buildsystem: add BUILD_FLAG support

- replace strip_lto/strip_gold (only allowed to disable)
- add flag for PIC feature
- add flag to stop build parallel
- add support for hardening option (initial copy from debian 9)

All build parameters, are added in setup_toolchain.
`PKG_[FLAG]_[HOST/TARGET]_ENABLED` variable is introduced for checking the flag (yes/no) in the package.mk

Thanks to @MilhouseVH, for support and fixing

config/functions

@@ -1,4 +1,44 @@
 setup_toolchain() {
+  # lto flag
+  if flag_enabled "lto" "$LTO_SUPPORT" "only-disable"; then
+    export TARGET_CFLAGS+=" $CFLAGS_OPTIM_LTO"
+    export TARGET_CXXFLAGS+=" $CXXFLAGS_OPTIM_LTO"
+    export TARGET_LDFLAGS+=" $LDFLAGS_OPTIM_LTO"
+  fi
+
+  # gold flag
+  if flag_enabled "gold" "$GOLD_SUPPORT" "only-disable"; then
+    export TARGET_LDFLAGS+=" $LDFLAGS_OPTIM_GOLD"
+  fi
+
+  # position-independent code
+  if flag_enabled "pic" "no"; then
+    export TARGET_CFLAGS+=" $CFLAGS_OPTIM_PIC"
+    export TARGET_CXXFLAGS+=" $CXXFLAGS_OPTIM_PIC"
+    export TARGET_LDFLAGS+=" $LDFLAGS_OPTIM_PIC"
+  fi
+  if flag_enabled "pic:host" "no"; then
+    export HOST_CFLAGS+=" $CFLAGS_OPTIM_PIC"
+    export HOST_CXXFLAGS+=" $CXXFLAGS_OPTIM_PIC"
+    export HOST_LDFLAGS+=" $LDFLAGS_OPTIM_PIC"
+  fi
+
+  # hardening support
+  if flag_enabled "hardening" "$HARDENING_SUPPORT"; then
+    export TARGET_CFLAGS+=" $CFLAGS_OPTIM_HARDENING"
+    export TARGET_CXXFLAGS+=" $CXXFLAGS_OPTIM_HARDENING"
+    export TARGET_CFLAGS+=" $CPPFLAGS_OPTIM_HARDENING"
+    export TARGET_LDFLAGS+=" $LDFLAGS_OPTIM_HARDENING"
+  fi
+
+  # parallel
+  if ! flag_enabled "parallel" "yes"; then
+    NINJA_OPTS="$NINJA_OPTS -j1"
+    export MAKEFLAGS="-j1"
+  else
+    export MAKEFLAGS="-j$CONCURRENCY_MAKE_LEVEL"
+  fi
+
   case "$1" in
     target|init)
       export DESTIMAGE="target"
@@ -318,6 +358,37 @@ listremoveitem() {
   echo "${tmp_array[@]}"
 }
 
+# check if a flag is enabled
+# $1: flag-name, $2: default (yes/no), $3: ingenious check (none,only-disable,only-enable)
+# set variable PKG_[FLAG]_[HOST/TARGET]_ENABLED=(yes/no)
+# return 0 if flag is enabled, otherwise 1
+flag_enabled() {
+  # make flag name upper case and replace hyphen with underscore, to use as variable name
+  local flag_name=${1^^}
+  [[ $flag_name =~ : ]] || flag_name+="_TARGET"
+  flag_name="PKG_${flag_name//[:-]/_}_ENABLED"
+
+  # check flag
+  if [ -n "${PKG_BUILD_FLAGS}" ] && listcontains "${PKG_BUILD_FLAGS}" "[+]?$1"; then
+    if [ "${3:none}" = "only-disable" ]; then
+      echo "ERROR: $1 can not enable via PKG_BUILD_FLAGS (found in $PKG_NAME)"
+      exit 1
+    fi
+    declare ${flag_name}="yes"
+    return 0
+  elif [ "$2" = "yes" ] && ! listcontains "${PKG_BUILD_FLAGS}" "-$1"; then
+    declare ${flag_name}="yes"
+    return 0
+  else
+    if [ "${3:none}" = "only-enable" ]; then
+      echo "ERROR: $1 can not disable via PKG_BUILD_FLAGS (found in $PKG_NAME)"
+      exit 1
+    fi
+    declare ${flag_name}="no"
+    return 1
+  fi
+}
+
 target_has_feature() {
   listcontains "$TARGET_FEATURES" "$1"
 }
@@ -662,26 +733,6 @@ do_autoreconf() {
   fi
 }
 
