blob: 6f60a8e38bc52ecbf677ad3f28065af5b8ee6828 [file] [log] [blame]
Paul Beesley43f35ef2019-05-29 13:59:40 +01001Build Options
2=============
3
4The TF-A build system supports the following build options. Unless mentioned
5otherwise, these options are expected to be specified at the build command
6line and are not to be modified in any component makefiles. Note that the
7build system doesn't track dependency for build options. Therefore, if any of
8the build options are changed from a previous build, a clean build must be
9performed.
10
11.. _build_options_common:
12
13Common build options
14--------------------
15
16- ``AARCH32_INSTRUCTION_SET``: Choose the AArch32 instruction set that the
17 compiler should use. Valid values are T32 and A32. It defaults to T32 due to
18 code having a smaller resulting size.
19
20- ``AARCH32_SP`` : Choose the AArch32 Secure Payload component to be built as
21 as the BL32 image when ``ARCH=aarch32``. The value should be the path to the
22 directory containing the SP source, relative to the ``bl32/``; the directory
23 is expected to contain a makefile called ``<aarch32_sp-value>.mk``.
24
johpow01873d4242020-10-02 13:41:11 -050025- ``AMU_RESTRICT_COUNTERS``: Register reads to the group 1 counters will return
26 zero at all but the highest implemented exception level. Reads from the
27 memory mapped view are unaffected by this control.
28
Paul Beesley43f35ef2019-05-29 13:59:40 +010029- ``ARCH`` : Choose the target build architecture for TF-A. It can take either
30 ``aarch64`` or ``aarch32`` as values. By default, it is defined to
31 ``aarch64``.
32
Alexei Fedorovf1821792020-12-07 16:38:53 +000033- ``ARM_ARCH_FEATURE``: Optional Arm Architecture build option which specifies
34 one or more feature modifiers. This option has the form ``[no]feature+...``
35 and defaults to ``none``. It translates into compiler option
36 ``-march=armvX[.Y]-a+[no]feature+...``. See compiler's documentation for the
37 list of supported feature modifiers.
38
Paul Beesley43f35ef2019-05-29 13:59:40 +010039- ``ARM_ARCH_MAJOR``: The major version of Arm Architecture to target when
40 compiling TF-A. Its value must be numeric, and defaults to 8 . See also,
41 *Armv8 Architecture Extensions* and *Armv7 Architecture Extensions* in
42 :ref:`Firmware Design`.
43
44- ``ARM_ARCH_MINOR``: The minor version of Arm Architecture to target when
45 compiling TF-A. Its value must be a numeric, and defaults to 0. See also,
46 *Armv8 Architecture Extensions* in :ref:`Firmware Design`.
47
48- ``BL2``: This is an optional build option which specifies the path to BL2
49 image for the ``fip`` target. In this case, the BL2 in the TF-A will not be
50 built.
51
52- ``BL2U``: This is an optional build option which specifies the path to
53 BL2U image. In this case, the BL2U in TF-A will not be built.
54
55- ``BL2_AT_EL3``: This is an optional build option that enables the use of
56 BL2 at EL3 execution level.
57
58- ``BL2_IN_XIP_MEM``: In some use-cases BL2 will be stored in eXecute In Place
59 (XIP) memory, like BL1. In these use-cases, it is necessary to initialize
60 the RW sections in RAM, while leaving the RO sections in place. This option
61 enable this use-case. For now, this option is only supported when BL2_AT_EL3
62 is set to '1'.
63
64- ``BL31``: This is an optional build option which specifies the path to
65 BL31 image for the ``fip`` target. In this case, the BL31 in TF-A will not
66 be built.
67
68- ``BL31_KEY``: This option is used when ``GENERATE_COT=1``. It specifies the
69 file that contains the BL31 private key in PEM format. If ``SAVE_KEYS=1``,
70 this file name will be used to save the key.
71
72- ``BL32``: This is an optional build option which specifies the path to
73 BL32 image for the ``fip`` target. In this case, the BL32 in TF-A will not
74 be built.
75
76- ``BL32_EXTRA1``: This is an optional build option which specifies the path to
77 Trusted OS Extra1 image for the ``fip`` target.
78
79- ``BL32_EXTRA2``: This is an optional build option which specifies the path to
80 Trusted OS Extra2 image for the ``fip`` target.
81
82- ``BL32_KEY``: This option is used when ``GENERATE_COT=1``. It specifies the
83 file that contains the BL32 private key in PEM format. If ``SAVE_KEYS=1``,
84 this file name will be used to save the key.
85
86- ``BL33``: Path to BL33 image in the host file system. This is mandatory for
87 ``fip`` target in case TF-A BL2 is used.
88
89- ``BL33_KEY``: This option is used when ``GENERATE_COT=1``. It specifies the
90 file that contains the BL33 private key in PEM format. If ``SAVE_KEYS=1``,
91 this file name will be used to save the key.
92
93- ``BRANCH_PROTECTION``: Numeric value to enable ARMv8.3 Pointer Authentication
94 and ARMv8.5 Branch Target Identification support for TF-A BL images themselves.
95 If enabled, it is needed to use a compiler that supports the option
96 ``-mbranch-protection``. Selects the branch protection features to use:
97- 0: Default value turns off all types of branch protection
98- 1: Enables all types of branch protection features
99- 2: Return address signing to its standard level
100- 3: Extend the signing to include leaf functions
Alexei Fedorov3768fec2020-06-19 14:33:49 +0100101- 4: Turn on branch target identification mechanism
Paul Beesley43f35ef2019-05-29 13:59:40 +0100102
103 The table below summarizes ``BRANCH_PROTECTION`` values, GCC compilation options
104 and resulting PAuth/BTI features.
105
106 +-------+--------------+-------+-----+
107 | Value | GCC option | PAuth | BTI |
108 +=======+==============+=======+=====+
109 | 0 | none | N | N |
110 +-------+--------------+-------+-----+
111 | 1 | standard | Y | Y |
112 +-------+--------------+-------+-----+
113 | 2 | pac-ret | Y | N |
114 +-------+--------------+-------+-----+
115 | 3 | pac-ret+leaf | Y | N |
116 +-------+--------------+-------+-----+
Alexei Fedorov3768fec2020-06-19 14:33:49 +0100117 | 4 | bti | N | Y |
118 +-------+--------------+-------+-----+
Paul Beesley43f35ef2019-05-29 13:59:40 +0100119
120 This option defaults to 0 and this is an experimental feature.
121 Note that Pointer Authentication is enabled for Non-secure world
122 irrespective of the value of this option if the CPU supports it.
