Merge "fix(versal): type cast addresses to fix integer overflow" into integration
diff --git a/Makefile b/Makefile
index 5edd625..7f781a0 100644
--- a/Makefile
+++ b/Makefile
@@ -448,6 +448,96 @@
include common/backtrace/backtrace.mk
################################################################################
+# Generic definitions
+################################################################################
+include ${MAKE_HELPERS_DIRECTORY}plat_helpers.mk
+
+ifeq (${BUILD_BASE},)
+ BUILD_BASE := ./build
+endif
+BUILD_PLAT := $(abspath ${BUILD_BASE})/${PLAT}/${BUILD_TYPE}
+
+SPDS := $(sort $(filter-out none, $(patsubst services/spd/%,%,$(wildcard services/spd/*))))
+
+# Platforms providing their own TBB makefile may override this value
+INCLUDE_TBBR_MK := 1
+
+################################################################################
+# Include SPD Makefile if one has been specified
+################################################################################
+
+ifneq (${SPD},none)
+ ifeq (${ARCH},aarch32)
+ $(error "Error: SPD is incompatible with AArch32.")
+ endif
+
+ ifdef EL3_PAYLOAD_BASE
+ $(warning "SPD and EL3_PAYLOAD_BASE are incompatible build options.")
+ $(warning "The SPD and its BL32 companion will be present but \
+ ignored.")
+ endif
+
+ ifeq (${SPD},spmd)
+ # SPMD is located in std_svc directory
+ SPD_DIR := std_svc
+
+ ifeq ($(SPMD_SPM_AT_SEL2),1)
+ CTX_INCLUDE_EL2_REGS := 1
+ ifeq ($(SPMC_AT_EL3),1)
+ $(error SPM cannot be enabled in both S-EL2 and EL3.)
+ endif
+ endif
+
+ ifeq ($(findstring optee_sp,$(ARM_SPMC_MANIFEST_DTS)),optee_sp)
+ DTC_CPPFLAGS += -DOPTEE_SP_FW_CONFIG
+ endif
+
+ ifeq ($(TS_SP_FW_CONFIG),1)
+ DTC_CPPFLAGS += -DTS_SP_FW_CONFIG
+ endif
+
+ ifneq ($(ARM_BL2_SP_LIST_DTS),)
+ DTC_CPPFLAGS += -DARM_BL2_SP_LIST_DTS=$(ARM_BL2_SP_LIST_DTS)
+ endif
+
+ ifneq ($(SP_LAYOUT_FILE),)
+ BL2_ENABLE_SP_LOAD := 1
+ endif
+ else
+ # All other SPDs in spd directory
+ SPD_DIR := spd
+ endif #(SPD)
+
+ # We expect to locate an spd.mk under the specified SPD directory
+ SPD_MAKE := $(wildcard services/${SPD_DIR}/${SPD}/${SPD}.mk)
+
+ ifeq (${SPD_MAKE},)
+ $(error Error: No services/${SPD_DIR}/${SPD}/${SPD}.mk located)
+ endif
+ $(info Including ${SPD_MAKE})
+ include ${SPD_MAKE}
+
+ # If there's BL32 companion for the chosen SPD, we expect that the SPD's
+ # Makefile would set NEED_BL32 to "yes". In this case, the build system
+ # supports two mutually exclusive options:
+ # * BL32 is built from source: then BL32_SOURCES must contain the list
+ # of source files to build BL32
+ # * BL32 is a prebuilt binary: then BL32 must point to the image file
+ # that will be included in the FIP
+ # If both BL32_SOURCES and BL32 are defined, the binary takes precedence
+ # over the sources.
+endif #(SPD=none)
+
+ifeq (${ENABLE_SPMD_LP}, 1)
+ifneq (${SPD},spmd)
+ $(error Error: ENABLE_SPMD_LP requires SPD=spmd.)
