From patchwork Wed Jul 30 11:53:27 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Harsimran Singh Tungal X-Patchwork-Id: 67735 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14373C87FCB for ; Wed, 30 Jul 2025 11:54:11 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.web11.33482.1753876443778599444 for ; Wed, 30 Jul 2025 04:54:03 -0700 Authentication-Results: mx.groups.io; dkim=none (message not signed); spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: harsimransingh.tungal@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 740AD2681; Wed, 30 Jul 2025 04:53:55 -0700 (PDT) Received: from e132995.cambridge.arm.com (e132995.arm.com [10.1.25.25]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id B71273F66E; Wed, 30 Jul 2025 04:54:02 -0700 (PDT) From: Harsimran Singh Tungal To: meta-arm@lists.yoctoproject.org Cc: Harsimran Singh Tungal Subject: [PATCH 13/13] arm-bsp/doc: corstone1000: Update architecture document with new PSA FWU implementation details Date: Wed, 30 Jul 2025 12:53:27 +0100 Message-Id: <20250730115327.3671160-14-harsimransingh.tungal@arm.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20250730115327.3671160-1-harsimransingh.tungal@arm.com> References: <20250730115327.3671160-1-harsimransingh.tungal@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 30 Jul 2025 11:54:11 -0000 X-Groupsio-URL: https://lists.yoctoproject.org/g/meta-arm/message/6650 Update the architecture documentation for Corstone-1000 to include details about the new PSA Firmware Update (FWU) implementation. The new section describes the bootloader abstraction layer (BAL), UEFI capsule update flow, FWU metadata handling, and the integration between TF-M and U-Boot for managing trial and accepted images. This documentation helps align the platform with PSA FWU requirements Signed-off-by: Harsimran Singh Tungal --- .../SystemArchitecturePSAFirmwareUpdate.png | Bin 0 -> 47522 bytes .../corstone1000/software-architecture.rst | 117 ++++++++++++++---- 2 files changed, 94 insertions(+), 23 deletions(-) create mode 100644 meta-arm-bsp/documentation/corstone1000/images/SystemArchitecturePSAFirmwareUpdate.png diff --git a/meta-arm-bsp/documentation/corstone1000/images/SystemArchitecturePSAFirmwareUpdate.png b/meta-arm-bsp/documentation/corstone1000/images/SystemArchitecturePSAFirmwareUpdate.png new file mode 100644 index 0000000000000000000000000000000000000000..75cee8be7d6873ab03bfd2b790772dccd4b67458 GIT binary patch literal 47522 zcmeFa1z1&Gw>C^{q`RbKgQWB(1&K|Aq#z|ogDBl8EuBiINQO7wz0J}WroQMa`S?(*!1}LnE9o_r>kae_O5O} zKdac-yLo~!PZ1$wA%UM`&hE_oa6Wz^ZeDiqje@25EeCKH7%v|$_{Rr^pAa|mn=#>_9r%nJu! zAph~pSlF0aJDY+h;F+sFYe8}E~6 z`LS~tueFCYAW)gTrTMXPj_+vd?Cjw2`)O7Vw#N^BJjW3{ z*U!5jFNhq_`jbqNqq;U0t~Y+p6%jl&ThY?S`o_u1K#Mv$Emgc zEXWgaIy*Rk`<>F-&o55@MB1&4r7cq0CvrSq2iVR3|7(9q!}*tm|DW8>+)Bwy*4@KO z#^4IyO?^#EWjSXxF23VCx|;&u`YDH>qH=NdIx%5q2RC~QOQedB-sEw^#??~G(bOC{ z-2+${7`x$WXM6m$i>tH4tzT;S>3&EDa5VkxDUKfuxR0yliB%$3{pZp>Q3SASO9wkk zS7$G9+vCdxPBeUM(p&<^&*kx(eej7KkKH(B8!+MHLDOTKwElH(PZeMIdgZ#DC|D$67v7vYLalohkB+)pc+NzyZL#t6b9Ha0bZj z=S-k|vy;g`Z+A+8;KV`N&QBkeajp!#6Z*3q@SOyS(*c10Z+8YB z3$NaPig(XN=W}JIQxf?t_4zCUJYjlPb8$*(l{}T{|)3nn2(c?eMS2X@<>RmW^3x=Vq^Z}d^UA<{qyiC!1fzJKw>aUPa9XgW7Y!sSs#4n z7mKG<}*$AqCh+rq^=VYay@;kl?X(iyy_&4!L|8U7) zOB^rxYYQh!{#3=kV@ZA)u(?z0)jyZa@$4Ub;=h{tC))8ZO-bZ09P1y0sFMupba;kK zE1inWr;@B+iP!JK?!UgdtehGzA0OD*uN(Z!oBkmb9OrYVy!=mD+&|3IoGo2!yiLu1 z@SI48c0?NA4<1lZnpsd5jF`H)I)FJyD@W!OzfTU1v&Pez#PQHSboc*2%9HCP%Rh0A z;~e0W|Ni2=Pdo4lnm94%zX9QS!UzAxLCZKGsbMaV^8K&6e?~s86ZZO8-G9Y!pYV96 z)&0kS`8QBEP$^QYr%<7mrMa6k62-~cgYz65D*vnYlfnl7ar*R6)c%Xc`_S3uW2E)xCU;&cQ~obp(yCx4y} z-AH_bl*MVC{{1K&zCUw1zkFF9AoCl4^5p*!3gtV|-hV-j{yAsYmgiFalOF%a;x2&` zFFd8&lceahvz|Eh-w0>@kIJn7WyZ{Rd>;LGOPNnl;PK%icwF8-vBUrPjG6z${Qtp< z|78i|Klcg!DvckT z>R+AHe^n{}8z#;FhOU*rq)AUPCBI>@6Qc76wfTz!)jy^^knHGh#3u3&r1+56{Pd51 z53hL=egAcsK8Be8-NN)A^7&u1<9}Y9{5P*9*KO0sZm&+8wJFjC1BNFPBw&>;A0YL2*T*)v3(QjQ)T zmmO1P*4EajCz%x;Yf<1wUN0n58s{xMtlZt*pB{W&J71siR99T^dqaN9K|YzYdA-y8 znXHR0cet-NDN=G9&iJoSx2W@6Z`#=R`ugP&jRKnyE?Q6k6pDofevJ}g(TNJkMUo*t zuv+z|-eZ)*QBH#~A7u#H87Rj?14r+0%@adZ;3#ju3f>wUs50+b`ts?m>xWl#hq~YS zEQy997Kp-Wgt<#3o#r}bj}8yNu9v8!!L~%QZR45J(o5d?w?m-_LG9F83>?i5LI%asb^m@H7hxM-;)&e`8`7BLfVEZuPttn3a28( zmtLSajL_%H$NT7*1iXXV{>}S~H18DCtSx6-Xsm>D?RXHiihgEbY4Aasiq1owm?WQ$ zaAHA1y$d+MDFiyhiFWjDi;&)Z9`k*T<;&!eN7sZ84pu9&?3A-9A)J9I?JuRci`24u zLUPT!V#yd~u`Wleo|&!3^4;4AynXcDW6^PEb^ODVP)CS$)Jw(15NuLUN1))@HU&$M+`p6HLxxKKquW!m4A>0aR!JAG zmI=vH#X)BqeJb0ni7(78;VRlC*wApSdmHI^kP8sKip>}?WOnsmVhsM z1%k>?+zO|4UJbZmg-B$cD92|=TOw=g+^bc~5^Zz8K!~*c6IqxDLabh8A~HOfp2e#+ zjpon4n-464VzIOj-rirJTt6dYwJroHRL$s|#ek-_dEH)OOam@el;eMxMx-KnYm76j zugG3TUXvATzOgjqY}lL=0$sY5ZZ*cktLfvC-`1P#`r%jqXiVU43|9n;wh- zw(mqX&I;M;#mj2(BRc4`mr(dp9>~Wye=sa?03PAUkLI(xW=UB?