optee_os/mk/config.mk

1 # Default configuration values for OP-TEE core (all platforms).
65 # If y, enable debug features of the TEE core (assertions and lock checks
71 # Log levels for the TEE core. Defines which core messages are displayed
98 # - To debug user-mode (TA) allocations: build OP-TEE *and* the TA with:
100 # - To debug TEE core allocations: build OP-TEE with:
171 # tee-supplicant process will open /dev/mmcblk<id>rpmb
216 # Enables RPMB key programming by the TEE, in case the RPMB partition has not
219 # Do *NOT* enable this in product builds, as doing so would allow the TEE to
227 # advance that OP-TEE supports it. Setting CFG_RPMB_ANNOUNCE_PROBE_CAP=y
228 # will announce OP-TEE's capability for RPMB probing to the kernel and it
230 # routed to tee-supplicant. This option is intended give some control over
236 # Signing key for OP-TEE TA's
239 # TA_PUBLIC_KEY's public key will be embedded into OP-TEE OS.
261 # has libgcc, Clang has compiler-rt). OP-TEE often can't use them because
282 # this option will increase the size of the 32-bit TEE binary by a few KB.
286 # the privileged layer of OP-TEE, enabling this feature will weaken the
303 # $(supported-ta-targets) defaults to "ta_arm32" when the TEE core is 32-bits,
333 # Address Space Layout Randomization for TEE Core
336 # offset when mapping TEE Core. ASLR makes the exploitation of memory
340 # Stack Protection for TEE Core
371 # Load user TAs from the REE filesystem via tee-supplicant
386 # anti-rollback errors. That is, rm /data/tee/dirf.db or rm -rf /data/tee (or
387 # whatever path is configured in tee-supplicant as CFG_TEE_FS_PARENT_PATH)
394 # Support for loading user TAs from a special section in the TEE binary.
395 # Such TAs are available even before tee-supplicant is available (hence their
396 # name), but note that many services exported to TAs may need tee-supplicant,
397 # so early use is limited to a subset of the TEE Internal Core API (crypto...)
409 #   $ make EARLY_TA_PATHS=<paths>    # Build OP-TEE and embbed the TA(s)
439 # By default the early TAs are compressed in the TEE binary, it is possible to
454 # used in the TEE core when acquiring and releasing mutexes. Any violation will
498 # When CFG_DT is enabled, the TEE _start function expects to find
528 # This option enables OP-TEE to support boot arguments handover via Transfer
603 # This option enables OP-TEE to respond to SMP boot request: the Rich OS
604 # issues this to request OP-TEE to release secondaries cores out of reset,
616 # When this option is enabled, OP-TEE can execute Trusted Applications
619 # tee-supplicant)
628 # When this option is enabled, OP-TEE can execute Trusted Applications
631 # /tmp/ftrace-<ta_uuid>.out (path is defined in tee-supplicant).
635 # When this option is enabled, OP-TEE core is instrumented with GCC's
671 # Enable Secure Data Path support in OP-TEE core (TA may be invoked with
686 # GlobalPlatform TEE Internal Core API (for example, re-seeding RNG entropy
691 # Enable the pseudo TA for enumeration of TEE based devices for the normal
696 # a TA or the TEE binary.
764 # the non-secure world. OP-TEE will not work without a compatible hypervisor
794 # Compress and encode conf.mk into the TEE core, and show the encoded string on
920 # When enabled, CFG_DRIVERS_CLK embeds a clock framework in OP-TEE core.
927 # state on OP-TEE core console with the info trace level.
938 # OP-TEE core to provide reset controls on subsystems of the devices.
942 # OP-TEE core to provide GPIO support for drivers.
953 # OP-TEE core to provide drivers a way to apply pin muxing configurations based
958 # OP-TEE core to provide drivers a common regulator interface and describe
968 # regulator tree state on OP-TEE core console with the info trace level.
979 # When enabled, CFG_INSECURE permits insecure configuration of OP-TEE core
984 # is that the one making products based on OP-TEE should override this flag in
986 # they've finalized implementing stubbed functionality (see OP-TEE
1011 # such as BR or BLR can jump. To make use of BTI in TEE core and ldelf on CPU's
1095 # this option is enabled, TEE core will initialize secret keys per TA.
1174 # When this option is enabled, OP-TEE provides a debug method for
1184 # Enables TEE Internal Core API v1.1 compatibility for in-tree TAs. Note
1246 # DTB as OP-TEE HUK.
1251 # DT node "/options/op-tee/widevine" to some specific TAs.
1272 # When CFG_SEMIHOSTING_CONSOLE_FILE=NULL, OP-TEE console reads/writes
1274 # When CFG_SEMIHOSTING_CONSOLE_FILE="{your_log_file}", OP-TEE console
1290 # CFG_FFA_CONSOLE, when enabled, embeds a FFA console driver. OP-TEE console
1296 # value set by CFG_CONSOLE_RUNTIME_LOG_LEVEL after OP-TEE has finished booting.
1301 # CFG_CORE_UNSAFE_MODEXP, when enabled, makes modular exponentiation on TEE