Initial commit

meta-arm/.gitignore

@@ -0,0 +1,2 @@
+__pycache__
+build

meta-arm/.gitlab-ci.yml

@@ -0,0 +1,305 @@
+image: ghcr.io/siemens/kas/kas:3.3
+
+variables:
+  CPU_REQUEST: ""
+  DEFAULT_TAG: ""
+  CACHE_DIR: $CI_BUILDS_DIR/persist
+  # These are needed as the k8s executor doesn't respect the container entrypoint
+  # by default
+  FF_KUBERNETES_HONOR_ENTRYPOINT: 1
+  FF_USE_LEGACY_KUBERNETES_EXECUTION_STRATEGY: 0
+
+stages:
+  - prep
+  - build
+
+# Common job fragment to get a worker ready
+.setup:
+  tags:
+    - $DEFAULT_TAG
+  stage: build
+  interruptible: true
+  variables:
+    KAS_WORK_DIR: $CI_PROJECT_DIR/work
+    KAS_REPO_REF_DIR: $CACHE_DIR/repos
+    SSTATE_DIR: $CACHE_DIR/sstate
+    DL_DIR: $CACHE_DIR/downloads
+    BB_LOGCONFIG: $CI_PROJECT_DIR/ci/logging.yml
+    TOOLCHAIN_DIR: $CACHE_DIR/toolchains
+    IMAGE_DIR: $CI_PROJECT_DIR/work/build/tmp/deploy/images
+    TOOLCHAIN_LINK_DIR: $CI_PROJECT_DIR/work/build/toolchains
+  before_script:
+    - echo KAS_WORK_DIR = $KAS_WORK_DIR
+    - echo SSTATE_DIR = $SSTATE_DIR
+    - echo DL_DIR = $DL_DIR
+    - rm -rf $KAS_WORK_DIR
+    - mkdir --verbose --parents $KAS_WORK_DIR $KAS_REPO_REF_DIR $SSTATE_DIR $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
+    # Must do this here, as it's the only way to make sure the toolchain is installed on the same builder
+    - ./ci/get-binary-toolchains $DL_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
+
+# Generalised fragment to do a Kas build
+.build:
+  extends: .setup
+  variables:
+    KUBERNETES_CPU_REQUEST: $CPU_REQUEST
+  rules:
+    # Don't run MR pipelines
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      when: never
+    # Don't run pipelines for tags
+    - if: $CI_COMMIT_TAG
+      when: never
+    # Don't run if BUILD_ENABLE_REGEX is set, but the job doesn't match the regex
+    - if: '$BUILD_ENABLE_REGEX != null && $CI_JOB_NAME !~ $BUILD_ENABLE_REGEX'
+      when: never
+    # Allow the dev kernels to fail and not fail the overall build
+    - if: '$KERNEL == "linux-yocto-dev"'
+      allow_failure: true
+    # Catch all for everything else
+    - if: '$KERNEL != "linux-yocto-dev"'
+  script:
+    - KASFILES=$(./ci/jobs-to-kas "$CI_JOB_NAME"):lockfile.yml
+    - kas dump --update --force-checkout --resolve-refs --resolve-env $KASFILES
+    - kas build $KASFILES
+    - ./ci/check-warnings $KAS_WORK_DIR/build/warnings.log
+  artifacts:
+    name: "logs"
+    when: always
+    paths:
+      - $CI_PROJECT_DIR/work/build/tmp/work*/**/temp/log.do_*.*
+      - $CI_PROJECT_DIR/work/build/tmp/work*/**/testimage/*
+
+#
+# Prep stage, update repositories once.
+# Set the CI variable CI_CLEAN_REPOS=1 to refetch the respositories from scratch
+#
+update-repos:
+  extends: .setup
+  stage: prep
+  script:
+    - |
+      flock --verbose --timeout 60 $KAS_REPO_REF_DIR ./ci/update-repos
+      # Only generate if doesn't already exist, to allow feature branches to drop one in.
+      if test -f lockfile.yml; then
+        echo Using existing lockfile.yml
+      else
+        # Be sure that this is the complete list of layers being fetched
+        kas dump --lock --update ci/qemuarm64.yml:ci/meta-openembedded.yml:ci/clang.yml:ci/meta-virtualization.yml | tee lockfile.yml
+      fi
+  artifacts:
+    name: "lockfile"
+    paths:
+      - lockfile.yml
+
+#
+# Build stage, the actual build jobs
+#
+# Available options for building are
+#  DISTRO: [poky, poky-tiny]
+#  KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+#  TOOLCHAINS: [gcc, clang, external-gccarm]
+#  TCLIBC: [glibc, musl]
+#  FIRMWARE: [u-boot, edk2]
+#  TS: [none, trusted-services]
+#  VIRT: [none, xen]
+#  TESTING: testimage
+
+corstone500:
+  extends: .build
+  parallel:
+    matrix:
+      - TESTING: testimage
+  tags:
+    - x86_64
+
+corstone1000-fvp:
+  extends: .build
+  parallel:
+    matrix:
+      - TESTING: [testimage, tftf]
+  tags:
+    - x86_64
+
+corstone1000-mps3:
+  extends: .build
+
+fvp-base:
+  extends: .build
+  parallel:
+    matrix:
+      - TESTING: testimage
+      - FIRMWARE: edk2
+
+fvp-baser-aemv8r64:
+  extends: .build
+  parallel:
+    matrix:
+      - TESTING: testimage
+  tags:
+    - x86_64
+
+fvps:
+  extends: .build
+
+generic-arm64:
+  extends: .build
+
+juno:
+  extends: .build
+  parallel:
+    matrix:
+      - TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+
+musca-b1:
+  extends: .build
+
+musca-s1:
+  extends: .build
+
+n1sdp:
+  extends: .build
+  parallel:
+    matrix:
+      - TS: [none, n1sdp-ts]
+
+qemu-generic-arm64:
+  extends: .build
+  parallel:
+    matrix:
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        TESTING: testimage
+
+qemuarm64-secureboot:
+  extends: .build
+  parallel:
+    matrix:
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        TCLIBC: [glibc, musl]
+        TS: [none, qemuarm64-secureboot-ts]
+        TESTING: testimage
+
+qemuarm64:
+  extends: .build
+  parallel:
+    matrix:
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+        TESTING: testimage
+      - DISTRO: poky-tiny
+        TESTING: testimage
+      - VIRT: xen
+
+qemuarm-secureboot:
+  extends: .build
+  parallel:
+    matrix:
+      - KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        TCLIBC: [glibc, musl]
+        TESTING: testimage
+      - TOOLCHAINS: external-gccarm
+        TESTING: testimage
+
+qemuarm:
+  extends: .build
+  parallel:
+    matrix:
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TOOLCHAINS: [gcc, clang]
+        FIRMWARE: [u-boot, edk2]
+        TESTING: testimage
+      - DISTRO: poky-tiny
+        TESTING: testimage
+      - VIRT: xen
+
+qemuarmv5:
+  extends: .build
+  parallel:
+    matrix:
+      - DISTRO: poky
+        KERNEL: [linux-yocto, linux-yocto-dev, linux-yocto-rt]
+        TESTING: testimage
+      - DISTRO: poky-tiny
+        TESTING: testimage
+
+sgi575:
+  extends: .build
+
+tc1:
+  extends: .build
+  parallel:
+    matrix:
+      - TESTING: testimage
+  tags:
+    - x86_64
+
+toolchains:
+  extends: .build
+
+selftest:
+  extends: .setup
+  script:
+    - KASFILES=./ci/qemuarm64.yml:./ci/selftest.yml:lockfile.yml
+    - kas shell --update --force-checkout $KASFILES -c 'oe-selftest --num-processes 1 --run-tests runfvp'
+
+# Validate layers are Yocto Project Compatible
+check-layers:
+  extends: .setup
+  script:
+    - kas shell --update --force-checkout ci/base.yml:ci/meta-openembedded.yml:lockfile.yml --command \
+      "yocto-check-layer-wrapper $CI_PROJECT_DIR/$LAYER --dependency $CI_PROJECT_DIR/meta-* $KAS_WORK_DIR/meta-openembedded/meta-oe --no-auto-dependency"
+  parallel:
+    matrix:
+      - LAYER: [meta-arm, meta-arm-bsp, meta-arm-toolchain]
+
+pending-updates:
+  extends: .setup
+  artifacts:
+    paths:
+      - update-report
+  script:
+    - rm -fr update-report
+    # This configuration has all of the layers we need enabled
+    - kas shell --update --force-checkout ci/qemuarm64.yml:ci/meta-openembedded.yml:lockfile.yml --command \
+      "$CI_PROJECT_DIR/scripts/machine-summary.py -t report -o $CI_PROJECT_DIR/update-report $($CI_PROJECT_DIR/ci/listmachines.py meta-arm meta-arm-bsp)"
+  # Do this on x86 whilst the compilers are x86-only
+  tags:
+    - x86_64
+
+# What percentage of machines in the layer do we build
+machine-coverage:
+  extends: .setup
+  script:
+    - ./ci/check-machine-coverage
+  coverage: '/Coverage: \d+/'
+
+metrics:
+  extends: .setup
+  artifacts:
+    reports:
+      metrics: metrics.txt
+  script:
+    - kas shell --update --force-checkout ci/base.yml --command \
+      "$CI_PROJECT_DIR/ci/patchreview $CI_PROJECT_DIR/meta-* --verbose --metrics $CI_PROJECT_DIR/metrics.txt"
+
+documentation:
+  extends: .setup
+  script:
+    - |
+      sudo pip3 install -r meta-arm-bsp/documentation/requirements.txt
+      for CONF in meta-*/documentation/*/conf.py ; do
+        echo Building $CONF...
+        SOURCE_DIR=$(dirname $CONF)
+        MACHINE=$(basename $SOURCE_DIR)
+        sphinx-build -vW $SOURCE_DIR build-docs/$MACHINE
+      done
+      test -d build-docs/
+  artifacts:
+    paths:
+      - build-docs/

meta-arm/COPYING.MIT

@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

meta-arm/README.md

@@ -0,0 +1,64 @@
+Introduction
+------------
+This repository contains the Arm layers for OpenEmbedded.
+
+* meta-arm
+
+  This layer contains general recipes for the Arm architecture, such as firmware, FVPs, and Arm-specific integration.
+
+* meta-arm-autonomy
+
+  This layer is the distribution for a reference stack for autonomous systems.
+
+* meta-arm-bsp
+
+  This layer contains machines for Arm reference platforms, for example FVP Base, N1SDP, and Juno.
+
+* meta-arm-toolchain
+
+  This layer contains recipes for Arm's binary toolchains (GCC and Clang for -A and -M), and a recipe to build Arm's GCC.
+
+Other Directories
+-----------------
+
+* ci
+
+  This directory contains gitlab continuous integration configuration files (KAS yaml files) as well as scripts needed for this
+
+* kas
+
+  This directory contains KAS yaml files to describe builds for systems not used in CI
+
+* scripts
+
+  This directory contains scripts used in running the CI tests
+
+Contributing
+------------
+Currently, we only accept patches from the meta-arm mailing list.  For general
+information on how to submit a patch, please read
+https://www.openembedded.org/wiki/How_to_submit_a_patch_to_OpenEmbedded
+
+E-mail meta-arm@lists.yoctoproject.org with patches created using this process. You can configure git-send-email to automatically use this address for the meta-arm repository with the following git command:
+
+$ git config --local --add sendemail.to meta-arm@lists.yoctoproject.org
+
+Commits and patches added should follow the OpenEmbedded patch guidelines:
+
+https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
+
+The component being changed in the shortlog should be prefixed with the layer name (without the meta- prefix), for example:
+
+  arm-bsp/trusted-firmware-a: decrease frobbing level
+
+  arm-toolchain/gcc: enable foobar v2
+
+Reporting bugs
+--------------
+E-mail meta-arm@lists.yoctoproject.org with the error encountered and the steps
+to reproduce the issue.
+
+Maintainer(s)
+-------------
+* Jon Mason <jon.mason@arm.com>
+* Ross Burton <ross.burton@arm.com>

meta-arm/ci/base.yml

@@ -0,0 +1,43 @@
+header:
+  version: 14
+
+distro: poky
+
+defaults:
+  repos:
+    branch: master
+
+repos:
+  meta-arm:
+    layers:
+      meta-arm:
+      meta-arm-bsp:
+      meta-arm-toolchain:
+
+  poky:
+    url: https://git.yoctoproject.org/git/poky
+    layers:
+      meta:
+      meta-poky:
+
+env:
+  BB_LOGCONFIG: ""
+  TOOLCHAIN_DIR: ""
+
+local_conf_header:
+  base: |
+    CONF_VERSION = "2"
+  setup: |
+    PACKAGE_CLASSES = "package_ipk"
+    PACKAGECONFIG:remove:pn-qemu-system-native = "gtk+ sdl"
+    PACKAGECONFIG:append:pn-perf = " coresight"
+    INHERIT += "rm_work"
+    DISTRO_FEATURES:remove = "ptest"
+  extrapackages: |
+    CORE_IMAGE_EXTRA_INSTALL += "perf opencsd"
+    CORE_IMAGE_EXTRA_INSTALL:append:aarch64 = " gator-daemon"
+
+machine: unset
+
+target:
+  - core-image-sato

meta-arm/ci/check-machine-coverage

@@ -0,0 +1,28 @@
+#! /usr/bin/env python3
+
+from pathlib import Path
+import sys
+from listmachines import list_machines
+
+metaarm = Path.cwd()
+
+if metaarm.name != "meta-arm":
+    print("Not running inside meta-arm")
+    sys.exit(1)
+
+# Find all layers
+layers = (p.name for p in metaarm.glob("meta-*") if p.is_dir())
+# All machine configurations
+machines = list_machines(layers)
+
+# All kas files
+kas = metaarm.glob("ci/*.yml")
+kas = set(p.stem for p in kas)
+
+missing = machines - kas
+print(f"The following machines are missing: {', '.join(sorted(missing))}.")
+
+covered = len(machines) - len(missing)
+total = len(machines)
+percent = int(covered / total * 100)
+print(f"Coverage: {percent}%")

meta-arm/ci/check-warnings

@@ -0,0 +1,19 @@
+#! /bin/bash
+
+# Expects the path to a log file as $1, and if this file has any content
+# then display the contents and exit with an error code.
+
+set -e -u
+
+LOGFILE=$1
+
+LINES=$(grep --invert-match "attempting MIRRORS if available" $LOGFILE | wc -l)
+if test "$LINES" -ne 0; then
+    echo ==============================
+    echo The build had warnings/errors:
+    echo ==============================
+    cat $LOGFILE
+    exit 1
+fi
+
+exit 0

meta-arm/ci/clang.yml

@@ -0,0 +1,19 @@
+header:
+  version: 14
+
+repos:
+  meta-clang:
+    url: https://github.com/kraj/meta-clang
+
+local_conf_header:
+  toolchain: |
+    TOOLCHAIN = "clang"
+    PREFERRED_PROVIDER_llvm = "clang"
+    PREFERRED_PROVIDER_llvm-native = "clang-native"
+    PREFERRED_PROVIDER_nativesdk-llvm = "nativesdk-clang"
+    PROVIDES:pn-clang = "llvm"
+    PROVIDES:pn-clang-native = "llvm-native"
+    PROVIDES:pn-nativesdk-clang = "nativesdk-llvm"
+    # This is needed to stop bitbake getting confused about what clang/llvm is
+    # being used, see https://github.com/kraj/meta-clang/pull/766
+    BBMASK += "/meta/recipes-devtools/llvm/llvm.*\.bb"