123
124- ``BUILD_MESSAGE_TIMESTAMP``: String used to identify the time and date of the
125 compilation of each build. It must be set to a C string (including quotes
126 where applicable). Defaults to a string that contains the time and date of
127 the compilation.
128
129- ``BUILD_STRING``: Input string for VERSION_STRING, which allows the TF-A
130 build to be uniquely identified. Defaults to the current git commit id.
131
Grant Likely29214e92020-07-30 08:50:10 +0100132- ``BUILD_BASE``: Output directory for the build. Defaults to ``./build``
133
Paul Beesley43f35ef2019-05-29 13:59:40 +0100134- ``CFLAGS``: Extra user options appended on the compiler's command line in
135 addition to the options set by the build system.
136
137- ``COLD_BOOT_SINGLE_CPU``: This option indicates whether the platform may
138 release several CPUs out of reset. It can take either 0 (several CPUs may be
139 brought up) or 1 (only one CPU will ever be brought up during cold reset).
140 Default is 0. If the platform always brings up a single CPU, there is no
141 need to distinguish between primary and secondary CPUs and the boot path can
142 be optimised. The ``plat_is_my_cpu_primary()`` and
143 ``plat_secondary_cold_boot_setup()`` platform porting interfaces do not need
144 to be implemented in this case.
145
Sandrine Bailleux3bff9102020-01-15 10:23:25 +0100146- ``COT``: When Trusted Boot is enabled, selects the desired chain of trust.
147 Defaults to ``tbbr``.
148
Paul Beesley43f35ef2019-05-29 13:59:40 +0100149- ``CRASH_REPORTING``: A non-zero value enables a console dump of processor
150 register state when an unexpected exception occurs during execution of
151 BL31. This option defaults to the value of ``DEBUG`` - i.e. by default
152 this is only enabled for a debug build of the firmware.
153
154- ``CREATE_KEYS``: This option is used when ``GENERATE_COT=1``. It tells the
155 certificate generation tool to create new keys in case no valid keys are
156 present or specified. Allowed options are '0' or '1'. Default is '1'.
157
158- ``CTX_INCLUDE_AARCH32_REGS`` : Boolean option that, when set to 1, will cause
159 the AArch32 system registers to be included when saving and restoring the
160 CPU context. The option must be set to 0 for AArch64-only platforms (that
161 is on hardware that does not implement AArch32, or at least not at EL1 and
162 higher ELs). Default value is 1.
163
Olivier Deprez4c65b4d2020-03-26 16:09:21 +0100164- ``CTX_INCLUDE_EL2_REGS`` : This boolean option provides context save/restore
165 operations when entering/exiting an EL2 execution context. This is of primary
166 interest when Armv8.4-SecEL2 extension is implemented. Default is 0 (disabled).
167 This option must be equal to 1 (enabled) when ``SPD=spmd`` and
168 ``SPMD_SPM_AT_SEL2`` is set.
169
Paul Beesley43f35ef2019-05-29 13:59:40 +0100170- ``CTX_INCLUDE_FPREGS``: Boolean option that, when set to 1, will cause the FP
171 registers to be included when saving and restoring the CPU context. Default
172 is 0.
173
Arunachalam Ganapathy062f8aa2020-05-28 11:57:09 +0100174- ``CTX_INCLUDE_NEVE_REGS``: Boolean option that, when set to 1, will cause the
175 Armv8.4-NV registers to be saved/restored when entering/exiting an EL2
176 execution context. Default value is 0.
177
Paul Beesley43f35ef2019-05-29 13:59:40 +0100178- ``CTX_INCLUDE_PAUTH_REGS``: Boolean option that, when set to 1, enables
179 Pointer Authentication for Secure world. This will cause the ARMv8.3-PAuth
180 registers to be included when saving and restoring the CPU context as
181 part of world switch. Default value is 0 and this is an experimental feature.
182 Note that Pointer Authentication is enabled for Non-secure world irrespective
183 of the value of this flag if the CPU supports it.
184
185- ``DEBUG``: Chooses between a debug and release build. It can take either 0
186 (release) or 1 (debug) as values. 0 is the default.
187
Sumit Garg7cda17b2019-11-15 10:43:00 +0530188- ``DECRYPTION_SUPPORT``: This build flag enables the user to select the
189 authenticated decryption algorithm to be used to decrypt firmware/s during
190 boot. It accepts 2 values: ``aes_gcm`` and ``none``. The default value of
191 this flag is ``none`` to disable firmware decryption which is an optional
192 feature as per TBBR. Also, it is an experimental feature.
193
Paul Beesley43f35ef2019-05-29 13:59:40 +0100194- ``DISABLE_BIN_GENERATION``: Boolean option to disable the generation
195 of the binary image. If set to 1, then only the ELF image is built.
196 0 is the default.
197
Javier Almansa Sobrino0063dd12020-11-23 18:38:15 +0000198- ``DISABLE_MTPMU``: Boolean option to disable FEAT_MTPMU if implemented
199 (Armv8.6 onwards). Its default value is 0 to keep consistency with platforms
200 that do not implement FEAT_MTPMU. For more information on FEAT_MTPMU,
201 check the latest Arm ARM.
202
Paul Beesley43f35ef2019-05-29 13:59:40 +0100203- ``DYN_DISABLE_AUTH``: Provides the capability to dynamically disable Trusted
204 Board Boot authentication at runtime. This option is meant to be enabled only
205 for development platforms. ``TRUSTED_BOARD_BOOT`` flag must be set if this
206 flag has to be enabled. 0 is the default.
207
208- ``E``: Boolean option to make warnings into errors. Default is 1.
209
210- ``EL3_PAYLOAD_BASE``: This option enables booting an EL3 payload instead of
211 the normal boot flow. It must specify the entry point address of the EL3
212 payload. Please refer to the "Booting an EL3 payload" section for more
213 details.
214
215- ``ENABLE_AMU``: Boolean option to enable Activity Monitor Unit extensions.
216 This is an optional architectural feature available on v8.4 onwards. Some
217 v8.2 implementations also implement an AMU and this option can be used to
218 enable this feature on those systems as well. Default is 0.
219
220- ``ENABLE_ASSERTIONS``: This option controls whether or not calls to ``assert()``
221 are compiled out. For debug builds, this option defaults to 1, and calls to
222 ``assert()`` are left in place. For release builds, this option defaults to 0
223 and calls to ``assert()`` function are compiled out. This option can be set
224 independently of ``DEBUG``. It can also be used to hide any auxiliary code
225 that is only required for the assertion and does not fit in the assertion
226 itself.
