Bernhard Rosenkränzer · f392c411
--- a/meta-oniro-core/conf/distro/oniro-linux.conf
+++ b/meta-oniro-core/conf/distro/oniro-linux.conf
+
+# Configure what to optimize for:
+# - "normal": A normal build.
+# - "debugging": More debuggable, but less performant and less secure binaries.
+# - "security": Add security hardening even when it comes at the cost of
+#               severe performance penalties
+# - "size": Optimize for code size
+# - "speed": Optimize for performance
+# - "unsafespeed": Optimize for performance even when it means
+#                  relaxing standards (potentially introducing bugs)
+OPTIMIZE_FOR ?= "normal"
+
+TARGET_CFLAGS += "-O2 -flto -Wformat -Wformat-security -Wformat-nonliteral -Werror=format-security -Werror=format-nonliteral -Werror=array-bounds -Wstrict-aliasing=2 -Werror=strict-aliasing -Wl,-z,relro,-z,now,-z,noexecstack,--hash-style=gnu,--as-needed -fvisibility=hidden -fvisibility-inlines-hidden -fstack-protector-strong --param=ssp-buffer-size=4 -fstack-clash-protection -fPIE -pie"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'debugging', '-g4', '', d)}"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'security', '-ftrivial-auto-var-init=pattern', '', d)}"
+TARGET_CFLAGS:toolchain-clang += "${@oe.utils.conditional('OPTIMIZE_FOR', 'security', '-mspeculative-load-hardening -mretpoline', '', d)}"