+endif
+ifeq ($(SPMC_AT_EL3),1)
+ $(error SPMC at EL3 not supported when enabling SPMD Logical partitions.)
+endif
+endif
+
+################################################################################
# Process BRANCH_PROTECTION value and set
# Pointer Authentication and Branch Target Identification flags
################################################################################
@@ -491,6 +581,18 @@
BL_COMMON_SOURCES += lib/extensions/pauth/pauth_helpers.S
endif
+################################################################################
+# Include the platform specific Makefile after the SPD Makefile (the platform
+# makefile may use all previous definitions in this file)
+################################################################################
+include ${PLAT_MAKEFILE_FULL}
+
+################################################################################
+# Setup arch_features based on ARM_ARCH_MAJOR, ARM_ARCH_MINOR provided from
+# platform.
+################################################################################
+include ${MAKE_HELPERS_DIRECTORY}arch_features.mk
+
####################################################
# Enable required options for Memory Stack Tagging.
####################################################
@@ -521,6 +623,9 @@
################################################################################
# FEAT_RME
ifeq (${ENABLE_RME},1)
+ # RME doesn't support BRBE
+ ENABLE_BRBE_FOR_NS := 0
+
# RME doesn't support PIE
ifneq (${ENABLE_PIE},0)
$(error ENABLE_RME does not support PIE)
@@ -670,12 +775,14 @@
$(warning "RME is an experimental feature")
endif
-################################################################################
-# Include the platform specific Makefile after the SPD Makefile (the platform
-# makefile may use all previous definitions in this file)
-################################################################################
-
-include ${PLAT_MAKEFILE_FULL}
+ifeq (${CTX_INCLUDE_EL2_REGS}, 1)
+ ifeq (${SPD},none)
+ ifeq (${ENABLE_RME},0)
+ $(error CTX_INCLUDE_EL2_REGS is available only when SPD \
+ or RME is enabled)
+ endif
+ endif
+endif
################################################################################
# Platform specific Makefile might provide us ARCH_MAJOR/MINOR use that to come
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst
index 654ddc5..347cf20 100644
--- a/docs/getting_started/build-options.rst
+++ b/docs/getting_started/build-options.rst
@@ -1195,7 +1195,8 @@
The platform will use PSA compliant Crypto APIs during authentication and
image measurement process by enabling this option. It uses APIs defined as
per the `PSA Crypto API specification`_. This feature is only supported if
- using MbedTLS 3.x version. By default it is disabled (``0``).
+ using MbedTLS 3.x version. By default it is disabled (``0``), and this is an
+ experimental feature.
- ``ENABLE_CONSOLE_GETC``: Boolean option to enable `getc()` feature in console
driver(s). By default it is disabled (``0``) because it constitutes an attack
diff --git a/drivers/auth/mbedtls/mbedtls_psa_crypto.c b/drivers/auth/mbedtls/mbedtls_psa_crypto.c
index 2fa8e63..5891acf 100644
--- a/drivers/auth/mbedtls/mbedtls_psa_crypto.c
+++ b/drivers/auth/mbedtls/mbedtls_psa_crypto.c
@@ -28,6 +28,13 @@
#define LIB_NAME "mbed TLS PSA"
+/* Maximum length of R_S pair in the ECDSA signature in bytes */
+#define MAX_ECDSA_R_S_PAIR_LEN 64U
+
+/* Size of ASN.1 length and tag in bytes*/
+#define SIZE_OF_ASN1_LEN 1U
+#define SIZE_OF_ASN1_TAG 1U
+
#if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/*
@@ -108,6 +115,7 @@
static void construct_psa_key_alg_and_type(mbedtls_pk_type_t pk_alg,
mbedtls_md_type_t md_alg,
+ psa_ecc_family_t psa_ecc_family,
psa_algorithm_t *psa_alg,
psa_key_type_t *psa_key_type)
{
@@ -118,14 +126,173 @@
*psa_alg = PSA_ALG_RSA_PSS(psa_md_alg);
*psa_key_type = PSA_KEY_TYPE_RSA_PUBLIC_KEY;
break;
+ case MBEDTLS_PK_ECDSA:
+ *psa_alg = PSA_ALG_ECDSA(psa_md_alg);
+ *psa_key_type = PSA_KEY_TYPE_ECC_PUBLIC_KEY(psa_ecc_family);
+ break;
default:
*psa_alg = PSA_ALG_NONE;
*psa_key_type = PSA_KEY_TYPE_NONE;
break;
}
+}
+
+
+#if TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA || \
+TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA
+
+/*
+ * This is a helper function to detect padding byte (if the MSB bit of the
+ * first data byte is set to 1, for example 0x80) and on detection, ignore the
+ * padded byte(0x00) and increase the buffer pointer beyond padded byte and
+ * decrease the length of the buffer by 1.
