata *p_metadata)
-+{
-+    enum fwu_agent_error_t ret = FWU_AGENT_ERROR;
- 
-    ret = FWU_METADATA_FLASH_DEV.EraseSector(part->start);
-    if (ret != ARM_DRIVER_OK) {
-        return FWU_AGENT_ERROR;
-+    ret = metadata_write(&_metadata, 1);
-+    if (ret) {
-+        return ret;
-     }
- 
-    ret = FWU_METADATA_FLASH_DEV.ProgramData(part->start,
-                                p_metadata, sizeof(struct fwu_metadata));
-    if (ret < 0 || ret != sizeof(struct fwu_metadata)) {
-        return FWU_AGENT_ERROR;
-+    ret = metadata_write(&_metadata, 2);
-+    if (ret) {
-+        return ret;
-     }
- 
-    FWU_LOG_MSG("%s: success: active = %u, previous = %d\n\r", __func__,
-                  p_metadata->active_index, p_metadata->previous_active_index);
-     return FWU_AGENT_SUCCESS;
- }
-#endif
- 
-+enum fwu_agent_error_t fwu_metadata_check_and_correct_integrity(void)
-+{
-+    enum fwu_agent_error_t ret_replica_1 = FWU_AGENT_ERROR;
-+    enum fwu_agent_error_t ret_replica_2 = FWU_AGENT_ERROR;
-+
-+    /* Check integrity of both metadata replica */
-+    ret_replica_1 = metadata_read(&_metadata, 1);
-+    ret_replica_2 = metadata_read(&_metadata, 2);
-+
-+    if (ret_replica_1 != FWU_AGENT_SUCCESS && ret_replica_2 != FWU_AGENT_SUCCESS) {
-+        return FWU_AGENT_ERROR;
-+    } else if (ret_replica_1 == FWU_AGENT_SUCCESS && ret_replica_2 != FWU_AGENT_SUCCESS) {
-+        metadata_read(&_metadata, 1);
-+        metadata_write(&_metadata, 2);
-+    } else if (ret_replica_1 != FWU_AGENT_SUCCESS && ret_replica_2 == FWU_AGENT_SUCCESS) {
-+        metadata_read(&_metadata, 2);
-+        metadata_write(&_metadata, 1);
-+    }
-+
-+    return FWU_AGENT_SUCCESS;
-+}
- 
- enum fwu_agent_error_t fwu_metadata_init(void)
- {
-@@ -617,8 +666,8 @@ enum fwu_agent_error_t fwu_metadata_provision(void)
-      * had a firmware data?. If yes, then don't initialize
-      * metadata
-      */
-    metadata_read(&_metadata);
-    if(_metadata.active_index < 2 || _metadata.previous_active_index <2){
-+    metadata_read(&_metadata, 1);
-+    if(_metadata.active_index < 2 || _metadata.previous_active_index < 2){
-     	if(_metadata.active_index ^ _metadata.previous_active_index)
-     		return FWU_AGENT_SUCCESS;
-     }
-@@ -652,13 +701,13 @@ enum fwu_agent_error_t fwu_metadata_provision(void)
-     _metadata.crc_32 = crc32((uint8_t *)&_metadata.version,
-                              sizeof(struct fwu_metadata) - sizeof(uint32_t));
- 
-    ret = metadata_write(&_metadata);
-+    ret = metadata_write_both_replica(&_metadata);
-     if (ret) {
-         return ret;
-     }
- 
-    memset(&_metadata, 0, sizeof(struct fwu_metadata));
-    ret = metadata_read(&_metadata);
-+    memset(&_metadata, 0, sizeof(_metadata));
-+    ret = metadata_read(&_metadata, 1);
-     if (ret) {
-         return ret;
-     }
-@@ -825,7 +874,7 @@ static enum fwu_agent_error_t flash_full_capsule(
-     metadata->crc_32 = crc32((uint8_t *)&metadata->version,
-                               sizeof(struct fwu_metadata) - sizeof(uint32_t));
- 
-    ret = metadata_write(metadata);
-+    ret = metadata_write_both_replica(metadata);
-     if (ret) {
-         return ret;
-     }
-@@ -852,7 +901,7 @@ enum fwu_agent_error_t corstone1000_fwu_flash_image(void)
- 
-     Select_Write_Mode_For_Shared_Flash();
- 
-    if (metadata_read(&_metadata)) {
-+    if (metadata_read(&_metadata, 1)) {
-         ret =  FWU_AGENT_ERROR;
-         goto out;
-     }
-@@ -938,7 +987,7 @@ static enum fwu_agent_error_t accept_full_capsule(
-     metadata->crc_32 = crc32((uint8_t *)&metadata->version,
-                               sizeof(struct fwu_metadata) - sizeof(uint32_t));
- 
-    ret = metadata_write(metadata);
-+    ret = metadata_write_both_replica(metadata);
-     if (ret) {
-         return ret;
-     }
-@@ -1034,7 +1083,7 @@ static enum fwu_agent_error_t fwu_select_previous(
-     metadata->crc_32 = crc32((uint8_t *)&metadata->version,
-                               sizeof(struct fwu_metadata) - sizeof(uint32_t));
- 
-    ret = metadata_write(metadata);
-+    ret = metadata_write_both_replica(metadata);
-     if (ret) {
-         return ret;
-     }
-@@ -1064,7 +1113,7 @@ void bl1_get_active_bl2_image(uint32_t *offset)
-         FWU_ASSERT(0);
-     }
- 
-    if (metadata_read(&_metadata)) {
-+    if (metadata_read(&_metadata, 1)) {