%BrTZw=w(L=v*2i zPc~w1yIVPhTlLm>xm&|^6LR2r4$7|C9FBR1|QGyd@I^H`5>jz$vIM8t@%ZGf>l zbkw@;#aCGwLiUqO#1NO!(yO!_2jj;6gC5g<3VVgm$=@mKXSRI*a;@ETNY~hJK_Ned z$9VC3Pz}bVr8iG*37B*Pn@C)RBQb zZ(N7O(q5EiR=$@TLCSgsXkfW57<1&Q-8G5t9(P7&&2|Rv%V-sA++TXv=y3;C)OAV2 zpvnw`PRu=e?Oh|QE*sUIG65#633^n+wmbOz;Z`MA3O-7jrrj?fLLu(C%S!mfVS4Jk zp+$d=WdD39CdyoT0$ZW!^E)b&hDxo6-*=61NLiwvSED0jt(K#y_(cs_i!q-iSfCNs zy)ui#kdcu>1Z1+L0ry!Td#X{FIN25dggpie?Ocr1RFhYU{kw*dTsV4;*Cp@ma7o@q zkM%`7&&$c2v#ECZ&tIkR(5t2kL^vu5BvP8p--%OSpL(|cJR~Y$xZtva$g@y#)GZe zePgPrzCP=+!}S=HFR!7}*(CIrJk|`UFFG^PN%&4E*aIhFrX8DsQd{<>@_p+IBPTv5 zzju4SrAl&dXWZE4>z7YtlDB=oB=+V=N|JLK+!OU!`*=4RH|#a^-Gt0z`*-O|pYGt( zU|~*)d8~ai>n9o*<%TEp@>{>s0QQ!8HaMI`DKTW12m_abX_Ef+GanBEVn~VIa3TJa z8-qbzr3SECySJT~pLEL&@9R~WRb6K1yuGyb9&z`ch?7|-YS@cR--e zSe2gkRBoFhxNbXe_b^I}i4@|}8BL|at5u}-iG3@@2^sXFh+3B!6zR)S0t+7B$?Hqz zqG>#sF~<)5_IcrQdlwcHsV-(fNNJ?*6N{i?mdnY}O01KgHxmLgBn+K$_comZGvpV0 z)9P;*s-!iiG7s4YhvyM4@vt2wap*Q+;oIndp)HLJ(g??|JymE7#}Dkqkks#au3p1(o^Ibc>|vq=-P* ztPsI-crmYTFJZoCf3~;;6R8iC;V!CQl}Q^~IUz1jVnm>TjDKr;RQ>gq+gVD*7d~98 zwciXBCFpl~-#yFc9QF|$9$PQO(+TdX)OC-Q>E9K0ljaqdUxR7DTMMuPIttWtvVqBx z-jLMDoyh&Z*+u^iPlCEmfpVN~mW)uDk{;_xF%zl%S&adWH8zdr;@$0Kt*5clC0U|w zk?L533Q`3Q)6JQww%zdz$TM9zU4Z>vvtLG@e9X!f!+a-Tot5-x1Lol|&r#FrUcFIo z)=4LBzFV2!_8DVnQAv(jEkoFW<-IJMZaM8WG*V{e4xL8rk}FOGm}EpZd|L= zaK?MQ_nQ1Kvq+p9ps9pPo6cFNbJax=6a_d|g?_!Dwl|WOsL}zy&poN&OBt`0i8A+o zBaHsG30hQK@`_ckwUYx6nXuZ}KpgeMz_>FKvLdEQKSOT~R%=k;!#9pI+#uG-sb_nT zp@u}vTw79-J)c`|^vpZyU2g)@nTPl%K9Y~TlSg7LN@fR?*0 zXfT&2R!xjU&@yMt@T6CiFfbwU_+>+S=xl9?DtlMYJ6SM@!DQ3*)sw;_zDq@fknLre43#n=mcbq;&s@3BQ&$A# zrj@L`klVL8-$klev_4dDnNouMMcqhH9EyaM#@?Qk67dftfs1xi8dg^i{)(1Gxo=as z(k3@Dj3d1&l{d2=J|Rs@@GuNkDblV=R$j9@UQtwO`rP>=%iM+8Wk~JBW1Hd6wYOha zTQ8KeI5OxH5rkLuOI<&6#6%jxT`3;yPx~ZMB^vcB!N@AtkIWi_5*)rDmQHCUJsu@BBx)s+qrybd14>lk&Yzal=dXDe|;wwa) z2-!~PUawT5m=)xVTN zGJAkW5-|;ut%O>kGj5c?7u$&=jGKs#GXzCgn1tu>1a9RA z-nx=batb-NniHWgNS#sCgF0H?1z?H?ZDSxXN#%+2vYq-0E}GSOl%Uw>=oaJn_bjAM z8F9(J-Tx_-pZOfXw0m+W_JNhRXH2d~LUSomE%;s}(IsZ8@g!cEHo}@Iz3iD<^+cD? z$p5n>(Kl3y=e+utf12A#3WjwS73}(@AwcaAMz|C|+C=PmI6-+}d?sqT>AgsMd6Zgw zXrrWIGdfdR-3aaBh_g{d1~c=!Q(0vJu@voDXFceHC*T1%(7OGDCM4dA#4}=f!q5~u z!Y4*}6j{u0O&0H2NM>_hr)oSw;!v#AP?SUzuyUk}z9KQ?F?68T!B~2ZY;qS^)`kVd zduQcE#KUj#y&xz2?8oDnB4=>@ci90J8vHym^C$($*Sk8W`Kaimpe*PN7FrCAFpDS2 zoH3ZqdOkqxGPuE7ibcEJm(L3?LvmIBaFbYu01K|VLez0V;C-2LC{!1n`pxQ{7cw7R z=*LA%mNo&%S-@>YyM>8#w{xa?i;Vq>-pxwbS#V(fN@UBTTLDPkH`@n_*7Hh*2}Lo+ zb6pc^CcyNN1|q*ig*xdLJAg{>@fsvRB)u8nDE;!@3o(Ilk_UsEIpU(pMNwFKbVZVL zG!*zRkGK$rQ}Ubxa4>bQGiJ5^ZhQhR8V*{m!!!$R`d++B{uGE~A{i@xFbR<`6vGZ7 z+X<;CN*?#}yi1>UuzYt$b;(*E1znGeLYYa!G7;xT_--!|zlbD{%9il!@z@69|CNy= zcR~;dQh_TY#hS~9-@hXB?++JV4quN6h*zngX!*plE&~H(gW}eQ{vvV?oeBFy7{h5{ z^h)PShvH~I^L8sWcv7lwq%0{UC8b!1AHt@!0dEbn5VCu7@9uYiQ4MB(zwSVIYj?tV zY^8wCIQohzjFQC|EG)#fe92pnR}xJ80Er7YOkHZuQTSbE8x$Y}ag;QSp%z>MLH-SO zyutMd$=`AuaI)EXkGY+MT*RX}|pH+e1=Tt-Nl zi#JV(rUDy(bZr;AoQ_7=p3L*KY=|JPAdUNu1;3zQo&PF1zo8ZiWg5Q5^oefEBC&+1 zR~?C%0fXVwRc4v|Tiyx9sv`HyU%s)Y2DNFHt&RhFdxUTSu)~)#~UtEKeAbytk3_(k$XBnhGH$r z&Wx03Y1de(ih6zi(-Wq#Y38ZFt#x2sFkVl6(tG8!JSiC+KfMvWpjQb6m}fNfnc}d! zG|+oiKD&!)B9*xJwmPsH=z=j^_ViV7DOR+&bK-gT*tLcLq2l(GY4jNeDnr^7qs@9M z>)l?EJ^FiZ&S9`0d3Tj1={I|A-2veExnz&{eI$%+@cSx+iV0kroH(3}o#aIfP0CzH zgbX$*OFqo9XG49W()5vtA=TYLtng+Sk%~K^hUv_+5d$vk4(Ms9(#k`GI&#Iie51b$S|#P!}>B2TdKPRVDV)X z_0k4%)Ir^xSr1_w$5qDoS6T9{bgPzaK^RRrt<54v4X#Z^;q;QtgqoVt{<9SFR9?7BRp{m4L2t7}1!iFBgBk@ZVUZ6{eHF3Ue8M0FU@wTeIEcP0Lfj&$qjD#ll| zkk_qCR|=HLIaG~0%^1<5D7fZ=@65f38U~PIu{zsM6;@>m(lI*HUI;cx9iFU>9#JI; zny~$(NuGYGHakPQ4v7k{IkDdYygl(g^__rsJ4p|ff=z?s?{EeNJRHO2)SaM2a&o&J zB-~cmPK|CvSjMgCSj3EwiU`Nqb}ET;ZxdDOGN0HC-vN{=D`a@X@;tr)9jfi5^M_Ze z=jEe`#`PcKUZ%=f;vghS#2d84n$S0{j})j=IXhH&jo9&pH++sV9=q-ZfZrpJw(h=q z6ea~I0Brlm&~(Lb78X^^2-%@%K*m;)YZ+R^7;+CKvofIQ3h42Jvkzn?oSY(qx)c<# zczptpkEIocaB3CONLLF{H2DfjJzl4o$x2h1n{OVMEN>+ch@%Grv^os@ae~)6Uv4;= ziB$h?BCEO@;BR*EmV4MRP$?M(TKxSReD`4tQJG}77@-F}>COq7X>kE`J4u82ZN4Rn zaaN2b+ukMGB_x0uQshjv!WoqL8YH&`n5D-S2$JVkCSr-$6xTuO*KqrL!`qtf+gp9Y z+u!zGM4jJb`5k@V<$MePz~&wLHC&tFLP3@IR{|klV?QtUT?Y7fR|_AtwJv0Lvfd?g zh&r&XwOT%gS^)4Tw<*kJv_LkX~{uDElTJmZ}gdzC=y`hiLP@G>Bd_w2Qwgb>iBgP<(~V$-Y$EPw=~6~;NuZD*%j&Ef9$z z_+gE>ii_YFVfR1$_Sn3O;9P8y5{n{b_}k2jF2z=T>6rp&^otUiFLy@b@EE=CPDmU0 z^tz^t-E${irJHQ=YbY+|=Qy22?9ib4OP(76ANH1qSsUC|lgm*&_o{-mLAsZmE_ka` z|LyIAW!9(X3>KP8Kuq7L(=CkX5U$?QGH`xM?_*&_G!y<*-MJ>aSMrZ2X&o7YKLVw= zeR3*`l>9O@(Qg`ivn`O307}O&3QYr8WbR|>K<&*o@kEi#4v%gcC6+|g1;pJj{(fqw zXAzGS7XbidlMcc9R`pbRku$!RlIQwH1TKYNC=PiuG!1$SNq68Q08!g@^!+7I%Z7KD z;|0J6WK@O`(tno6rMVJcmL=xl+z5VH4GDOCwumHQ#sNuNjMAqE3UL#d{%@b!sT7*j zhhUKNsF@@qdB2SaNfMSo$M!1$7#>Rl3{MRi-SNhFGpl!3Mx!DMADH)NUaXN{Bf>^MnE56-r+YSEqm^5?