From 342341a16207f29ee920c0220b5e2c526cf10dc0 Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Sun, 4 Oct 2026 00:19:28 +0200 Subject: [PATCH 1/4] tests: build the SHA-256 crypto extensions with GCC and a fortified libc Build sha256.c with -mcpu=cortex-a53 and _FORTIFY_SOURCE for both MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY and _IF_PRESENT. Without Mbed-TLS/TF-PSA-Crypto#936 this fails to inline the fortified memset(). Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tests/scripts/components-platform.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/scripts/components-platform.sh b/tests/scripts/components-platform.sh index 0d3f1bf2c4..8a843e6e49 100644 --- a/tests/scripts/components-platform.sh +++ b/tests/scripts/components-platform.sh @@ -316,6 +316,26 @@ component_build_sha_armce () { not grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s } +support_build_sha_armce_gcc () { + # GCC >= 6 is required to build with SHA extensions + [ "$(gcc_version "${AARCH64_LINUX_GNU_GCC_PREFIX}gcc")" -ge 6 ] +} + +component_build_sha_armce_gcc () { + # The SHA-256 crypto extensions must be added to the target of the build, + # not replace it: with -mcpu=cortex-a53 (which has CRC) GCC otherwise + # refuses to inline always_inline functions such as a fortified memset(). + scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + for opt in MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT; do + scripts/config.py set $opt + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, -mcpu=cortex-a53 -D_FORTIFY_SOURCE=2" + $MAKE_COMMAND -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC="${AARCH64_LINUX_GNU_GCC_PREFIX}gcc" CFLAGS="-std=c99 -Werror -O2 -mcpu=cortex-a53 -D_FORTIFY_SOURCE=2" + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, test aarch64 crypto instructions built" + grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s + scripts/config.py unset $opt + done +} + component_test_arm_linux_gnueabi_gcc_arm5vte () { # Mimic Debian armel port msg "test: ${ARM_LINUX_GNUEABI_GCC_PREFIX}gcc -march=arm5vte, default config" # ~4m From 56c7f0bd201c488490d46f1956091948845ba552 Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Sun, 4 Oct 2026 00:19:29 +0200 Subject: [PATCH 2/4] Update crypto submodule with the SHA-256 pragma fix Point tf-psa-crypto at Mbed-TLS/TF-PSA-Crypto#936. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index 607ef78f93..3aca5bad5e 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 607ef78f93568d15d8f9b56d09401b4b9e177f93 +Subproject commit 3aca5bad5ea986d9a56f8cb8e2581a31a00c97db From 43279e65d3a005cbfc504a6530fc5c923cf8c0b6 Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Tue, 6 Oct 2026 00:03:56 +0200 Subject: [PATCH 3/4] tests: build the SHA-512 crypto extensions with GCC and a fortified libc Build sha512.c with -mcpu=cortex-a76 and _FORTIFY_SOURCE for both MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY and _IF_PRESENT with GCC 13 or later. Without Mbed-TLS/TF-PSA-Crypto#936 this fails to inline the fortified memset(). Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tests/scripts/components-platform.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/scripts/components-platform.sh b/tests/scripts/components-platform.sh index 8a843e6e49..835df0656c 100644 --- a/tests/scripts/components-platform.sh +++ b/tests/scripts/components-platform.sh @@ -334,6 +334,20 @@ component_build_sha_armce_gcc () { grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s scripts/config.py unset $opt done + + # The same for the SHA-512 extensions with -mcpu=cortex-a76, which has + # extensions beyond Armv8.2-A. Before GCC 13, the SHA-512 intrinsics + # require Armv8.2-A, so this only builds with GCC 13 or later. + if [ "$(gcc_version "${AARCH64_LINUX_GNU_GCC_PREFIX}gcc")" -ge 13 ]; then + for opt in MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT; do + scripts/config.py set $opt + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, -mcpu=cortex-a76 -D_FORTIFY_SOURCE=2" + $MAKE_COMMAND -B library/../${BUILTIN_SRC_PATH}/sha512.o library/../${BUILTIN_SRC_PATH}/sha512.s CC="${AARCH64_LINUX_GNU_GCC_PREFIX}gcc" CFLAGS="-std=c99 -Werror -O2 -mcpu=cortex-a76 -D_FORTIFY_SOURCE=2" + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, test aarch64 crypto instructions built" + grep -E 'sha512[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha512.s + scripts/config.py unset $opt + done + fi } component_test_arm_linux_gnueabi_gcc_arm5vte () { From f8636072fe9658638d0d16dd4cc714165eaffe0c Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Tue, 6 Oct 2026 00:21:00 +0200 Subject: [PATCH 4/4] Update crypto submodule with the SHA-512 pragma fix Point tf-psa-crypto at Mbed-TLS/TF-PSA-Crypto#936. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index 3aca5bad5e..a7d5707ee3 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 3aca5bad5ea986d9a56f8cb8e2581a31a00c97db +Subproject commit a7d5707ee38fb469ca5706b11abb15094cbc3b0b