diff options
Diffstat (limited to 'docs/getting_started/build-options.rst')
| -rw-r--r-- | docs/getting_started/build-options.rst | 101 |
1 files changed, 80 insertions, 21 deletions
diff --git a/docs/getting_started/build-options.rst b/docs/getting_started/build-options.rst index 901a72a9b..7662a1425 100644 --- a/docs/getting_started/build-options.rst +++ b/docs/getting_started/build-options.rst @@ -55,6 +55,9 @@ Common build options - ``BL2_AT_EL3``: This is an optional build option that enables the use of BL2 at EL3 execution level. +- ``BL2_ENABLE_SP_LOAD``: Boolean option to enable loading SP packages from the + FIP. Automatically enabled if ``SP_LAYOUT_FILE`` is provided. + - ``BL2_IN_XIP_MEM``: In some use-cases BL2 will be stored in eXecute In Place (XIP) memory, like BL1. In these use-cases, it is necessary to initialize the RW sections in RAM, while leaving the RO sections in place. This option @@ -117,7 +120,7 @@ Common build options | 4 | bti | N | Y | +-------+--------------+-------+-----+ - This option defaults to 0 and this is an experimental feature. + This option defaults to 0. Note that Pointer Authentication is enabled for Non-secure world irrespective of the value of this option if the CPU supports it. @@ -178,7 +181,7 @@ Common build options - ``CTX_INCLUDE_PAUTH_REGS``: Boolean option that, when set to 1, enables Pointer Authentication for Secure world. This will cause the ARMv8.3-PAuth registers to be included when saving and restoring the CPU context as - part of world switch. Default value is 0 and this is an experimental feature. + part of world switch. Default value is 0. Note that Pointer Authentication is enabled for Non-secure world irrespective of the value of this flag if the CPU supports it. @@ -189,7 +192,7 @@ Common build options authenticated decryption algorithm to be used to decrypt firmware/s during boot. It accepts 2 values: ``aes_gcm`` and ``none``. The default value of this flag is ``none`` to disable firmware decryption which is an optional - feature as per TBBR. Also, it is an experimental feature. + feature as per TBBR. - ``DISABLE_BIN_GENERATION``: Boolean option to disable the generation of the binary image. If set to 1, then only the ELF image is built. @@ -217,6 +220,14 @@ Common build options v8.2 implementations also implement an AMU and this option can be used to enable this feature on those systems as well. Default is 0. +- ``ENABLE_AMU_AUXILIARY_COUNTERS``: Enables support for AMU auxiliary counters + (also known as group 1 counters). These are implementation-defined counters, + and as such require additional platform configuration. Default is 0. + +- ``ENABLE_AMU_FCONF``: Enables configuration of the AMU through FCONF, which + allows platforms with auxiliary counters to describe them via the + ``HW_CONFIG`` device tree blob. Default is 0. + - ``ENABLE_ASSERTIONS``: This option controls whether or not calls to ``assert()`` are compiled out. For debug builds, this option defaults to 1, and calls to ``assert()`` are left in place. For release builds, this option defaults to 0 @@ -235,6 +246,10 @@ Common build options builds, but this behaviour can be overridden in each platform's Makefile or in the build command line. +- ``ENABLE_FEAT_HCX``: This option sets the bit SCR_EL3.HXEn in EL3 to allow + access to HCRX_EL2 (extended hypervisor control register) from EL2 as well as + adding HCRX_EL2 to the EL2 context save/restore operations. + - ``ENABLE_LTO``: Boolean option to enable Link Time Optimization (LTO) support in GCC for TF-A. This option is currently only supported for AArch64. Default is 0. @@ -250,6 +265,16 @@ Common build options partitioning in EL3, however. Platform initialisation code should configure and use partitions in EL3 as required. This option defaults to ``0``. +- ``ENABLE_MPMM``: Boolean option to enable support for the Maximum Power + Mitigation Mechanism supported by certain Arm cores, which allows the SoC + firmware to detect and limit high activity events to assist in SoC processor + power domain dynamic power budgeting and limit the triggering of whole-rail + (i.e. clock chopping) responses to overcurrent conditions. Defaults to ``0``. + +- ``ENABLE_MPMM_FCONF``: Enables