227
Alexei Fedorov68c76082020-02-06 17:11:03 +0000228- ``ENABLE_BACKTRACE``: This option controls whether to enable backtrace
Paul Beesley43f35ef2019-05-29 13:59:40 +0100229 dumps or not. It is supported in both AArch64 and AArch32. However, in
230 AArch32 the format of the frame records are not defined in the AAPCS and they
231 are defined by the implementation. This implementation of backtrace only
232 supports the format used by GCC when T32 interworking is disabled. For this
233 reason enabling this option in AArch32 will force the compiler to only
234 generate A32 code. This option is enabled by default only in AArch64 debug
235 builds, but this behaviour can be overridden in each platform's Makefile or
236 in the build command line.
237
Sandrine Bailleux535fa662019-12-17 09:38:08 +0100238- ``ENABLE_LTO``: Boolean option to enable Link Time Optimization (LTO)
zelalem-awekeedbce9a2019-11-12 16:20:17 -0600239 support in GCC for TF-A. This option is currently only supported for
240 AArch64. Default is 0.
241
Paul Beesley43f35ef2019-05-29 13:59:40 +0100242- ``ENABLE_MPAM_FOR_LOWER_ELS``: Boolean option to enable lower ELs to use MPAM
243 feature. MPAM is an optional Armv8.4 extension that enables various memory
244 system components and resources to define partitions; software running at
245 various ELs can assign themselves to desired partition to control their
246 performance aspects.
247
248 When this option is set to ``1``, EL3 allows lower ELs to access their own
249 MPAM registers without trapping into EL3. This option doesn't make use of
250 partitioning in EL3, however. Platform initialisation code should configure
251 and use partitions in EL3 as required. This option defaults to ``0``.
252
253- ``ENABLE_PIE``: Boolean option to enable Position Independent Executable(PIE)
254 support within generic code in TF-A. This option is currently only supported
Yann Gautier4324a142020-10-05 11:02:54 +0200255 in BL2_AT_EL3, BL31, and BL32 (TSP) for AARCH64 binaries, and in BL32
256 (SP_min) for AARCH32. Default is 0.
Paul Beesley43f35ef2019-05-29 13:59:40 +0100257
258- ``ENABLE_PMF``: Boolean option to enable support for optional Performance
259 Measurement Framework(PMF). Default is 0.
260
261- ``ENABLE_PSCI_STAT``: Boolean option to enable support for optional PSCI
262 functions ``PSCI_STAT_RESIDENCY`` and ``PSCI_STAT_COUNT``. Default is 0.
263 In the absence of an alternate stat collection backend, ``ENABLE_PMF`` must
264 be enabled. If ``ENABLE_PMF`` is set, the residency statistics are tracked in
265 software.
266
267- ``ENABLE_RUNTIME_INSTRUMENTATION``: Boolean option to enable runtime
268 instrumentation which injects timestamp collection points into TF-A to
269 allow runtime performance to be measured. Currently, only PSCI is
270 instrumented. Enabling this option enables the ``ENABLE_PMF`` build option
271 as well. Default is 0.
272
273- ``ENABLE_SPE_FOR_LOWER_ELS`` : Boolean option to enable Statistical Profiling
274 extensions. This is an optional architectural feature for AArch64.
275 The default is 1 but is automatically disabled when the target architecture
276 is AArch32.
277
Paul Beesley43f35ef2019-05-29 13:59:40 +0100278- ``ENABLE_SVE_FOR_NS``: Boolean option to enable Scalable Vector Extension
279 (SVE) for the Non-secure world only. SVE is an optional architectural feature
280 for AArch64. Note that when SVE is enabled for the Non-secure world, access
281 to SIMD and floating-point functionality from the Secure world is disabled.
282 This is to avoid corruption of the Non-secure world data in the Z-registers
283 which are aliased by the SIMD and FP registers. The build option is not
284 compatible with the ``CTX_INCLUDE_FPREGS`` build option, and will raise an
285 assert on platforms where SVE is implemented and ``ENABLE_SVE_FOR_NS`` set to
286 1. The default is 1 but is automatically disabled when the target
287 architecture is AArch32.
288
289- ``ENABLE_STACK_PROTECTOR``: String option to enable the stack protection
290 checks in GCC. Allowed values are "all", "strong", "default" and "none". The
291 default value is set to "none". "strong" is the recommended stack protection
292 level if this feature is desired. "none" disables the stack protection. For
293 all values other than "none", the ``plat_get_stack_protector_canary()``
294 platform hook needs to be implemented. The value is passed as the last
295 component of the option ``-fstack-protector-$ENABLE_STACK_PROTECTOR``.
296
Sumit Gargf97062a2019-11-15 18:47:53 +0530297- ``ENCRYPT_BL31``: Binary flag to enable encryption of BL31 firmware. This
298 flag depends on ``DECRYPTION_SUPPORT`` build flag which is marked as
299 experimental.
300
301- ``ENCRYPT_BL32``: Binary flag to enable encryption of Secure BL32 payload.
302 This flag depends on ``DECRYPTION_SUPPORT`` build flag which is marked as
303 experimental.
304
305- ``ENC_KEY``: A 32-byte (256-bit) symmetric key in hex string format. It could
306 either be SSK or BSSK depending on ``FW_ENC_STATUS`` flag. This value depends
307 on ``DECRYPTION_SUPPORT`` build flag which is marked as experimental.
308
309- ``ENC_NONCE``: A 12-byte (96-bit) encryption nonce or Initialization Vector
310 (IV) in hex string format. This value depends on ``DECRYPTION_SUPPORT``
311 build flag which is marked as experimental.
312
Paul Beesley43f35ef2019-05-29 13:59:40 +0100313- ``ERROR_DEPRECATED``: This option decides whether to treat the usage of
314 deprecated platform APIs, helper functions or drivers within Trusted
315 Firmware as error. It can take the value 1 (flag the use of deprecated
316 APIs as error) or 0. The default is 0.
317
318- ``EL3_EXCEPTION_HANDLING``: When set to ``1``, enable handling of exceptions
319 targeted at EL3. When set ``0`` (default), no exceptions are expected or
320 handled at EL3, and a panic will result. This is supported only for AArch64
321 builds.
322
Javier Almansa Sobrino6ac269d2020-09-18 16:47:07 +0100323- ``EVENT_LOG_LEVEL``: Chooses the log level to use for Measured Boot when
324 ``MEASURED_BOOT`` is enabled. For a list of valid values, see ``LOG_LEVEL``.