-         FWU_ASSERT(0);
-     }
- 
-@@ -1203,9 +1252,17 @@ enum fwu_agent_error_t corstone1000_fwu_host_ack(void)
-         return FWU_AGENT_ERROR;
-     }
- 
-+    /* This cannot be added to the fwu_metadata_init() because that function is
-+     * called before the logging is enabled by TF-M. */
-+    ret = fwu_metadata_check_and_correct_integrity();
-+    if (ret = FWU_AGENT_SUCCESS) {
-+        FWU_LOG_MSG("fwu_metadata_check_and_correct_integrity failed\r\n");
-+        return ret;
-+    }
-+
-     Select_Write_Mode_For_Shared_Flash();
- 
-    if (metadata_read(&_metadata)) {
-+    if (metadata_read(&_metadata, 1)) {
-         ret = FWU_AGENT_ERROR;
-         goto out;
-     }
-@@ -1315,7 +1372,7 @@ void host_acknowledgement_timer_to_reset(void)
-         FWU_ASSERT(0);
-     }
- 
-    if (metadata_read(&_metadata)) {
-+    if (metadata_read(&_metadata, 1)) {
-         FWU_ASSERT(0);
-     }
- 
-diff --git a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.h b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.h
-index 701f20558..78e104277 100644
--- a/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.h
-+++ b/platform/ext/target/arm/corstone1000/fw_update_agent/fwu_agent.h
-@@ -70,4 +70,11 @@ enum fwu_nv_counter_index_t {
- enum fwu_agent_error_t fwu_stage_nv_counter(enum fwu_nv_counter_index_t index,
-         uint32_t img_security_cnt);
- 
-+/*
-+ * Check if both metadata replica is valid by calculating and comparing crc32.
-+ * If one of the replica is corrupted then update it with the valid replica.
-+ * If both of the replicas are corrupted then the correction is not possible.
-+ */
-+enum fwu_agent_error_t fwu_metadata_check_and_correct_integrity(void);
-+
- #endif /* FWU_AGENT_H */
-- 
-2.25.1
-
@@ -1,38 +0,0 @@
-From 3a53a6ad7b91770a8514082e411e277c03764eb0 Mon Sep 17 00:00:00 2001
-From: Emekcan Aras <emekcan.aras@arm.com>
-Date: Wed, 9 Aug 2023 17:16:03 +0100
-Subject: [PATCH] Revert ADAC cert and token version
-
-Align ADAC certificate versions with versions in secure-debug-manager
-[1] repository. The versions of the certificate and token are checked
-during the authentication process. The debugger connection is refused
-if there is a mismatch between the sent certificate/token and expected
-certificate/token versions.
-
-[1] https://github.com/ARM-software/secure-debug-manager/tree/master
-
-Signed-off-by: Emekcan Aras <emekcan.aras@arm.com>
-Upstream-Status: Inappropriate [Add newer dummy token and cert]
---
- psa-adac/core/include/psa_adac.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/psa-adac/core/include/psa_adac.h b/psa-adac/core/include/psa_adac.h
-index b190992..6c3feb2 100644
--- a/psa-adac/core/include/psa_adac.h
-+++ b/psa-adac/core/include/psa_adac.h
-@@ -30,8 +30,8 @@ extern "C" {
-  *
-  * Current version numbers for certificate and token format.
-  */
-#define ADAC_CERT_MAJOR 1u
-#define ADAC_CERT_MINOR 0u
-+#define ADAC_CERT_MAJOR 0u
-+#define ADAC_CERT_MINOR 1u
- #define ADAC_TOKEN_MAJOR 1u
- #define ADAC_TOKEN_MINOR 0u
- 
-- 
-2.25.1
-
-
@@ -1,35 +0,0 @@
-From af71103845498eef4f859deba4b904a195f2817f Mon Sep 17 00:00:00 2001
-From: Bence Balogh <bence.balogh@arm.com>
-Date: Mon, 22 Jul 2024 17:33:23 +0200
-Subject: [PATCH] ADAC: Link psa_interface instead of tfm_sprt
-
-The tfm_sprt brings in other functionalities that are not needed for
-the Secure Debug.
-
-The printf() override in tfm_sp_log_raw.c can cause problems because
-it calls tfm_hal_output_sp_log() which triggers an SVC. The SVC calls
-tfm_hal_output_spm_log which relies on an SPM, which might not be
-initialized at that point.
-
-Signed-off-by: Bence Balogh <bence.balogh@arm.com>
-Upstream-Status: Pending [Not submitted to upstream yet]
---
- psa_crypto/CMakeLists.txt | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/psa_crypto/CMakeLists.txt b/psa_crypto/CMakeLists.txt
-index 3e70624..58d95f7 100644
--- a/psa_crypto/CMakeLists.txt
-+++ b/psa_crypto/CMakeLists.txt
-@@ -18,7 +18,7 @@ target_sources(psa_adac_psa_crypto
- target_link_libraries(psa_adac_psa_crypto
-     PRIVATE
-         psa_adac_config
-        tfm_sprt
-+        psa_interface
- )
- 
- target_link_libraries(trusted-firmware-m-psa-adac
-- 
-2.25.1
-
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`basic-mmio-gpio: Failed to locate of_node [id: -2]`