+ *
+ * On Success returns 0, error otherwise.
+ **/
+static inline int ignore_asn1_int_padding_byte(unsigned char **buf_start,
+ size_t *buf_len)
+{
+ unsigned char *local_buf = *buf_start;
+
+ /* Check for negative number */
+ if ((local_buf[0] & 0x80U) != 0U) {
+ return -1;
+ }
+
+ if ((local_buf[0] == 0U) && (local_buf[1] > 0x7FU) &&
+ (*buf_len > 1U)) {
+ *buf_start = &local_buf[1];
+ (*buf_len)--;
+ }
+
+ return 0;
+}
+
+/*
+ * This is a helper function that gets a pointer to the encoded ECDSA publicKey
+ * and its length (as per RFC5280) and returns corresponding decoded publicKey
+ * and its length. As well, it retrieves the family of ECC key in the PSA
+ * format.
+ *
+ * This function returns error(CRYPTO_ERR_SIGNATURE) on ASN.1 parsing failure,
+ * otherwise success(0).
+ **/
+static int get_ecdsa_pkinfo_from_asn1(unsigned char **pk_start,
+ unsigned int *pk_len,
+ psa_ecc_family_t *psa_ecc_family)
+{
+ mbedtls_asn1_buf alg_oid, alg_params;
+ mbedtls_ecp_group_id grp_id;
+ int rc;
+ unsigned char *pk_end;
+ size_t len;
+ size_t curve_bits;
+ unsigned char *pk_ptr = *pk_start;
+
+ pk_end = pk_ptr + *pk_len;
+ rc = mbedtls_asn1_get_tag(&pk_ptr, pk_end, &len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE);
+ if (rc != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ pk_end = pk_ptr + len;
+ rc = mbedtls_asn1_get_alg(&pk_ptr, pk_end, &alg_oid, &alg_params);
+ if (rc != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ if (alg_params.tag == MBEDTLS_ASN1_OID) {
+ if (mbedtls_oid_get_ec_grp(&alg_params, &grp_id) != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+ *psa_ecc_family = mbedtls_ecc_group_to_psa(grp_id,
+ &curve_bits);
+ } else {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ pk_end = pk_ptr + len - (alg_oid.len + alg_params.len +
+ 2 * (SIZE_OF_ASN1_LEN + SIZE_OF_ASN1_TAG));
+ rc = mbedtls_asn1_get_bitstring_null(&pk_ptr, pk_end, &len);
+ if (rc != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ *pk_start = pk_ptr;
+ *pk_len = len;
+
+ return rc;
}
/*
+ * Ecdsa-Sig-Value ::= SEQUENCE {
+ * r INTEGER,
+ * s INTEGER
+ * }
+ *
+ * This helper function that gets a pointer to the encoded ECDSA signature and
+ * its length (as per RFC5280) and returns corresponding decoded signature
+ * (R_S pair) and its size.
+ *
+ * This function returns error(CRYPTO_ERR_SIGNATURE) on ASN.1 parsing failure,
+ * otherwise success(0).