325 Default value is 40 (LOG_LEVEL_INFO).
326
Paul Beesley43f35ef2019-05-29 13:59:40 +0100327- ``FAULT_INJECTION_SUPPORT``: ARMv8.4 extensions introduced support for fault
328 injection from lower ELs, and this build option enables lower ELs to use
329 Error Records accessed via System Registers to inject faults. This is
330 applicable only to AArch64 builds.
331
332 This feature is intended for testing purposes only, and is advisable to keep
333 disabled for production images.
334
335- ``FIP_NAME``: This is an optional build option which specifies the FIP
336 filename for the ``fip`` target. Default is ``fip.bin``.
337
338- ``FWU_FIP_NAME``: This is an optional build option which specifies the FWU
339 FIP filename for the ``fwu_fip`` target. Default is ``fwu_fip.bin``.
340
Sumit Gargf97062a2019-11-15 18:47:53 +0530341- ``FW_ENC_STATUS``: Top level firmware's encryption numeric flag, values:
342
343 ::
344
345 0: Encryption is done with Secret Symmetric Key (SSK) which is common
346 for a class of devices.
347 1: Encryption is done with Binding Secret Symmetric Key (BSSK) which is
348 unique per device.
349
350 This flag depends on ``DECRYPTION_SUPPORT`` build flag which is marked as
351 experimental.
352
Paul Beesley43f35ef2019-05-29 13:59:40 +0100353- ``GENERATE_COT``: Boolean flag used to build and execute the ``cert_create``
354 tool to create certificates as per the Chain of Trust described in
355 :ref:`Trusted Board Boot`. The build system then calls ``fiptool`` to
356 include the certificates in the FIP and FWU_FIP. Default value is '0'.
357
358 Specify both ``TRUSTED_BOARD_BOOT=1`` and ``GENERATE_COT=1`` to include support
359 for the Trusted Board Boot feature in the BL1 and BL2 images, to generate
360 the corresponding certificates, and to include those certificates in the
361 FIP and FWU_FIP.
362
363 Note that if ``TRUSTED_BOARD_BOOT=0`` and ``GENERATE_COT=1``, the BL1 and BL2
364 images will not include support for Trusted Board Boot. The FIP will still
365 include the corresponding certificates. This FIP can be used to verify the
366 Chain of Trust on the host machine through other mechanisms.
367
368 Note that if ``TRUSTED_BOARD_BOOT=1`` and ``GENERATE_COT=0``, the BL1 and BL2
369 images will include support for Trusted Board Boot, but the FIP and FWU_FIP
370 will not include the corresponding certificates, causing a boot failure.
371
372- ``GICV2_G0_FOR_EL3``: Unlike GICv3, the GICv2 architecture doesn't have
373 inherent support for specific EL3 type interrupts. Setting this build option
374 to ``1`` assumes GICv2 *Group 0* interrupts are expected to target EL3, both
Madhukar Pappireddy6844c342020-07-29 09:37:25 -0500375 by :ref:`platform abstraction layer<platform Interrupt Controller API>` and
376 :ref:`Interrupt Management Framework<Interrupt Management Framework>`.
Paul Beesley43f35ef2019-05-29 13:59:40 +0100377 This allows GICv2 platforms to enable features requiring EL3 interrupt type.
378 This also means that all GICv2 Group 0 interrupts are delivered to EL3, and
379 the Secure Payload interrupts needs to be synchronously handed over to Secure
380 EL1 for handling. The default value of this option is ``0``, which means the
381 Group 0 interrupts are assumed to be handled by Secure EL1.
382
Paul Beesley43f35ef2019-05-29 13:59:40 +0100383- ``HANDLE_EA_EL3_FIRST``: When set to ``1``, External Aborts and SError
384 Interrupts will be always trapped in EL3 i.e. in BL31 at runtime. When set to
385 ``0`` (default), these exceptions will be trapped in the current exception
386 level (or in EL1 if the current exception level is EL0).
387
388- ``HW_ASSISTED_COHERENCY``: On most Arm systems to-date, platform-specific
389 software operations are required for CPUs to enter and exit coherency.
390 However, newer systems exist where CPUs' entry to and exit from coherency
391 is managed in hardware. Such systems require software to only initiate these
392 operations, and the rest is managed in hardware, minimizing active software
393 management. In such systems, this boolean option enables TF-A to carry out
394 build and run-time optimizations during boot and power management operations.
395 This option defaults to 0 and if it is enabled, then it implies
396 ``WARMBOOT_ENABLE_DCACHE_EARLY`` is also enabled.
397
398 If this flag is disabled while the platform which TF-A is compiled for
399 includes cores that manage coherency in hardware, then a compilation error is
400 generated. This is based on the fact that a system cannot have, at the same
401 time, cores that manage coherency in hardware and cores that don't. In other
402 words, a platform cannot have, at the same time, cores that require
403 ``HW_ASSISTED_COHERENCY=1`` and cores that require
404 ``HW_ASSISTED_COHERENCY=0``.
405
406 Note that, when ``HW_ASSISTED_COHERENCY`` is enabled, version 2 of
407 translation library (xlat tables v2) must be used; version 1 of translation
408 library is not supported.
409
Louis Mayencourtb890b362020-02-13 08:21:34 +0000410- ``INVERTED_MEMMAP``: memmap tool print by default lower addresses at the
David Horstmann47147012021-01-21 12:29:59 +0000411 bottom, higher addresses at the top. This build flag can be set to '1' to
Louis Mayencourtb890b362020-02-13 08:21:34 +0000412 invert this behavior. Lower addresses will be printed at the top and higher
413 addresses at the bottom.
414
Paul Beesley43f35ef2019-05-29 13:59:40 +0100415- ``JUNO_AARCH32_EL3_RUNTIME``: This build flag enables you to execute EL3
416 runtime software in AArch32 mode, which is required to run AArch32 on Juno.
417 By default this flag is set to '0'. Enabling this flag builds BL1 and BL2 in
418 AArch64 and facilitates the loading of ``SP_MIN`` and BL33 as AArch32 executable
419 images.
420
421- ``KEY_ALG``: This build flag enables the user to select the algorithm to be
422 used for generating the PKCS keys and subsequent signing of the certificate.
423 It accepts 3 values: ``rsa``, ``rsa_1_5`` and ``ecdsa``. The option
424 ``rsa_1_5`` is the legacy PKCS#1 RSA 1.5 algorithm which is not TBBR
425 compliant and is retained only for compatibility. The default value of this
426 flag is ``rsa`` which is the TBBR compliant PKCS#1 RSA 2.1 scheme.
