blob: 1a5524fd8d7a62afd0434443a0b58fa563ca376e [file] [log] [blame]
Ambroise Vincentcc28b212019-06-05 15:40:29 +01001Security hardening
2==================
3
4This page contains guidance on what to check for additional security measures,
5including build options that can be modified to improve security or catch issues
6early in development.
7
8Build options
9-------------
10
11Several build options can be used to check for security issues. Refer to the
Paul Beesleyf8640672019-04-12 14:19:42 +010012:ref:`User Guide` for detailed information on the specific build options.
Ambroise Vincentcc28b212019-06-05 15:40:29 +010013
14- The ``BRANCH_PROTECTION`` build flag can be used to enable Pointer
15 Authentication and Branch Target Identification.
16
17- The ``ENABLE_STACK_PROTECTOR`` build flag can be used to identify buffer
18 overflows.
19
20- The ``W`` build flag can be used to enable a number of compiler warning
21 options to detect potentially incorrect code.
22
23 - W=0 (default value)
24
25 The ``Wunused`` with ``Wno-unused-parameter``, ``Wdisabled-optimization``
26 and ``Wvla`` flags are enabled.
27
28 The ``Wunused-but-set-variable``, ``Wmaybe-uninitialized`` and
29 ``Wpacked-bitfield-compat`` are GCC specific flags that are also enabled.
30
31 - W=1
32
33 Adds ``Wextra``, ``Wmissing-declarations``, ``Wmissing-format-attribute``,
34 ``Wmissing-prototypes``, ``Wold-style-definition`` and
35 ``Wunused-const-variable``.
36
37 - W=2
38
39 Adds ``Waggregate-return``, ``Wcast-align``, ``Wnested-externs``,
40 ``Wshadow``, ``Wlogical-op``, ``Wmissing-field-initializers`` and
41 ``Wsign-compare``.
42
43 - W=3
44
45 Adds ``Wbad-function-cast``, ``Wcast-qual``, ``Wconversion``, ``Wpacked``,
46 ``Wpadded``, ``Wpointer-arith``, ``Wredundant-decls`` and
47 ``Wswitch-default``.
48
49 Refer to the GCC or Clang documentation for more information on the individual
50 options: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html and
51 https://clang.llvm.org/docs/DiagnosticsReference.html.
52
53 NB: The ``Werror`` flag is enabled by default in TF-A and can be disabled by
54 setting the ``E`` build flag to 0.
55
Paul Beesleyf8640672019-04-12 14:19:42 +010056--------------
Ambroise Vincentcc28b212019-06-05 15:40:29 +010057
Paul Beesleyf8640672019-04-12 14:19:42 +010058*Copyright (c) 2019, Arm Limited. All rights reserved.*