meta-arm/ci/corstone1000-common.yml

@@ -0,0 +1,14 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/meta-openembedded.yml
+    - ci/poky-tiny.yml
+
+local_conf_header:
+    extrapackages: |
+    # Intentionally blank to prevent perf from being added to the image in base.yml
+
+target:
+  - corstone1000-image
+  - perf

meta-arm/ci/corstone1000-fvp.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+  includes:
+    - ci/corstone1000-common.yml
+    - ci/fvp.yml
+
+local_conf_header:
+    fvp-config: |
+        # Remove Dropbear SSH as it will not fit into the corstone1000 image.
+        IMAGE_FEATURES:remove = " ssh-server-dropbear"
+
+machine: corstone1000-fvp

meta-arm/ci/corstone1000-mps3.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/corstone1000-common.yml
+
+machine: corstone1000-mps3

meta-arm/ci/corstone500.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/fvp.yml
+    - ci/poky-tiny.yml
+
+local_conf_header:
+  fvp-config: |
+    IMAGE_FEATURES:remove = " ssh-server-dropbear"
+
+machine: corstone500

meta-arm/ci/debug.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+# Add universally helpful features when testing boards
+local_conf_header:
+  debug: |
+    EXTRA_IMAGE_FEATURES:append = " debug-tweaks"

meta-arm/ci/download-lockfile.py

@@ -0,0 +1,31 @@
+#! /usr/bin/env python3
+
+"""
+Download the lockfile.yml produced by a CI pipeline, specified by the GitLab
+server, full name of the meta-arm project, and the refspec that was executed.
+
+For example,
+$ ./download-lockfile.py https://gitlab.com/ rossburton/meta-arm master
+
+SPDX-FileCopyrightText: Copyright 2023 Arm Limited and Contributors
+SPDX-License-Identifier: GPL-2.0-only
+"""
+
+import argparse
+import gitlab
+import io
+import zipfile
+
+parser = argparse.ArgumentParser()
+parser.add_argument("server", help="GitLab server name")
+parser.add_argument("project", help="meta-arm project name")
+parser.add_argument("refspec", help="Branch/commit")
+args = parser.parse_args()
+
+gl = gitlab.Gitlab(args.server)
+project = gl.projects.get(args.project)
+artefact = project.artifacts.download(ref_name=args.refspec, job="update-repos")
+
+z = zipfile.ZipFile(io.BytesIO(artefact))
+z.extract("lockfile.yml")
+print("Fetched lockfile.yml")

meta-arm/ci/edk2.yml

@@ -0,0 +1,17 @@
+header:
+  version: 14
+
+local_conf_header:
+  bootfirmware: |
+    PREFERRED_PROVIDER_virtual/bootloader = "edk2-firmware"
+    MACHINE_FEATURES += "efi"
+    TFA_UBOOT = "0"
+    TFA_UEFI = "1"
+
+    EXTRA_IMAGEDEPENDS += "edk2-firmware"
+    EFI_PROVIDER ?= "grub-efi"
+
+    QB_DEFAULT_BIOS = "QEMU_EFI.fd"
+    WKS_FILE ?= "efi-disk.wks.in"
+  failing_tests: |
+    TEST_SUITES:remove = "xorg"

meta-arm/ci/external-gccarm.yml

@@ -0,0 +1,8 @@
+header:
+  version: 14
+
+local_conf_header:
+  cc: |
+    SKIP_RECIPE[gcc-cross-arm] = "Using external toolchain"
+    TCMODE = "external-arm"
+    EXTERNAL_TOOLCHAIN = "${TOPDIR}/toolchains/${TARGET_ARCH}"

meta-arm/ci/fvp-base.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/fvp.yml
+
+machine: fvp-base

meta-arm/ci/fvp-baser-aemv8r64.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/fvp.yml
+
+machine: fvp-baser-aemv8r64

meta-arm/ci/fvp.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+
+local_conf_header:
+  testimagefvp: |
+    LICENSE_FLAGS_ACCEPTED += "Arm-FVP-EULA"
+    INHERIT += "fvpboot"
+  failing_tests: |
+    # This fails but we can't add to the ignorelist from meta-arm yet
+    # https://bugzilla.yoctoproject.org/show_bug.cgi?id=14604
+    TEST_SUITES:remove = "parselogs"
+    TEST_SUITES:remove = "xorg"

meta-arm/ci/fvps.yml

@@ -0,0 +1,22 @@
+# Simple target to build the FVPs that are publically available
+
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarm64
+
+local_conf_header:
+  license: |
+    LICENSE_FLAGS_ACCEPTED += "Arm-FVP-EULA"
+  sdk: |
+    SDKMACHINE = "x86_64"
+
+target:
+  - nativesdk-fvp-base-a-aem
+  - nativesdk-fvp-corstone500
+  - nativesdk-fvp-corstone1000
+  - nativesdk-fvp-n1-edge
+  - nativesdk-fvp-sgi575
+  - nativesdk-fvp-tc1

meta-arm/ci/gcc.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  toolchain: |
+    TOOLCHAIN = "gcc"

meta-arm/ci/generic-arm64.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: generic-arm64

meta-arm/ci/get-binary-toolchains

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -u -e
+
+BASENAME=arm-gnu-toolchain
+VER=${VER:-12.2.rel1}
+HOST_ARCH=${HOST_ARCH:-$(uname -m)}
+
+DOWNLOAD_DIR=$1
+TOOLCHAIN_DIR=$2
+TOOLCHAIN_LINK_DIR=$3
+
+# These should be already created by .gitlab-ci.yml, but do here if run outside of that env
+mkdir -p $DOWNLOAD_DIR $TOOLCHAIN_DIR $TOOLCHAIN_LINK_DIR
+
+download() {
+	TRIPLE=$1
+	URL=https://developer.arm.com/-/media/Files/downloads/gnu/$VER/binrel/$BASENAME-$VER-$HOST_ARCH-$TRIPLE.tar.xz
+	wget -P $DOWNLOAD_DIR -nc $URL
+}
+
+if [ $HOST_ARCH = "aarch64" ]; then
+	# AArch64 Linux hosted cross compilers
+
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf
+elif [ $HOST_ARCH = "x86_64" ]; then
+	# x86_64 Linux hosted cross compilers
+
+	# AArch32 target with hard float
+	download arm-none-linux-gnueabihf
+
+	# AArch64 GNU/Linux target
+	download aarch64-none-linux-gnu
+else
+	echo "ERROR - Unknown build arch of $HOST_ARCH"
+	exit 1
+fi
+
+for i in arm aarch64; do
+	if [ ! -d $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*/ ]; then
+		if [ ! -f $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz ]; then
+			continue
+		fi
+
+		tar -C $TOOLCHAIN_DIR -axvf $DOWNLOAD_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu*.tar.xz
+	fi
+
+	# Setup a link for the toolchain to use local to the building machine (e.g., not in a shared location)
+	ln -s $TOOLCHAIN_DIR/$BASENAME-$VER-$HOST_ARCH-$i-none-linux-gnu* $TOOLCHAIN_LINK_DIR/$i
+done

meta-arm/ci/glibc.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  libc: |
+    TCLIBC = "glibc"

meta-arm/ci/jobs-to-kas

@@ -0,0 +1,27 @@
+#! /bin/bash
+
+# This script is expecting an input of machine name, optionally followed by a
+# colon and a list of one or more parameters separated by commas between
+# brackets.  For example, the following are acceptable:
+# corstone500
+# fvp-base: [testimage]
+# qemuarm64-secureboot: [clang, glibc, testimage]
+#
+# Turn this list into a series of yml files separated by colons to pass to kas
+
+set -e -u
+
+FILES="ci/$(echo $1 | cut -d ':' -f 1).yml"
+
+for i in $(echo $1 | cut -s -d ':' -f 2 | sed 's/[][,]//g'); do
+	# Given that there are no yml files for gcc or glibc, as those are the
+	# defaults, we can simply ignore those parameters.  They are necessary
+	# to pass in so that matrix can correctly setup all of the permutations
+	# of each individual run.
+	if [[ $i == 'none' ]]; then
+		continue
+	fi
+	FILES+=":ci/$i.yml"
+done
+
+echo $FILES

meta-arm/ci/juno.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: juno

meta-arm/ci/linux-yocto-dev.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-dev"

meta-arm/ci/linux-yocto-rt.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-rt"

meta-arm/ci/linux-yocto.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+#NOTE: This is the default for poky.  This is only being added for completeness/clarity
+local_conf_header:
+  kernel: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto"

meta-arm/ci/listmachines.py

@@ -0,0 +1,29 @@
+#! /usr/bin/env python3
+
+import pathlib
+import typing
+import sys
+
+"""
+List all of the machines available under the listed sub-layers of meta-arm.
+"""
+def list_machines(layers: typing.Sequence[str]) -> typing.Set[str]:
+    machines = set()
+
+    # We know we're in meta-arm/scripts, so find the top-level directory
+    metaarm = pathlib.Path(__file__).resolve().parent.parent
+    if metaarm.name != "meta-arm":
+        raise Exception("Not running inside meta-arm")
+    
+    for layer in layers:
+        machines |= set(p.stem for p in (metaarm / layer / "conf" / "machine").glob("*.conf"))
+    return machines
+
+if __name__ == "__main__":
+    if len(sys.argv) > 1:
+        machines = list_machines(sys.argv[1:])
+        print(" ".join(sorted(machines)))
+        sys.exit(0)
+    else:
+        print("Usage:\n$ %s [layer name ...] " % sys.argv[0])
+        sys.exit(1)

meta-arm/ci/logging.yml

@@ -0,0 +1,13 @@
+# Python logging configuration to write all warnings to a separate file
+version: 1
+
+handlers:
+  warnings:
+    class: logging.FileHandler
+    level: WARNING
+    filename: warnings.log
+    formatter: BitBake.logfileFormatter
+
+loggers:
+  BitBake:
+    handlers: [warnings]

meta-arm/ci/meta-openembedded.yml

@@ -0,0 +1,11 @@
+header:
+  version: 14
+
+repos:
+  meta-openembedded:
+    url: https://git.openembedded.org/meta-openembedded
+    layers:
+      meta-filesystems:
+      meta-networking:
+      meta-oe:
+      meta-python:

meta-arm/ci/meta-virtualization.yml

@@ -0,0 +1,8 @@
+header:
+  version: 14
+  includes:
+    - ci/meta-openembedded.yml
+
+repos:
+  meta-virtualization:
+    url: git://git.yoctoproject.org/meta-virtualization

meta-arm/ci/musca-b1.yml

@@ -0,0 +1,10 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/meta-openembedded.yml
+
+machine: musca-b1
+
+target:
+  - trusted-firmware-m

meta-arm/ci/musca-s1.yml

@@ -0,0 +1,10 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/meta-openembedded.yml
+
+machine: musca-s1
+
+target:
+  - trusted-firmware-m

meta-arm/ci/musl.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+
+local_conf_header:
+  libc: |
+    TCLIBC = "musl"

meta-arm/ci/n1sdp-ts.yml

@@ -0,0 +1,14 @@
+header:
+  version: 14
+  includes:
+    - ci/meta-openembedded.yml
+
+local_conf_header:
+  trusted_services: |
+    TEST_SUITES:append = " trusted_services"
+    # Include TS Crypto, TS Protected Storage, TS Internal and Trusted Storage SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its"
+    # Include TS demo/test tools into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests"
+    # Include TS PSA Arch tests into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"

meta-arm/ci/n1sdp.yml

@@ -0,0 +1,10 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: n1sdp
+
+local_conf_header:
+  unsupported_trusted_services: |
+    MACHINE_FEATURES:remove = "ts-smm-gateway"