@s$~DN#DU zcoXP`&7+^nYq}@Fzy`AoINJX}e?cP`CFY!XI-tXsyGT&yBKsJHTJ|VCi1qJF-O-~t z>w`R-d6}q!L1}6`>9sT*4~xL6P(4S@ZFOv6&Gd!glbhtzJJkGEDlBOt9c^Ff4KRWvO+p(8e=JPzilFlS5!Cf2&i+`pZGQ^UAX9g?f|LB+9Z;{ zBvvFg%ko{N+@_oS=4gVM7(uuX4BV?p5e4I2FuKI_6lGiAJ2n5>jAmG*z=TpKETxs0 z_vSMwK@Hf;(`SVpScwtqy(L;j6JqKMcoVy`8YEw@J20i`rEU1i40Q)w!p-vYu##8{Hq(h}6CJith#SrG|!Wa#m{2(K)Z-r5QR#P;ehvIGvhSrI)5K2N8h~qu#fP zXw!K}V#EjHu24z{w=NaTA~#Pi3dR?bM9lr%ak`^K4Zx$N?_YPDN`h7)Lh6ADDgh{Y zxYd|1Z#}*-xCAs{&4HW9)+QR(N2b;}6SUkr0Uy)$(9a|(P|Hg1ik*gEFMav&NDhB@ z{Hfhr*dThzFi_->sUV7J7@kz8>2g36MP~>;(*`I!wWJ1^xnNJ`7AwS1%Yih?%9ltO zvTHQM>woAwmKx z}c|3ly$LY{#fc9jTGkJm(vA*0M z*q>5{Rau#gz~#+$Q1n(stH}|Nv*F8CK@T}0Xo*zkUOa8Am#y1qy->~`gpKN6q&*)Ig0>ez3A@Lj>=J@d`L^z=-{DW*A_Tqx^?Cj zy-@I3F)YAIU|)$X3l_1F1}^u#g$X(doeF;#V%8>4`JM!0w-f~Rd2)9!1WV7AaX~*PqI9##?$o0DVVEuSQ5`uF3E2!W zJ>_kmM_b38oZr0Nrgc6yRb@$=sG(KS%4GebA`3yk$?FaVO0}E8LoEYh(2RlSmEqFr zGr73yzTfsX^$BM*NXJwzVP<`5fe1=^QtZVdv{&0*Fhq&Ne5VXP=2t{R@uwOHnw+M9 zCTI)i=|0of+Ou9lKc9AJ4y!8alo<05Y~*wm`jQG=*kEisN6Emsci6f$kfFpvz}8wY z@~n33i8)7NgeqiG#7WsM6v@g`GN@rion>9!Na`xQxiV7HG^i;oewJVDs??g}9KkFU z%LDLVm*|o#g0KRK+OCoptwJR|69AvwsUzBS7FpKm;|M1b(q8H(PAo|jsq1KmMW$Y9 z3PJMwDOYUEO};+|)rG3BENPAjq0AJXt<`5PGjax05*)CmK^-T2OIe*)_M|3EG34Md zhPusm@2D8DGKQONd$aC$=trgT7-Kil{p(%=iodG$nW}hhKnBdQ%ZdU*T4cCHg8`u_ ze-e*b#&oE}QkLPhH860}3*eZ7alO*l;J%3q{#;Z{4cRTIiJ;$tn)V39W`kBr1>cpB zpy_elOX=}BM|>T*C5#;(l%`ozl!q+Jj-q(|Gmb=VQXzxo1_Rt?tfr4TP^qT8Xge`< z(9-E$L)KGOM&vlzUE^-{xfQ8QzOK#MP9n~4%c_oV?vs;R_eOP+hS7x3P1K9rLWCUZ z>`G3ko5kUknLvVS8NLiopwDd(LWbWev5XNA_-!2PQ`E?nQoLR3y5T^JJi2I9jEUBFXg#1Zp`oJ}N&6Ltk!~O&oB7OAXfQH< zU4w|^OLJZ%=*cDYT@_iPS(4{s8um~rT)zl+kcunT8JKZREp>2;4}p+Ya+j`Eio6e^ zgqStX(gg_3Zq779ge8|WkNDE8UbdEgf30M^%#5#-lo0(=5NpYZXJWjyrf>It>Mi+| zDV;3lv_pl51~6hm!rn^Bb_sHM+K^Oi1k<5JFsNldd@>Pf5ro&8guRxlgJiZlgSEVg zILK_>dDUzMX3vGupo^BfVga);(#BWLFsN(mw{!8@d^ z`zz#}dwb8x(e1?e-KUvI!%!+W0t4FC>Bdm%zMYYURiVDPLmD9#fEiAcNcyhH>n?)M zu*ZZ-o`l?%J3(p4U$cT&(;Q}c6$Spn08ZEOxZUUrNaiv}u<|LBal0YkA8tN!d>&A? zfp-vyK`vrC*-DY2tjA~q?~KA8zwwZ)PR;ydYU59%wiLSH>EYNK>~VHXYz9@=Z*n-) z(|U=^6=EKeJ9!E_4Y;=*}07Gpd$EzB|6{E-ZuQHLtS^1~e0#$3oV&p_o$RRWouEtP-3+rwD6e|9 zlB)D+P?@S_MX;I<9+NSo8ED)UEo2O^ka9E*j-oa@|H#k;5rUgZj$M@C#o_4kba8*^cE}Vvh(fZjy4EdZQ`A#@^>{iOI=+=X0%}L0K`Hq~gouBB3S_G)2bH zTW5%$mlj|lMuO5u_~=lHR5AzjnWuz!QQ~c}sXU!haz-P;{YMwg!ZyP%UDAzI{2aV@ ziwP%KEP-sExbo#!(-g0>Jf=2$P{?)}B|?w;R?iK{w$%YeqRnI3d~tYd9@f&nr@pK5 zIdRT}Foh`fGwWuMk3XK7o1#|W$RBwb)76la(5v=(MEAWV(7gHma1qS?mwueWRP9*e5A=Jd!Iu$`=$Qkj;9*)@q++zbkE zfNc9VL6qi+iM-Cnl{~&df4t@wef_cQi0qxbqVgx234`^dsN$>2iiKj#tbVv?ER4Ad znyDfx70b%+X9e?;BW_Bya<7LOE#8NRT#-XZ1B+!hP~W+5wF&a`vJ_5|v_dGj2+Ow<yX z-FBk#_R5Sy>PrCq*;P_`M~c+xJ26scvSA95{GT23#l7T-DoN4Yy(BN0p37S|s#vG< z6W&3JfQ~Nb(g#1RC4F6K*fWP`-Oe7cL8xY9_fVScbMBi_4T}~uq&)~Nv0Og7(;tJ5?&<9#W6ce$f)5Lw;bF4|26s4&6 ztt_f1K)*|K3Xv>H|NTi2^1I^2JnRnu1+WZQpOI!iA5|vOPwH8sNpCTf>_&DFn?& z=V=JjfvoaAC=74;f}B_dbU57yU0lT7^krdyYuK%lYLAQ%YXJ0u9H>Ws5UpGR>|<2K z9N0Rt>j<=n)$wd-as6obara9BrNF8M5~g*a3|n!dI!6X%F&^|pU0&!(dI03gcM)_z zhzZ&Zb=V~CfBAIn>13hO-8*WTB5ihn8yzJ?^rrE%ewuE{@yEOpvsv8n`YmT#UPW02 zT9cBozCQJKrqYh5l;Xw7p}P{cDWB8u=Ov8>&B2zPsgbp_IX`!wwV{q@I*{pf;1*KX>BA6_jGCdC_x%#yv z=}@dsV^t!<_56|TM}_mCj|JHvh=vW=ET(HPQ&nJJ42=Up_bmI;lkybe*7%w9$l;S0 zu9nJzsn)vVt&>-;f>Z(*Rz#r(hu^q0R)%1rT&u0jY&Y{>o4jbh`yt2Q%2~vu6~+DG zs5A_o57%K;P4AE;_X|`Enk-$bh9;$=bEbKoS*u$ed-Q<*_FfwYQUIA=Z_BpIgqJv0 zbH6VrW)3#4rH3u~jIa7ASU&urcYj}pX}{b8G4A2nt=*+}U*lp4jI&+%(e6v%R(*Zt zMP4LEqUMqY10Ge(4`~n)i%fTiHg=_%NcenDF~vc1m^zZ_ zHx|!V;8}O}*KC(F&r5^3vuGWRzl{K*@sEyuBW$Pzs4b(TZf^H)SJ< zxbHm}j{l${Ka(>KtaUiW^}{Ug+J1(jX-T5A06$aIeIKSD!SUUO*mUc`@YZto6S^GZ zDYghUt#&jr2^EVEG>O#q@R`w;{^h+LI@b@c1=l2R<)LZAjNEFYU!mneKjC1Y8&b6uUA2^Dbw6aVuGWT_3RaV=~`ch%Y|y zcqd3WxLZEH8{4DP?>(rcOE;ZomvUn_;@Y>Ch&lNOX!>`rSiHd3inNAq7&_TZIlad* zYW)5>U`M9YQ@dc`!v^ysIb_T!A$N<}F(KA-wLlwx6%VCnj$5G8;f)!7;`Ze7ZtO6E zrqMI@YPC>RliVAw6Ic$@%A>T9vbUuI+0_Siw8dBG~?Bb*TCYgbHtYKWmhbuz8i5nj!taR zg&B7;@RK4?e!YfMU5QQO3WsppvPLZksbSQvZ8ATPM)C|KeBn0Z{n~%2m%Cb;mo6#! zNsd+oi=lPnIHK^Pyw;DSWsX|k#aW21u`0~S!lj7K+N^&liGz5;!->4{)$JT8PZDBd zzkz^*!kSFZF@vDj;rSi>%w=+?1hzVQ((XTdU!C_C(tPsE^%-)zc}c!Q1C0DCm(+@ z6FuejjxESu|MXFk)v}NFNz4yC(o6Ea_3~Q^U0nV8q=8q(URAEzuDLoDdk@}AKT~3D zgpC-1)IU`Y9uxk+Sw>z!Yq3%CllU1H&O6j?{X}0@X!M`PBC`EbE%^X z3Ep3|rqi zthT$z=KYT_q#7?~jJ?~#B_fbq(@mjh^kV-^{+$Bi2`77E>#Rq~&+0AL2S>nq_|0Ji zuX;Wc`7PX!>S;5LYIY`KLqAvZ*~h+hJ0Clkc%bI`VcJqLi|Ug5_4e zEK)d#zS6g*(e2J%KBxL^Ire@qMGa8kj zKe;?FB7PI>NwIKP<5orGR{PC2ZZ`M@u^GWb9WU=cV<@pvg1nj%Rs3L2pYMx!sd0GE zlIxE{i&zW%wqic7vu82rA2x{HYMp7nY!HbwPVMv$-Ec+_Zrbk)FrMsz_j zM`~YbX-Q+@A|ZTcrexK1V+8*~8b3o)&yMjLjzU<48_>HenJIeqUDXU!s6id}>&N4WRAc$(jFTSt4un+IvyYVpF zHxlO4d2+baVqaR`D}aNv06>ia(37z*arqu_|Lh8?P2&cS^;fTNCe)Mfnw-1n9Fikf zqFZsUFO@G?Ek~kH-xhSh^rjhUI=)Z@U9jH;JQjM$(*Y{I-$%qCy|+(OJu+8HJ|g3_ zyG93sPHe^1{f$|4V?