From cbcee99db13df409f797ed80a6fe941bcde5538c Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Sun, 4 Oct 2026 00:19:31 +0200 Subject: [PATCH 1/4] tests: build the SHA-256 crypto extensions with GCC and a fortified libc Build sha256.c with -mcpu=cortex-a53 and _FORTIFY_SOURCE for both MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY and _IF_PRESENT. Without Mbed-TLS/TF-PSA-Crypto#937 this fails to inline the fortified memset(). Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tests/scripts/components-platform.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/scripts/components-platform.sh b/tests/scripts/components-platform.sh index 0d3f1bf2c4..8a843e6e49 100644 --- a/tests/scripts/components-platform.sh +++ b/tests/scripts/components-platform.sh @@ -316,6 +316,26 @@ component_build_sha_armce () { not grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s } +support_build_sha_armce_gcc () { + # GCC >= 6 is required to build with SHA extensions + [ "$(gcc_version "${AARCH64_LINUX_GNU_GCC_PREFIX}gcc")" -ge 6 ] +} + +component_build_sha_armce_gcc () { + # The SHA-256 crypto extensions must be added to the target of the build, + # not replace it: with -mcpu=cortex-a53 (which has CRC) GCC otherwise + # refuses to inline always_inline functions such as a fortified memset(). + scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + for opt in MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT; do + scripts/config.py set $opt + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, -mcpu=cortex-a53 -D_FORTIFY_SOURCE=2" + $MAKE_COMMAND -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC="${AARCH64_LINUX_GNU_GCC_PREFIX}gcc" CFLAGS="-std=c99 -Werror -O2 -mcpu=cortex-a53 -D_FORTIFY_SOURCE=2" + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, test aarch64 crypto instructions built" + grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s + scripts/config.py unset $opt + done +} + component_test_arm_linux_gnueabi_gcc_arm5vte () { # Mimic Debian armel port msg "test: ${ARM_LINUX_GNUEABI_GCC_PREFIX}gcc -march=arm5vte, default config" # ~4m From 584c7091e1ea55844f73647e40417119260d98d1 Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Sun, 4 Oct 2026 00:19:31 +0200 Subject: [PATCH 2/4] Update crypto submodule with the SHA-256 pragma fix Point tf-psa-crypto at Mbed-TLS/TF-PSA-Crypto#937. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index a4c2d35881..2d8a58e2d4 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit a4c2d358812944ab8a68018f3ca8a9f2d478813c +Subproject commit 2d8a58e2d4fb83c033ff1678650249b6c72ceb50 From 1e017acb15cb0cbffe931c98c453335d8ed4159c Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Tue, 6 Oct 2026 00:03:56 +0200 Subject: [PATCH 3/4] tests: build the SHA-512 crypto extensions with GCC and a fortified libc Build sha512.c with -mcpu=cortex-a76 and _FORTIFY_SOURCE for both MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY and _IF_PRESENT with GCC 13 or later. Without Mbed-TLS/TF-PSA-Crypto#937 this fails to inline the fortified memset(). Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tests/scripts/components-platform.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/scripts/components-platform.sh b/tests/scripts/components-platform.sh index 8a843e6e49..835df0656c 100644 --- a/tests/scripts/components-platform.sh +++ b/tests/scripts/components-platform.sh @@ -334,6 +334,20 @@ component_build_sha_armce_gcc () { grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s scripts/config.py unset $opt done + + # The same for the SHA-512 extensions with -mcpu=cortex-a76, which has + # extensions beyond Armv8.2-A. Before GCC 13, the SHA-512 intrinsics + # require Armv8.2-A, so this only builds with GCC 13 or later. + if [ "$(gcc_version "${AARCH64_LINUX_GNU_GCC_PREFIX}gcc")" -ge 13 ]; then + for opt in MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT; do + scripts/config.py set $opt + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, -mcpu=cortex-a76 -D_FORTIFY_SOURCE=2" + $MAKE_COMMAND -B library/../${BUILTIN_SRC_PATH}/sha512.o library/../${BUILTIN_SRC_PATH}/sha512.s CC="${AARCH64_LINUX_GNU_GCC_PREFIX}gcc" CFLAGS="-std=c99 -Werror -O2 -mcpu=cortex-a76 -D_FORTIFY_SOURCE=2" + msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, test aarch64 crypto instructions built" + grep -E 'sha512[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha512.s + scripts/config.py unset $opt + done + fi } component_test_arm_linux_gnueabi_gcc_arm5vte () { From 13c2e1b18b2fdd2b668029774db2e15d6963fcee Mon Sep 17 00:00:00 2001 From: Julius Bairaktaris Date: Tue, 6 Oct 2026 00:21:01 +0200 Subject: [PATCH 4/4] Update crypto submodule with the SHA-512 pragma fix Point tf-psa-crypto at Mbed-TLS/TF-PSA-Crypto#937. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index 2d8a58e2d4..f13d40055b 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 2d8a58e2d4fb83c033ff1678650249b6c72ceb50 +Subproject commit f13d40055bb5b7ce2e2d414fde12e26fd10396a2