meta-arm/ci/patchreview

@@ -0,0 +1,286 @@
+#! /usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-only
+#
+
+# TODO
+# - option to just list all broken files
+# - test suite
+# - validate signed-off-by
+
+import argparse
+import collections
+import json
+import os
+import re
+import subprocess
+
+status_values = (
+    "accepted",
+    "pending",
+    "inappropriate",
+    "backport",
+    "submitted",
+    "denied",
+)
+
+
+class PatchResult:
+    # Whether the patch has an Upstream-Status or not
+    missing_upstream_status = False
+    # If the Upstream-Status tag is malformed in some way (string for bad bit)
+    malformed_upstream_status = None
+    # If the Upstream-Status value is unknown (boolean)
+    unknown_upstream_status = False
+    # The upstream status value (Pending, etc)
+    upstream_status = None
+    # Whether the patch has a Signed-off-by or not
+    missing_sob = False
+    # Whether the Signed-off-by tag is malformed in some way
+    malformed_sob = False
+    # The Signed-off-by tag value
+    sob = None
+    # Whether a patch looks like a CVE but doesn't have a CVE tag
+    missing_cve = False
+
+
+class Summary:
+    total = 0
+    cve_missing = 0
+    sob_missing = 0
+    sob_malformed = 0
+    status_missing = 0
+    status_malformed = 0
+    status_pending = 0
+
+def blame_patch(patch):
+    """
+    From a patch filename, return a list of "commit summary (author name <author
+    email>)" strings representing the history.
+    """
+    return subprocess.check_output(("git", "log",
+                                    "--follow", "--find-renames", "--diff-filter=A",
+                                    "--format=%s (%aN <%aE>)",
+                                    "--", patch)).decode("utf-8").splitlines()
+
+def patchreview(patches):
+    # General pattern: start of line, optional whitespace, tag with optional
+    # hyphen or spaces, maybe a colon, some whitespace, then the value, all case
+    # insensitive.
+    sob_re = re.compile(r"^[\t ]*(Signed[-_ ]off[-_ ]by:?)[\t ]*(.+)", re.IGNORECASE | re.MULTILINE)
+    status_re = re.compile(r"^[\t ]*(Upstream[-_ ]Status:?)[\t ]*(\w*)", re.IGNORECASE | re.MULTILINE)
+    cve_tag_re = re.compile(r"^[\t ]*(CVE:)[\t ]*(.*)", re.IGNORECASE | re.MULTILINE)
+    cve_re = re.compile(r"cve-[0-9]{4}-[0-9]{4,6}", re.IGNORECASE)
+
+    results = {}
+
+    for patch in patches:
+
+        result = PatchResult()
+        results[patch] = result
+
+        content = open(patch, encoding="ascii", errors="ignore").read()
+
+        # Find the Signed-off-by tag
+        match = sob_re.search(content)
+        if match:
+            value = match.group(1)
+            if value != "Signed-off-by:":
+                result.malformed_sob = value
+            result.sob = match.group(2)
+        else:
+            result.missing_sob = True
+
+        # Find the Upstream-Status tag
+        match = status_re.search(content)
+        if match:
+            value = match.group(1)
+            if value != "Upstream-Status:":
+                result.malformed_upstream_status = value
+
+            value = match.group(2).lower()
+            # TODO: check case
+            if value not in status_values:
+                result.unknown_upstream_status = True
+            result.upstream_status = value
+        else:
+            result.missing_upstream_status = True
+
+        # Check that patches which looks like CVEs have CVE tags
+        if cve_re.search(patch) or cve_re.search(content):
+            if not cve_tag_re.search(content):
+                result.missing_cve = True
+        # TODO: extract CVE list
+
+    return results
+
+
+def analyse(results, want_blame=False, verbose=True):
+    """
+    want_blame: display blame data for each malformed patch
+    verbose: display per-file results instead of just summary
+    """
+
+    # want_blame requires verbose, so disable blame if we're not verbose
+    if want_blame and not verbose:
+        want_blame = False
+
+    summary = Summary()
+
+    for patch in sorted(results):
+        r = results[patch]
+        summary.total += 1
+        need_blame = False
+
+        # Build statistics
+        if r.missing_sob:
+            summary.sob_missing += 1
+        if r.malformed_sob:
+            summary.sob_malformed += 1
+        if r.missing_upstream_status:
+            summary.status_missing += 1
+        if r.malformed_upstream_status or r.unknown_upstream_status:
+            summary.status_malformed += 1
+            # Count patches with no status as pending
+            summary.status_pending += 1
+        if r.missing_cve:
+            summary.cve_missing += 1
+        if r.upstream_status == "pending":
+            summary.status_pending += 1
+
+        # Output warnings
+        if r.missing_sob:
+            need_blame = True
+            if verbose:
+                print("Missing Signed-off-by tag (%s)" % patch)
+        if r.malformed_sob:
+            need_blame = True
+            if verbose:
+                print("Malformed Signed-off-by '%s' (%s)" % (r.malformed_sob, patch))
+        if r.missing_cve:
+            need_blame = True
+            if verbose:
+                print("Missing CVE tag (%s)" % patch)
+        if r.missing_upstream_status:
+            need_blame = True
+            if verbose:
+                print("Missing Upstream-Status tag (%s)" % patch)
+        if r.malformed_upstream_status:
+            need_blame = True
+            if verbose:
+                print("Malformed Upstream-Status '%s' (%s)" % (r.malformed_upstream_status, patch))
+        if r.unknown_upstream_status:
+            need_blame = True
+            if verbose:
+                print("Unknown Upstream-Status value '%s' (%s)" % (r.upstream_status, patch))
+
+        if want_blame and need_blame:
+            print("\n".join(blame_patch(patch)) + "\n")
+
+    return summary
+
+
+def display_summary(summary, verbose):
+    def percent(num):
+        try:
+            return "%d (%d%%)" % (num, round(num * 100.0 / summary.total))
+        except ZeroDivisionError:
+            return "N/A"
+
+    if verbose:
+        print()
+
+    print("""Total patches found: %d
+Patches missing Signed-off-by: %s
+Patches with malformed Signed-off-by: %s
+Patches missing CVE: %s
+Patches missing Upstream-Status: %s
+Patches with malformed Upstream-Status: %s
+Patches in Pending state: %s""" % (summary.total,
+                                   percent(summary.sob_missing),
+                                   percent(summary.sob_malformed),
+                                   percent(summary.cve_missing),
+                                   percent(summary.status_missing),
+                                   percent(summary.status_malformed),
+                                   percent(summary.status_pending)))
+
+
+def generate_metrics(summary, output):
+    # https://github.com/OpenObservability/OpenMetrics/blob/main/specification/OpenMetrics.md
+    # Summary attribute name, MetricPoint help
+    mapping = (
+        ("total", "Total patches"),
+        ("cve_missing", "Patches missing CVE tag"),
+        ("sob_malformed", "Patches with malformed Signed-off-by"),
+        ("sob_missing", "Patches with missing Signed-off-by"),
+        ("status_malformed", "Patches with malformed Upstream-Status"),
+        ("status_missing", "Patches with missing Upstream-Status"),
+        ("status_pending", "Patches with Pending Upstream-Status")
+    )
+    for attr, help in mapping:
+        metric = f"patch_check_{attr}"
+        value = getattr(summary, attr)
+        output.write(f"""
+# TYPE {metric} gauge
+# HELP {help}
+{metric} {value}
+""")
+    output.write("\n# EOF\n")
+
+def histogram(results):
+    import math
+
+    from toolz import dicttoolz, recipes
+    counts = recipes.countby(lambda r: r.upstream_status, results.values())
+    bars = dicttoolz.valmap(lambda v: "#" * int(math.ceil(float(v) / len(results) * 100)), counts)
+    for k in bars:
+        print("%-20s %s (%d)" % (k.capitalize() if k else "No status", bars[k], counts[k]))
+
+def gather_patches(directories):
+    patches = []
+    for directory in directories:
+        filenames = subprocess.check_output(("git", "-C", directory, "ls-files", "recipes-*/**/*.patch", "recipes-*/**/*.diff")).decode("utf-8").split()
+        patches += [os.path.join(directory, f) for f in filenames]
+    return patches
+
+if __name__ == "__main__":
+    args = argparse.ArgumentParser(description="Patch Review Tool")
+    args.add_argument("-b", "--blame", action="store_true", help="show blame for malformed patches")
+    args.add_argument("-v", "--verbose", action="store_true", help="show per-patch results")
+    args.add_argument("-g", "--histogram", action="store_true", help="show patch histogram")
+    args.add_argument("-j", "--json", help="update JSON")
+    args.add_argument("-m", "--metrics", type=argparse.FileType('w'), help="write OpenMetrics")
+    args.add_argument("dirs", metavar="DIRECTORY", nargs="+", help="directory to scan")
+    args = args.parse_args()
+
+    patches = gather_patches(args.dirs)
+    results = patchreview(patches)
+    summary = analyse(results, want_blame=args.blame, verbose=args.verbose)
+    display_summary(summary, verbose=args.verbose)
+
+    if args.json:
+        if os.path.isfile(args.json):
+            data = json.load(open(args.json))
+        else:
+            data = []
+
+        row = collections.Counter()
+        row["total"] = len(results)
+        row["date"] = subprocess.check_output(["git", "-C", args.dirs[0], "show", "-s", "--pretty=format:%cd", "--date=format:%s"]).decode("utf-8").strip()
+        for r in results.values():
+            if r.upstream_status in status_values:
+                row[r.upstream_status] += 1
+            if r.malformed_upstream_status or r.missing_upstream_status:
+                row["malformed-upstream-status"] += 1
+            if r.malformed_sob or r.missing_sob:
+                row["malformed-sob"] += 1
+
+        data.append(row)
+        json.dump(data, open(args.json, "w"))
+
+    if args.metrics:
+        generate_metrics(summary, args.metrics)
+
+    if args.histogram:
+        print()
+        histogram(results)

meta-arm/ci/poky-tiny.yml

@@ -0,0 +1,14 @@
+header:
+  version: 14
+
+distro: poky-tiny
+
+local_conf_header:
+  hacking: |
+    TEST_SUITES = "ping"
+  extrapackages: |
+    # Intentionally blank to prevent perf from being added to the image in base.yml
+
+target:
+  - core-image-minimal
+  - perf

meta-arm/ci/poky.yml

@@ -0,0 +1,4 @@
+header:
+  version: 14
+
+distro: poky

meta-arm/ci/qemu-generic-arm64.yml

@@ -0,0 +1,14 @@
+header:
+  version: 14
+  includes:
+    - ci/generic-arm64.yml
+
+local_conf_header:
+  failing_tests: |
+    DEFAULT_TEST_SUITES:remove = "parselogs"
+
+machine: qemu-generic-arm64
+
+target:
+  - core-image-sato
+  - sbsa-acs

meta-arm/ci/qemuarm-secureboot.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarm-secureboot
+
+target:
+  - core-image-base
+  - optee-examples
+  - optee-test
+  - optee-os-tadevkit

meta-arm/ci/qemuarm.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarm

meta-arm/ci/qemuarm64-secureboot-ts.yml

@@ -0,0 +1,14 @@
+header:
+  version: 14
+  includes:
+    - ci/meta-openembedded.yml
+
+local_conf_header:
+  trusted_services: |
+    TEST_SUITES:append = " trusted_services"
+    # Include TS Crypto, TS Protected Storage, TS Internal Trusted Storage and SMM-Gateway SPs into optee-os image
+    MACHINE_FEATURES:append = " arm-ffa ts-crypto ts-storage ts-its ts-smm-gateway"
+    # Include TS demo/test tools into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests"
+    # Include TS PSA Arch tests into image
+    IMAGE_INSTALL:append = " packagegroup-ts-tests-psa"

meta-arm/ci/qemuarm64-secureboot.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarm64-secureboot
+
+target:
+  - core-image-base
+  - optee-examples
+  - optee-test
+  - optee-os-tadevkit

meta-arm/ci/qemuarm64.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarm64

meta-arm/ci/qemuarmv5.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: qemuarmv5

meta-arm/ci/selftest.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+local_conf_header:
+  setup: |
+    BB_LOGCONFIG = ""
+    SANITY_TESTED_DISTROS = ""

meta-arm/ci/sgi575.yml

@@ -0,0 +1,6 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+machine: sgi575

meta-arm/ci/tc1.yml

@@ -0,0 +1,12 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+    - ci/fvp.yml
+    - ci/meta-openembedded.yml
+
+machine: tc1
+
+target:
+  - core-image-minimal
+  - trusted-firmware-m

meta-arm/ci/testimage.yml

@@ -0,0 +1,21 @@
+header:
+  version: 14
+  includes:
+    - ci/debug.yml
+
+local_conf_header:
+  testimage: |
+    IMAGE_CLASSES += "testimage"
+    TESTIMAGE_AUTO = "1"
+  kvm: |
+    QEMU_USE_KVM = ""
+  slirp: |
+    TEST_RUNQEMUPARAMS = "slirp"
+    TEST_SERVER_IP = "127.0.0.1"
+    QEMU_USE_SLIRP = "1"
+  sshd: |
+    IMAGE_FEATURES:append = " ssh-server-dropbear"
+  sshkeys: |
+    CORE_IMAGE_EXTRA_INSTALL += "ssh-pregen-hostkeys"
+  universally_failing_tests: |
+    TEST_SUITES:remove = "opkg"

meta-arm/ci/tftf.yml

@@ -0,0 +1,7 @@
+header:
+  version: 14
+
+local_conf_header:
+  tftf: |
+    TFA_UBOOT = "0"
+    TFTF_TESTS = "1"

meta-arm/ci/toolchains.yml

@@ -0,0 +1,19 @@
+header:
+  version: 14
+  includes:
+    - ci/base.yml
+
+# Target is arm64 and SDK is x86-64 to ensure that we exercise both
+# architectures
+
+machine: qemuarm64
+local_conf_header:
+  toolchains: |
+    SDKMACHINE = "x86_64"
+
+target:
+  - gcc-aarch64-none-elf
+  - nativesdk-gcc-aarch64-none-elf
+  - gcc-arm-none-eabi
+  - nativesdk-gcc-arm-none-eabi
+  - nativesdk-androidclang

meta-arm/ci/u-boot.yml

@@ -0,0 +1,8 @@
+header:
+  version: 14
+
+local_conf_header:
+  bootfirmware: |
+    PREFERRED_PROVIDER_virtual/bootloader = "u-boot"
+    TFA_UBOOT = "1"
+    TFA_UEFI = "0"

meta-arm/ci/update-repos

@@ -0,0 +1,48 @@
+#! /usr/bin/env python3
+
+# Update clones of the repositories we need in KAS_REPO_REF_DIR to speed up fetches
+
+import sys
+import os
+import shutil
+import subprocess
+import pathlib
+
+def repo_shortname(url):
+    # Taken from Kas (Repo.__getattr__) to ensure the logic is right
+    from urllib.parse import urlparse
+    url = urlparse(url)
+    return ('{url.netloc}{url.path}'
+            .format(url=url)
+            .replace('@', '.')
+            .replace(':', '.')
+            .replace('/', '.')
+            .replace('*', '.'))
+
+repositories = (
+    "https://git.yoctoproject.org/git/poky",
+    "https://git.openembedded.org/meta-openembedded",
+    "https://git.yoctoproject.org/git/meta-virtualization",
+    "https://github.com/kraj/meta-clang",
+)
+
+if __name__ == "__main__":
+    if "KAS_REPO_REF_DIR" not in os.environ:
+        print("KAS_REPO_REF_DIR needs to be set")
+        sys.exit(1)
+
+    base_repodir = pathlib.Path(os.environ["KAS_REPO_REF_DIR"])
+
+    for repo in repositories:
+        repodir = base_repodir / repo_shortname(repo)
+
+        if "CI_CLEAN_REPOS" in os.environ:
+            print("Cleaning %s..." % repo)
+            shutil.rmtree(repodir, ignore_errors=True)
+
+        if repodir.exists():
+            print("Updating %s..." % repo)
+            subprocess.run(["git", "-C", repodir, "-c", "gc.autoDetach=false", "fetch"], check=True)
+        else:
+            print("Cloning %s..." % repo)
+            subprocess.run(["git", "clone", "--bare", repo, repodir], check=True)

meta-arm/ci/xen.yml

@@ -0,0 +1,11 @@
+header:
+  version: 14
+  includes:
+    - ci/meta-virtualization.yml
+
+local_conf_header:
+  meta-virt: |
+    DISTRO_FEATURES:append = " virtualization xen"
+
+target:
+  - xen-image-minimal

meta-arm/documentation/oeqa-fvp.md

@@ -0,0 +1,49 @@
+# OEQA on Arm FVPs
+
+OE-Core's [oeqa][OEQA] framework provides a method of performing runtime tests on machines using the `testimage` Yocto task. meta-arm has good support for writing test cases against [Arm FVPs][FVP], meaning the [runfvp][RUNFVP] boot configuration can be re-used.
+
+Tests can be configured to run automatically post-build by setting the variable `TESTIMAGE_AUTO="1"`, e.g. in your Kas file or local.conf.
+
+meta-arm provides the OEFVPTarget which must be set up in the machine configuration:
+```
+TEST_TARGET = "OEFVPTarget"
+TEST_SERVER_IP = "127.0.0.1"
+TEST_TARGET_IP = "127.0.0.1:8022"
+IMAGE_FEATURES:append = " ssh-server-dropbear"
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
+FVP_CONSOLES[default] = "terminal_0"
+FVP_CONSOLES[tf-a] = "s_terminal_0"
+```
+
+The test target also generates a log file with the prefix 'fvp_log' in the image recipe's `${WORKDIR}/testimage` containing the FVP's stdout.
+
+OEFVPTarget supports two different test interfaces - SSH and pexpect.
+
+## SSH
+
+As in OEQA in OE-core, tests cases can run commands on the machine using SSH. It therefore requires that an SSH server is installed in the image.
+
+This uses the `run` method on the target, e.g:
+```
+(status, output) = self.target.run('uname -a')
+```
+which executes a single command on the target (using `ssh -c`) and returns the status code and the output. It is therefore useful for running tests in a Linux environment.
+
+For examples of test cases, see meta/lib/oeqa/runtime/cases in OE-Core. The majority of test cases depend on `ssh.SSHTest.test_ssh`, which first validates that the SSH connection is functioning.
+
+## pexpect
+
+To support firmware and baremetal testing, OEFVPTarget also allows test cases to make assertions against one or more consoles using the pexpect library.
+
+Internally, this test target launches a [Pexpect][PEXPECT] instance for each entry in FVP_CONSOLES which can be used with the provided alias. The whole Pexpect API is exposed on the target, where the alias is always passed as the first argument, e.g.:
+```
+self.target.expect('default', r'root@.*\:~#', timeout=30)
+self.assertNotIn(b'ERROR:', self.target.before('tf-a'))
+```
+
+For an example of a full test case, see meta-arm/lib/oeqa/runtime/cases/linuxboot.py This test case can be used to minimally verify that a machine boots to a Linux shell. The default timeout is 10 minutes, but this can be configured with the variable TEST_FVP_LINUX_BOOT_TIMEOUT, which expects a value in seconds.
+
+[OEQA]: https://docs.yoctoproject.org/test-manual/intro.html
+[FVP]: https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
+[RUNFVP]: runfvp.md
+[PEXPECT]: https://pexpect.readthedocs.io/en/stable/overview.html