@yAK|kBA?G+L~OM$$h><6G)?@Y%2y76xD{|(rzhe5W~n^J63DKIyDF1@5ggL)A1B&A9k8SoUjxOzgM}1hHh|-r zsx;OSzFUj<)20#lIEOEe=Be(ns%H;?&dw5@M+Wy;RH@&z_)8w0%OII-ix33_bJ2a7 zuq&W4;AuYJ!+6k>w50qN&HxIrO*^IwyOWA!(M-rXR30dvRuOdGpD8zLT2L*aehagv9MpyhSLW=t5N zjo>&;<+oO&2ZUkd=3KezJ%Gdc;hpRa98pUgx_KOSxQNG{)RiENFiFcNs4(4+2CW~+ zF8G}zfPB;RfF-0vQu3_LQw^71xjBzG6_ULcX>!HaqZgBQ`Lp z8nit4#_KivdLcVek~sAfWzKJ81#GKy9+Ok1GWN`e*P7>L8kq7_pML3FU7 zC#zq=^%w&!|NHSOwgPiqaq6H&VP0+4442XS=+G}`R1>s>Nxc4IhtNL4ddZ4awgNhz z4Q%g7No!VO2VLgIs`v}_q9*hPya`*wzraGexh(?uI8=a(Pb(6iA(e{J&CHnw%>W%* z7UOz5D5Ts~dsd(&CJ9-Q2Sqd!;n&FeFUZ=vW~tdWJll>^*tPCZa2s~d66V_>vfJw_ zX)YFv)8F|P2@PN#?BYJ3qZ9KLrLW$+djIp)p8de5)^D>PyH3Fj>Rm9#35$DkBy!HU z(kU8;?Y-&G5&N>HXsw=o6{d72U*fq0tF8C`9P@%&R#?NAb>-0&orUSFy)DRSxkebl z^-EHHtB-T5lX}?Z+17{0rpFHphrC`6ATn4DnZKaC?aSoF{Ulx+)*edu;lnylc8m6! z5Qmb_t2H6lOP~uWl)t;P>{~WXM35#EY1Ljg%C$O2Qta$AlQZT1ttj`haJ$sw; z7fophux3eo<~#9YUqjgCR2IRTV2JDN(0uT=9(WrPl<})sRX{t`gjnZ4avQ>GDg^hf z-_DAfmyCBv=>2So7W;Gh*%xPrB3EV6q7W*HOxQW{57(+IE%NZF1;W*fHKkw)R76U& zj(PaP7wTTjZ5upGg!EsOfh9y^VY3XdaHfT?wk?a8i5lqxg-F33rj)|NDrn8>vL(Ef z@5-y>?QjSWe3^fHC3BD2T4&+=#^r2K@1URZ&#h=ajGT_j zja=d=lFP3T0@1ARE>3P9(19xGw@jJmgfqdR_qTWq>!g(KvMiv(X~7$i7~b^jG>K2! z<}o%8p!Y!A&SGy(H_23^hlBfFjCxtR5Phh&8E6U2w3+-TDqu*n%Kg|ZVKMxL%I9d; zg0Y#H^<`ZJXPplW{&B3r_y_|bYshSNGajNC^HvrOd$Q%u_6{^5-!(?z_flGWlcPMBp9FulUOTgKbhKs zxp9+<*966fcgZu7RoMhGaf{5Xh!NBvUgqQpn>C)SNi9N<-lv0B7=R(7Ua7@xGm zhsSoV6)R+9YuDVyzo6O7#H^n55m)$qtg4u1GOd2`mA=S(k}|02)sC zxzDwrg(|mTp~thW-Uf}nbTRaz+4B8oRrOu0?q7}49qd)AxzQ7Z_&D~q*xUStcpd0T zO^#Ukt{ul0Sm4wVkN|mU%^F%}bvZptX>obJ==FgpI2|KNc?h1APN%=hy41zw^1fBm zbzzSDz;ABd_2`wj``1u8VVOld6&Nl#kK(&C?hmkt&qKZ{hd1L;Fg`zr1Vs}}1q{!L ze&klx2Om{rkhrrpEtJ~svGXCqKy~Q1x3z_v;k0dK&85JT_{KR$^-b3wt z9^=Pb9K<11;&~+=y>7gd^XW}>hM8*g{ObtO;W;k(SpWNvBbC^XBQEHPr}u@3)*l6adApS;$ajjmHy zShAR1lJeTjF*Q3msnQ^X)co;7mdYPwU}3xTaLosD1y-Lj4ra#k>@TyVwceP>zptXB z>Fu%fJfvEt;)@E*nltOwT6Zkjpl)ogMK8b3?f#gw`;X0-kclr6*2dh+-FXA3>UfnO zu$JC}-wYvuZn?X|kRh~dx?UpwR?ZmXJvYrgl~{TSwU%8v<%mS4Jk$pV{Mf4#`N7h> z4;%&S6#Pj)(Y*1s7^dulSc9Ol_{Q=UIpru!`Qzg4&;k5K|1LbL%Pj(5LknZGlq)1h zcTRc%w#NJB-9eyCiqy`3XMK3NmA|gb?+B-9YkU!Mmw^yuT*4MXL*e&9DdHy-)(%O& zr2+s2?- z$O7Vp`L4Kol76?T#cpw4`{tW6qsTG`gZF%9uS)bHOPRpA%HhaqJ|!TjQG&zFt~|mf zK{50c|E*?W8P#hH9j>C-EHhkYLtQ`0(L}F}A$Sg6bI@^h!PWo ztTD8KEo0oaP_BlOox4?QX)l3vL_H#d^E>z-#rD5pJoz}8m;+kK3~xNRO&XehIGtGU zvZb~%Rw{N4w#A;x`MN39tTPtjW`Df}5hAFQsiy*)ZJ^o7I4Zx1b#pnY8K%ys_j|VB zuX5?LHVE6{TrNBP+Rz%T3(bIYdaXysqoq<0%f)4_Z7p2im5^E9t{Nuey8?-Qy)0Cm zk%Qm;?ybi~J_Wvlb3y@uDdRx@B9B})|xdpb1`eU z;Oaf^yZ5u7+E4r*vdONv2l(-WMe1b;E+Z2>!uZiFHO?q!tfdUu-e*IZt)ypmBh}7^ zi+21N942RZBCiAyL6cqLB}%ih`05iLek6(yTi)Ts)#K-c@n}-_FT;m2Nrj6{n^=w+ zo+2=a`l(Jn$~WG18^=3b7`V4KmLVYa@otc&qj~FFn|k4pS8YeqiSjQ70`NGXjmr&E zpzW^j(I%e16XyeMxli-$OKbfieg_W}=V&Ap8d{EiJDNrorYQJ`m!jhlo0Ic7efg9I zQ-bVM2Aa%L#Jum!A1h-iUmcA+=e2rUB&bpE%3+wdF9QwTHryO`-s?!EH?u!2*QBDU ztrABsY(Zxuc(uNqZA=yMd$_NrgO+CZGx1vTXZTkT^qhM`po`@SuBVsmKWZI><;>tDnIkMp^r;~(D%#B zM`THhfJBAz+|S+ZEt()=;ecgXrNR=I{FQNK<$}>7<&+Pzw;QJ?7#v^s#fh6bCN3PK zL{txTD9siYghwCtjTz)*NNvro_H@3+hbq&NJT}9-I9?1`4rjKPUP}o~6Q6EBt)2IH zm`*}~*`Gv2uCTN)VASn}g}+t%mj9>K1tZ~LpqTq%Uc(6kf-S?Q={LfGys^16LtBMp zlu1fysc>|pE<{>q`%Fz^9m_!eP>Az2duLBH_4N^R#V9Ujs}A8Q+0ujFY?}hf_?N$y zZ*Z)3tO+QpQxjs0V^lJv+cm#K=Py(}t;N<_oyxH-JK1ANdP;Q>cC9nM<~Ocn4qRnV zuQQnHF8|~9K)VJ`*u+2@TaDd@VLd0soReTgPAfd(H~y&>d&xndgDo zZ1l3{v6qpBwLyloY72`rLbm4yt)>FHJmOhw$|@PK|p_W zR5%Ah0g9V;zryqK6_pC>e6v+LW>8Qu5Y>)jsw4t#t3)1p6;?E7Pb}^iOxhzZD(vS? zOeU)`=f)L>myd|UBnIAbNEtWh>VzNH7R!e94AGvaXWBDDQy#Lv!d&dplCN#@$?^Y{ zPmk)j3bA%xTHZpqWXhcXwNA z$VK`oBmQaVJ@a@0w;6iG(T`RM5QdnTc(C&wSf1YVJv6pPx zSF<^)1`@vWd0OBqeu&;AzQ)M&92ZjRlC!o^{n8IFy1_f~7{p_KcTsBZZ+~yTUMVv+ zz2&EHudaP#4#L#*Sogfl~lk&FdRe1dw}V(+&1Mm~fb|tK3X_sE7-_ z^`Syem<@KA=4gRtzP7%7lKXiE@rB7`CI`FqFonrXA?^OwOf2V59-{9~K96E5&l|*j zOK7uNm&vU>&T7h4anPv->xl2I^pCqr-`3*F6~e%y&Zy8iHhvW2D-nq*z5(ct+Gd*iELn!ZP_?9IcU$w!Qi3@=G7jgoC1SL>fiE@I}YD;Ft{=E@%# z7DiFYn3+uFvdJVpMF=xu?5%N_h;giQWVDwvKBl2p%*a@b!)5df_&VDhc;E{sNw?pt zi@$+Q*>4ayRo3h)Sq@KaWuxs=WTVE(77Dl_eV-BkcW5d5sL5}(#h$2uM`Gt&3lIDB zF4muos3@*l9@z%G5{vF2Chz$A;NJIdV6)FlJ{gU^imh~Dq22nHeHxwvOWd5Umg0~cOJDtfMa*;!ltI2Klw4qf%^L=# z1!}O-TNJkvc)JF*(?8Jx)$d8gb1m3~D)pn`oUch_BVWFwR^l`-bT8$tbaPzK11&&M zf1~jdYS4x;fIH5vsOMbx_MEhO8kT9vM?fizHpAN+&m9J`;0v6;s!z@yo6I@H_$fF& z=Mh5I1fi)CZ5<*JP(Z49zE<=sOa`!1ET=OKu2ar1aO+C=!4unHbv*-i!5vqzg@@ny*%rN&CZnNIE}0yY zFbyG)o;BdXlBC$i#-+D=efGdAk51PHBCs zs;wHJP&Dg8kHrU}P4&e3b`Zq#%{%J+WY4U;C!UH;&bFl(L(;6zRMyk$TLvDtWPk8I zp5Lgp7u3noJwjsjqAm|p{^S?pc6anMXBP}n z3b_ZVvY3A+nc0TQ3%T>dsY`5mGD2$dEUX6^lsG0>fBNYLCg)o*E0yN9Gcyd|xQFjq zx=x9)R*C{Vta~CDVL;-w&%~YGPk_jS=yQsm`;o8xEf#@88P1?#wM15Wc->jl!Pb-n zdPFVVPkCi2gV-J2JFzK`bAAo*bDfAE1yrSt9*vUQ?