427
Gilad Ben-Yossefb8622922019-09-15 13:29:29 +0300428- ``KEY_SIZE``: This build flag enables the user to select the key size for
429 the algorithm specified by ``KEY_ALG``. The valid values for ``KEY_SIZE``
430 depend on the chosen algorithm and the cryptographic module.
431
432 +-----------+------------------------------------+
433 | KEY_ALG | Possible key sizes |
434 +===========+====================================+
435 | rsa | 1024 , 2048 (default), 3072, 4096* |
436 +-----------+------------------------------------+
437 | ecdsa | unavailable |
438 +-----------+------------------------------------+
439
440 * Only 2048 bits size is available with CryptoCell 712 SBROM release 1.
441 Only 3072 bits size is available with CryptoCell 712 SBROM release 2.
442
Paul Beesley43f35ef2019-05-29 13:59:40 +0100443- ``HASH_ALG``: This build flag enables the user to select the secure hash
444 algorithm. It accepts 3 values: ``sha256``, ``sha384`` and ``sha512``.
445 The default value of this flag is ``sha256``.
446
447- ``LDFLAGS``: Extra user options appended to the linkers' command line in
448 addition to the one set by the build system.
449
450- ``LOG_LEVEL``: Chooses the log level, which controls the amount of console log
451 output compiled into the build. This should be one of the following:
452
453 ::
454
455 0 (LOG_LEVEL_NONE)
456 10 (LOG_LEVEL_ERROR)
457 20 (LOG_LEVEL_NOTICE)
458 30 (LOG_LEVEL_WARNING)
459 40 (LOG_LEVEL_INFO)
460 50 (LOG_LEVEL_VERBOSE)
461
462 All log output up to and including the selected log level is compiled into
463 the build. The default value is 40 in debug builds and 20 in release builds.
464
Alexei Fedorov8c105292020-01-23 14:27:38 +0000465- ``MEASURED_BOOT``: Boolean flag to include support for the Measured Boot
Sandrine Bailleuxcc255b92021-06-10 11:18:04 +0200466 feature. If this flag is enabled ``TRUSTED_BOARD_BOOT`` must be set as well
467 in order to provide trust that the code taking the measurements and recording
468 them has not been tampered with.
469
Alexei Fedorov8c105292020-01-23 14:27:38 +0000470 This option defaults to 0 and is an experimental feature in the stage of
471 development.
472
Paul Beesley43f35ef2019-05-29 13:59:40 +0100473- ``NON_TRUSTED_WORLD_KEY``: This option is used when ``GENERATE_COT=1``. It
474 specifies the file that contains the Non-Trusted World private key in PEM
475 format. If ``SAVE_KEYS=1``, this file name will be used to save the key.
476
477- ``NS_BL2U``: Path to NS_BL2U image in the host file system. This image is
478 optional. It is only needed if the platform makefile specifies that it
479 is required in order to build the ``fwu_fip`` target.
480
481- ``NS_TIMER_SWITCH``: Enable save and restore for non-secure timer register
482 contents upon world switch. It can take either 0 (don't save and restore) or
483 1 (do save and restore). 0 is the default. An SPD may set this to 1 if it
484 wants the timer registers to be saved and restored.
485
486- ``OVERRIDE_LIBC``: This option allows platforms to override the default libc
487 for the BL image. It can be either 0 (include) or 1 (remove). The default
488 value is 0.
489
490- ``PL011_GENERIC_UART``: Boolean option to indicate the PL011 driver that
491 the underlying hardware is not a full PL011 UART but a minimally compliant
492 generic UART, which is a subset of the PL011. The driver will not access
493 any register that is not part of the SBSA generic UART specification.
494 Default value is 0 (a full PL011 compliant UART is present).
495
496- ``PLAT``: Choose a platform to build TF-A for. The chosen platform name
497 must be subdirectory of any depth under ``plat/``, and must contain a
498 platform makefile named ``platform.mk``. For example, to build TF-A for the
499 Arm Juno board, select PLAT=juno.
500
501- ``PRELOADED_BL33_BASE``: This option enables booting a preloaded BL33 image
502 instead of the normal boot flow. When defined, it must specify the entry
503 point address for the preloaded BL33 image. This option is incompatible with
504 ``EL3_PAYLOAD_BASE``. If both are defined, ``EL3_PAYLOAD_BASE`` has priority
505 over ``PRELOADED_BL33_BASE``.
506
507- ``PROGRAMMABLE_RESET_ADDRESS``: This option indicates whether the reset
508 vector address can be programmed or is fixed on the platform. It can take
509 either 0 (fixed) or 1 (programmable). Default is 0. If the platform has a
510 programmable reset address, it is expected that a CPU will start executing
511 code directly at the right address, both on a cold and warm reset. In this
512 case, there is no need to identify the entrypoint on boot and the boot path
513 can be optimised. The ``plat_get_my_entrypoint()`` platform porting interface
514 does not need to be implemented in this case.
515
516- ``PSCI_EXTENDED_STATE_ID``: As per PSCI1.0 Specification, there are 2 formats
517 possible for the PSCI power-state parameter: original and extended State-ID
518 formats. This flag if set to 1, configures the generic PSCI layer to use the
519 extended format. The default value of this flag is 0, which means by default
520 the original power-state format is used by the PSCI implementation. This flag
521 should be specified by the platform makefile and it governs the return value
522 of PSCI_FEATURES API for CPU_SUSPEND smc function id. When this option is
523 enabled on Arm platforms, the option ``ARM_RECOM_STATE_ID_ENC`` needs to be
524 set to 1 as well.
525
526- ``RAS_EXTENSION``: When set to ``1``, enable Armv8.2 RAS features. RAS features
527 are an optional extension for pre-Armv8.2 CPUs, but are mandatory for Armv8.2
528 or later CPUs.
529
530 When ``RAS_EXTENSION`` is set to ``1``, ``HANDLE_EA_EL3_FIRST`` must also be
531 set to ``1``.
532
533 This option is disabled by default.
534
535- ``RESET_TO_BL31``: Enable BL31 entrypoint as the CPU reset vector instead
536 of the BL1 entrypoint. It can take the value 0 (CPU reset to BL1
537 entrypoint) or 1 (CPU reset to BL31 entrypoint).