meta-arm/documentation/runfvp.md

@@ -0,0 +1,131 @@
+# Running Images with a FVP
+
+The `runfvp` tool in meta-arm makes it easy to run Yocto Project disk images inside a [Fixed Virtual Platform (FVP)][FVP].  Some FVPs, such as the [Arm Architecture Models][AEM], are available free to download, but others need registration or are only available commercially.  The `fvp-base` machine in meta-arm-bsp uses one of these AEM models.
+
+## Running images with `runfvp`
+
+To build images with the FVP integration, the `fvpboot` class needs to be inherited.  If the machine does not do this explicitly it can be done in `local.conf`:
+
+```
+INHERIT += "fvpboot"
+```
+
+The class will download the correct FVP and write a `.fvpconf` configuration file when an image is built.
+
+To run an image in a FVP, pass either a machine name or a `.fvpconf` path to `runfvp`.
+
+```
+$ ./meta-arm/scripts/runfvp tmp/deploy/images/fvp-base/core-image-minimal-fvp-base.fvpconf
+```
+
+When a machine name is passed, `runfvp` will start the latest image that has been built for that machine. This requires that the BitBake environment has been initialized (using `oe-init-build-env` or similar) as it will start BitBake to determine where the images are.
+
+```
+$ ./meta-arm/scripts/runfvp fvp-base
+```
+
+Note that currently meta-arm's `scripts` directory isn't in `PATH`, so a full path needs to be used.
+
+`runfvp` will automatically start terminals connected to each of the serial ports that the machine specifies.  This can be controlled by using the `--terminals` option, for example `--terminals=none` will mean no terminals are started, and `--terminals=tmux` will start the terminals in [`tmux`][tmux] sessions.  Alternatively, passing `--console` will connect the serial port directly to the current session, without needing to open further windows.
+
+The default terminal can also be configured by writing a [INI-style][INI] configuration file to `~/.config/runfvp.conf`:
+
+```
+[RunFVP]
+Terminal=tmux
+```
+
+Arbitrary options can be passed directly to the FVP by specifying them after a double dash, for example this will list all of the FVP parameters:
+
+```
+$ runfvp fvp-base -- --list-params
+```
+
+## Configuring machines with `fvpboot`
+
+To configure a machine so that it can be ran inside `runfvp`, a number of variables need to be set in the machine configuration file (such as `meta-arm-bsp/conf/machine/fvp-base.conf`).
+
+Note that at present these variables are not stable and their behaviour may be changed in the future.
+
+### `FVP_EXE`
+
+The name of the FVP binary itself, for example `fvp-base` uses `FVP_Base_RevC-2xAEMvA`.
+
+### `FVP_PROVIDER`
+
+The name of the recipe that provides the FVP executable set in `FVP_EXE`, for example `fvp-base` uses `fvp-base-a-aem-native`.  This *must* be a `-native` recipe as the binary will be executed on the build host.
+
+There are recipes for common FVPs in meta-arm already, and writing new recipes is trivial.  For FVPs which are free to download `fvp-base-a-aem.bb` is a good example. Some FVPs must be downloaded separately as they need an account on Arm's website, `fvp-base-r-aem.bb` is a good example of those.
+
+If `FVP_PROVIDER` is not set then it is assumed that `FVP_EXE` is installed on the host already.
+
+### `FVP_CONFIG`
+
+Parameters passed to the FVP with the `--parameter`/`-C` option.  These are expressed as variable flags so individual parameters can be altered easily. For example:
+
+```
+FVP_CONFIG[bp.flashloader0.fname] = "fip-fvp.bin"
+```
+
+### `FVP_DATA`
+
+Specify raw data to load at the specified address, passed to the FVP with the `--data` option.  This is a space-separated list of parameters in the format `[INST=]FILE@[MEMSPACE:]ADDRESS`. For example:
+
+```
+FVP_DATA = "cluster0.cpu0=Image@0x80080000 \
+            cluster0.cpu0=fvp-base-revc.dtb@0x83000000"
+```
+
+### `FVP_APPLICATIONS`
+
+Applications to load on the cores, passed to the FVP with the `--application` option.  These are expressed as variable flags with the flag name being the instance and flag value the filename, for example:
+
+```
+FVP_APPLICATIONS[cluster0] = "linux-system.axf"
+```
+
+Note that symbols are not allowed in flag names, so if you need to use a wildcard in the instance then you'll need to use `FVP_EXTRA_ARGS` and `--application` directly.
+
+### `FVP_TERMINALS`
+
+Map hardware serial ports to abstract names. For example the `FVP_Base_RevC-2xAEMvA` FVP exposes four serial ports, `terminal_0` to `terminal_3`.  Typically only `terminal_0` is used in the `fvp-base` machine so this can be named `"Console"` and the others `""`.  When runfvp starts terminals it will only start named serial ports, so instead of opening four windows where only one is useful, it will only open one.
+
+For example:
+```
+FVP_TERMINALS[bp.terminal_0] = "Console"
+FVP_TERMINALS[bp.terminal_1] = ""
+FVP_TERMINALS[bp.terminal_2] = ""
+FVP_TERMINALS[bp.terminal_3] = ""
+```
+
+### `FVP_CONSOLES`
+
+This specifies what serial ports can be used in oeqa tests, along with an alias to be used in the test cases. Note that the values have to be the FVP identifier but without the board prefix, for example:
+```
+FVP_CONSOLES[default] = "terminal_0"
+FVP_CONSOLES[tf-a] = "s_terminal_0"
+```
+
+The 'default' console is also used when `--console` is passed to runfvp.
+
+### `FVP_EXTRA_ARGS`
+
+Arbitrary extra arguments that are passed directly to the FVP.  For example:
+
+```
+FVP_EXTRA_ARGS = "--simlimit 60"
+```
+
+### `FVP_ENV_PASSTHROUGH`
+
+The FVP is launched with an isolated set of environment variables. Add the name of a Bitbake variable to this list to pass it through to the FVP environment. For example:
+
+```
+FVP_ENV_PASSTHROUGH = "ARMLMD_LICENSE_FILE FM_TRACE_PLUGINS"
+```
+
+
+[AEM]: https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms/arm-ecosystem-models
+[FVP]: https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
+[tmux]: https://tmux.github.io/
+[INI]: https://docs.python.org/3/library/configparser.html

meta-arm/documentation/trusted-services.md

@@ -0,0 +1,65 @@
+# The Trusted Services: framework for developing root-of-trust services
+
+meta-arm layer includes recipes for [Trusted Services][^1] Secure Partitions and Normal World applications
+in `meta-arm/recipes-security/trusted-services`
+
+## Secure Partitions recipes
+
+We define dedicated recipes for all supported Trusted Services (TS) Secure Partitions.
+These recipes produce ELF and DTB files for SPs.
+These files are automatically included into optee-os image accordingly to defined MACHINE_FEATURES.
+
+### How to include TS SPs
+
+To include TS SPs into optee-os image you need to add into MACHINE_FEATURES
+features for each [Secure Partition][^2] you would like to include:
+
+| Secure Partition  | MACHINE_FEATURE |
+| ----------------- | --------------- |
+| Attestation       | ts-attesation   |
+| Crypto            | ts-crypto       |
+| Internal Storage  | ts-its          |
+| Protected Storage | ts-storage      |
+| se-proxy          | ts-se-proxy     |
+| smm-gateway       | ts-smm-gateway  |
+| spm-test[1-3]     | optee-spmc-test |
+
+Other steps depend on your machine/platform definition:
+
+1. For communications between Secure and Normal Words Linux kernel option `CONFIG_ARM_FFA_TRANSPORT=y`
+   is required. If your platform doesn't include it already you can add `arm-ffa` into MACHINE_FEATURES.
+   (Please see ` meta-arm/recipes-kernel/arm-ffa-tee`.)
+
+   For running the `uefi-test` or the `xtest -t ffa_spmc` tests under Linux the `arm-ffa-user` drivel is required. This is
+   enabled if the `ts-smm-gateway` and/or the `optee-spmc-test` machine features are enabled.
+   (Please see ` meta-arm/recipes-kernel/arm-ffa-user`.)
+
+2. optee-os might require platform specific OP-TEE build parameters (for example what SEL the SPM Core is implemented at).
+   You can find examples in `meta-arm/recipes-security/optee/optee-os_%.bbappend` for qemuarm64-secureboot machine
+   and in `meta-arm-bsp/recipes-security/optee/optee-os-n1sdp.inc` and `meta-arm-bsp/recipes-security/optee/optee-os-corstone1000-common.inc`
+   for N1SDP and Corstone1000 platforms accordingly.
+
+3. trusted-firmware-a might require platform specific TF-A build parameters (SPD and SPMC details on the platform).
+   See `meta-arm/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend` for qemuarm64-secureboot machine
+   and in `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-n1sdp.inc` and
+   `meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-corstone1000.inc` for N1SDP and Corstone1000 platforms.
+
+## Normal World applications
+
+Optionally for testing purposes you can add `packagegroup-ts-tests` into your image. It includes 
+[Trusted Services test and demo tools][^3] and [xtest][^4] configured to include the `ffa_spmc` tests.
+
+## OEQA Trusted Services tests
+
+  meta-arm also includes Trusted Service OEQA tests which can be used for automated testing.
+See `ci/trusted-services.yml` for an example how to include them into an image.
+
+
+------
+[^1]: https://trusted-services.readthedocs.io/en/integration/overview/index.html
+
+[^2]: https://trusted-services.readthedocs.io/en/integration/deployments/secure-partitions.html
+
+[^3]: https://trusted-services.readthedocs.io/en/integration/deployments/test-executables.html
+
+[^4]: https://optee.readthedocs.io/en/latest/building/gits/optee_test.html

meta-arm/kas/corstone1000-base.yml

@@ -0,0 +1,43 @@
+header:
+  version: 11
+
+distro: poky-tiny
+
+defaults:
+  repos:
+    refspec: master
+
+repos:
+  meta-arm:
+    layers:
+      meta-arm:
+      meta-arm-bsp:
+      meta-arm-toolchain:
+
+  poky:
+    url: https://git.yoctoproject.org/git/poky
+    refspec: 31dd418207f6c95ef0aad589cd03cd2a4c9a8bf2
+    layers:
+      meta:
+      meta-poky:
+      meta-yocto-bsp:
+
+  meta-openembedded:
+    url: https://git.openembedded.org/meta-openembedded
+    refspec: 5a01ab461c9bcabcbb2298236602373948f8f073
+    layers:
+      meta-oe:
+      meta-python:
+
+local_conf_header:
+  base: |
+    CONF_VERSION = "2"
+    PACKAGE_CLASSES = "package_ipk"
+    BB_NUMBER_THREADS ?= "16"
+    PARALLEL_MAKE ?= "-j16"
+    PACKAGECONFIG:append:pn-perf = " coresight"
+
+machine: unset
+
+target:
+  - corstone1000-image

meta-arm/kas/corstone1000-fvp.yml

@@ -0,0 +1,16 @@
+header:
+  version: 11
+  includes:
+    - kas/corstone1000-base.yml
+    - kas/fvp-eula.yml
+
+machine: corstone1000-fvp
+
+local_conf_header:
+    fvp-config: |
+        # Remove Dropbear SSH as it will not fit into the corstone1000 image.
+        IMAGE_FEATURES:remove = " ssh-server-dropbear"
+        INHERIT = " ${@bb.utils.contains('BUILD_ARCH', 'x86_64', 'fvpboot', '', d)}"
+
+target:
+  - corstone1000-image

meta-arm/kas/corstone1000-mps3.yml

@@ -0,0 +1,6 @@
+header:
+  version: 11
+  includes:
+    - kas/corstone1000-base.yml
+
+machine: corstone1000-mps3

meta-arm/kas/corstone500.yml

@@ -0,0 +1,47 @@
+header:
+  version: 11
+  includes:
+    - kas/fvp-eula.yml
+
+distro: poky-tiny
+
+defaults:
+  repos:
+    refspec: master
+
+repos:
+  meta-arm:
+    layers:
+      meta-arm:
+      meta-arm-bsp:
+      meta-arm-toolchain:
+
+  poky:
+    url: https://git.yoctoproject.org/git/poky
+    refspec: master
+    layers:
+      meta:
+      meta-poky:
+      meta-yocto-bsp:
+
+  meta-openembedded:
+    url: https://git.openembedded.org/meta-openembedded
+    refspec: master
+    layers:
+      meta-oe:
+      meta-python:
+
+local_conf_header:
+  base: |
+    CONF_VERSION = "2"
+    PACKAGE_CLASSES = "package_ipk"
+    BB_NUMBER_THREADS ?= "16"
+    PARALLEL_MAKE ?= "-j16"
+    PACKAGECONFIG:append:pn-perf = " coresight"
+  fvp-config: |
+    IMAGE_CLASSES:append = " ${@bb.utils.contains('BUILD_ARCH', 'x86_64', 'fvpboot', '', d)}"
+
+machine: corstone500
+
+target:
+  - core-image-minimal

meta-arm/kas/fvp-baser-aemv8r64-bsp.yml

@@ -0,0 +1,39 @@
+header:
+  version: 9
+  includes:
+    - kas/fvp-eula.yml
+
+distro: poky
+machine: fvp-baser-aemv8r64
+
+defaults:
+  repos:
+    refspec: master
+
+repos:
+  meta-arm:
+    url: https://git.yoctoproject.org/git/meta-arm
+    path: layers/meta-arm
+    layers:
+      meta-arm:
+      meta-arm-bsp:
+      meta-arm-toolchain:
+
+  poky:
+    url: https://git.yoctoproject.org/git/poky
+    path: layers/poky
+    layers:
+      meta:
+      meta-poky:
+
+local_conf_header:
+  base: |
+    CONF_VERSION = "2"
+    PACKAGE_CLASSES = "package_ipk"
+    PACKAGECONFIG:remove:pn-qemu-system-native = "gtk+ sdl"
+    EXTRA_IMAGE_FEATURES:append = " debug-tweaks ssh-server-openssh"
+    CORE_IMAGE_EXTRA_INSTALL:append = " ssh-pregen-hostkeys"
+    IMAGE_CLASSES:append = " testimage"
+
+target:
+  - core-image-minimal

meta-arm/kas/fvp-baser-aemv8r64-rt-bsp.yml

@@ -0,0 +1,8 @@
+header:
+  version: 9
+  includes:
+    - kas/fvp-baser-aemv8r64-bsp.yml
+
+local_conf_header:
+  base-rt: |
+    PREFERRED_PROVIDER_virtual/kernel = "linux-yocto-rt"

