1# Copyright (C) 2015 The Android Open Source Project
2#
3# Licensed under the Apache License, Version 2.0 (the "License");
4# you may not use this file except in compliance with the License.
5# You may obtain a copy of the License at
6#
7#      http://www.apache.org/licenses/LICENSE-2.0
8#
9# Unless required by applicable law or agreed to in writing, software
10# distributed under the License is distributed on an "AS IS" BASIS,
11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12# See the License for the specific language governing permissions and
13# limitations under the License.
14#
15
16LOCAL_DIR := $(GET_LOCAL_DIR)
17
18DEBUG ?= 2
19SMP_MAX_CPUS ?= 8
20SMP_CPU_CLUSTER_SHIFT ?= 2
21GIC_VERSION ?= 2
22# Use modern KM wrapping key size (256-bits)
23TRUSTY_KM_WRAPPING_KEY_SIZE ?= 32
24
25TARGET := generic-arm64
26
27ifeq (false,$(call TOBOOL,$(KERNEL_32BIT)))
28
29# Arm64 address space configuration
30USER_ASPACE_BASE   := 0x0000000000008000
31
32ifeq (false,$(call TOBOOL,$(USER_32BIT)))
33USER_ASPACE_SIZE   := 0x0000ffffffff8000
34GLOBAL_DEFINES += MMU_USER_SIZE_SHIFT=48
35else
36USER_ASPACE_SIZE   := 0x00000000ffff8000
37GLOBAL_DEFINES += MMU_USER_SIZE_SHIFT=32
38endif
39
40KERNEL_BASE_ASLR   ?= true
41
42else
43
44KERNEL_BASE        := 0xc0000000
45
46# ASLR is allowed on 32-bit platforms, but they are usually more space
47# conscious, and the extra page tables and weight from PIE may be more than
48# they want to pay.
49# Set ASLR := true explicitly if you are a 32-bit platform and want ASLR.
50ASLR               ?= false
51
52endif
53
54# select timer
55ifeq (true,$(call TOBOOL,$(KERNEL_32BIT)))
56# 32 bit Secure EL1 with a 64 bit EL3 gets the non-secure physical timer
57TIMER_ARM_GENERIC_SELECTED ?= CNTP
58else
59TIMER_ARM_GENERIC_SELECTED ?= CNTPS
60endif
61GLOBAL_DEFINES += TIMER_ARM_GENERIC_SELECTED=$(TIMER_ARM_GENERIC_SELECTED)
62
63#
64# GLOBAL definitions
65#
66
67# requires linker GC
68WITH_LINKER_GC := 1
69
70# Need support for Non-secure memory mapping
71WITH_NS_MAPPING := true
72
73# do not relocate kernel in physical memory
74GLOBAL_DEFINES += WITH_NO_PHYS_RELOCATION=1
75
76# limit heap grows
77GLOBAL_DEFINES += HEAP_GROW_SIZE=8192
78
79# enable LTO in user-tasks modules
80USER_LTO_ENABLED ?= true
81
82# enable LTO in kernel modules
83KERNEL_LTO_ENABLED ?= true
84
85# enable cfi in trusty modules
86USER_CFI_ENABLED ?= true
87KERNEL_CFI_ENABLED ?= true
88
89#TODO(b/373398295): if clang is too old to support cross-language CFI, disable it
90ifneq ($(findstring clang-r498229b,$(CLANG_BINDIR)),)
91KERNEL_CFI_ENABLED := false
92endif
93
94# Storage should send error reports to the metrics service
95STORAGE_ENABLE_ERROR_REPORTING := true
96STORAGE_AIDL_ENABLED ?= true
97
98ifeq ($(shell expr $(DEBUG) \>= 2), 1)
99CFI_DIAGNOSTICS ?= true
100endif
101
102# disable UBSan by default
103UBSAN_ENABLED ?= false
104ifeq (true,$(call TOBOOL,$(UBSAN_ENABLED)))
105include trusty/kernel/lib/ubsan/enable.mk
106endif
107
108ifeq (false,$(call TOBOOL,$(KERNEL_32BIT)))
109KERNEL_SCS_ENABLED ?= true
110ifeq (false,$(call TOBOOL,$(USER_32BIT)))
111# enable shadow call stack in user-tasks modules
112USER_SCS_ENABLED ?= true
113endif
114endif
115
116# fall back to user-space stack protector if user-space SCS is off
117ifneq (true,$(call TOBOOL,$(USER_SCS_ENABLED)))
118USER_STACK_PROTECTOR ?= true
119endif
120
121# Allow the KeyMint TA implementation to be selected at build time.  This needs to be
122# done in sync with the HAL service implementation included in Android.  Possible values are:
123#
124# - Rust implementation:   export TRUSTY_KEYMINT_IMPL=rust
125# - C++ implementation:    (any other value of TRUSTY_KEYMINT_IMPL)
126
127ifeq ($(TRUSTY_KEYMINT_IMPL),rust)
128    TRUSTY_KEYMINT_USER_TASK := trusty/user/app/keymint/app
129else
130    # Default to the C++ implementation
131    TRUSTY_KEYMINT_USER_TASK := trusty/user/app/keymaster
132endif
133
134# Allow inclusion of the Secretkeeper TA to be selected at build time.