538 The default value is 0.
539
540- ``RESET_TO_SP_MIN``: SP_MIN is the minimal AArch32 Secure Payload provided
541 in TF-A. This flag configures SP_MIN entrypoint as the CPU reset vector
542 instead of the BL1 entrypoint. It can take the value 0 (CPU reset to BL1
543 entrypoint) or 1 (CPU reset to SP_MIN entrypoint). The default value is 0.
544
545- ``ROT_KEY``: This option is used when ``GENERATE_COT=1``. It specifies the
Max Shvetsova6ffdde2019-12-06 11:50:12 +0000546 file that contains the ROT private key in PEM format and enforces public key
547 hash generation. If ``SAVE_KEYS=1``, this
Paul Beesley43f35ef2019-05-29 13:59:40 +0100548 file name will be used to save the key.
549
550- ``SAVE_KEYS``: This option is used when ``GENERATE_COT=1``. It tells the
551 certificate generation tool to save the keys used to establish the Chain of
552 Trust. Allowed options are '0' or '1'. Default is '0' (do not save).
553
554- ``SCP_BL2``: Path to SCP_BL2 image in the host file system. This image is optional.
555 If a SCP_BL2 image is present then this option must be passed for the ``fip``
556 target.
557
558- ``SCP_BL2_KEY``: This option is used when ``GENERATE_COT=1``. It specifies the
559 file that contains the SCP_BL2 private key in PEM format. If ``SAVE_KEYS=1``,
560 this file name will be used to save the key.
561
562- ``SCP_BL2U``: Path to SCP_BL2U image in the host file system. This image is
563 optional. It is only needed if the platform makefile specifies that it
564 is required in order to build the ``fwu_fip`` target.
565
566- ``SDEI_SUPPORT``: Setting this to ``1`` enables support for Software
567 Delegated Exception Interface to BL31 image. This defaults to ``0``.
568
569 When set to ``1``, the build option ``EL3_EXCEPTION_HANDLING`` must also be
570 set to ``1``.
571
572- ``SEPARATE_CODE_AND_RODATA``: Whether code and read-only data should be
573 isolated on separate memory pages. This is a trade-off between security and
574 memory usage. See "Isolating code and read-only data on separate memory
Olivier Deprez4c65b4d2020-03-26 16:09:21 +0100575 pages" section in :ref:`Firmware Design`. This flag is disabled by default
576 and affects all BL images.
Paul Beesley43f35ef2019-05-29 13:59:40 +0100577
Samuel Hollandf8578e62018-10-17 21:40:18 -0500578- ``SEPARATE_NOBITS_REGION``: Setting this option to ``1`` allows the NOBITS
579 sections of BL31 (.bss, stacks, page tables, and coherent memory) to be
580 allocated in RAM discontiguous from the loaded firmware image. When set, the
David Horstmann47147012021-01-21 12:29:59 +0000581 platform is expected to provide definitions for ``BL31_NOBITS_BASE`` and
Samuel Hollandf8578e62018-10-17 21:40:18 -0500582 ``BL31_NOBITS_LIMIT``. When the option is ``0`` (the default), NOBITS
583 sections are placed in RAM immediately following the loaded firmware image.
584
Jeremy Linton2d31cb02021-01-26 22:42:03 -0600585- ``SMC_PCI_SUPPORT``: This option allows platforms to handle PCI configuration
586 access requests via a standard SMCCC defined in `DEN0115`_. When combined with
587 UEFI+ACPI this can provide a certain amount of OS forward compatibility
588 with newer platforms that aren't ECAM compliant.
589
Paul Beesley43f35ef2019-05-29 13:59:40 +0100590- ``SPD``: Choose a Secure Payload Dispatcher component to be built into TF-A.
591 This build option is only valid if ``ARCH=aarch64``. The value should be
592 the path to the directory containing the SPD source, relative to
593 ``services/spd/``; the directory is expected to contain a makefile called
Olivier Deprez4c65b4d2020-03-26 16:09:21 +0100594 ``<spd-value>.mk``. The SPM Dispatcher standard service is located in
595 services/std_svc/spmd and enabled by ``SPD=spmd``. The SPM Dispatcher
596 cannot be enabled when the ``SPM_MM`` option is enabled.
Paul Beesley43f35ef2019-05-29 13:59:40 +0100597
598- ``SPIN_ON_BL1_EXIT``: This option introduces an infinite loop in BL1. It can
599 take either 0 (no loop) or 1 (add a loop). 0 is the default. This loop stops
600 execution in BL1 just before handing over to BL31. At this point, all
601 firmware images have been loaded in memory, and the MMU and caches are
602 turned off. Refer to the "Debugging options" section for more details.
603
Olivier Deprez4c65b4d2020-03-26 16:09:21 +0100604- ``SPMD_SPM_AT_SEL2`` : this boolean option is used jointly with the SPM
605 Dispatcher option (``SPD=spmd``). When enabled (1) it indicates the SPMC
606 component runs at the S-EL2 execution state provided by the Armv8.4-SecEL2
607 extension. This is the default when enabling the SPM Dispatcher. When
608 disabled (0) it indicates the SPMC component runs at the S-EL1 execution
609 state. This latter configuration supports pre-Armv8.4 platforms (aka not
610 implementing the Armv8.4-SecEL2 extension).
611
Paul Beesley3f3c3412019-09-16 11:29:03 +0000612- ``SPM_MM`` : Boolean option to enable the Management Mode (MM)-based Secure
Olivier Deprez4c65b4d2020-03-26 16:09:21 +0100613 Partition Manager (SPM) implementation. The default value is ``0``
614 (disabled). This option cannot be enabled (``1``) when SPM Dispatcher is
615 enabled (``SPD=spmd``).
Paul Beesley3f3c3412019-09-16 11:29:03 +0000616
Manish Pandeyce2b1ec2020-01-14 11:52:05 +0000617- ``SP_LAYOUT_FILE``: Platform provided path to JSON file containing the
Olivier Deprez4c65b4d2020-03-26 16:09:21 +0100618 description of secure partitions. The build system will parse this file and
619 package all secure partition blobs into the FIP. This file is not
620 necessarily part of TF-A tree. Only available when ``SPD=spmd``.
Manish Pandeyce2b1ec2020-01-14 11:52:05 +0000621
Paul Beesley43f35ef2019-05-29 13:59:40 +0100622- ``SP_MIN_WITH_SECURE_FIQ``: Boolean flag to indicate the SP_MIN handles
623 secure interrupts (caught through the FIQ line). Platforms can enable
624 this directive if they need to handle such interruption. When enabled,
625 the FIQ are handled in monitor mode and non secure world is not allowed
626 to mask these events. Platforms that enable FIQ handling in SP_MIN shall
627 implement the api ``sp_min_plat_fiq_handler()``. The default value is 0.