meta-arm/kas/fvp-eula.yml

@@ -0,0 +1,5 @@
+header:
+  version: 13
+
+env:
+  ARM_FVP_EULA_ACCEPT:

meta-arm/kas/tftf.yml

@@ -0,0 +1,7 @@
+header:
+  version: 9
+
+local_conf_header:
+  tftf: |
+    TFA_UBOOT = "0"
+    TFTF_TESTS = "1"

meta-arm/meta-arm-bsp/README.md

@@ -0,0 +1 @@
+See ../README.md

meta-arm/meta-arm-bsp/conf/layer.conf

@@ -0,0 +1,21 @@
+# We have a conf and classes directory, add to BBPATH
+BBPATH .= ":${LAYERDIR}"
+
+# We have recipes-* directories, add to BBFILES
+BBFILES += "${LAYERDIR}/recipes-*/*/*.bb \
+            ${LAYERDIR}/recipes-*/*/*.bbappend"
+
+BBFILE_COLLECTIONS += "meta-arm-bsp"
+BBFILE_PATTERN_meta-arm-bsp = "^${LAYERDIR}/"
+BBFILE_PRIORITY_meta-arm-bsp = "5"
+
+LAYERSERIES_COMPAT_meta-arm-bsp = "mickledore"
+
+LAYERDEPENDS_meta-arm-bsp = "core meta-arm"
+# This won't be used by layerindex-fetch, but works everywhere else
+LAYERDEPENDS_meta-arm-bsp:append:corstone1000 = " meta-python openembedded-layer"
+LAYERDEPENDS_meta-arm-bsp:append:musca-b1 = " meta-python"
+LAYERDEPENDS_meta-arm-bsp:append:musca-s1 = " meta-python"
+
+# Additional license directories.
+LICENSE_PATH += "${LAYERDIR}/custom-licenses"

meta-arm/meta-arm-bsp/conf/machine/corstone1000-fvp.conf

@@ -0,0 +1,51 @@
+#@TYPE: Machine
+#@NAME: corstone1000-fvp machine
+#@DESCRIPTION: Machine configuration for Corstone1000 64-bit FVP
+require conf/machine/include/corstone1000.inc
+
+TFA_TARGET_PLATFORM = "fvp"
+
+TFM_PLATFORM_IS_FVP = "TRUE"
+
+# testimage config
+TEST_TARGET = "OEFVPTarget"
+TEST_SUITES = "fvp_boot"
+
+# FVP Config
+FVP_PROVIDER ?= "fvp-corstone1000-native"
+FVP_EXE ?= "FVP_Corstone-1000"
+FVP_CONSOLE ?= "host_terminal_0"
+
+# FVP Parameters
+FVP_CONFIG[se.trustedBootROMloader.fname] ?= "bl1.bin"
+FVP_CONFIG[board.xnvm_size] ?= "64"
+FVP_CONFIG[se.trustedSRAM_config] ?= "6"
+FVP_CONFIG[se.BootROM_config] ?= "3"
+FVP_CONFIG[board.hostbridge.interfaceName] ?= "tap0"
+FVP_CONFIG[board.smsc_91c111.enabled] ?= "1"
+FVP_CONFIG[board.hostbridge.userNetworking] ?= "true"
+FVP_CONFIG[board.hostbridge.userNetPorts] ?= "5555=5555,8080=80,8022=22"
+FVP_CONFIG[board.se_flash_size] ?= "8192"
+FVP_CONFIG[diagnostics] ?= "4"
+FVP_CONFIG[disable_visualisation] ?= "true"
+FVP_CONFIG[se.nvm.update_raw_image] ?= "0"
+FVP_CONFIG[se.cryptocell.USER_OTP_FILTERING_DISABLE] ?= "1"
+
+# Boot image
+FVP_DATA ?= "board.flash0=${IMAGE_NAME}.wic@0x68000000"
+
+# External system (cortex-M3)
+FVP_CONFIG[extsys_harness0.extsys_flashloader.fname] ?= "es_flashfw.bin"
+
+# FVP Terminals
+FVP_TERMINALS[host.host_terminal_0] ?= "Normal World Console"
+FVP_TERMINALS[host.host_terminal_1] ?= "Secure World Console"
+FVP_TERMINALS[se.secenc_terminal] ?= "Secure Enclave Console"
+FVP_TERMINALS[extsys0.extsys_terminal] ?= "Cortex M3"
+
+# MMC card configuration
+FVP_CONFIG[board.msd_mmc.card_type] ?= "SDHC"
+FVP_CONFIG[board.msd_mmc.p_fast_access] ?= "0"
+FVP_CONFIG[board.msd_mmc.diagnostics] ?= "2"
+FVP_CONFIG[board.msd_mmc.p_max_block_count] ?= "0xFFFF"
+FVP_CONFIG[board.msd_config.pl180_fifo_depth] ?= "16"

meta-arm/meta-arm-bsp/conf/machine/corstone1000-mps3.conf

@@ -0,0 +1,9 @@
+#@TYPE: Machine
+#@NAME: corstone1000-mps3 machine
+#@DESCRIPTION: Machine configuration for Corstone1000 64-bit MPS3 FPGA board
+
+require conf/machine/include/corstone1000.inc
+
+TFA_TARGET_PLATFORM = "fpga"
+
+PLATFORM_IS_FVP = "FALSE"

meta-arm/meta-arm-bsp/conf/machine/corstone500.conf

@@ -0,0 +1,49 @@
+#@TYPE: Machine
+#@NAME: Corstone-500 machine
+#@DESCRIPTION: Machine configuration for the Corstone-500 platform
+
+require conf/machine/include/arm/armv7a/tune-cortexa5.inc
+
+# Corstone-500 is built against poky-tiny distro.
+# poky-tiny sets PREFERRED_PROVIDER_virtual/kernel to linux-yocto-tiny.
+# Since distro config is evaluated after the machine config, we need to
+# use the strongest override possible (forcevariable) so the
+# PREFERRED_PROVIDER_virtual/kernel specified in the machine config will
+# apply.
+#
+PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
+PREFERRED_VERSION_linux-yocto ?= "6.1%"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a u-boot"
+
+IMAGE_CLASSES += "wic_nopt"
+IMAGE_FSTYPES:forcevariable = "cpio.gz squashfs wic wic.nopt"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+# Corstone-500 u-boot configuration
+UBOOT_MACHINE = "corstone500_defconfig"
+UBOOT_IMAGE_ENTRYPOINT = "0x84000000"
+UBOOT_IMAGE_LOADADDRESS = "0x84000000"
+PREFERRED_VERSION_u-boot ?= "2023.01"
+
+# making sure EXTRA_IMAGEDEPENDS will be used while creating the image
+WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
+
+WKS_FILE ?= "core-image-minimal.corstone500.wks"
+
+TEST_TARGET = "OEFVPTarget"
+TEST_SUITES = "fvp_boot"
+
+FVP_PROVIDER ?= "fvp-corstone500-native"
+FVP_EXE ?= "FVP_Corstone-500"
+FVP_CONFIG[board.flashloader0.fname] ?= "bl1.bin"
+FVP_DATA ?= "css.cluster.cpu0=${IMAGE_NAME}.wic.nopt@0x80000000"
+FVP_CONSOLE ?= "terminal_0"
+FVP_TERMINALS[css.terminal_0] ?= "console"
+FVP_TERMINALS[css.terminal_1] ?= ""
+
+# Disable openssl in kmod to shink the initramfs size
+PACKAGECONFIG:remove:pn-kmod = "openssl"
+
+IMAGE_NAME_SUFFIX = ""

meta-arm/meta-arm-bsp/conf/machine/fvp-base.conf

@@ -0,0 +1,18 @@
+# Configuration for Armv8-A Base Platform FVP
+
+#@TYPE: Machine
+#@NAME: Armv8-A Base Platform FVP machine
+#@DESCRIPTION: Machine configuration for Armv8-A Base Platform FVP model
+
+require conf/machine/include/fvp-common.inc
+require conf/machine/include/arm/arch-armv8a.inc
+
+TUNE_FEATURES = "aarch64"
+
+# FVP u-boot configuration
+UBOOT_MACHINE = "vexpress_aemv8a_semi_defconfig"
+
+KERNEL_IMAGETYPE = "Image"
+
+FVP_CONFIG[bp.virtio_rng.enabled] ?= "1"
+IMAGE_NAME_SUFFIX = ""

meta-arm/meta-arm-bsp/conf/machine/fvp-baser-aemv8r64.conf

@@ -0,0 +1,66 @@
+# Configuration for Fixed Virtual Platform BaseR AEMv8r64 Machine
+
+#@TYPE: Machine
+#@NAME: FVP BaseR AEMv8r64 Machine
+#@DESCRIPTION: Machine configuration for FVP BaseR AEMv8r64
+
+require conf/machine/include/arm/armv8r/arch-armv8r64.inc
+
+EXTRA_IMAGEDEPENDS += "boot-wrapper-aarch64"
+
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+PREFERRED_VERSION_u-boot ?= "2022.10"
+
+KERNEL_IMAGETYPE = "Image"
+KERNEL_DEVICETREE = "arm/fvp-baser-aemv8r64.dtb"
+
+UBOOT_MACHINE ?= "vexpress_aemv8r_defconfig"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+IMAGE_CLASSES:append = " fvpboot"
+IMAGE_FSTYPES += "wic"
+WKS_FILE ?= "efi-disk.wks.in"
+EFI_PROVIDER ?= "grub-efi"
+MACHINE_FEATURES:append = " efi"
+
+IMAGE_NAME_SUFFIX = ""
+
+# As this is a virtual target that will not be used in the real world there is
+# no need for real SSH keys.
+MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"
+
+# testimage configuration
+TEST_TARGET = "OEFVPTarget"
+TEST_SUITES:append = " fvp_boot fvp_devices"
+TEST_TARGET_IP ?= "127.0.0.1:8022"
+TEST_SERVER_IP ?= "127.0.1.1"
+TEST_FVP_DEVICES ?= "rtc watchdog networking virtiorng cpu_hotplug"
+
+FVP_EXTRA_ARGS = "-a cluster0*=linux-system.axf"
+FVP_PROVIDER ?= "fvp-base-r-aem-native"
+FVP_EXE ?= "FVP_BaseR_AEMv8R"
+FVP_CONSOLE ?= "terminal_0"
+
+# FVP parameters
+FVP_CONFIG[bp.exclusive_monitor.monitor_access_level] ?= "2"
+FVP_CONFIG[bp.refcounter.non_arch_start_at_default] ?= "1"
+FVP_CONFIG[bp.refcounter.use_real_time] ?= "1"
+FVP_CONFIG[bp.ve_sysregs.exit_on_shutdown] ?= "1"
+FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] ?= "8022=22"
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
+FVP_CONFIG[bp.virtio_net.secure_accesses] = "1"
+FVP_CONFIG[bp.virtio_rng.enabled] ?= "1"
+FVP_CONFIG[bp.virtio_rng.secure_accesses] = "1"
+FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${IMAGE_NAME}.wic"
+FVP_CONFIG[bp.virtioblockdevice.secure_accesses] = "1"
+FVP_CONFIG[cache_state_modelled] ?= "0"
+FVP_CONFIG[cci400.force_on_from_start] = "1"
+FVP_CONFIG[cluster0.gicv3.cpuintf-mmap-access-level] ?= "2"
+FVP_CONFIG[cluster0.gicv3.extended-interrupt-range-support] ?= "1"
+FVP_CONFIG[cluster0.gicv3.SRE-EL2-enable-RAO] ?= "1"
+FVP_CONFIG[cluster0.gicv3.SRE-enable-action-on-mmap] ?= "2"
+FVP_CONFIG[cluster0.has_aarch64] ?= "1"
+FVP_CONFIG[gic_distributor.GICD_CTLR-DS-1-means-secure-only] ?= "1"
+FVP_CONFIG[gic_distributor.has-two-security-states] ?= "0"

meta-arm/meta-arm-bsp/conf/machine/include/arm/armv8r/arch-armv8r64.inc

@@ -0,0 +1,10 @@
+require conf/machine/include/arm/arch-armv8r.inc
+
+TUNE_FEATURES:tune-armv8r            =+ "aarch64"
+PACKAGE_EXTRA_ARCHS:tune-armv8r      =+ "aarch64"
+BASE_LIB:tune-armv8r                 = "lib64"
+BASE_LIB:tune-armv8r-crc             = "lib64"
+BASE_LIB:tune-armv8r-crypto          = "lib64"
+BASE_LIB:tune-armv8r-simd            = "lib64"
+BASE_LIB:tune-armv8r-crc-simd        = "lib64"
+BASE_LIB:tune-armv8r-crc-crypto-simd = "lib64"

meta-arm/meta-arm-bsp/conf/machine/include/corstone1000.inc

@@ -0,0 +1,80 @@
+require conf/machine/include/arm/armv8a/tune-cortexa35.inc
+
+MACHINEOVERRIDES =. "corstone1000:"
+
+# TF-A
+TFA_PLATFORM = "corstone1000"
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+
+TFA_BL2_BINARY = "bl2-corstone1000.bin"
+TFA_FIP_BINARY = "fip-corstone1000.bin"
+
+# TF-M
+EXTRA_IMAGEDEPENDS += "virtual/trusted-firmware-m"
+
+# TF-M settings for signing host images
+TFA_BL2_RE_IMAGE_LOAD_ADDRESS = "0x62353000"
+TFA_BL2_RE_SIGN_BIN_SIZE = "0x2d000"
+TFA_FIP_RE_IMAGE_LOAD_ADDRESS = "0x68130000"
+TFA_FIP_RE_SIGN_BIN_SIZE = "0x00200000"
+RE_LAYOUT_WRAPPER_VERSION = "0.0.7"
+TFM_SIGN_PRIVATE_KEY = "${libdir}/tfm-scripts/root-RSA-3072_1.pem"
+RE_IMAGE_OFFSET = "0x1000"
+
+# u-boot
+PREFERRED_VERSION_u-boot ?= "2023.01"
+EXTRA_IMAGEDEPENDS += "u-boot"
+
+UBOOT_CONFIG ??= "EFI"
+UBOOT_CONFIG[EFI] = "corstone1000_defconfig"
+UBOOT_ENTRYPOINT  = "0x80000000"
+UBOOT_LOADADDRESS = "0x80000000"
+UBOOT_BOOTARGS = "earlycon=pl011,0x1a510000 console=ttyAMA0 loglevel=9"
+UBOOT_ARCH = "arm"
+UBOOT_EXTLINUX = "0"
+
+#optee
+PREFERRED_VERSION_optee-os ?= "3.20.%"
+PREFERRED_VERSION_optee-client ?= "3.18.%"
+EXTRA_IMAGEDEPENDS += "optee-os"
+OPTEE_ARCH = "arm64"
+OPTEE_BINARY = "tee-pager_v2.bin"
+
+# Include smm-gateway and se-proxy SPs into optee-os binary
+MACHINE_FEATURES += "ts-smm-gateway ts-se-proxy"
+TS_PLATFORM = "arm/corstone1000"
+TS_SP_SE_PROXY_CONFIG = "corstone1000"
+
+# External System(Cortex-M3)
+EXTRA_IMAGEDEPENDS += "external-system"
+
+# Linux kernel
+PREFERRED_PROVIDER_virtual/kernel:forcevariable = "linux-yocto"
+PREFERRED_VERSION_linux-yocto = "6.1%"
+KERNEL_IMAGETYPE = "Image.gz"
+
+INITRAMFS_IMAGE_BUNDLE ?= "1"
+
+#telling the build system which image is responsible of the generation of the initramfs rootfs
+INITRAMFS_IMAGE = "corstone1000-initramfs-image"
+IMAGE_NAME_SUFFIX = ""
+
+# add FF-A support in the kernel
+MACHINE_FEATURES += "arm-ffa"
+
+# prevent the kernel image from being included in the intramfs rootfs
+PACKAGE_EXCLUDE = "kernel-image-*"
+
+# enable this feature for kernel debugging
+# MACHINE_FEATURES += "corstone1000_kernel_debug"
+
+# login terminal serial port settings
+SERIAL_CONSOLES ?= "115200;ttyAMA0"
+
+# making sure EXTRA_IMAGEDEPENDS will be used while creating the image
+WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
+
+WKS_FILE ?= "corstone1000-image.corstone1000.wks"
+
+# Disable openssl in kmod to shink the initramfs size
+PACKAGECONFIG:remove:pn-kmod = "openssl"

