conf/distro: Add option for controlling compiler flags

Add an OPTIMIZE_FOR option that sets different compiler and hardening flags depending on the requested optimization type.

Signed-off-by: Bernhard Rosenkränzer bernhard.rosenkraenzer.ext@huawei.com

meta-oniro-core/conf/distro/oniro-linux.conf

@@ -112,3 +112,24 @@ ENABLE_UART ?= "1"
 GPU_MEM:raspberrypi4-64 = "128"
 
 SPLASH = "psplash-oniro"
+
+# Configure what to optimize for:
+# - "normal": A normal build.
+# - "debugging": More debuggable, but less performant and less secure binaries.
+# - "security": Add security hardening even when it comes at the cost of
+#               severe performance penalties
+# - "size": Optimize for code size
+# - "speed": Optimize for performance
+# - "unsafespeed": Optimize for performance even when it means
+#                  relaxing standards (potentially introducing bugs)
+OPTIMIZE_FOR ?= "normal"
+
+TARGET_CFLAGS += "-O2 -flto -Wformat -Wformat-security -Wformat-nonliteral -Werror=format-security -Werror=format-nonliteral -Werror=array-bounds -Wstrict-aliasing=2 -Werror=strict-aliasing -Wl,-z,relro,-z,now,-z,noexecstack,--hash-style=gnu,--as-needed -fvisibility=hidden -fvisibility-inlines-hidden -fstack-protector-strong --param=ssp-buffer-size=4 -fstack-clash-protection -fPIE -pie"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'debugging', '-g4', '', d)}"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'security', '-ftrivial-auto-var-init=pattern', '', d)}"
+TARGET_CFLAGS:toolchain-clang += "${@oe.utils.conditional('OPTIMIZE_FOR', 'security', '-mspeculative-load-hardening -mretpoline', '', d)}"
+TARGET_CFLAGS:toolchain-gcc += "${@oe.utils.conditional('OPTIMIZE_FOR', 'security', '-mindirect-branch -mfunction-return', '', d)}"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'size', '-Os', '', d)}"
+TARGET_CFLAGS:toolchain-clang += "${@oe.utils.conditional('OPTIMIZE_FOR', 'size', '-Oz', '', d)}"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'speed', '-O3 -fno-semantic-interposition -Wl,-Bsymbolic,-Bsymbolic-functions', '', d)}"
+TARGET_CFLAGS += "${@oe.utils.conditional('OPTIMIZE_FOR', 'unsafespeed', '-Ofast -fno-semantic-interposition -Wl,-Bsymbolic,-Bsymbolic-functions', '', d)}"

[Marta Rybczynska]

Would this be useful for all architectures? I'm thinking of RISC-V