628
629- ``TRUSTED_BOARD_BOOT``: Boolean flag to include support for the Trusted Board
630 Boot feature. When set to '1', BL1 and BL2 images include support to load
631 and verify the certificates and images in a FIP, and BL1 includes support
632 for the Firmware Update. The default value is '0'. Generation and inclusion
633 of certificates in the FIP and FWU_FIP depends upon the value of the
634 ``GENERATE_COT`` option.
635
636 .. warning::
637 This option depends on ``CREATE_KEYS`` to be enabled. If the keys
638 already exist in disk, they will be overwritten without further notice.
639
640- ``TRUSTED_WORLD_KEY``: This option is used when ``GENERATE_COT=1``. It
641 specifies the file that contains the Trusted World private key in PEM
642 format. If ``SAVE_KEYS=1``, this file name will be used to save the key.
643
644- ``TSP_INIT_ASYNC``: Choose BL32 initialization method as asynchronous or
645 synchronous, (see "Initializing a BL32 Image" section in
646 :ref:`Firmware Design`). It can take the value 0 (BL32 is initialized using
647 synchronous method) or 1 (BL32 is initialized using asynchronous method).
648 Default is 0.
649
650- ``TSP_NS_INTR_ASYNC_PREEMPT``: A non zero value enables the interrupt
651 routing model which routes non-secure interrupts asynchronously from TSP
652 to EL3 causing immediate preemption of TSP. The EL3 is responsible
653 for saving and restoring the TSP context in this routing model. The
654 default routing model (when the value is 0) is to route non-secure
655 interrupts to TSP allowing it to save its context and hand over
656 synchronously to EL3 via an SMC.
657
658 .. note::
659 When ``EL3_EXCEPTION_HANDLING`` is ``1``, ``TSP_NS_INTR_ASYNC_PREEMPT``
660 must also be set to ``1``.
661
662- ``USE_ARM_LINK``: This flag determines whether to enable support for ARM
663 linker. When the ``LINKER`` build variable points to the armlink linker,
664 this flag is enabled automatically. To enable support for armlink, platforms
665 will have to provide a scatter file for the BL image. Currently, Tegra
666 platforms use the armlink support to compile BL3-1 images.
667
668- ``USE_COHERENT_MEM``: This flag determines whether to include the coherent
669 memory region in the BL memory map or not (see "Use of Coherent memory in
670 TF-A" section in :ref:`Firmware Design`). It can take the value 1
671 (Coherent memory region is included) or 0 (Coherent memory region is
672 excluded). Default is 1.
673
Ambroise Vincent992f0912019-07-12 13:47:03 +0100674- ``USE_DEBUGFS``: When set to 1 this option activates an EXPERIMENTAL feature
675 exposing a virtual filesystem interface through BL31 as a SiP SMC function.
676 Default is 0.
677
Louis Mayencourta6de8242020-02-28 16:57:30 +0000678- ``ARM_IO_IN_DTB``: This flag determines whether to use IO based on the
679 firmware configuration framework. This will move the io_policies into a
Louis Mayencourt0a6e7e32019-10-24 15:18:46 +0100680 configuration device tree, instead of static structure in the code base.
Louis Mayencourtc2c150e2020-04-09 16:32:20 +0100681 This is currently an experimental feature.
Louis Mayencourt0a6e7e32019-10-24 15:18:46 +0100682
Manish V Badarkhe84ef9cd2020-06-29 10:32:53 +0100683- ``COT_DESC_IN_DTB``: This flag determines whether to create COT descriptors
684 at runtime using fconf. If this flag is enabled, COT descriptors are
685 statically captured in tb_fw_config file in the form of device tree nodes
686 and properties. Currently, COT descriptors used by BL2 are moved to the
687 device tree and COT descriptors used by BL1 are retained in the code
688 base statically. This is currently an experimental feature.
689
Balint Dobszaycbf9e842019-12-18 15:28:00 +0100690- ``SDEI_IN_FCONF``: This flag determines whether to configure SDEI setup in
691 runtime using firmware configuration framework. The platform specific SDEI
692 shared and private events configuration is retrieved from device tree rather
693 than static C structures at compile time. This is currently an experimental
694 feature and is only supported if SDEI_SUPPORT build flag is enabled.
Louis Mayencourt0a6e7e32019-10-24 15:18:46 +0100695
Madhukar Pappireddy452d5e52020-06-02 09:26:30 -0500696- ``SEC_INT_DESC_IN_FCONF``: This flag determines whether to configure Group 0
697 and Group1 secure interrupts using the firmware configuration framework. The
698 platform specific secure interrupt property descriptor is retrieved from
699 device tree in runtime rather than depending on static C structure at compile
700 time. This is currently an experimental feature.
701
Paul Beesley43f35ef2019-05-29 13:59:40 +0100702- ``USE_ROMLIB``: This flag determines whether library at ROM will be used.
703 This feature creates a library of functions to be placed in ROM and thus
704 reduces SRAM usage. Refer to :ref:`Library at ROM` for further details. Default
705 is 0.
706
707- ``V``: Verbose build. If assigned anything other than 0, the build commands
708 are printed. Default is 0.
709
710- ``VERSION_STRING``: String used in the log output for each TF-A image.
711 Defaults to a string formed by concatenating the version number, build type
712 and build string.
713
714- ``W``: Warning level. Some compiler warning options of interest have been
715 regrouped and put in the root Makefile. This flag can take the values 0 to 3,
716 each level enabling more warning options. Default is 0.
717
718- ``WARMBOOT_ENABLE_DCACHE_EARLY`` : Boolean option to enable D-cache early on
719 the CPU after warm boot. This is applicable for platforms which do not
720 require interconnect programming to enable cache coherency (eg: single
721 cluster platforms). If this option is enabled, then warm boot path
722 enables D-caches immediately after enabling MMU. This option defaults to 0.
723
Manish V Badarkhe7ff088d2020-03-22 05:06:38 +0000724- ``SUPPORT_STACK_MEMTAG``: This flag determines whether to enable memory
725 tagging for stack or not. It accepts 2 values: ``yes`` and ``no``. The
726 default value of this flag is ``no``. Note this option must be enabled only
727 for ARM architecture greater than Armv8.5-A.
728
Manish V Badarkhee008a292020-07-31 08:38:49 +0100729- ``ERRATA_SPECULATIVE_AT``: This flag determines whether to enable ``AT``
730 speculative errata workaround or not. It accepts 2 values: ``1`` and ``0``.