meta-arm/meta-arm-bsp/conf/machine/include/fvp-common.inc

@@ -0,0 +1,50 @@
+# FVP common parameters
+
+#
+# Capturing FVP common configurations (Armv8-A Base Platform FVP,
+# Armv8-A Foundation Platform and Armv7-A Base Platform FVP).
+#
+
+MACHINE_FEATURES = "optee"
+
+IMAGE_FSTYPES += "wic"
+WKS_FILE ?= "fvp-base.wks"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+
+KERNEL_DEVICETREE = "arm/fvp-base-revc.dtb"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+
+# As this is a virtual target that will not be used in the real world there is
+# no need for real SSH keys.
+MACHINE_EXTRA_RRECOMMENDS += "ssh-pregen-hostkeys"
+
+TEST_TARGET = "OEFVPTarget"
+TEST_TARGET_IP = "127.0.0.1:8022"
+TEST_SUITES:append = " fvp_boot fvp_devices"
+TEST_FVP_DEVICES ?= "rtc watchdog networking virtiorng cpu_hotplug"
+
+FVP_PROVIDER ?= "fvp-base-a-aem-native"
+FVP_EXE ?= "FVP_Base_RevC-2xAEMvA"
+FVP_CONFIG[bp.ve_sysregs.exit_on_shutdown] ?= "1"
+FVP_CONFIG[bp.virtio_net.enabled] ?= "1"
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetworking] ?= "1"
+# Tell testimage to connect to localhost:8022, and forward that to SSH in the FVP.
+FVP_CONFIG[bp.virtio_net.hostbridge.userNetPorts] = "8022=22"
+FVP_CONFIG[cache_state_modelled] ?= "0"
+FVP_CONFIG[bp.secureflashloader.fname] ?= "bl1-fvp.bin"
+FVP_CONFIG[bp.flashloader0.fname] ?= "fip-fvp.bin"
+FVP_CONFIG[bp.virtioblockdevice.image_path] ?= "${IMAGE_NAME}.wic"
+# Set the baseline to ARMv8.4, as the default is 8.0.
+FVP_CONFIG[cluster0.has_arm_v8-4] = "1"
+FVP_CONFIG[cluster1.has_arm_v8-4] = "1"
+FVP_CONSOLE ?= "terminal_0"
+FVP_DATA ?= "cluster0.cpu0=${KERNEL_IMAGETYPE}@0x80080000 \
+             cluster0.cpu0=fvp-base-revc.dtb@0x8fc00000"
+FVP_TERMINALS[bp.terminal_0] ?= "Console"
+FVP_TERMINALS[bp.terminal_1] ?= ""
+FVP_TERMINALS[bp.terminal_2] ?= ""
+FVP_TERMINALS[bp.terminal_3] ?= ""

meta-arm/meta-arm-bsp/conf/machine/include/tc.inc

@@ -0,0 +1,35 @@
+TUNE_FEATURES = "aarch64"
+
+require conf/machine/include/arm/arch-armv8a.inc
+
+MACHINEOVERRIDES =. "tc:"
+
+# Das U-boot
+UBOOT_MACHINE ?= "total_compute_defconfig"
+UBOOT_RD_LOADADDRESS = "0x88000000"
+UBOOT_RD_ENTRYPOINT = "0x88000000"
+UBOOT_LOADADDRESS = "0x80080000"
+UBOOT_ENTRYPOINT = "0x80080000"
+
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+
+# OP-TEE
+PREFERRED_VERSION_optee-os ?= "3.18%"
+PREFERRED_VERSION_optee-client ?= "3.18%"
+PREFERRED_VERSION_optee-test ?= "3.18%"
+
+# Cannot use the default zImage on arm64
+KERNEL_IMAGETYPE = "Image"
+KERNEL_IMAGETYPES += "fitImage"
+KERNEL_CLASSES = " kernel-fitimage "
+
+IMAGE_FSTYPES += "cpio.gz"
+INITRAMFS_IMAGE ?= "core-image-minimal"
+IMAGE_NAME_SUFFIX = ""
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a optee-os"
+# FIXME - there is signed image dependency/race with testimage.
+# This should be fixed in oe-core
+TESTIMAGEDEPENDS:append = " virtual/kernel:do_deploy"

meta-arm/meta-arm-bsp/conf/machine/juno.conf

@@ -0,0 +1,30 @@
+# Configuration for juno development board
+
+#@TYPE: Machine
+#@NAME: Juno machine
+#@DESCRIPTION: Machine configuration for Juno
+
+TUNE_FEATURES = "aarch64"
+
+require conf/machine/include/arm/arch-armv8a.inc
+
+MACHINE_FEATURES = "usbhost usbgadget alsa screen wifi bluetooth optee pci"
+
+KERNEL_IMAGETYPE = "Image.gz"
+KERNEL_DEVICETREE = "arm/juno.dtb arm/juno-r1.dtb arm/juno-r2.dtb"
+
+IMAGE_FSTYPES += "tar.bz2 ext4 cpio.gz"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+PREFERRED_PROVIDER_virtual/bootloader ?= "u-boot"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a virtual/bootloader firmware-image-juno"
+
+# Juno u-boot configuration
+UBOOT_MACHINE = "vexpress_aemv8a_juno_defconfig"
+
+INITRAMFS_IMAGE_BUNDLE ?= "1"
+INITRAMFS_IMAGE = "core-image-minimal"
+IMAGE_NAME_SUFFIX = ""

meta-arm/meta-arm-bsp/conf/machine/musca-b1.conf

@@ -0,0 +1,23 @@
+# Configuration for Musca-B1 development board
+
+#@TYPE: Machine
+#@NAME: Musca-B1 machine
+#@DESCRIPTION: Machine configuration for Musca-B1
+
+DEFAULTTUNE ?= "armv8m-main"
+require conf/machine/include/arm/armv8-m/tune-cortexm33.inc
+
+# GLIBC will not work with Cortex-M.
+TCLIBC = "newlib"
+
+# For runqemu
+IMAGE_FSTYPES += "ext4"
+IMAGE_CLASSES += "qemuboot"
+QB_SYSTEM_NAME = "qemu-system-arm"
+QB_MACHINE = "-machine musca-b1"
+QB_CPU = "-cpu cortex-m33"
+QB_GRAPHICS = "-nographic -vga none"
+QB_MEM = "512k"
+QB_RNG = ""
+
+TFM_PLATFORM = "arm/musca_b1"

meta-arm/meta-arm-bsp/conf/machine/musca-s1.conf

@@ -0,0 +1,22 @@
+# Configuration for Musca-S1 development board
+
+#@TYPE: Machine
+#@NAME: Musca-S1 machine
+#@DESCRIPTION: Machine configuration for Musca-S1
+
+require conf/machine/include/arm/armv8-m/tune-cortexm33.inc
+
+# GLIBC will not work with Cortex-M.
+TCLIBC = "newlib"
+
+# For runqemu
+IMAGE_FSTYPES += "ext4"
+IMAGE_CLASSES += "qemuboot"
+QB_SYSTEM_NAME = "qemu-system-arm"
+QB_MACHINE = "-machine musca-s1"
+QB_CPU = "-cpu cortex-m33"
+QB_GRAPHICS = "-nographic -vga none"
+QB_MEM = "512k"
+QB_RNG = ""
+
+TFM_PLATFORM = "arm/musca_s1"

meta-arm/meta-arm-bsp/conf/machine/n1sdp.conf

@@ -0,0 +1,42 @@
+# Configuration for Arm N1SDP development board
+
+#@TYPE: Machine
+#@NAME: N1SDP machine
+#@DESCRIPTION: Machine configuration for N1SDP
+
+require conf/machine/include/arm/armv8-2a/tune-neoversen1.inc
+
+KERNEL_IMAGETYPE = "Image"
+
+IMAGE_FSTYPES += "wic wic.gz wic.bmap tar.bz2 ext4"
+
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+# Set default WKS
+WKS_FILE ?= "n1sdp-efidisk.wks"
+IMAGE_EFI_BOOT_FILES ?= "n1sdp-multi-chip.dtb n1sdp-single-chip.dtb"
+WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"
+
+# Use kernel provided by yocto
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+PREFERRED_VERSION_linux-yocto ?= "6.1%"
+
+# RTL8168E Gigabit Ethernet Controller is attached to the PCIe interface
+MACHINE_ESSENTIAL_EXTRA_RDEPENDS += "linux-firmware-rtl8168"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"
+
+#UEFI EDK2 firmware
+EXTRA_IMAGEDEPENDS += "edk2-firmware"
+PREFERRED_VERSION_edk2-firmware ?= "202211"
+
+#optee
+PREFERRED_VERSION_optee-os ?= "3.20.%"
+
+#grub-efi
+EFI_PROVIDER ?= "grub-efi"
+MACHINE_FEATURES += "efi"
+
+# SD-Card firmware
+EXTRA_IMAGEDEPENDS += "sdcard-image-n1sdp"

meta-arm/meta-arm-bsp/conf/machine/sgi575.conf

@@ -0,0 +1,24 @@
+# Configuration for Arm SGI575 development board
+
+#@TYPE: Machine
+#@NAME: SGI575
+#@DESCRIPTION: Machine configuration for SGI575
+
+require conf/machine/include/arm/armv8-2a/tune-cortexa75.inc
+
+EXTRA_IMAGEDEPENDS += "virtual/control-processor-firmware"
+
+EXTRA_IMAGEDEPENDS += "trusted-firmware-a"
+
+KERNEL_IMAGETYPE ?= "Image"
+PREFERRED_PROVIDER_virtual/kernel ?= "linux-yocto"
+SERIAL_CONSOLES = "115200;ttyAMA0"
+
+#grub-efi
+EFI_PROVIDER ?= "grub-efi"
+MACHINE_FEATURES += "efi"
+
+IMAGE_FSTYPES += "cpio.gz wic"
+
+WKS_FILE ?= "sgi575-efidisk.wks"
+WKS_FILE_DEPENDS:append = " ${EXTRA_IMAGEDEPENDS}"

meta-arm/meta-arm-bsp/conf/machine/tc1.conf

@@ -0,0 +1,31 @@
+# Configuration for TC1
+
+#@TYPE: Machine
+#@NAME: TC1
+#@DESCRIPTION: Machine configuration for TC1
+
+require conf/machine/include/tc.inc
+
+TEST_TARGET = "OEFVPTarget"
+TEST_SUITES = "fvp_boot"
+
+# FVP Config
+FVP_PROVIDER ?= "fvp-tc1-native"
+FVP_EXE ?= "FVP_TC1"
+
+# FVP Parameters
+FVP_CONFIG[css.scp.ROMloader.fname] ?= "scp_romfw.bin"
+FVP_CONFIG[css.trustedBootROMloader.fname] ?= "bl1-tc.bin"
+FVP_CONFIG[board.flashloader0.fname] ?= "fip_gpt-tc.bin"
+
+#FVP_CONFIG[board.hostbridge.userNetworking] ?= "true"
+#FVP_CONFIG[board.hostbridge.userNetPorts] ?= "8022=22"
+#smsc ethernet takes a very long time to come up.  disable now to prevent testimage timeout
+#FVP_CONFIG[board.smsc_91c111.enabled] ?= "1"
+
+FVP_CONSOLE = "terminal_s1"
+FVP_TERMINALS[soc.terminal_s0] ?= "Secure Console"
+FVP_TERMINALS[soc.terminal_s1] ?= "Console"
+
+# Boot image
+FVP_DATA ?= "board.dram=fitImage-core-image-minimal-tc1-tc1@0x20000000"

meta-arm/meta-arm-bsp/custom-licenses/STM-SLA0044-Rev5

@@ -0,0 +1,18 @@
+SLA0044 Rev5/February 2018
+
+BY INSTALLING COPYING, DOWNLOADING, ACCESSING OR OTHERWISE USING THIS SOFTWARE OR ANY PART THEREOF (AND THE RELATED DOCUMENTATION) FROM STMICROELECTRONICS INTERNATIONAL N.V, SWISS BRANCH AND/OR ITS AFFILIATED COMPANIES (STMICROELECTRONICS), THE RECIPIENT, ON BEHALF OF HIMSELF OR HERSELF, OR ON BEHALF OF ANY ENTITY BY WHICH SUCH RECIPIENT IS EMPLOYED AND/OR ENGAGED AGREES TO BE BOUND BY THIS SOFTWARE LICENSE AGREEMENT.
+
+Under STMicroelectronics’ intellectual property rights, the redistribution, reproduction and use in source and binary forms of the software or any part thereof, with or without modification, are permitted provided that the following conditions are met:
+1.	Redistribution of source code (modified or not) must retain any copyright notice, this list of conditions and the disclaimer set forth below as items 10 and 11.
+2.	Redistributions in binary form, except as embedded into microcontroller or microprocessor device manufactured by or for STMicroelectronics or a software update for such device, must reproduce any copyright notice provided with the binary code, this list of conditions, and the disclaimer set forth below as items 10 and 11, in documentation and/or other materials provided with the distribution.
+3.	Neither the name of STMicroelectronics nor the names of other contributors to this software may be used to endorse or promote products derived from this software or part thereof without specific written permission.
+4.	This software or any part thereof, including modifications and/or derivative works of this software, must be used and execute solely and exclusively on or in combination with a microcontroller or microprocessor device manufactured by or for STMicroelectronics.
+5.	No use, reproduction or redistribution of this software partially or totally may be done in any manner that would subject this software to any Open Source Terms. “Open Source Terms” shall mean any open source license which requires as part of distribution of software that the source code of such software is distributed therewith or otherwise made available, or open source license that substantially complies with the Open Source definition specified at www.opensource.org and any other comparable open source license such as for example GNU General Public License (GPL), Eclipse Public License (EPL), Apache Software License, BSD license or MIT license.
+6.	STMicroelectronics has no obligation to provide any maintenance, support or updates for the software.
+7.	The software is and will remain the exclusive property of STMicroelectronics and its licensors. The recipient will not take any action that jeopardizes STMicroelectronics and its licensors' proprietary rights or acquire any rights in the software, except the limited rights specified hereunder.
+8.	The recipient shall comply with all applicable laws and regulations affecting the use of the software or any part thereof including any applicable export control law or regulation.
+9.	Redistribution and use of this software or any part thereof other than as permitted under this license is void and will automatically terminate your rights under this license. 
+10.	THIS SOFTWARE IS PROVIDED BY STMICROELECTRONICS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS, IMPLIED OR STATUTORY WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT OF THIRD PARTY INTELLECTUAL PROPERTY RIGHTS, WHICH ARE DISCLAIMED TO THE FULLEST EXTENT PERMITTED BY LAW. IN NO EVENT SHALL STMICROELECTRONICS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+11.	EXCEPT AS EXPRESSLY PERMITTED HEREUNDER, NO LICENSE OR OTHER RIGHTS, WHETHER EXPRESS OR IMPLIED, ARE GRANTED UNDER ANY PATENT OR OTHER INTELLECTUAL PROPERTY RIGHTS OF STMICROELECTRONICS OR ANY THIRD PARTY.
+ 
+