-strip_lto() {
-  # strip out LTO optimization from *FLAGS
-  if [ -n "$GCC_OPTIM_LTO" ] ; then
-    CFLAGS=`echo $CFLAGS | sed -e "s|$GCC_OPTIM_LTO||g"`
-    CXXFLAGS=`echo $CXXFLAGS | sed -e "s|$GCC_OPTIM_LTO||g"`
-    TARGET_CFLAGS=`echo $TARGET_CFLAGS | sed -e "s|$GCC_OPTIM_LTO||g"`
-    TARGET_CXXFLAGS=`echo $TARGET_CXXFLAGS | sed -e "s|$GCC_OPTIM_LTO||g"`
-  fi
-  if [ -n "$LD_OPTIM_LTO" ] ; then
-    LDFLAGS=`echo $LDFLAGS | sed -e "s|$LD_OPTIM_LTO||g"`
-    TARGET_LDFLAGS=`echo $TARGET_LDFLAGS | sed -e "s|$LD_OPTIM_LTO||g"`
-  fi
-}
-
-strip_gold() {
-  # strip out usage from GOLD linker
-  LDFLAGS=`echo $LDFLAGS | sed -e "s|-fuse-ld=gold||g"`
-  TARGET_LDFLAGS=`echo $TARGET_LDFLAGS | sed -e "s|-fuse-ld=gold||g"`
-}
-
 fix_module_depends() {
   # modify .modinfo section in kernel module to depends on other required modules
   local MODULE="$1"

config/optimize

@@ -1,15 +1,6 @@
 GCC_OPTIM="-Os"
 LD_OPTIM="-Wl,--as-needed"
 
-if [ "$LTO_SUPPORT" = yes ];then
-  GCC_OPTIM_LTO="-flto -ffat-lto-objects"
-  LD_OPTIM_LTO="-fuse-linker-plugin -flto"
-fi
-
-if [ "$GOLD_SUPPORT" = yes ];then
-  LD_OPTIM_GOLD="-fuse-ld=gold"
-fi
-
 if [ "${BUILD_WITH_DEBUG}" = "yes" ]; then
   TARGET_CFLAGS="$TARGET_CFLAGS -ggdb"
   TARGET_CXXFLAGS="$TARGET_CXXFLAGS -ggdb"
@@ -20,10 +11,12 @@ else
   TARGET_LDFLAGS="$TARGET_LDFLAGS"
 fi
 
-TARGET_CPPFLAGS=
-TARGET_CFLAGS="$TARGET_CFLAGS -Wall -pipe $GCC_OPTIM $GCC_OPTIM_LTO $PROJECT_CFLAGS"
+NINJA_OPTS=""
+
+TARGET_CPPFLAGS=""
+TARGET_CFLAGS="$TARGET_CFLAGS -Wall -pipe $GCC_OPTIM $PROJECT_CFLAGS"
 TARGET_CXXFLAGS="$TARGET_CFLAGS"
-TARGET_LDFLAGS="$TARGET_LDFLAGS $LD_OPTIM $LD_OPTIM_GOLD $LD_OPTIM_LTO"
+TARGET_LDFLAGS="$TARGET_LDFLAGS $LD_OPTIM"
 TARGET_LIBDIR="$SYSROOT_PREFIX/lib $SYSROOT_PREFIX/usr/lib"
 TARGET_INCDIR="$SYSROOT_PREFIX/include $SYSROOT_PREFIX/usr/include"
 
@@ -38,6 +31,26 @@ HOST_INCDIR="$TOOLCHAIN/include /usr/include"
 HOST_CFLAGS="$HOST_CFLAGS -Wno-format-security"
 HOST_CXXFLAGS="$HOST_CXXFLAGS -Wno-format-security" 
 
+# lto flags
+CFLAGS_OPTIM_LTO="-flto -ffat-lto-objects"
+CXXFLAGS_OPTIM_LTO="-flto -ffat-lto-objects"
+LDFLAGS_OPTIM_LTO="-fuse-linker-plugin -flto"
+
+# gold flags
+LDFLAGS_OPTIM_GOLD="-fuse-ld=gold"
+
+# position-independent code
+CFLAGS_OPTIM_PIC="-fPIC -DPIC"
+CXXFLAGS_OPTIM_PIC="-fPIC -DPIC"
+LDFLAGS_OPTIM_PIC="-fPIC"
+
+# hardening support
+# TODO: basiclly copied from debian 9, should adjust for LE
+CFLAGS_OPTIM_HARDENING="-fstack-protector-strong -Wformat -Werror=format-security -fPIE"
+CXXFLAGS_OPTIM_HARDENING="-fstack-protector-strong -Wformat -Werror=format-security -fPIE"
+CPPFLAGS_OPTIM_HARDENING="-D_FORTIFY_SOURCE=2"
+LDFLAGS_OPTIM_HARDENING="-Wl,-z,relro -Wl,-z,now"
+
 # add distro specific library dirs
 if [ -z "$HOST_LIBDIR" ]; then
   HOST_LIBDIR="$TOOLCHAIN/lib"

