mirror of
https://github.com/ARM-software/arm-trusted-firmware.git
synced 2025-04-18 02:24:18 +00:00
43f35ef516
The User Guide document has grown organically over time and now covers a wide range of topics, making it difficult to skim read and extract information from. Currently, it covers these topics and maybe a couple more: - Requirements (hardware, tools, libs) - Checking out the repo - Basic build instructions - A comprehensive list of build flags - FIP packaging - Building specifically for Juno - Firmware update images - EL3 payloads - Preloaded BL33 boot flow - Running on FVPs - Running on Juno I have separated these out into a few groups that become new documents. Broadly speaking, build instructions for the tools, for TF-A generally, and for specific scenarios are separated. Content relating to specific platforms (Juno and the FVPs are Arm-specific platforms, essentially) has been moved into the documentation that is specific to those platforms, under docs/plat/arm. Change-Id: Ica87c52d8cd4f577332be0b0738998ea3ba3bbec Signed-off-by: Paul Beesley <paul.beesley@arm.com>
58 lines
1.9 KiB
ReStructuredText
58 lines
1.9 KiB
ReStructuredText
Security hardening
|
|
==================
|
|
|
|
This page contains guidance on what to check for additional security measures,
|
|
including build options that can be modified to improve security or catch issues
|
|
early in development.
|
|
|
|
Build options
|
|
-------------
|
|
|
|
Several build options can be used to check for security issues. Refer to the
|
|
:ref:`Build Options` for detailed information on these.
|
|
|
|
- The ``BRANCH_PROTECTION`` build flag can be used to enable Pointer
|
|
Authentication and Branch Target Identification.
|
|
|
|
- The ``ENABLE_STACK_PROTECTOR`` build flag can be used to identify buffer
|
|
overflows.
|
|
|
|
- The ``W`` build flag can be used to enable a number of compiler warning
|
|
options to detect potentially incorrect code.
|
|
|
|
- W=0 (default value)
|
|
|
|
The ``Wunused`` with ``Wno-unused-parameter``, ``Wdisabled-optimization``
|
|
and ``Wvla`` flags are enabled.
|
|
|
|
The ``Wunused-but-set-variable``, ``Wmaybe-uninitialized`` and
|
|
``Wpacked-bitfield-compat`` are GCC specific flags that are also enabled.
|
|
|
|
- W=1
|
|
|
|
Adds ``Wextra``, ``Wmissing-declarations``, ``Wmissing-format-attribute``,
|
|
``Wmissing-prototypes``, ``Wold-style-definition`` and
|
|
``Wunused-const-variable``.
|
|
|
|
- W=2
|
|
|
|
Adds ``Waggregate-return``, ``Wcast-align``, ``Wnested-externs``,
|
|
``Wshadow``, ``Wlogical-op``, ``Wmissing-field-initializers`` and
|
|
``Wsign-compare``.
|
|
|
|
- W=3
|
|
|
|
Adds ``Wbad-function-cast``, ``Wcast-qual``, ``Wconversion``, ``Wpacked``,
|
|
``Wpadded``, ``Wpointer-arith``, ``Wredundant-decls`` and
|
|
``Wswitch-default``.
|
|
|
|
Refer to the GCC or Clang documentation for more information on the individual
|
|
options: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html and
|
|
https://clang.llvm.org/docs/DiagnosticsReference.html.
|
|
|
|
NB: The ``Werror`` flag is enabled by default in TF-A and can be disabled by
|
|
setting the ``E`` build flag to 0.
|
|
|
|
--------------
|
|
|
|
*Copyright (c) 2019, Arm Limited. All rights reserved.*
|