` z5>NYAt^N9v2xrhE;G5jON5dp{M@@rTGCtmgF{WN9Sw8sTgoG`)3SD=t*cDRM_m$?f z824um0+>awb}EjVoIl_#lCF*9#Mnfrz}Na;_Y--dKByMn@&V+IPtXXWuGziM@c&n7F4|NqARP`*ZM^!&O^#T{&feLh14=j%8%>f{l{nP z(b+%TD_pzuXF#_lXT5;iPWbW1jgC(G)2L)n077UT(J9 zB;r1uwsvBrylxhZW;2YG!yc0HJglWJ1l1-gf#3aEhke_7;?};>s(vyI1WRIV`kn2> zBt4flVVBiY{isms@v`b;nG(4Z)qXXAJCP3hm7&=To!OueBjPOMT7p|cl43`%kn!AN zG42ZVp12@&3}3hG(pD2_KXnVi$cXob2BFh_+T(#;$cM`eImgo<_nsBnZ`)iBhJjTJL_PfBX>^%H`AHXL4M8Y zB^|6p`2*=s4;Xtuc)nl(&;Cn9wLypVG3U~Zb_*s-EH> zE&YYewFHNgz1jqkgSD9cI@MOx$Y|veHyc?B!%Yb+W9xmDB0mGDB%y4bIY&!pVm9V{6N)LjTxeYh4C*{X9ecqG-;w!IY6 z)5K{mzXX~&86Vw|<(_ssJ1+0*R~{U2+%FP_7SKJu-i{wn&E~wbV7E3*U%~lw$A^-8 zC!VdZDHeHpt&{c!x5at2KpSi;OuuJCJmveG; zod+~OEE}*8P#UQSFU;YGbBYL!$68PlK7B8n$tDkf!o#f@@##sf%z~S&ibF14BTDE2 zN*ry2@4bBrLCSaFvj!ub5@F-b1mNU;){kTkkHN&JZyRk+${qa?{XC?4kRTT{%n!U_ zN-rjn)heF(sI?hxom4s;tjzSWq1*3pi(an%H@n9Oj%56vEwl%DyC}CgT4{>mk(6G% zRpWSwv;W}fhl_Vi8T2E{^;12mpDJ+K3Dy8C&LgkK57gulkva9B41r6<5 zYS#N7Gmhg$S!lEns?O?1B6O_%Y$P7M65FC*JvI%`74o2q97L8vC3UssZkHNE(^LFg zX`#dk4R)HvkkUj%3fD&)iKH34sZ5!vzP(3gjmJRZH_PC%B-}BjB{=s-Wl} zlOb7ChO#)Bg)7gMSSP{dGhn@$dJmeoYf4-ye!`@dndkG1I~8ec%VLN6R*BQn5{~3f zuOFU+zRH1gSlBmj|E+d_g#w`&QV{fU`ii+#jWQHMBMs_mT`+PBNuqLOTg{}F`pc(v&M5cu~Bpl7y(nUmSQ_xd!3wleUqKSVpb`dM&-L z>OMK#?2q&zqLZEa&HM9sM2fz!hR5hMFeALt3U;nj=@1m29x@goUExNj^RCD4ctOEr zJek2>h4+_ac+QH%T5Y9es{8ZjWrz7mvuQ;ZT`D^MVKi!U^a1o5rj87*tM`>FC9P=? z6fwn~4et9Nj!!v*H)rc*M!Jc<-|yL|-a(gwj{KG`kdnu{FcSN!#|I3&kjSkv;!>uV z`%UGHW8qF;D7#=i#14K<@3LcTsvTLVG45Xz zzN1`*5vB3@b*iWQ5-iM*VI)60{m6352ZIII59?==B#n9?qsoMG`~*3n#Kq!S?IFAJ zFIx#=$}i=Kh=PiPqH@$;mH?@4KZXx0&1W~mSzbT$-9AXEnr*{Iz-5)D%&c{;6{;)D ztCSaB2T204udeIWT6&Z;r2xAPSzYE*6yMKjGW1bLoo2J=yXQUG(LKpi`Y(lieXT|Yoj(w4F=*Wjh|CrIS%aO7 zofp*~Z#-|jdZRJXB5sr=t6^GmpfGLhR9k=XRwtSe-@!79z}q{K?X$=BAnS0KN^GgR z(S0A+uwlB&AjU?jMdU-$<0m7gQ|}m5^G~g`2(T#5ye^y~O zV$Br}4q$}rS3%$9?2diXGM_DE#t7r4o z`|1KngZ*(jP$n*Knd0ZoU{A9Nxc$=r&)WTnSe;R>YUSk@?;0?J;q5AQq$JA5$q&Rc z(x)dK7z;(8WcwhjC_O^o@b+kg84iJf{Q@pq&$^0YpSavOXrLo)dcG_Qf*z znf01*WsynF6))r&AyDSw;{YBOS!e(B`@0*jxF)TWT+mSJeIQXVG33^ z5tG_f)eOU-IbkYDODJ@^FrNk9{S{hBXS0Z4l*g`;aco>(>Q#1uqW-z0ttuOA4*6n&LwbZ~iRO50LIpQKdTO{vh;+j01z(3#rR9`Y zCUcCW^;}zu>b}-cb=Yz=+`)7tq14QAb=G&2&T(FqLD8S{;lvmJ<~Ldxcd2xfAXu%!mFlWe)H26odn>BV8*M;vF>F@t(SxoPm;8=br!OT2m)d#m%b4RXILe~Hj7 z<8q$`4yahlSV4wV&Ylew)`Dn6JIQeA|8Qwl#{ylUVujmtCxTQr_LI+CE9hs0w!+t8 zHu9D3t!~iG8Z0VM!a`ZJyvS~JOBkwyoh~*RB@-ux{`$vD=h_CFw{XJV4|(r#=weP= zN+Bv9hTek=oM5iz1Z-S0eJ)^Zke>HcqSJflR0>gaI+?x6_`?^32~!1*a6bNR zTp`Ktycdngl5Os6Sz;g*nT6~Y;}OlMcb1R|D4+^-XQ@O*>P`9jS8WH&JflNn!xT7K z>Lry8sW|#VLo#T4OY1Rd#i=yJ(R^A=N&KQ2a&O@v^3|%SgL(Pqz#CIqok+#r|wVFY&W1F`oz>{A_0uqWo^d)+MO`8_u62p8$fuu49Z)M zsqGpvCD%_L+Nc_pQ<%FQz`2b+z50n&q)mb&wbU$ia~z!@L%&|t%(%{K$=k+H9Y45S zRA`R1s?!_Z@@TwR|2j=_QzS&~IEa`hR&-vWoMEqw=air=TyMh(@lM)ZAyQCmj zP}26z#s3jxx0`6BYs-(#q>W|Q%HZoxzQdmyJYTp;R21znK1jrb|L;T$WXSECt4ZHX zVUd*^EMiV2Tj!&LvZ%EeHt{1!5IMgW&IZ3=cLj_7&b#Oy7nyYinDfM7(#>G`-Dk{3 z`jMYlK;lo=Y^74!vY#ue|<>v zA>+q2nA?_T9Breb2%#RwVe)6yI~M`P7mGZuFEM<1ezuE{J~ft0I;dZ584tkp3e13D zuJwE#cGRdgqVA33oLz3v+qcvjwMapkzA-qOriI_VC`rNw4-|fuM#oYl1~yLnjhc}D zBsA0k#DVs<;yk!lrW9k?igBQD^B#PyC|B&#Ro%Fbk_( zHa%pBg5LOl7O@Z#1p4|>A2S&J@Pw+(9nD9ahgNwA!86brfh38|hT zb0GR1fnNR~ZNm#PeZ3+=E;jhUvRoF)1WR_XCEWuIHub*>*q9jZW8q5eMJ$K);F9wX zW(%dQd{6X|>^eRSr?kDXHdPdcC^@%n*USTTJxj3m|5?2WGSv#JPD{3+Kn@W%O4O6Q z=?jlVNf$c_`Kx378!$DWTH+H8o$(yHh5j6Ad9)v$f?T2U|MM04`o7-1{B6_!|J(n& z)BOK7tw5f-!(tioIcT9s{C! z*Nf1#$Zqjas(08H(L0WyK>Mhhi~aS;OH6_tQ<9lSNtp`k8fvfpl;vAR`I2hJgFYR{ z4>l7dp_-8*FJ{|Rko`Hw{6e}6VJVS|?O8a_Kc*I&MS8hk)dFm!^E$myjq(F+Bn^gM7!ae43iGx8i$i7i?T$1 zxkNHK#>0Q>^-c5kHe0n~i_?hsK#vs^@2>u0vD;4k9;#W?MsjiU+lflFZ*&ZY<@&7k=pd0 zB=O{g-whXhUxMw5$@{!Qpj>{VbPW{2N<=1ZC)VC1Ugfy#zvZ)k5*ZdnJ{Ufd<*Y8u z&gbfui*~QnNS%{R|2d(^?%Tb5zyz@`$8@dFR*&o!CU7jS6_&=}5r*8C`Dqoad+&)% zN72>`B8~8Te@yvKyAc_3zf!U_1^llE)O|NUdS-nQ*;CmrDciZ1S~SH-CguxcA(!DSep#6B$Jz3Wpw|AoLIRP2cIHE*sWU3DSxWjm+6 zP*FXU35~Rm2|lKQ4^IffXSv~vMIhvwrZ|*wtIqupp0xk|Uz z(t%X*z$tdB%f80b)8a5}0v!5C26 zjBHvy=R4x7yx~2=fr;Gmbh3OqU#uJfR}bj3EDw4txhyMedU&QEcOi{g&g#mKp-fT~e}DKnb=zC$QW9NI%G@*Q z)VW!#`P9chz>ytQ09IZs^pTj&13qWPJKLyex^+%Mpg$mOxliDxuava_K*F11y-w`K zakn_EVX#!FG}8{QTqugvxk_UZwk5A7y(8uo2Yez5o*U$XWIX6s4TtJWb_|5kqNA`1 zeg_re%AlN;`iuyTN(-H?P^z2A9$M?Y1(;A1)}8wT?z{lN z>OGh-@&mneKal=I!_IB)PP$%+CfQ@jz8k%77BVCpk;ypFBE0DwH{JMR@#&mPF+k$c zE`ejnB=IL8>*Jrg?4(nCN52)$q7w_inj`>H?2h-iOFO=pp7XnSc=!_43tG1fLmvbF zox!wPq=ncUwm+=v-P9|#dGO~bke%S5N4&37=8<^d%2RLf!WXa6K!X=dAyqU5Op)+w zd53K}ALBAQoLuxs^t~WxS-I!7sF4~rP;&>R_L7uDEle_6myV;HPC(0#l9w2&!6JD# z83BrfAOIudM&f{0^*n2EUx39?J$~7OhOD)xZ9}|bMhgkd5%tFd4a3xg#6hHYi{p?