configuration of MPMM through FCONF, which + allows platforms with cores supporting MPMM to describe them via the + ``HW_CONFIG`` device tree blob. Default is 0. + - ``ENABLE_PIE``: Boolean option to enable Position Independent Executable(PIE) support within generic code in TF-A. This option is currently only supported in BL2_AT_EL3, BL31, and BL32 (TSP) for AARCH64 binaries, and in BL32 @@ -264,12 +289,31 @@ Common build options be enabled. If ``ENABLE_PMF`` is set, the residency statistics are tracked in software. +- ``ENABLE_RME``: Boolean option to enable support for the ARMv9 Realm + Management Extension. Default value is 0. This is currently an experimental + feature. + - ``ENABLE_RUNTIME_INSTRUMENTATION``: Boolean option to enable runtime instrumentation which injects timestamp collection points into TF-A to allow runtime performance to be measured. Currently, only PSCI is instrumented. Enabling this option enables the ``ENABLE_PMF`` build option as well. Default is 0. +- ``ENABLE_SME_FOR_NS``: Boolean option to enable Scalable Matrix Extension + (SME), SVE, and FPU/SIMD for the non-secure world only. These features share + registers so are enabled together. Using this option without + ENABLE_SME_FOR_SWD=1 will cause SME, SVE, and FPU/SIMD instructions in secure + world to trap to EL3. SME is an optional architectural feature for AArch64 + and TF-A support is experimental. At this time, this build option cannot be + used on systems that have SPD=spmd/SPM_MM or ENABLE_RME, and attempting to + build with these options will fail. Default is 0. + +- ``ENABLE_SME_FOR_SWD``: Boolean option to enable the Scalable Matrix + Extension for secure world use along with SVE and FPU/SIMD, ENABLE_SME_FOR_NS + must also be set to use this. If enabling this, the secure world MUST + handle context switching for SME, SVE, and FPU/SIMD registers to ensure that + no data is leaked to non-secure world. This is experimental. Default is 0. + - ``ENABLE_SPE_FOR_LOWER_ELS`` : Boolean option to enable Statistical Profiling extensions. This is an optional architectural feature for AArch64. The default is 1 but is automatically disabled when the target architecture @@ -284,8 +328,9 @@ Common build options which are aliased by the SIMD and FP registers. The build option is not compatible with the ``CTX_INCLUDE_FPREGS`` build option, and will raise an assert on platforms where SVE is implemented and ``ENABLE_SVE_FOR_NS`` set to - 1. The default is 1 but is automatically disabled when the target - architecture is AArch32. + 1. The default is 1 but is automatically disabled when ENABLE_SME_FOR_NS=1 + since SME encompasses SVE. At this time, this build option cannot be used on + systems that have SPM_MM enabled. - ``ENABLE_SVE_FOR_SWD``: Boolean option to enable SVE for the Secure world. SVE is an optional architectural feature for AArch64. Note that this option @@ -301,20 +346,18 @@ Common build options component of the option ``-fstack-protector-$ENABLE_STACK_PROTECTOR``. - ``ENCRYPT_BL31``: Binary flag to enable encryption of BL31 firmware. This - flag depends on ``DECRYPTION_SUPPORT`` build flag which is marked as - experimental. + flag depends on ``DECRYPTION_SUPPORT`` build flag. - ``ENCRYPT_BL32``: Binary flag to enable encryption of Secure BL32 payload. - This flag depends on ``DECRYPTION_SUPPORT`` build flag which is marked as - experimental. + This flag depends on ``DECRYPTION_SUPPORT`` build flag. - ``ENC_KEY``: A 32-byte (256-bit) symmetric key in hex string format. It could either be SSK or BSSK depending on ``FW_ENC_STATUS`` flag. This value depends - on ``DECRYPTION_SUPPORT`` build flag which is marked as experimental. + on ``DECRYPTION_SUPPORT`` build flag. - ``ENC_NONCE``: A 12-byte (96-bit) encryption nonce or Initialization Vector (IV) in hex string format. This value depends on ``DECRYPTION_SUPPORT`` - build flag which is marked as experimental. + build flag. - ``ERROR_DEPRECATED``: This option decides whether to treat the usage of deprecated platform APIs, helper functions or drivers within Trusted @@ -353,8 +396,7 @@ Common build options 1: Encryption is done with Binding Secret Symmetric Key (BSSK) which is unique per device. - This flag depends on ``DECRYPTION_SUPPORT`` build flag which is marked as - experimental. + This flag depends on ``DECRYPTION_SUPPORT`` build flag. - ``GENERATE_COT``: Boolean flag used to build and execute the ``cert_create`` tool to create certificates as per the Chain of Trust described in @@ -473,8 +515,7 @@ Common build options in order to provide trust that the code taking the measurements and recording them has not been tampered with. - This option defaults to 0 and is an experimental feature in the stage of - development. + This option defaults to 0. - ``NON_TRUSTED_WORLD_KEY``: This option is used when ``GENERATE_COT=1``. It specifies the file that contains the Non-Trusted World private key in PEM @@ -684,26 +725,25 @@ Common build options - ``ARM_IO_IN_DTB``: This flag determines whether to use IO based on the firmware configuration framework. This will move the io_policies into a configuration device tree, instead of static structure in the code base. - This is currently an experimental feature. - ``COT_DESC_IN_DTB``: This flag determines whether to create COT descriptors at runtime using fconf. If this flag is enabled, COT descriptors are statically captured in tb_fw_config file in the form of device tree nodes and properties. Currently, COT descriptors used by BL2 are moved to the device tree and COT descriptors used by BL1 are retained in the code - base statically. This is currently an experimental feature. + base statically. - ``SDEI_IN_FCONF``: This flag determines whether to configure SDEI setup in runtime using firmware configuration framework. The platform specific SDEI shared and private events configuration is retrieved from device tree rather - than static C structures at compile time. This is currently an experimental - feature and is only supported if SDEI_SUPPORT build flag is enabled. + than static C structures at compile time. This is only supported if + SDEI_SUPPORT build flag is enabled. - ``SEC_INT_DESC_IN_FCONF``: This flag determines whether to configure Group 0 and Group1 secure interrupts using the firmware configuration framework. The platform specific secure interrupt property descriptor is retrieved from device tree in runtime rather than depending on static C structure at compile - time. This is currently an experimental feature. + time. - ``USE_ROMLIB``: This flag determines whether library at ROM will be used. This feature creates a library of functions to be placed in ROM and thus @@ -775,6 +815,21 @@ Common build options functions that wait for an arbitrary time length (udelay and mdelay). The default value is 0. +- ``ENABLE_TRBE_FOR_NS``: This flag is used to enable access of trace buffer + control registers from NS ELs, NS-EL2 or NS-EL1(when NS-EL2 is implemented + but unused) when FEAT_TRBE is implemented. TRBE is an optional architectural + feature for AArch64. The default is 0 and it is automatically disabled when + the target architecture is AArch32. + +- ``ENABLE_SYS_REG_TRACE_FOR_NS``: Boolean option to enable trace system + registers access from NS ELs, NS-EL2 or NS-EL1 (when NS-EL2 is implemented + but unused). This feature is available if trace unit such as ETMv4.x, and + ETE(extending ETM feature) is implemented. This flag is disabled by default. + +- ``ENABLE_TRF_FOR_NS``: Boolean option to enable trace filter control registers + access from NS ELs, NS-EL2 or NS-EL1 (when NS-EL2 is implemented but unused), + if FEAT_TRF is implemented. This flag is disabled by default. + GICv3 driver options -------------------- @@ -790,6 +845,11 @@ makefile: GIC-600, so is safe to select even for a GIC500 implementation. This option defaults to 0. +- ``GICV3_SUPPORT_GIC600AE_FMU``: Add support for the Fault Management Unit + for GIC-600 AE. Enabling this option will introduce support to initialize + the FMU. Platforms should call the init function during boot to enable the + FMU and its safety mechanisms. This option defaults to 0. + - ``GICV3_IMPL_GIC600_MULTICHIP``: Selects GIC-600 variant with multichip functionality. This option defaults to 0 @@ -887,4 +947,3 @@ Firmware update options .. _DEN0115: https://developer.arm.com/docs/den0115/latest .. _PSA FW update specification: https://developer.arm.com/documentation/den0118/a/ - |