135ifeq (true,$(call TOBOOL,$(SECRETKEEPER_ENABLED)))
136     TRUSTY_SECRETKEEPER_USER_TASK := trusty/user/app/secretkeeper/app
137endif
138
139#
140# Modules to be compiled into lk.bin
141#
142MODULES += \
143	trusty/kernel/lib/trusty \
144	trusty/kernel/lib/metrics \
145	trusty/kernel/services/apploader \
146	trusty/kernel/services/smc \
147
148# Add lib/sm by default but allow building without it
149LIB_SM_ENABLED ?= true
150ifeq (true,$(call TOBOOL,$(LIB_SM_ENABLED)))
151    MODULES += \
152		trusty/kernel/lib/memlog \
153		trusty/kernel/lib/sm \
154
155endif
156
157#
158# Set user space arch
159#
160ifeq (true,$(call TOBOOL,$(KERNEL_32BIT)))
161TRUSTY_USER_ARCH := arm
162else
163ifeq (true,$(call TOBOOL,$(USER_32BIT)))
164TRUSTY_USER_ARCH := arm
165GLOBAL_DEFINES += USER_32BIT=1
166else
167TRUSTY_USER_ARCH := arm64
168endif
169endif
170
171#
172# user tasks to be compiled into lk.bin
173#
174
175# prebuilt
176TRUSTY_PREBUILT_USER_TASKS :=
177
178# compiled from source
179TRUSTY_BUILTIN_USER_TASKS := \
180	trusty/user/app/avb \
181	trusty/user/app/cast-auth/app \
182	trusty/user/app/confirmationui \
183	trusty/user/app/gatekeeper \
184	$(TRUSTY_KEYMINT_USER_TASK) \
185	$(TRUSTY_SECRETKEEPER_USER_TASK) \
186	trusty/user/app/sample/hwaes \
187	trusty/user/app/sample/hwbcc \
188	trusty/user/app/sample/hwcrypto \
189	trusty/user/app/sample/hwcryptohal/server/app \
190	trusty/user/app/sample/hwwsk \
191	trusty/user/app/sample/secure_fb_mock_impl \
192	trusty/user/app/storage \
193	trusty/user/base/app/apploader \
194	trusty/user/base/app/device_tree \
195	trusty/user/base/app/metrics \
196	trusty/user/base/app/system_state_server_static \
197
198MODULES += \
199	trusty/user/base/app/device_tree/tests/dtb \
200	trusty/user/base/app/device_tree/tests/dtb/base \
201
202ifeq (true,$(call TOBOOL,$(USER_COVERAGE_ENABLED)))
203TRUSTY_ALL_USER_TASKS += \
204	trusty/user/base/app/coverage \
205
206endif
207
208ifeq (true,$(call TOBOOL,$(UNITTEST_COVERAGE_ENABLED)))
209TRUSTY_ALL_USER_TASKS += \
210	trusty/user/base/app/line-coverage \
211
212endif
213
214# on generic-arm64 hwcrypto requires FAKE HWRNG and HWKEY services
215WITH_FAKE_HWRNG ?= true
216WITH_FAKE_HWKEY ?= true
217WITH_FAKE_KEYBOX ?= true
218
219# This project requires trusty IPC
220WITH_TRUSTY_IPC := true
221
222SYMTAB_ENABLED ?= true
223
224# include software implementation of a SPI loopback device
225WITH_SW_SPI_LOOPBACK ?= true
226
227EXTRA_BUILDRULES += trusty/kernel/app/trusty/user-tasks.mk
228