- zZJTyK-IR;+&+ao2Fcjc%RvzH|prgEUQfJ{Oo5g(1|{WTUAzleuur2vC+7(kE1c3ul{bMrt} z7{Ay7gt#}4X^y)z&=#E;AAJwHl*|v%@F&%Te+_z zkO)Ali*$V~6Yi^_11>#S#;YAh01wqoTp8#DqnPKeqnFVQrLp5L_j!cDf%5LZShR;I z`R;?fT^+2W4}gI>&j(}k@&{g~j6AR3dGPkTAmnAsTWOYG_rO>cMjW+vI0aCyx6zbh zq38f(RTwIxVZ^yEy7lfH;0JJueC8M$@F_JFhfk}5mzP6^YUaX2G5#|kh71r{sI>J| zALr{|5uKvryFhXm@me!z`I~>*4OHfTFsz>jdIJ5}n()P^LgcW71IH)xXcdX{z#+sE@!#;mw?KsoDSPwi$=}1~ z83biWsap*v!C+2vA_0FMc5 zCuGP_XrF!dM3Wt%K*FvsCCnZviFJedz$}P*iizkRp6|t$>yk&%*}3~NZ{OKj;>nxD zvGoRv>OSs1?ycqZXS1{1ea@;dfJP`fJLJ0kU1L3;o+` zsJAFQ!M_kV-t`%bDx4K(n%%j>Q~*e^1EA!(!TczQMDPO;!@b)X%aLcd(k~?b@!`*D znVuIM)$Q=i_Yx2mXZ5E(ZRpcN*HF;z2wwAgidl8Lf9{(Z3mGj+l#?|*Y1U@uy1tSj zTVFk0Y4o|9e7m$k&AX>WB7dJRzV&z;w>#k=Gl}KboZ@KQD6Km)0Q%vwjCc-%g@W$2 zShC{|fC&5>`{QdYow*MXwqUMcDJtZmDLe(+39N{d^|c9H9G?97S|pFnrWs9XwDGKS zRMn$S=}92%f`301jjnye=!sq+suz)!KT%YPmtR22^<%RoP>!FyH;q~ED6U--zvwj~tn_C6Y$)67TgxAkXO`ha-z9kNz z-WnN$zvo}jM ztx4bW-Rs|I+H-9g8!>}=-QO8ZIJYL6WHA9kSdY&t?^xz5hpO8Xs;l|^4EBkN5W zj9;sI=+tsR*g4%G-ZIvbVW9~!WNw^3jmmDLkOzNbxL*dT` zlT`gUM#Ly_&zM2Mla+N1mS-9E$g3 zbe^4<)pm{c8P$9yfMs4B#xP#8IN+9BNCu!>z;uh!L6Yn95h?svEWA{-LZP=Lr4g4H z{l!vCxxuPgxea=TN`j*5w2eO_LYmPAlkyL{T|hSMC%^UhIcmRDSSrUD zK4z2uw#pVeZ@@w{ZGYe^VOhBrgIv94sM4(~5>RwPZq(hgBI}>5YZ0CG;XbZcF(4W@ zuxE4`BQ}w|<(0Fm8m(ihoD5EXo}k;vko9>Xg)5M z=h&H!PMV?p%iCs*xh>6<&JbPvdzyZne(w_8Sfw^xnNjcYlEY+sgzo#8p6F^YBjN9> z(wV0=%i$}6d8b*Rva?_@K(wK-*C;(@t8Z{*627|jQ?aqD+(vF> z{nbHn5F?@|I_E#H5v2vM3E0Gpj|fHbUj-A)K>S1U?ujrW=F=8y{gs5@!Tg4ED)L+` zit6%Xkr1}meh*;=?G254IDbhaO!tCk8<&zmhX#=7%^ix)J(LKByH|4Sgc$;FR}yd< zbMPmcEa`#YV3mDk`~+seq!}M@wIwvcCWr6jo`nOVD7k zYqtP7ulIAruJ{0j^evLQbMJ>ZjeG?^auR4wci@ zAv#&(Nd>^5uLtI|uXaFj4bbD_nq3ghF~ucyhuAt#tu~p6x!-ucsdNj_Rw^zY&Yu>1 zxW)DyYWQ`-CsQY)GO}9S{r4eCsC101T1a@fRHR#}7DGfAEjjCjDx$E5z;XLM9}aV-rE; zhug^}cdCndv8K7o_T72b4s`9(jF;#iJf&xbnp$^rLs!>spz{qn^PHCmYYjK>+qI!D*dKng{8ik2Rw@B z2V-|>xT{ZQXa?8EDVG{A+^iaTC-cHicXxdii?@pw#)VirnN=*K4tm!+x5$5*BUJg^ z4_{ng?LWfkOrTA=y?GLSx)iy#GcIuv;<(HlrZ2@GA=Gye9$xR7ZWBQ==<$sau@0~e z&^6g%1{K|`QC@v};U6Edm39Q5K}IZ!s68HX>lRi$s(n*!7rN(Kleh7$L8XvYmtkjl zK3(0PRMZeEH6t&}A5=!`Jcd)9w^_f_(M$!A8qIIG!NV5Qu%pO*#Y`dR$b;Rpq*s$h zyJX=wUD(oLCr`R;#Gpav%5~<+PML_@FZxmXJiX^fEk}bzj%v>9^&dr}viNu8sdC&L zsgBIEIu<_37EpV5dDE=Mv%Su}{Q=^1p&iFW_6WAvhUg*0HvN)Te=K0cSm#e#AwBb%JrO+`CC^VX?H3(&Tw@wIs?xme zHjdNTji!XpdAD&(1oVq;d+2+^pkp4TnwekEwG9u_Wk*QipQHV0g!XrVl2MAP`6pIS zkzzI9ugns2?UKVe>k-n6)77uz>VB;Sl&plIhmO~6rK{Gz+Yw!e>1ksK z!rE@)mh@>{kGo~bsrin8^wD%D&th;~Q5Y*%=JViqnBnvh7GD_m#$qF^^`>TmJB`vh zFPP-u%&By;CmO|R<1yryu0JWUkkal5^Nq6z4W4$1As!hP3F}F1lkA%JxNmfxz1}L5 zF>oFC_&ksXW`KIymWgpC^qx_dYHLzZr}^%s+FFf)CpyzQh;m*yFZwo@*!`m287PrS zg{81O=?!IDULC>|<-AF<(_(64+54g7P3z3A#X@zrK2KSVg!|Z{KI@s%|0n7N0d}ikmqx#&+cJTe$(w%ZhrSYO&j7l8l_p7B5++`k?Y^6DD?_3`6hCFgT+=xsaBZ|Tt)1lWh zpI{v?z4&+(^VN#eVqlahZ6qUSWGmbJ{Pe428~jT^Q4FM1ZH#m0yd`3(k2d%sFJI@Z z{5A>y#OZ~Oj=F+BQsv&ZqSVTRc3amJhmRto~ zY@S@RnmUPVC-M07nmuOk(qK#J7)70O0%RO<=cil!p$4|e^{x$3hEzp7M ztA|-p8C~X%U26n-q6UIV2<%YmT<6`zC{%PTSk|UoQWSixTp&?E>m9b!GexzM@Y-Jn z#HTIycaOtuKN=Z88z(E;c>O?Q5|!e4rX&sVL(&+X1ibNK!$r03o_7K@Z!4Y;tW%XH zP^AwRREEN9&PI~iuhgHXU@kDG7VJA^g{4xbcWRpA?2LmXQ#;GM5xj(1Bm!KTfK-Sb628oD{ZKx+8jiAKThr zJ=SE4ba|GsQ(6RXAxR5d9>KTo?5SYTf>pZrSH2x26Hs5^iK|H7DdAsQxX+IK9+g87 z>vvu^;gCLz{nQ0VPd=V0jG>e}%unTsyuDmBVwRtT8 zn8BN~>StGveXmBkV!Q9;Us7DTVidxyHKCB0Q9Jy9cS1ZRa7anf^(iXuSbu0C-MD4) zW}Wu`MJ5YSqwW5TPMZGrN^$*%C{-HKZ=-PojZ$t6%~2M5P|5hA;rm6BF{zrScDKQY zHv$CQuNoes|MRcWSeU@2pq2g2C2<{oMxH^zHAnHW9)dkj>&crH;<^r{<${m}H^20u zGlKLDd*@f11?J$Q)GjS^#jb)B&yZIgJGJlmfe=7_7Jc%I?yQ|%R@w}=v@RR{uZ&PU zv-43P{QI$7EDEU1i}8{u+|r%?;CHNuJJY8oXvk!`tT;1UNGwDDgH zVnHs5nIV z1i=iT3BTzBuS6xD6}b$yKg&3fHcl9LWB9|M)J_$5+Mcsdg&SgcVD_Vy5@q$*kF*Z` zi)M1F+ArrXH1nn4aidI|>^?CQ_EA-@XxJ!FL;;BKCABFoujViI!$)0^62qe3XI{&n z#?6c{V$o}y+<4Y~_cqG3ScT0h>L3L1VuIht*+T9zoO9n=gz@SfFOb)JPy2`^7v%kc zMW1!V&h6t;^A~832RZ+e5N=Kju2<{P#&~td_MdtZ z22UASbALe72I8&Vbt67#>4fg`G5(qRx#EA=%xfDN@@mN=oJp(&v5oQV4@0|UK+r)T ziCM?}pL$Zi1)gGJkqGrfinr9bXX(Hja-e8GK!!REybJ zq-HClY~K)`l|N$`+@L%1=P*E@g6!}WnEv{=;cH&(Xvh=*3&^pR9@&l$87c(g>0Oyy+$$ssb{g2!p1* zT1vl;K}HVA4(GXn|IDu1elDVG0I7n6n5qU3w6?W|u1CzOyYXNS?u@T~&MvW;>{k#27+N zM{@0Rk*%9qvSfLZbpK+Y6x(`U0D7t$Oe;gq@hYac6X7X^(5SI9j(PI>oknV}7r5^q z)9HiZ%c6~w4`@0!rmA;y02;(|5Z^UhOTK-j?>(D{QK=;8NZ-D?cJ20On5d9)a5#W< z>daP1vl2qC5V&3jhwEcr2Hv{R~Z@rHKGIaL5SSa2bUhhmZVtg?baqO8zZ9h z+{ZIj7{#F)IE5ayIZsZu|!jKs{c=(+L_V(U&q!9D*4D(OB8N4xshIK~@1ka|vB( z8H#*V5MvM3uD0m}^Q0gE1NWtV@+={0AuLl@QH{C*oP=VYDsup#JQ_+UuE44MqoPXo zyeHbhL$FNM!F&z2>XXgd41jmaVz2lwDsn5M>D#B*y%uL6&xfIZv07H|Nd#L01F3rO zBxLZP-YLG@k4raEVa^D8aZBmlYkD+bOQ7+hCyN}5kjW}Hyyc2+g7?wEtPU!GkAwgN z4&Qz{*&7#12DvB$iC1Gmu3!!~!$-b@XfV}rDun|dJI&MmX=YzIa-wR^NsV<#L-pqk zmN-qN^V6e6fKSae^z*+CWB_Ajrv#*h;~cxKDemNX;&j=UWC6UhPlSByr=b5wFVT64 zSfkA7?#Cu>*t@)KfSA|2RRkbvyXy~U)`yQ+8-BMiRr4`+K43QrF`FoZftizA%G|zJ zTGHz=Mw#WTE|?HyFvHy8C76$TIPI9^442{3vE~EAx6BiB;`rTaOjW{h{RIJ%cm~My zLe0KCUVgZ~q;w3h17QH;mUeN%w1}e*Z^e%1=6_f{13i*S z<}2+Zlbi__%YTENNHtm}2+&Oz6J0l-NPR}0)cwaVJi$0~;p4+COQq8~C>Z4&0dk=* z02>G9gs~(J!