+ **/
+static int get_ecdsa_signature_from_asn1(unsigned char *sig_ptr,
+ size_t *sig_len,
+ unsigned char *r_s_pair)
+{
+ int rc;
+ unsigned char *sig_end;
+ size_t len, r_len, s_len;
+
+ sig_end = sig_ptr + *sig_len;
+ rc = mbedtls_asn1_get_tag(&sig_ptr, sig_end, &len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE);
+ if (rc != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ sig_end = sig_ptr + len;
+ rc = mbedtls_asn1_get_tag(&sig_ptr, sig_end, &r_len,
+ MBEDTLS_ASN1_INTEGER);
+ if (rc != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ if (ignore_asn1_int_padding_byte(&sig_ptr, &r_len) != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ (void)memcpy((void *)&r_s_pair[0], (const void *)sig_ptr, r_len);
+
+ sig_ptr = sig_ptr + r_len;
+ sig_end = sig_ptr + len - (r_len + (SIZE_OF_ASN1_LEN +
+ SIZE_OF_ASN1_TAG));
+ rc = mbedtls_asn1_get_tag(&sig_ptr, sig_end, &s_len,
+ MBEDTLS_ASN1_INTEGER);
+ if (rc != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ if (ignore_asn1_int_padding_byte(&sig_ptr, &s_len) != 0) {
+ return CRYPTO_ERR_SIGNATURE;
+ }
+
+ (void)memcpy((void *)&r_s_pair[r_len], (const void *)sig_ptr, s_len);
+
+ *sig_len = s_len + r_len;
+
+ return 0;
+}
+#endif /*
+ * TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA || \
+ * TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA
+ **/
+
+/*
* Verify a signature.
*
* Parameters are passed using the DER encoding format following the ASN.1
@@ -143,6 +310,10 @@
int rc;
void *sig_opts = NULL;
unsigned char *p, *end;
+ unsigned char *local_sig_ptr;
+ size_t local_sig_len;
+ psa_ecc_family_t psa_ecc_family = 0U;
+ __unused unsigned char reformatted_sig[MAX_ECDSA_R_S_PAIR_LEN] = {0};
/* construct PSA key algo and type */
psa_status_t status = PSA_SUCCESS;
@@ -174,10 +345,36 @@
rc = CRYPTO_ERR_SIGNATURE;
goto end2;
}
- signature.p = p;
+
+ local_sig_ptr = p;
+ local_sig_len = signature.len;
+
+#if TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA || \
+TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA
+ if (pk_alg == MBEDTLS_PK_ECDSA) {
+ rc = get_ecdsa_signature_from_asn1(local_sig_ptr,
+ &local_sig_len,
+ reformatted_sig);
+ if (rc != 0) {
+ goto end2;
+ }
+
+ local_sig_ptr = reformatted_sig;
+
+ rc = get_ecdsa_pkinfo_from_asn1((unsigned char **)&pk_ptr,
+ &pk_len,
+ &psa_ecc_family);
+ if (rc != 0) {
+ goto end2;
+ }
+ }
+#endif /*
+ * TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_ECDSA || \
+ * TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA
+ **/
/* Convert this pk_alg and md_alg to PSA key type and key algorithm */
- construct_psa_key_alg_and_type(pk_alg, md_alg,
+ construct_psa_key_alg_and_type(pk_alg, md_alg, psa_ecc_family,
&psa_alg, &psa_key_type);
@@ -208,7 +405,7 @@
*/
status = psa_verify_message(psa_key_id, psa_alg,
data_ptr, data_len,
- signature.p, signature.len);
+ local_sig_ptr, local_sig_len);
if (status != PSA_SUCCESS) {
rc = CRYPTO_ERR_SIGNATURE;
diff --git a/make_helpers/arch_features.mk b/make_helpers/arch_features.mk
index c92b4a5..f957f0d 100644
--- a/make_helpers/arch_features.mk
+++ b/make_helpers/arch_features.mk
@@ -8,12 +8,64 @@
# and enables them based on the configured architecture version.
# This file follows the following format:
-# - By default disable any mandatory features.