731 The default value of this flag is ``0``.
732
733 ``AT`` speculative errata workaround disables stage1 page table walk for
734 lower ELs (EL1 and EL0) in EL3 so that ``AT`` speculative fetch at any point
735 produces either the correct result or failure without TLB allocation.
Manish V Badarkhe45aecff2020-04-28 04:53:32 +0100736
737 This boolean option enables errata for all below CPUs.
738
Manish V Badarkhee008a292020-07-31 08:38:49 +0100739 +---------+--------------+-------------------------+
740 | Errata | CPU | Workaround Define |
741 +=========+==============+=========================+
742 | 1165522 | Cortex-A76 | ``ERRATA_A76_1165522`` |
743 +---------+--------------+-------------------------+
744 | 1319367 | Cortex-A72 | ``ERRATA_A72_1319367`` |
745 +---------+--------------+-------------------------+
746 | 1319537 | Cortex-A57 | ``ERRATA_A57_1319537`` |
747 +---------+--------------+-------------------------+
748 | 1530923 | Cortex-A55 | ``ERRATA_A55_1530923`` |
749 +---------+--------------+-------------------------+
750 | 1530924 | Cortex-A53 | ``ERRATA_A53_1530924`` |
751 +---------+--------------+-------------------------+
752
753 .. note::
754 This option is enabled by build only if platform sets any of above defines
755 mentioned in ’Workaround Define' column in the table.
756 If this option is enabled for the EL3 software then EL2 software also must
757 implement this workaround due to the behaviour of the errata mentioned
758 in new SDEN document which will get published soon.
Manish V Badarkhe45aecff2020-04-28 04:53:32 +0100759
Varun Wadekarfbc44bd2020-06-12 10:11:28 -0700760- ``RAS_TRAP_LOWER_EL_ERR_ACCESS``: This flag enables/disables the SCR_EL3.TERR
761 bit, to trap access to the RAS ERR and RAS ERX registers from lower ELs.
762 This flag is disabled by default.
763
Manish V Badarkhe582e4e72020-07-29 10:58:44 +0100764- ``OPENSSL_DIR``: This flag is used to provide the installed openssl directory
765 path on the host machine which is used to build certificate generation and
766 firmware encryption tool.
767
Madhukar Pappireddyfddfb3b2020-08-12 13:18:19 -0500768- ``USE_SP804_TIMER``: Use the SP804 timer instead of the Generic Timer for
769 functions that wait for an arbitrary time length (udelay and mdelay). The
770 default value is 0.
771
Alexei Fedorova6ea06f2020-03-23 18:45:17 +0000772GICv3 driver options
773--------------------
774
775GICv3 driver files are included using directive:
776
777``include drivers/arm/gic/v3/gicv3.mk``
778
779The driver can be configured with the following options set in the platform
780makefile:
781
Andre Przywarab4ad3652020-03-25 15:50:38 +0000782- ``GICV3_SUPPORT_GIC600``: Add support for the GIC-600 variants of GICv3.
783 Enabling this option will add runtime detection support for the
784 GIC-600, so is safe to select even for a GIC500 implementation.
785 This option defaults to 0.
Alexei Fedorova6ea06f2020-03-23 18:45:17 +0000786
787- ``GICV3_IMPL_GIC600_MULTICHIP``: Selects GIC-600 variant with multichip
788 functionality. This option defaults to 0
789
790- ``GICV3_OVERRIDE_DISTIF_PWR_OPS``: Allows override of default implementation
791 of ``arm_gicv3_distif_pre_save`` and ``arm_gicv3_distif_post_restore``
792 functions. This is required for FVP platform which need to simulate GIC save
793 and restore during SYSTEM_SUSPEND without powering down GIC. Default is 0.
794
Alexei Fedorov5875f262020-04-06 19:00:35 +0100795- ``GIC_ENABLE_V4_EXTN`` : Enables GICv4 related changes in GICv3 driver.
796 This option defaults to 0.
797
Alexei Fedorov8f3ad762020-04-06 16:27:54 +0100798- ``GIC_EXT_INTID``: When set to ``1``, GICv3 driver will support extended
799 PPI (1056-1119) and SPI (4096-5119) range. This option defaults to 0.
800
Paul Beesley43f35ef2019-05-29 13:59:40 +0100801Debugging options
802-----------------
803
804To compile a debug version and make the build more verbose use
805
806.. code:: shell
807
808 make PLAT=<platform> DEBUG=1 V=1 all
809
810AArch64 GCC uses DWARF version 4 debugging symbols by default. Some tools (for
811example DS-5) might not support this and may need an older version of DWARF
812symbols to be emitted by GCC. This can be achieved by using the
813``-gdwarf-<version>`` flag, with the version being set to 2 or 3. Setting the
814version to 2 is recommended for DS-5 versions older than 5.16.
815
816When debugging logic problems it might also be useful to disable all compiler
817optimizations by using ``-O0``.
818
819.. warning::
820 Using ``-O0`` could cause output images to be larger and base addresses
821 might need to be recalculated (see the **Memory layout on Arm development
822 platforms** section in the :ref:`Firmware Design`).
823
824Extra debug options can be passed to the build system by setting ``CFLAGS`` or
825``LDFLAGS``:
826
827.. code:: shell
828
829 CFLAGS='-O0 -gdwarf-2' \
830 make PLAT=<platform> DEBUG=1 V=1 all
831
832Note that using ``-Wl,`` style compilation driver options in ``CFLAGS`` will be
833ignored as the linker is called directly.
834
835It is also possible to introduce an infinite loop to help in debugging the
836post-BL2 phase of TF-A. This can be done by rebuilding BL1 with the
837``SPIN_ON_BL1_EXIT=1`` build flag. Refer to the :ref:`build_options_common`
838section. In this case, the developer may take control of the target using a
839debugger when indicated by the console output. When using DS-5, the following
840commands can be used:
841
842::
843
844 # Stop target execution
845 interrupt
846
847 #
848 # Prepare your debugging environment, e.g. set breakpoints
849 #
850
851 # Jump over the debug loop
852 set var $AARCH64::$Core::$PC = $AARCH64::$Core::$PC + 4
853
854 # Resume execution
855 continue
856
857--------------
858
Yann Gautier4324a142020-10-05 11:02:54 +0200859*Copyright (c) 2019-2021, Arm Limited. All rights reserved.*
Jeremy Linton2d31cb02021-01-26 22:42:03 -0600860
861.. _DEN0115: https://developer.arm.com/docs/den0115/latest
862