meta-arm/meta-arm-bsp/documentation/corstone1000/change-log.rst

@@ -0,0 +1,230 @@
+..
+ # Copyright (c) 2022-2023, Arm Limited.
+ #
+ # SPDX-License-Identifier: MIT
+
+##########
+Change Log
+##########
+
+This document contains a summary of the new features, changes and
+fixes in each release of Corstone-1000 software stack.
+
+***************
+Version 2023.06
+***************
+
+Changes
+=======
+
+- GPT support (in TF-M, TF-A, U-boot)
+- Use TF-M BL1 code as the ROM code instead of MCUboot (the next stage bootloader BL2 remains to be MCUboot)
+- Secure Enclave uses CC312 OTP as the provisioning backend in FVP and FPGA
+- NVMXIP block storage support in U-Boot
+- Upgrading the SW stack recipes
+- Upgrades for the U-Boot FF-A driver and MM communication
+
+Corstone-1000 components versions
+=================================
+
++-------------------------------------------+--------------------------------------------+
+| arm-ffa-tee                               | 1.1.2-r0                                   |
++-------------------------------------------+--------------------------------------------+
+| arm-ffa-user                              | 5.0.1-r0                                   |
++-------------------------------------------+--------------------------------------------+
+| corstone1000-external-sys-tests           | 1.0+gitAUTOINC+2945cd92f7-r0               |
++-------------------------------------------+--------------------------------------------+
+| external-system                           | 0.1.0+gitAUTOINC+8c9dca74b1-r0             |
++-------------------------------------------+--------------------------------------------+
+| linux-yocto                               | 6.1.25+gitAUTOINC+36901b5b29_581dc1aa2f-r0 |
++-------------------------------------------+--------------------------------------------+
+| u-boot                                    | 2023.01-r0                                 |
++-------------------------------------------+--------------------------------------------+
+| optee-client                              | 3.18.0-r0                                  |
++-------------------------------------------+--------------------------------------------+
+| optee-os                                  | 3.20.0-r0                                  |
++-------------------------------------------+--------------------------------------------+
+| trusted-firmware-a                        | 2.8.0-r0                                   |
++-------------------------------------------+--------------------------------------------+
+| trusted-firmware-m                        | 1.7.0-r0                                   |
++-------------------------------------------+--------------------------------------------+
+| ts-newlib                                 | 4.1.0-r0                                   |
++-------------------------------------------+--------------------------------------------+
+| ts-psa-{crypto, iat, its. ps}-api-test    | 38cb53a4d9                                 |
++-------------------------------------------+--------------------------------------------+
+| ts-sp-{se-proxy, smm-gateway}             | 08b3d39471                                 |
++-------------------------------------------+--------------------------------------------+
+
+Yocto distribution components versions
+======================================
+
++-------------------------------------------+--------------------------------+
+| meta-arm                                  | mickledore                     |
++-------------------------------------------+--------------------------------+
+| poky                                      | mickledore                     |
++-------------------------------------------+--------------------------------+
+| meta-openembedded                         | mickledore                     |
++-------------------------------------------+--------------------------------+
+| busybox                                   | 1.36.0-r0                      |
++-------------------------------------------+--------------------------------+
+| musl                                      | 1.2.3+gitAUTOINC+7d756e1c04-r0 |
++-------------------------------------------+--------------------------------+
+| gcc-arm-none-eabi-native                  | 11.2-2022.02                   |
++-------------------------------------------+--------------------------------+
+| gcc-cross-aarch64                         | 12.2.rel1-r0                   |
++-------------------------------------------+--------------------------------+
+| openssl                                   | 3.1.0-r0                       |
++-------------------------------------------+--------------------------------+
+
+******************
+Version 2022.11.23
+******************
+
+Changes
+=======
+
+- Booting the External System (Cortex-M3) with RTX RTOS
+- Adding MHU communication between the HOST (Cortex-A35) and the External System
+- Adding a Linux application to test the External System
+- Adding ESRT (EFI System Resource Table) support
+- Upgrading the SW stack recipes
+- Upgrades for the U-Boot FF-A driver and MM communication
+
+Corstone-1000 components versions
+=================================
+
++-------------------------------------------+------------+
+| arm-ffa-tee                               | 1.1.1      |
++-------------------------------------------+------------+
+| arm-ffa-user                              | 5.0.0      |
++-------------------------------------------+------------+
+| corstone1000-external-sys-tests           | 1.0        |
++-------------------------------------------+------------+
+| external-system                           | 0.1.0      |
++-------------------------------------------+------------+
+| linux-yocto                               | 5.19       |
++-------------------------------------------+------------+
+| u-boot                                    | 2022.07    |
++-------------------------------------------+------------+
+| optee-client                              | 3.18.0     |
++-------------------------------------------+------------+
+| optee-os                                  | 3.18.0     |
++-------------------------------------------+------------+
+| trusted-firmware-a                        | 2.7.0      |
++-------------------------------------------+------------+
+| trusted-firmware-m                        | 1.6.0      |
++-------------------------------------------+------------+
+| ts-newlib                                 | 4.1.0      |
++-------------------------------------------+------------+
+| ts-psa-{crypto, iat, its. ps}-api-test    | 451aa087a4 |
++-------------------------------------------+------------+
+| ts-sp-{se-proxy, smm-gateway}             | 3d4956770f |
++-------------------------------------------+------------+
+
+Yocto distribution components versions
+======================================
+
++-------------------------------------------+---------------------+
+| meta-arm                                  | langdale            |
++-------------------------------------------+---------------------+
+| poky                                      | langdale            |
++-------------------------------------------+---------------------+
+| meta-openembedded                         | langdale            |
++-------------------------------------------+---------------------+
+| busybox                                   | 1.35.0              |
++-------------------------------------------+---------------------+
+| musl                                      | 1.2.3+git37e18b7bf3 |
++-------------------------------------------+---------------------+
+| gcc-arm-none-eabi-native                  | 11.2-2022.02        |
++-------------------------------------------+---------------------+
+| gcc-cross-aarch64                         | 12.2                |
++-------------------------------------------+---------------------+
+| openssl                                   | 3.0.5               |
++-------------------------------------------+---------------------+
+
+******************
+Version 2022.04.04
+******************
+
+Changes
+=======
+- Linux distro openSUSE, raw image installation and boot in the FVP.
+- SCT test support in FVP.
+- Manual capsule update support in FVP.
+
+******************
+Version 2022.02.25
+******************
+
+Changes
+=======
+- Building and running psa-arch-tests on Corstone-1000 FVP
+- Enabled smm-gateway partition in Trusted Service on Corstone-1000 FVP
+- Enabled MHU driver in Trusted Service on Corstone-1000 FVP
+- Enabled OpenAMP support in SE proxy SP on Corstone-1000 FVP
+
+******************
+Version 2022.02.21
+******************
+
+Changes
+=======
+- psa-arch-tests: recipe is dropped and merged into the secure-partitons recipe.
+- psa-arch-tests: The tests are align with latest tfm version for psa-crypto-api suite.
+
+******************
+Version 2022.01.18
+******************
+
+Changes
+=======
+- psa-arch-tests: change master to main for psa-arch-tests
+- U-Boot: fix null pointer exception for get_image_info
+- TF-M: fix capsule instability issue for Corstone-1000
+
+******************
+Version 2022.01.07
+******************
+
+Changes
+=======
+- Corstone-1000: fix SystemReady-IR ACS test (SCT, FWTS) failures.
+- U-Boot: send bootcomplete event to secure enclave.
+- U-Boot: support populating Corstone-1000 image_info to ESRT table.
+- U-Boot: add ethernet device and enable configs to support bootfromnetwork SCT.
+
+******************
+Version 2021.12.15
+******************
+
+Changes
+=======
+- Enabling Corstone-1000 FPGA support on:
+  - Linux 5.10
+  - OP-TEE 3.14
+  - Trusted Firmware-A 2.5
+  - Trusted Firmware-M 1.5
+- Building and running psa-arch-tests
+- Adding openamp support in SE proxy SP
+- OP-TEE: adding smm-gateway partition
+- U-Boot: introducing Arm FF-A and MM support
+
+******************
+Version 2021.10.29
+******************
+
+Changes
+=======
+- Enabling Corstone-1000 FVP support on:
+  - Linux 5.10
+  - OP-TEE 3.14
+  - Trusted Firmware-A 2.5
+  - Trusted Firmware-M 1.4
+- Linux kernel: enabling EFI, adding FF-A debugfs driver, integrating ARM_FFA_TRANSPORT.
+- U-Boot: Extending EFI support
+- python3-imgtool: adding recipe for Trusted-firmware-m
+- python3-imgtool: adding the Yocto recipe used in signing host images (based on MCUBOOT format)
+
+--------------
+
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*

meta-arm/meta-arm-bsp/documentation/corstone1000/conf.py

@@ -0,0 +1,52 @@
+# Configuration file for the Sphinx documentation builder.
+#
+# This file only contains a selection of the most common options. For a full
+# list see the documentation:
+# https://www.sphinx-doc.org/en/master/usage/configuration.html
+
+# -- Path setup --------------------------------------------------------------
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#
+# import os
+# import sys
+# sys.path.insert(0, os.path.abspath('.'))
+
+
+# -- Project information -----------------------------------------------------
+
+project = 'corstone1000'
+copyright = '2020-2022, Arm Limited'
+author = 'Arm Limited'
+
+
+# -- General configuration ---------------------------------------------------
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = [
+]
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+# This pattern also affects html_static_path and html_extra_path.
+exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store', 'docs/infra']
+
+
+# -- Options for HTML output -------------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+#
+html_theme = 'sphinx_rtd_theme'
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+#html_static_path = ['_static']

meta-arm/meta-arm-bsp/documentation/corstone1000/index.rst

@@ -0,0 +1,16 @@
+..
+ # Copyright (c) 2022, Arm Limited.
+ #
+ # SPDX-License-Identifier: MIT
+
+################
+ARM Corstone1000
+################
+
+.. toctree::
+   :maxdepth: 1
+
+   software-architecture
+   user-guide
+   release-notes
+   change-log

meta-arm/meta-arm-bsp/documentation/corstone1000/release-notes.rst

@@ -0,0 +1,199 @@
+..
+ # Copyright (c) 2022-2023, Arm Limited.
+ #
+ # SPDX-License-Identifier: MIT
+
+#############
+Release notes
+#############
+
+
+*************************
+Disclaimer
+*************************
+
+You expressly assume all liabilities and risks relating to your use or operation
+of Your Software and Your Hardware designed or modified using the Arm Tools,
+including without limitation, Your software or Your Hardware designed or
+intended for safety-critical applications. Should Your Software or Your Hardware
+prove defective, you assume the entire cost of all necessary servicing, repair
+or correction.
+
+***********************
+Release notes - 2023.06
+***********************
+
+Known Issues or Limitations
+---------------------------
+ - FPGA supports Linux distro install and boot through installer. However, FVP only supports openSUSE raw image installation and boot.
+ - Due to the performance uplimit of MPS3 FPGA and FVP, some Linux distros like Fedora Rawhide can not boot on Corstone-1000 (i.e. user may experience timeouts or boot hang).
+ - PSA Crypto tests (psa-crypto-api-test command) take 30 minutes to complete for FVP and 1 hour for MPS3.
+ - Corstone-1000 SoC on FVP doesn't have a secure debug peripheral. It does on the MPS3 .
+ - The following limitations listed in the previous release are still applicable:
+
+   - UEFI Compliant - Boot from network protocols must be implemented -- FAILURE
+
+   - Known limitations regarding ACS tests - see previous release's notes.
+
+Platform Support
+-----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v2
+   https://developer.arm.com/downloads/-/download-fpga-images
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.19_21
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+**************************
+Release notes - 2022.11.23
+**************************
+
+Known Issues or Limitations
+---------------------------
+ - The external-system can not be reset individually on (or using) AN550_v1 FPGA release. However, the system-wide reset still applies to the external-system.
+ - FPGA supports Linux distro install and boot through installer. However, FVP only supports openSUSE raw image installation and boot.
+ - Due to the performance uplimit of MPS3 FPGA and FVP, some Linux distros like Fedora Rawhide can not boot on Corstone-1000 (i.e. user may experience timeouts or boot hang).
+ - Below SCT FAILURE is a known issues in the FVP:
+   UEFI Compliant - Boot from network protocols must be implemented -- FAILURE
+ - Below SCT FAILURE is a known issue when a terminal emulator (in the system where the user connects to serial ports) does not support 80x25 or 80x50 mode:
+   EFI_SIMPLE_TEXT_OUT_PROTOCOL.SetMode - SetMode() with valid mode -- FAILURE
+ - Known limitations regarding ACS tests: The behavior after running ACS tests on FVP is not consistent.  Both behaviors are expected and are valid;
+   The system might boot till the Linux prompt. Or, the system might wait after finishing the ACS tests.
+   In both cases, the system executes the entire test suite and writes the results as stated in the user guide.
+
+
+Platform Support
+-----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v1
+   https://developer.arm.com/downloads/-/download-fpga-images
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.19_21
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+**************************
+Release notes - 2022.04.04
+**************************
+
+Known Issues or Limitations
+---------------------------
+ - FPGA support Linux distro install and boot through installer. However,
+   FVP only support openSUSE raw image installation and boot.
+ - Due to the performance uplimit of MPS3 FPGA and FVP, some Linux distros like Fedora Rawhide
+   cannot boot on Corstone-1000 (i.e. user may experience timeouts or boot hang).
+ - Below SCT FAILURE is a known issues in the FVP:
+   UEFI Compliant - Boot from network protocols must be implemented -- FAILURE
+
+Platform Support
+-----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v1
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.17_23
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+**************************
+Release notes - 2022.02.25
+**************************
+
+Known Issues or Limitations
+---------------------------
+ - The following tests only work on Corstone-1000 FPGA: ACS tests (SCT, FWTS,
+   BSA), manual capsule update test, Linux distro install and boot.
+
+Platform Support
+----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v1
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.17_23
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+Release notes - 2022.02.21
+--------------------------
+
+Known Issues or Limitations
+---------------------------
+ - The following tests only work on Corstone-1000 FPGA: ACS tests (SCT, FWTS,
+   BSA), manual capsule update test, Linux distro install and boot, psa-arch-test.
+
+Platform Support
+----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v1
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.16.21
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+Release notes - 2022.01.18
+--------------------------
+
+Known Issues or Limitations
+---------------------------
+
+ - Before running each SystemReady-IR tests: ACS tests (SCT, FWTS, BSA), manual
+   capsule update test, Linux distro install and boot, etc., the SecureEnclave
+   flash must be cleaned. See user-guide "Clean Secure Flash Before Testing"
+   section.
+
+Release notes - 2021.12.15
+--------------------------
+
+Software Features
+------------------
+The following components are present in the release:
+
+ - Yocto version Honister
+ - Linux kernel version 5.10
+ - U-Boot 2021.07
+ - OP-TEE version 3.14
+ - Trusted Firmware-A 2.5
+ - Trusted Firmware-M 1.5
+ - OpenAMP 347397decaa43372fc4d00f965640ebde042966d
+ - Trusted Services a365a04f937b9b76ebb2e0eeade226f208cbc0d2
+
+
+Platform Support
+----------------
+ - This software release is tested on Corstone-1000 FPGA version AN550_v1
+ - This software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.16.21
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+Known Issues or Limitations
+---------------------------
+ - The following tests only work on Corstone-1000 FPGA: ACS tests (SCT, FWTS,
+   BSA), manual capsule update test, Linux distro install and boot, and
+   psa-arch-tests.
+ - Only the manual capsule update from UEFI shell is supported on FPGA.
+ - Due to flash size limitation and to support A/B banks,the wic image provided
+   by the user should be smaller than 15MB.
+ - The failures in PSA Arch Crypto Test are known limitations with crypto
+   library. It requires further investigation. The user can refer to `PSA Arch Crypto Test Failure Analysis In TF-M V1.5 Release <https://developer.trustedfirmware.org/w/tf_m/release/psa_arch_crypto_test_failure_analysis_in_tf-m_v1.5_release/>`__
+   for the reason for each failing test.
+
+
+Release notes - 2021.10.29
+--------------------------
+
+Software Features
+-----------------
+This initial release of Corstone-1000 supports booting Linux on the Cortex-A35
+and TF-M/MCUBOOT in the Secure Enclave. The following components are present in
+the release:
+
+ - Linux kernel version 5.10
+ - U-Boot 2021.07
+ - OP-TEE version 3.14
+ - Trusted Firmware-A 2.5
+ - Trusted Firmware-M 1.4
+
+Platform Support
+----------------
+ - This Software release is tested on Corstone-1000 Fast Model platform (FVP) version 11.16.21
+   https://developer.arm.com/tools-and-software/open-source-software/arm-platforms-software/arm-ecosystem-fvps
+
+Known Issues or Limitations
+---------------------------
+ - No software support for external system(Cortex M3)
+ - No communication established between A35 and M0+
+ - Very basic functionality of booting Secure Enclave, Trusted Firmware-A , OP-TEE , u-boot and Linux are performed
+
+Support
+-------
+For technical support email: support-subsystem-iot@arm.com
+
+For all security issues, contact Arm by email at arm-security@arm.com.
+
+--------------
+
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*