-# - Then Enable mandatory feature if applicable to an Arch Version.
+# - Enable mandatory feature if applicable to an Arch Version.
+# - By default disable any mandatory features if they have not been defined yet.
# - Disable or enable any optional feature this would be enabled/disabled if needed by platform.
#
################################################################################
+# Enable Mandatory features based on Arch versions.
+################################################################################
+#
+
+# Enable the features which are mandatory from ARCH version 8.1 and upwards.
+ifeq "8.1" "$(word 1, $(sort 8.1 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_PAN := 1
+ENABLE_FEAT_VHE := 1
+endif
+
+# Enable the features which are mandatory from ARCH version 8.2 and upwards.
+ifeq "8.2" "$(word 1, $(sort 8.2 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_RAS := 1
+endif
+
+# Enable the features which are mandatory from ARCH version 8.4 and upwards.
+ifeq "8.4" "$(word 1, $(sort 8.4 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_SEL2 := 1
+ENABLE_TRF_FOR_NS := 1
+ENABLE_FEAT_DIT := 1
+endif
+
+# Enable the features which are mandatory from ARCH version 8.5 and upwards.
+ifeq "8.5" "$(word 1, $(sort 8.5 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_RNG := 1
+ENABLE_FEAT_SB := 1
+
+# Enable Memory tagging, Branch Target Identification for aarch64 only.
+ifeq ($(ARCH), aarch64)
+ mem_tag_arch_support := yes
+endif #(ARCH=aarch64)
+
+endif
+
+# Enable the features which are mandatory from ARCH version 8.6 and upwards.
+ifeq "8.6" "$(word 1, $(sort 8.6 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_ECV := 1
+ENABLE_FEAT_FGT := 1
+endif
+
+# Enable the features which are mandatory from ARCH version 8.7 and upwards.
+ifeq "8.7" "$(word 1, $(sort 8.7 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_HCX := 1
+endif
+
+# Enable the features which are mandatory from ARCH version 8.9 and upwards.
+ifeq "8.9" "$(word 1, $(sort 8.9 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
+ENABLE_FEAT_TCR2 := 1
+endif
+
+#
+################################################################################
# Set mandatory features by default to zero.
################################################################################
#
@@ -23,17 +75,17 @@
#----
# Flag to enable access to Privileged Access Never bit of PSTATE.
-ENABLE_FEAT_PAN := 0
+ENABLE_FEAT_PAN ?= 0
# Flag to enable Virtualization Host Extensions.
-ENABLE_FEAT_VHE := 0
+ENABLE_FEAT_VHE ?= 0
#----
# 8.2
#----
# Enable RAS Support.
-ENABLE_FEAT_RAS := 0
+ENABLE_FEAT_RAS ?= 0
#----
# 8.3
@@ -41,118 +93,67 @@
# Flag to enable Pointer Authentication. Internal flag not meant for
# direct setting. Use BRANCH_PROTECTION to enable PAUTH.
-ENABLE_PAUTH := 0
+ENABLE_PAUTH ?= 0
# Include pointer authentication (ARMv8.3-PAuth) registers in cpu context. This
# must be set to 1 if the platform wants to use this feature in the Secure
# world. It is not necessary for use in the Non-secure world.
-CTX_INCLUDE_PAUTH_REGS := 0
+CTX_INCLUDE_PAUTH_REGS ?= 0
+
#----
# 8.4
#----
# Flag to enable Secure EL-2 feature.
-ENABLE_FEAT_SEL2 := 0
+ENABLE_FEAT_SEL2 ?= 0
# By default, disable trace filter control register access to lower non-secure
# exception levels, i.e. NS-EL2, or NS-EL1 if NS-EL2 is implemented, but
# trace filter control register access is unused if FEAT_TRF is implemented.
-ENABLE_TRF_FOR_NS := 0
+ENABLE_TRF_FOR_NS ?= 0
# Flag to enable Data Independent Timing instructions.
-ENABLE_FEAT_DIT := 0
+ENABLE_FEAT_DIT ?= 0
#----
# 8.5
#----
-# Flag to enable access to the Random Number Generator registers.
