Add support for default stack-protector flag
The current stack-protector support is for none, "strong" or "all".
The default use of the flag enables the stack-protection to all
functions that declare a character array of eight bytes or more in
length on their stack.
This option can be tuned with the --param=ssp-buffer-size=N option.
Change-Id: I11ad9568187d58de1b962b8ae04edd1dc8578fb0
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>
diff --git a/docs/user-guide.rst b/docs/user-guide.rst
index b9f0871..01cf17a 100644
--- a/docs/user-guide.rst
+++ b/docs/user-guide.rst
@@ -460,12 +460,12 @@
architecture is AArch32.
- ``ENABLE_STACK_PROTECTOR``: String option to enable the stack protection
- checks in GCC. Allowed values are "all", "strong" and "0" (default).
- "strong" is the recommended stack protection level if this feature is
- desired. 0 disables the stack protection. For all values other than 0, the
- ``plat_get_stack_protector_canary()`` platform hook needs to be implemented.
- The value is passed as the last component of the option
- ``-fstack-protector-$ENABLE_STACK_PROTECTOR``.
+ checks in GCC. Allowed values are "all", "strong", "default" and "none". The
+ default value is set to "none". "strong" is the recommended stack protection
+ level if this feature is desired. "none" disables the stack protection. For
+ all values other than "none", the ``plat_get_stack_protector_canary()``
+ platform hook needs to be implemented. The value is passed as the last
+ component of the option ``-fstack-protector-$ENABLE_STACK_PROTECTOR``.
- ``ERROR_DEPRECATED``: This option decides whether to treat the usage of
deprecated platform APIs, helper functions or drivers within Trusted
diff --git a/lib/stack_protector/stack_protector.mk b/lib/stack_protector/stack_protector.mk
index 0f0d90f..94e804b 100644
--- a/lib/stack_protector/stack_protector.mk
+++ b/lib/stack_protector/stack_protector.mk
@@ -1,5 +1,5 @@
#
-# Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
#
# SPDX-License-Identifier: BSD-3-Clause
#
@@ -7,13 +7,20 @@
# Boolean macro to be used in C code
STACK_PROTECTOR_ENABLED := 0
-ifneq (${ENABLE_STACK_PROTECTOR},0)
-STACK_PROTECTOR_ENABLED := 1
-BL_COMMON_SOURCES += lib/stack_protector/stack_protector.c \
+ifeq (${ENABLE_STACK_PROTECTOR},0)
+ ENABLE_STACK_PROTECTOR := none
+endif
+
+ifneq (${ENABLE_STACK_PROTECTOR},none)
+ STACK_PROTECTOR_ENABLED := 1
+ BL_COMMON_SOURCES += lib/stack_protector/stack_protector.c \
lib/stack_protector/${ARCH}/asm_stack_protector.S
-TF_CFLAGS += -fstack-protector-${ENABLE_STACK_PROTECTOR}
+ ifeq (${ENABLE_STACK_PROTECTOR},default)
+ TF_CFLAGS += -fstack-protector
+ else
+ TF_CFLAGS += -fstack-protector-${ENABLE_STACK_PROTECTOR}
+ endif
endif
$(eval $(call add_define,STACK_PROTECTOR_ENABLED))
-