meta-arm/meta-arm-bsp/documentation/corstone1000/software-architecture.rst

@@ -0,0 +1,242 @@
+..
+ # Copyright (c) 2022-2023, Arm Limited.
+ #
+ # SPDX-License-Identifier: MIT
+
+######################
+Software architecture
+######################
+
+
+*****************
+Arm Corstone-1000
+*****************
+
+Arm Corstone-1000 is a reference solution for IoT devices. It is part of
+Total Solution for IoT which consists of hardware and software reference
+implementation.
+
+Corstone-1000 software plus hardware reference solution is PSA Level-2 ready
+certified (`PSA L2 Ready`_) as well as System Ready IR certified(`SRIR cert`_).
+More information on the Corstone-1000 subsystem product and design can be
+found at:
+`Arm corstone1000 Software`_ and `Arm corstone1000 Technical Overview`_.
+
+This readme explicitly focuses on the software part of the solution and
+provides internal details on the software components. The reference
+software package of the platform can be retrieved following instructions
+present in the user-guide document.
+
+***************
+Design Overview
+***************
+
+The software architecture of Corstone-1000 platform is a reference
+implementation of Platform Security Architecture (`PSA`_) which provides
+framework to build secure IoT devices.
+
+The base system architecture of the platform is created from three
+different types of systems: Secure Enclave, Host and External System.
+Each subsystem provides different functionality to overall SoC.
+
+
+.. image:: images/CorstoneSubsystems.png
+   :width: 720
+   :alt: CorstoneSubsystems
+
+
+The Secure Enclave System, provides PSA Root of Trust (RoT) and
+cryptographic functions. It is based on an Cortex-M0+ processor,
+CC312 Cryptographic Accelerator and peripherals, such as watchdog and
+secure flash. Software running on the Secure Enclave is isolated via
+hardware for enhanced security. Communication with the Secure Encalve
+is achieved using Message Handling Units (MHUs) and shared memory.
+On system power on, the Secure Enclave boots first. Its software
+comprises of a  ROM code (TF-M BL1), Mcuboot BL2, and
+TrustedFirmware-M(`TF-M`_) as runtime software. The software design on 
+Secure Enclave follows Firmware Framework for M class
+processor (`FF-M`_) specification.
+
+The Host System is based on ARM Cotex-A35 processor with standardized
+peripherals to allow for the booting of a Linux OS. The Cortex-A35 has
+the TrustZone technology that allows secure and non-secure security
+states in the processor. The software design in the Host System follows
+Firmware Framework for A class procseeor (`FF-A`_) specification.
+The boot process follows Trusted Boot Base Requirement (`TBBR`_).
+The Host Subsystem is taken out of reset by the Secure Enclave system
+during its final stages of the initialization. The Host subsystem runs
+FF-A Secure Partitions(based on `Trusted Services`_) and OPTEE-OS
+(`OPTEE-OS`_) in the secure world, and U-Boot(`U-Boot repo`_) and
+linux (`linux repo`_) in the non-secure world. The communication between
+non-secure and the secure world is performed via FF-A messages.
+
+An external system is intended to implement use-case specific
+functionality. The system is based on Cortex-M3 and run RTX RTOS.
+Communictaion between external system and Host(cortex-A35) is performed
+using MHU as transport mechanism and rpmsg messaging system.
+
+Overall, the Corstone-1000 architecture is designed to cover a range
+of Power, Performance, and Area (PPA) applications, and enable extension
+for use-case specific applications, for example, sensors, cloud
+connectivitiy, and edge computing.
+
+*****************
+Secure Boot Chain
+*****************
+
+For the security of a device, it is essential that only authorized
+software should run on the device. The Corstone-1000 boot uses a
+Secure Boot Chain process where an already authenticated image verifies
+and loads the following software in the chain. For the boot chain
+process to work, the start of the chain should be trusted, forming the
+Root of Trust (RoT) of the device. The RoT of the device is immutable in
+nature and encoded into the device by the device owner before it
+is deployed into the field. In Corstone-1000, the BL1 image of the secure
+enclave and content of the CC312 OTP (One Time Programmable) memory
+forms the RoT. The BL1 image exists in ROM (Read Only Memory).
+
+.. image:: images/SecureBootChain.png
+   :width: 870
+   :alt: SecureBootChain
+
+It is a lengthy chain to boot the software on Corstone-1000. On power on,
+the secure enclave starts executing BL1 code from the ROM which is the RoT
+of the device. Authentication of an image involves the steps listed below:
+
+- Load image from flash to dynamic RAM.
+- The public key present in the image header is validated by comparing with the hash.
+  Depending on the image, the hash of the public key is either stored in the OTP or part
+  of the software which is being already verified in the previous stages.
+- The image is validated using the public key.
+
+In the secure enclave, BL1 authenticates the BL2 and passes the execution
+control. BL2 authenticates the initial boot loader of the host (Host TF-A BL2)
+and TF-M. The execution control is now passed to TF-M. TF-M being the run
+time executable of secure enclave which initializes itself and, at the end,
+brings the host CPU out of rest. The host follows the boot standard defined
+in the `TBBR`_ to authenticate the secure and non-secure software.
+
+***************
+Secure Services
+***************
+
+Corstone-1000 is unique in providing a secure environment to run a secure
+workload. The platform has TrustZone technology in the Host subsystem but
+it also has hardware isolated secure enclave environment to run such secure
+workloads. In Corstone-1000, known Secure Services such as Crypto, Protected
+Storage, Internal Trusted Storage and Attestation are available via PSA
+Functional APIs in TF-M. There is no difference for a user communicating to
+these services which are running on a secure enclave instead of the
+secure world of the host subsystem. The below diagram presents the data
+flow path for such calls.
+
+
+.. image:: images/SecureServices.png
+   :width: 930
+   :alt: SecureServices
+
+
+The SE Proxy SP (Secure Enclave Proxy Secure Partition) is a proxy partition
+managed by OPTEE which forwards such calls to the secure enclave. The
+solution relies on OpenAMP which uses shared memory and MHU interrupts as
+a doorbell for communication between two cores. Corstone-1000 implements
+isolation level 2. Cortex-M0+ MPU (Memory Protection Unit) is used to implement
+isolation level 2.
+
+For a user to define its own secure service, both the options of the host
+secure world or secure encalve are available. It's a trade-off between
+lower latency vs higher security. Services running on a secure enclave are
+secure by real hardware isolation but have a higher latency path. In the
+second scenario, the services running on the secure world of the host
+subsystem have lower latency but virtual hardware isolation created by
+TrustZone technology.
+
+
+**********************
+Secure Firmware Update
+**********************
+
+Apart from always booting the authorized images, it is also essential that
+the device only accepts the authorized images in the firmware update
+process. Corstone-1000 supports OTA (Over the Air) firmware updates and
+follows Platform Security Firmware Update sepcification (`FWU`_).
+
+As standardized into `FWU`_, the external flash is divided into two
+banks of which one bank has currently running images and the other bank is
+used for staging new images.  There are four updatable units, i.e. Secure
+Enclave's BL2 and TF-M, and Host's FIP (Firmware Image Package) and Kernel
+Image (the initramfs bundle). The new images are accepted in the form of a UEFI capsule.
+
+
+.. image:: images/ExternalFlash.png
+   :width: 690
+   :alt: ExternalFlash
+
+
+The Metadata Block in the flash has the below firmware update state machine.
+TF-M runs an OTA service that is responsible for accepting and updating the
+images in the flash. The communication between the UEFI Capsule update
+subsystem and the OTA service follows the same data path explained above.
+The OTA service writes the new images to the passive bank after successful
+capsule verification. It changes the state of the system to trial state and
+triggers the reset. Boot loaders in Secure Enclave and Host read the Metadata
+block to get the information on the boot bank. In the successful trial stage,
+the acknowledgment from the host moves the state of the system from trial to
+regular. Any failure in the trial stage or system hangs leads to a system
+reset. This is made sure by the use of watchdog hardware. The Secure Enclave's
+BL1 has the logic to identify multiple resets and eventually switch back to the
+previous good bank. The ability to revert to the previous bank is crucial to
+guarantee the availability of the device.
+
+
+.. image:: images/SecureFirmwareUpdate.png
+   :width: 430
+   :alt: SecureFirmwareUpdate
+
+
+
+******************************
+UEFI Runtime Support in U-Boot
+******************************
+
+Implementation of UEFI boottime and runtime APIs require variable storage.
+In Corstone-1000, these UEFI variables are stored in the Protected Storage
+service. The below diagram presents the data flow to store UEFI variables.
+The U-Boot implementation of the UEFI subsystem uses the U-Boot FF-A driver to
+communicate with the SMM Service in the secure world. The backend of the
+SMM service uses the proxy PS from the SE Proxy SP. From there on, the PS
+calls are forwarded to the secure enclave as explained above.
+
+
+.. image:: images/UEFISupport.png
+   :width: 590
+   :alt: UEFISupport
+
+
+***************
+References
+***************
+`ARM corstone1000 Search`_
+
+`Arm security features`_
+
+--------------
+
+*Copyright (c) 2022-2023, Arm Limited. All rights reserved.*
+
+.. _Arm corstone1000 Technical Overview: https://developer.arm.com/documentation/102360/0000
+.. _Arm corstone1000 Software: https://developer.arm.com/Tools%20and%20Software/Corstone-1000%20Software
+.. _Arm corstone1000 Search: https://developer.arm.com/search#q=corstone-1000
+.. _Arm security features: https://www.arm.com/architecture/security-features/platform-security
+.. _linux repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
+.. _FF-A: https://developer.arm.com/documentation/den0077/latest
+.. _FF-M: https://developer.arm.com/-/media/Files/pdf/PlatformSecurityArchitecture/Architect/DEN0063-PSA_Firmware_Framework-1.0.0-2.pdf?revision=2d1429fa-4b5b-461a-a60e-4ef3d8f7f4b4&hash=3BFD6F3E687F324672F18E5BE9F08EDC48087C93
+.. _FWU: https://developer.arm.com/documentation/den0118/a/
+.. _OPTEE-OS: https://github.com/OP-TEE/optee_os
+.. _PSA: https://www.psacertified.org/
+.. _PSA L2 Ready: https://www.psacertified.org/products/corstone-1000/
+.. _SRIR cert: https://armkeil.blob.core.windows.net/developer/Files/pdf/certificate-list/arm-systemready-ir-certification-arm-corstone-1000.pdf
+.. _TBBR: https://developer.arm.com/documentation/den0006/latest
+.. _TF-M: https://www.trustedfirmware.org/projects/tf-m/
+.. _Trusted Services: https://www.trustedfirmware.org/projects/trusted-services/
+.. _U-Boot repo: https://github.com/u-boot/u-boot.git

meta-arm/meta-arm-bsp/documentation/corstone500.md

@@ -0,0 +1,28 @@
+# Corstone-500 Platform Support in meta-arm-bsp
+
+## Howto Build and Run
+
+### Configuration:
+
+Use the kas
+
+### Build:
+
+``bash$ kas build kas/corstone500.yml
+
+### Run:
+
+Building using kas should have fetch the Fixed Virtual Platform for this
+platform and installed at:
+
+build/tmp/sysroots-components/x86_64/fvp-corstone500-native/usr/bin/./FVP_Corstone-500
+
+with this in place is possible to launch the FVP using the runfvp inside the
+scripts directory:
+
+cd scripts
+
+./runfvp ../build/tmp/deploy/images/corstone500/core-image-minimal-corstone500.fvpconf --console
+
+this will output the console in the launching terminal
+

meta-arm/meta-arm-bsp/documentation/fvp-base.md

@@ -0,0 +1,30 @@
+# Armv8-A Base Platform FVP Support in meta-arm-bsp
+
+## Howto Build and Run
+
+### Configuration:
+In the local.conf file, `MACHINE` should be set:
+```
+MACHINE = "fvp-base"
+```
+
+### Build:
+```
+$ bitbake core-image-base
+```
+
+### Run:
+The `fvp-base` machine has support for the `runfvp` script, so running is simple:
+
+```
+$ runfvp tmp/deploy/images/fvp-base/core-image-base-fvp-base.fvpconf
+```
+## Devices supported in the kernel
+- serial
+- virtio disk
+- network
+- watchdog
+- rtc
+
+## Devices not supported or not functional
+None