-ENABLE_FEAT_RNG := 0
-
-# Flag to enable Speculation Barrier Instruction.
-ENABLE_FEAT_SB := 0
-
# Flag to enable Branch Target Identification.
# Internal flag not meant for direct setting.
# Use BRANCH_PROTECTION to enable BTI.
-ENABLE_BTI := 0
+ENABLE_BTI ?= 0
+
+# Flag to enable access to the Random Number Generator registers.
+ENABLE_FEAT_RNG ?= 0
+
+# Flag to enable Speculation Barrier Instruction.
+ENABLE_FEAT_SB ?= 0
#----
# 8.6
#----
# Flag to enable access to the CNTPOFF_EL2 register.
-ENABLE_FEAT_ECV := 0
+ENABLE_FEAT_ECV ?= 0
# Flag to enable access to the HDFGRTR_EL2 register.
-ENABLE_FEAT_FGT := 0
+ENABLE_FEAT_FGT ?= 0
#----
# 8.7
#----
# Flag to enable access to the HCRX_EL2 register by setting SCR_EL3.HXEn.
-ENABLE_FEAT_HCX := 0
+ENABLE_FEAT_HCX ?= 0
#----
# 8.9
#----
# Flag to enable access to TCR2 (FEAT_TCR2).
-ENABLE_FEAT_TCR2 := 0
-
-#
-################################################################################
-# Enable Mandatory features based on Arch versions.
-################################################################################
-#
-
-# Enable the features which are mandatory from ARCH version 8.1 and upwards.
-ifeq "8.1" "$(word 1, $(sort 8.1 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_PAN := 1
-ENABLE_FEAT_VHE := 1
-endif
-
-# Enable the features which are mandatory from ARCH version 8.2 and upwards.
-ifeq "8.2" "$(word 1, $(sort 8.2 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_RAS := 1
-endif
-
-# Enable the features which are mandatory from ARCH version 8.4 and upwards.
-ifeq "8.4" "$(word 1, $(sort 8.4 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_SEL2 := 1
-ENABLE_TRF_FOR_NS := 1
-ENABLE_FEAT_DIT := 1
-endif
-
-# Enable the features which are mandatory from ARCH version 8.5 and upwards.
-ifeq "8.5" "$(word 1, $(sort 8.5 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_RNG := 1
-ENABLE_FEAT_SB := 1
-
-# Enable Memory tagging, Branch Target Identification for aarch64 only.
-ifeq ($(ARCH), aarch64)
- mem_tag_arch_support := yes
-endif #(ARCH=aarch64)
-
-endif
-
-# Enable the features which are mandatory from ARCH version 8.6 and upwards.
-ifeq "8.6" "$(word 1, $(sort 8.6 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_ECV := 1
-ENABLE_FEAT_FGT := 1
-endif
-
-# Enable the features which are mandatory from ARCH version 8.7 and upwards.
-ifeq "8.7" "$(word 1, $(sort 8.7 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_HCX := 1
-endif
-
-# Enable the features which are mandatory from ARCH version 8.9 and upwards.
