Add support for default stack-protector flag

The current stack-protector support is for none, "strong" or "all".
The default use of the flag enables the stack-protection to all
functions that declare a character array of eight bytes or more in
length on their stack.
This option can be tuned with the --param=ssp-buffer-size=N option.

Change-Id: I11ad9568187d58de1b962b8ae04edd1dc8578fb0
Signed-off-by: Louis Mayencourt <louis.mayencourt@arm.com>

diff --git a/docs/user-guide.rst b/docs/user-guide.rst
index b9f08716ac9e986f3078030dce116ac5c666d6ed..01cf17a23d2824a2728517d5a69c6bc4dc9a6118 100644 (file)
--- a/docs/user-guide.rst
+++ b/docs/user-guide.rst
@@ -460,12 +460,12 @@ Common build options
    architecture is AArch32.
 
 -  ``ENABLE_STACK_PROTECTOR``: String option to enable the stack protection
-   checks in GCC. Allowed values are "all", "strong" and "0" (default).
-   "strong" is the recommended stack protection level if this feature is
-   desired. 0 disables the stack protection. For all values other than 0, the
-   ``plat_get_stack_protector_canary()`` platform hook needs to be implemented.
-   The value is passed as the last component of the option
-   ``-fstack-protector-$ENABLE_STACK_PROTECTOR``.
+   checks in GCC. Allowed values are "all", "strong", "default" and "none". The
+   default value is set to "none". "strong" is the recommended stack protection
+   level if this feature is desired. "none" disables the stack protection. For
+   all values other than "none", the ``plat_get_stack_protector_canary()``
+   platform hook needs to be implemented. The value is passed as the last
+   component of the option ``-fstack-protector-$ENABLE_STACK_PROTECTOR``.
 
 -  ``ERROR_DEPRECATED``: This option decides whether to treat the usage of
    deprecated platform APIs, helper functions or drivers within Trusted

diff --git a/lib/stack_protector/stack_protector.mk b/lib/stack_protector/stack_protector.mk
index 0f0d90fb8aac0874a026bebb863abf241c6e4e8a..94e804be9ccc3a46d3d50ed46092e4c44331667e 100644 (file)
--- a/lib/stack_protector/stack_protector.mk
+++ b/lib/stack_protector/stack_protector.mk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2017, ARM Limited and Contributors. All rights reserved.
+# Copyright (c) 2017-2019, ARM Limited and Contributors. All rights reserved.
 #
 # SPDX-License-Identifier: BSD-3-Clause
 #
@@ -7,13 +7,20 @@
 # Boolean macro to be used in C code
 STACK_PROTECTOR_ENABLED := 0
 
-ifneq (${ENABLE_STACK_PROTECTOR},0)
-STACK_PROTECTOR_ENABLED := 1
-BL_COMMON_SOURCES      +=      lib/stack_protector/stack_protector.c                   \
+ifeq (${ENABLE_STACK_PROTECTOR},0)
+  ENABLE_STACK_PROTECTOR := none
+endif
+
+ifneq (${ENABLE_STACK_PROTECTOR},none)
+  STACK_PROTECTOR_ENABLED := 1
+  BL_COMMON_SOURCES    +=      lib/stack_protector/stack_protector.c   \
                                lib/stack_protector/${ARCH}/asm_stack_protector.S
 
-TF_CFLAGS              +=      -fstack-protector-${ENABLE_STACK_PROTECTOR}
+  ifeq (${ENABLE_STACK_PROTECTOR},default)
+    TF_CFLAGS          +=      -fstack-protector
+  else
+    TF_CFLAGS          +=      -fstack-protector-${ENABLE_STACK_PROTECTOR}
+  endif
 endif
 
 $(eval $(call add_define,STACK_PROTECTOR_ENABLED))
-