build: forbid `ENABLE_RME=1` when `SEPARATE_CODE_AND_RODATA=0`
This change mitigates against read-only data being used for malicious
execution on platforms utilizing the RME/CCA.
Change-Id: I0068535aeaa5d2515c7c54ee0dc19200c7a86ba5
Signed-off-by: Chris Kay <chris.kay@arm.com>
diff --git a/Makefile b/Makefile
index 6d15e27..65955b2 100644
--- a/Makefile
+++ b/Makefile
@@ -842,6 +842,12 @@
$(info DRTM_SUPPORT is an experimental feature)
endif
+ifeq (${ENABLE_RME},1)
+ ifneq (${SEPARATE_CODE_AND_RODATA},1)
+ $(error `ENABLE_RME=1` requires `SEPARATE_CODE_AND_RODATA=1`)
+ endif
+endif
+
################################################################################
# Process platform overrideable behaviour
################################################################################