-ifeq "8.9" "$(word 1, $(sort 8.9 $(ARM_ARCH_MAJOR).$(ARM_ARCH_MINOR)))"
-ENABLE_FEAT_TCR2 := 1
-endif
+ENABLE_FEAT_TCR2 ?= 0
#
################################################################################
@@ -184,7 +185,7 @@
ifeq (${ARCH},aarch64)
ENABLE_SPE_FOR_NS ?= 2
else ifeq (${ARCH},aarch32)
- ifdef ENABLE_SPE_FOR_NS
+ ifneq ($(or $(ENABLE_SPE_FOR_NS),0),0)
$(error ENABLE_SPE_FOR_NS is not supported for AArch32)
else
ENABLE_SPE_FOR_NS := 0
@@ -196,7 +197,7 @@
ENABLE_SVE_FOR_NS ?= 2
# SVE is only supported on AArch64 so disable it on AArch32.
else ifeq (${ARCH},aarch32)
- ifdef ENABLE_SVE_FOR_NS
+ ifneq ($(or $(ENABLE_SVE_FOR_NS),0),0)
$(error ENABLE_SVE_FOR_NS is not supported for AArch32)
else
ENABLE_SVE_FOR_NS := 0
@@ -302,10 +303,10 @@
ifeq (${ARCH},aarch64)
ENABLE_TRBE_FOR_NS ?= 0
else ifeq (${ARCH},aarch32)
- ifdef ENABLE_TRBE_FOR_NS
- $(error ENABLE_TRBE_FOR_NS is not supported for AArch32)
+ ifneq ($(or $(ENABLE_TRBE_FOR_NS),0),0)
+ $(error ENABLE_TRBE_FOR_NS is not supported for AArch32)
else
- ENABLE_TRBE_FOR_NS := 0
+ ENABLE_TRBE_FOR_NS := 0
endif
endif
diff --git a/plat/arm/board/fvp/include/platform_def.h b/plat/arm/board/fvp/include/platform_def.h
index 836080a..aad0417 100644
--- a/plat/arm/board/fvp/include/platform_def.h
+++ b/plat/arm/board/fvp/include/platform_def.h
@@ -193,8 +193,10 @@
/*
* PLAT_ARM_MAX_BL1_RW_SIZE is calculated using the current BL1 RW debug size
* plus a little space for growth.
+ * In case of PSA Crypto API, few algorithms like ECDSA needs bigger BL1 RW
+ * area.
*/
-#if TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA
+#if TF_MBEDTLS_KEY_ALG_ID == TF_MBEDTLS_RSA_AND_ECDSA || PSA_CRYPTO
#define PLAT_ARM_MAX_BL1_RW_SIZE UL(0xC000)
#else
#define PLAT_ARM_MAX_BL1_RW_SIZE UL(0xB000)
diff --git a/plat/arm/board/fvp/platform.mk b/plat/arm/board/fvp/platform.mk
index d70eb49..902a5df 100644
--- a/plat/arm/board/fvp/platform.mk
+++ b/plat/arm/board/fvp/platform.mk
@@ -72,9 +72,7 @@
# enable unconditionally for all builds
ifeq (${ARCH}, aarch64)
-ifeq (${ENABLE_RME},0)
- ENABLE_BRBE_FOR_NS := 2
-endif
+ ENABLE_BRBE_FOR_NS := 2
ENABLE_TRBE_FOR_NS := 2
endif
ENABLE_SYS_REG_TRACE_FOR_NS := 2
diff --git a/plat/arm/board/n1sdp/platform.mk b/plat/arm/board/n1sdp/platform.mk
index bd62614..f937ee7 100644
--- a/plat/arm/board/n1sdp/platform.mk
+++ b/plat/arm/board/n1sdp/platform.mk
@@ -1,5 +1,5 @@
#
-# Copyright (c) 2018-2022, Arm Limited. All rights reserved.
+# Copyright (c) 2018-2023, Arm Limited. All rights reserved.
#
# SPDX-License-Identifier: BSD-3-Clause
#
@@ -14,6 +14,10 @@
N1SDP_CPU_SOURCES := lib/cpus/aarch64/neoverse_n1.S
+# Neoverse N1 cores support Armv8.2 extensions
+ARM_ARCH_MAJOR := 8
+ARM_ARCH_MINOR := 2
+
# GIC-600 configuration
GICV3_SUPPORT_GIC600 := 1
GICV3_IMPL_GIC600_MULTICHIP := 1