>EbnUVu@bJ7B3X%a6euH(@tV_Sb1a#+X~6b9iDuEF6f&hx5UO|N2a^ z;2N71qgvtHTPUVp8l?uE@9$FaPJ7ydfZ?Dg&;$3ioU9%mZTn>nUCX)7pO|p!XQA0V zUuN76r=fN$@_i@CTPA1UeQ@DB3!OxAQ2S%$Bxdy*yPSou36s0x@|0I6dq)}23Fk{e z<&4QeNk8rq_Z=&OevJ$Oy6#kg(p~*?AY&R7%|BsN12d{9Ep#l^J-bYGvkuQY$UWG} z*{d2d7hdU%VQ1N8!4tCUR-`itN5%6s%O&j+p8gl}c%a$MegIg_(HbZ?Xmxk`aak}4 zndpEHcp^o7_RQ{v?tBFp4M{WJUj$U#kv;cXP*@Yde(Vu1JT3>o_PfpANsP+&Fb9Ba z58>t>mzLLsb}EMf96(7gRP>(KFaHQ8_zm4oDPX$Ru^aSOwa5xx@DVz#r1-AY83=l_P$XPUV2*(PT)U)Y$l1+YPWS*;g0V}3) zety^($9w^%NyZlcOn=#ouU=`9pz*GN^ct9|MmzoN2^b7JP&6z`&0#!%_KxZk`ks#` zo51~k+*@m-1*Q#y>)#qZ8ppRK$V-`kPP2n$CYHZ!y%A=#wpXKP>NJGqwf@gYa-u%t z=`Ymb340OApwg9z*+mhO>A9(zPyS+iB9uMnDWwqFo;@AF7~R!i)EkQLlr}#BIyoKK z=p~|cY_6#g3Y}EqD+TCzfjawUH|VHIC(3);wvX>zFNE=}>I+~p4OE{WiqV5I6eF?~ zr^jf(n!pp~#>Nj%k9LzR?1o{Pk@vZ6(pN^yYEB6J4IW$Y7F=ESxKLysE9n8~0xhn} zF1jE=d{n@7_&U#c0F)-(*Cl+kIof`JdI>U9ma`3p9FH;~Y#al_lI#QURkKqII<>!^ zC&~r7oqs+}^s^P(=DpcC##1%Hj&ZITCn}!%_wX?olPw=^Y$Ic4gNB*qdS*f^eZG zE-&!nR$eY7e)?_~o*Y8DK$PqHplB)3M0GQtD<>t|u3T7L6gL@wP$(ts-ANDp0nR^}BIFJ#77Jm`(z)9|;&Coo|?}UJxhyfV=l-tBm(cp)C3_ugS zR7w^NzBBRe@AWDR-EIhztQFpuI34&BkjEDX6@xZe%8+BgY^v%Bxi@5Ly7M>oVCU!6 zp{zKx-B(iZKILtuPU!+=0pkHV6o6Iz%3WcdE$%;ZoQko+78R>)0gAiw+a=e-jzmob zeqtnfvMi5^veDDSz?jx1SN2vS)YX}JF!C+7R~JCu!|{5s%y(>4#GMo2nYyA`yBy>B zI<*xrPSA@Vvq`7@FN*Y3P4K2ntTu~!aT6q}<}~2C7X`)&qdogO;8vNmkAvP_48>hz z(`#r4TeFt0Hh_2i*Jv{Z%g2#{9fn`qZt@xZUW959hg+iu6O*H?;njrbWy>; z!$=_FNF@XZvv`*X%wk`FL6+S0u}$`Owv~~hM1ygk$06T;kv8d#A{Y)hx5|;t^ahny zHa-Nj8peEE>re54JqE+7$=Ti(!IokQVmQrXj~352Yqw&TIqV&o&IT94u3ssfZB4;2 z*ffSh<6gCtTcnJ@hQ(mI|5#KiKiV8kF{pV8yR$+Q|E%5OTXD)!BCB3QRk=UbO{o{a zC0%k%cL(OL+sr+)Q$Gf(pU;D^fEk!z*{|6H4`!#6HYr-~n4X>5w^s&;QIG2kOj46)^OSQQRZcs^;WMer1N&e%N@Vo||693fRQypyd^{5vc?;b_ z8^xtjY)p0A+)@0nng~yvyzlnS9XN4W7Yh9z5A2RFdOV))k>la~^Db2c1w8q8uN&)p zjW~W;?#`-Jkw5-6`__ +and `PSA Firmware Update IHI 0093 `__ +specifications. + +To standardize and streamline capsule creation with multiple FMP payloads, the `EDK2 capsule generation tool `__ +tool has been integrated into the meta-arm Yocto layer for Corstone‑1000. This integration involves defining +build rules for generating UEFI capsules as part of the firmware image build process. Configuration parameters +exposed in the recipe allow developers to specify the number of FMP payloads, target image GUIDs, version numbers etc. +This capsule ensures that all update payloads conform to the UEFI FMP specification and are ready for +validation and delivery by U‑Boot. + +The FWU solution for Corstone-1000 is composed of three primary domains: + +- Host System +- Trusted Services intermediary +- Secure Enclave + +Each domain has distinct responsibilities and communicates through standardized interfaces. + + +.. image:: images/SystemArchitecturePSAFirmwareUpdate.png + :width: 690 + :alt: SystemArchitecturePSAFirmwareUpdate -In addition to always booting authorized images, it is equally important that the device only accepts -authorized (signed) images during the firmware update process. Corstone-1000 supports over-the-air (OTA) -firmware updates and complies with the `Platform Security Firmware Update for the A-profile Arm Architecture `__ -specification. +On the host side, U-Boot functions as the FWU client and orchestrates the update process from capsule retrieval to +payload delivery based on `PSA FWU DEN0018 specification `__ +via Arm FF-A framework. The Trusted-Services SE Proxy secure partition serves as a gateway between the non-secure host +environment and the Secure Enclave. The `PSA FWU service `__ running in the Trusted Services +implementation forwards the data to the Secure Enclave via MHU-based PSA calls. Within the Secure Enclave, the PSA FWU +Agent, conforming to `PSA Firmware Update IHI 0093 `__ specification, +orchestrates the actual flash programming, metadata management, and rollback protection mechanisms. The agent relies on a +bespoke `shim layer `__ to abstract hardware‑specific flash operations and bootloader interactions. As defined in the specification, the external flash is divided into two banks: one bank holds the currently running images, while the other is used to stage new images. @@ -336,23 +370,55 @@ New images are delivered and accepted in the form of UEFI capsules. :width: 690 :alt: ExternalFlash -When a firmware update is triggered, U-Boot begins by verifying the UEFI capsule by checking its signature, -version number, and size. After successful verification, it signals the Secure Enclave, which then -starts writing the capsule contents to flash memory. +When a FWU is initiated on Corstone-1000, the following sequence of operations takes place: + +#. **Capsule Retrieval and Preparation** + + U-Boot on the host system retrieves the firmware capsule. + It validates the capsule header and parses the FMP (Firmware Management Protocol) descriptor list to identify the payloads to be updated. + + For each FMP descriptor, U-Boot: + + Splits the firmware payload into 4 KiB chunks. + Invokes the PSA_FWU_Update API for each chunk, transmitting the buffer address via the FF-A (Firmware Framework for Arm) shared memory interface. + +#. **Secure Transmission and Forwarding** + + The PSA Firmware Update (FWU) service, running as part of Trusted Services, receives the chunks through Secure Partition Client (SPC) calls. + It forwards these chunks to the Secure Enclave using MHU-based PSA calls. + +#. **Flashing Within the Secure Enclave** + + Inside the Secure Enclave, the PSA FWU Agent dispatches each chunk to the shim layer. + + The shim layer: + + Erases the corresponding sectors in the non-active flash bank. + Writes the received firmware chunks at the correct offsets. + During partial updates, it also copies static partitions from the active bank to the non-active one to maintain consistency. + +#. **Finalization and Boot Preparation** + + After all chunks are successfully written: + + The shim updates the firmware manifest and the EFI System Resource Table (ESRT) entries to reflect the new image version. + This step enables the bootloader to recognize the new firmware for a trial boot. + The platform then performs an automatic reset, booting into the non-active bank in trial mode. + +#. **Trial Boot and Confirmation** + + In trial mode, U-Boot evaluates the new firmware and issues either an accept or reject command using the PSA FWU ABI. + These commands are sent to the Secure Enclave, instructing the shim to update the firmware metadata accordingly. + +#. **Recovery and Fallback Mechanism** + + If the trial boot is successful, the host sends an acknowledgment, transitioning the firmware state from 'trial' to 'regular'. -Once the write operation is complete, the Secure Enclave resets the entire system. The update process -is tracked using a state machine stored in the Metadata Block within flash. TF-M runs an OTA service -that is responsible for verifying and updating the images in the passive flash bank. Communication -between the UEFI capsule update subsystem and the OTA service follows the same data path described -earlier. After verifying the capsule, the OTA service writes the new images to the passive bank, -updates the system state to 'trial,' and initiates a reset. + If the system fails or becomes unresponsive: -During boot, the bootloaders in both the Secure Enclave and the Host system read the Metadata Block to -determine which bank to boot from. If the trial boot succeeds, the Host system sends an acknowledgment -that transitions the system state from 'trial' to 'regular.' If the system fails during the trial phase -or hangs, a watchdog timer triggers a reset. The Secure Enclave’s BL1 contains logic to detect multiple -resets and can revert to the previously known-good bank. This fallback mechanism is essential to ensure -the device remains available and functional. + A watchdog timer triggers a system reset. + The BL1 firmware in the Secure Enclave detects repeated failures and reverts to the previously known-good flash bank. + This rollback mechanism ensures the device remains operational and recoverable, even after a failed update. .. image:: images/SecureFirmwareUpdate.png @@ -401,6 +467,11 @@ References .. _arm-fmw-framework-a-profile-pdf: https://developer.arm.com/documentation/den0077/latest .. _arm-fmw-framework-m-profile-pdf: https://developer.arm.com/architectures/Firmware%20Framework%20for%20M-Profile .. _platform-security-fwu-for-a-profile-pdf: https://developer.arm.com/documentation/den0118/a/ +.. _psa-firmware-update-ihi-0093-api-reference-website: https://arm-software.github.io/psa-api/fwu/1.0/api/api.html +.. _edk2-capsule-generation-tool-repository: https://github.com/tianocore/edk2/blob/master/BaseTools/Source/Python/Capsule/GenerateCapsule.py +.. _psa-fwu-den0018-specification-website: https://developer.arm.com/documentation/den0118/latest/ +.. _ts-psa-fwu-service-website: https://trusted-services.readthedocs.io/en/stable/services/fwu/psa-fwu-m.html +.. _tfm-shim-layer-website: https://trustedfirmware-m.readthedocs.io/en/latest/design_docs/services/tfm_fwu_service.html#shim-layer-between-fwu-and-bootloader .. _op-tee-os-repository: https://github.com/OP-TEE/optee_os .. _psa-certified-website: https://www.psacertified.org/ .. _psa_l2-ready: https://www.psacertified.org/products/corstone-1000/