config/path

@@ -134,7 +134,6 @@ XORG_PATH_DRIVERS=/usr/lib/xorg/modules/drivers
 if [ -z "$CCACHE_DIR" ]; then
   export CCACHE_DIR=$BUILD/.ccache
 fi
-export MAKEFLAGS=-j$CONCURRENCY_MAKE_LEVEL
 
 if [[ -z "$PATH" || ( "$PATH" != "$TOOLCHAIN/bin:$TOOLCHAIN/sbin" && "$PATH" = "${PATH#$TOOLCHAIN/bin:$TOOLCHAIN/sbin:}" ) ]]; then
   export PATH="$TOOLCHAIN/bin:$TOOLCHAIN/sbin${PATH:+":$PATH"}"

distributions/LibreELEC/options

@@ -4,6 +4,9 @@
 # GOLD (Google Linker) support
   GOLD_SUPPORT="yes"
 
+# HARDENING (security relevant linker and compiler flags) support
+  HARDENING_SUPPORT="no"
+
 # Name of the Distro to build (full name, without special characters)
   DISTRONAME="LibreELEC"
 

packages/addons/addon-depends/atk/package.mk

@@ -30,10 +30,7 @@ PKG_SECTION="accessibility"
 PKG_SHORTDESC="ATK - Accessibility Toolkit"
 PKG_LONGDESC="ATK provides the set of accessibility interfaces that are implemented by other toolkits and applications. Using the ATK interfaces, accessibility tools have full access to view and control running applications."
 PKG_TOOLCHAIN="autotools"
+PKG_BUILD_FLAGS="+pic"
 
 PKG_CONFIGURE_OPTS_TARGET="--enable-static --disable-shared \
                            --disable-rebuilds --enable-introspection=no"
-
-pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC"
-}

packages/addons/addon-depends/cxxtools/package.mk

@@ -28,16 +28,11 @@ PKG_DEPENDS_TARGET="toolchain"
 PKG_SECTION="python/web"
 PKG_SHORTDESC="cxxtools: a collection of general-purpose C++ classes"
 PKG_LONGDESC="Cxxtools is a collection of general-purpose C++ classes"
+PKG_BUILD_FLAGS="+pic"
 
 PKG_CONFIGURE_OPTS_HOST="--disable-demos --with-atomictype=pthread --disable-unittest"
 PKG_CONFIGURE_OPTS_TARGET="--enable-static --disable-shared --disable-demos --with-atomictype=pthread --disable-unittest"
 
-pre_configure_target() {
-  CFLAGS="$CFLAGS -fPIC"
-  CXXFLAGS="$CXXFLAGS -fPIC"
-  LDFLAGS="$LDFLAGS -fPIC"
-}
-
 post_makeinstall_host() {
   rm -rf $TOOLCHAIN/bin/cxxtools-config
 }

packages/addons/addon-depends/enca/package.mk

@@ -27,6 +27,7 @@ PKG_DEPENDS_TARGET="toolchain"
 PKG_SECTION="devel"
 PKG_SHORTDESC="enca: detects the encoding of text files, on the basis of knowledge of their language."
 PKG_LONGDESC="Enca detects the encoding of text files, on the basis of knowledge of their language. It can also convert them to other encodings, allowing you to recode files without knowing their current encoding. It supports most of Central and East European languages, and a few Unicode variants, independently on language."
+PKG_BUILD_FLAGS="+pic"
 
 PKG_MAKEINSTALL_OPTS_TARGET="-C lib"
 PKG_CONFIGURE_OPTS_TARGET="ac_cv_file__dev_random=yes \
@@ -41,10 +42,6 @@ PKG_CONFIGURE_OPTS_TARGET="ac_cv_file__dev_random=yes \
                            --disable-rpath \
                            --with-gnu-ld"
 
-pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC -DPIC"
-}
-
 pre_make_target() {
   make CC="$HOST_CC" \
        CPPFLAGS="$HOST_CPPFLAGS" \

packages/addons/addon-depends/ffmpegx/package.mk

@@ -27,6 +27,8 @@ PKG_SOURCE_DIR="FFmpeg-n${PKG_VERSION}"
 PKG_DEPENDS_TARGET="toolchain bzip2 fdk-aac libvorbis openssl opus x264 x265 zlib"
 PKG_SECTION="multimedia"
 PKG_LONGDESC="FFmpegx is an complete FFmpeg build to support encoding and decoding"
+# ffmpeg builds better with these options
+PKG_BUILD_FLAGS="-gold -lto"
 
 # Dependencies
 get_graphicdrivers
@@ -48,10 +50,6 @@ pre_configure_target() {
   cd $PKG_BUILD
   rm -rf .$TARGET_NAME
 
-# ffmpeg builds better with these options
-  strip_gold
-  strip_lto
-
   if [ "$KODIPLAYER_DRIVER" == "bcm2835-driver" ]; then
     CFLAGS="-DRPI=1 -I$SYSROOT_PREFIX/usr/include/IL -I$SYSROOT_PREFIX/usr/include/interface/vcos/pthreads -I$SYSROOT_PREFIX/usr/include/interface/vmcs_host/linux $CFLAGS"
     PKG_FFMPEG_LIBS="-lbcm_host -ldl -lmmal -lmmal_core -lmmal_util -lvchiq_arm -lvcos -lvcsm"

packages/addons/addon-depends/jasper/package.mk

@@ -27,13 +27,10 @@ PKG_DEPENDS_TARGET="toolchain libjpeg-turbo"
 PKG_SECTION="graphics"
 PKG_SHORTDESC="jasper: JPEG-2000 Part-1 standard (i.e., ISO/IEC 15444-1) implementation"
 PKG_LONGDESC="This distribution contains the public release of the an open-source implementation of the ISO/IEC 15444-1 also known as JPEG-2000 standard for image compression."
+PKG_BUILD_FLAGS="+pic"
 
 PKG_CONFIGURE_OPTS_TARGET="--disable-shared --enable-static"
 
-pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC -DPIC"
-}
-
 post_makeinstall_target() {
   rm -rf $INSTALL/usr/bin
 }

packages/addons/addon-depends/libdvbcsa/package.mk

@@ -29,6 +29,8 @@ PKG_SECTION="lib"
 PKG_SHORTDESC="libdvbcsa is a free implementation of the DVB Common Scrambling Algorithm - DVB/CSA - with encryption and decryption capabilities"
 PKG_LONGDESC="libdvbcsa is a free implementation of the DVB Common Scrambling Algorithm - DVB/CSA - with encryption and decryption capabilities"
 PKG_TOOLCHAIN="autotools"
+# libdvbcsa is a bit faster without LTO, and tests will fail with gcc-5.x
+PKG_BUILD_FLAGS="-lto +pic"
 
 PKG_CONFIGURE_OPTS_TARGET="--disable-shared --enable-static --with-sysroot=$SYSROOT_PREFIX"
 
@@ -43,10 +45,3 @@ elif [ "$TARGET_ARCH" = x86_64  ]; then
     PKG_CONFIGURE_OPTS_TARGET="$PKG_CONFIGURE_OPTS_TARGET --enable-uint64"
   fi
 fi
-
-pre_configure_target() {
-# libdvbcsa is a bit faster without LTO, and tests will fail with gcc-5.x
-  strip_lto
-
-  export CFLAGS="$CFLAGS -fPIC"
-}

packages/addons/addon-depends/multimedia-tools-depends/tstools/package.mk

@@ -29,9 +29,10 @@ PKG_DEPENDS_TARGET="toolchain"
 PKG_SECTION="tools"
 PKG_SHORTDESC="command line tools for working with MPEG data"
 PKG_LONGDESC="This is a set of cross-platform command line tools for working with MPEG data."
+PKG_BUILD_FLAGS="-parallel"
 
 make_target() {
-  make -j1 CROSS_COMPILE=$TARGET_PREFIX
+  make CROSS_COMPILE=$TARGET_PREFIX
 }
 
 makeinstall_target() {

packages/addons/addon-depends/network-tools-depends/iw/package.mk

@@ -27,11 +27,10 @@ PKG_DEPENDS_TARGET="toolchain libnl"
 PKG_SECTION="tools"
 PKG_SHORTDESC="iw is a new nl80211 based CLI configuration utility for wireless devices"
 PKG_LONGDESC="iw is a new nl80211 based CLI configuration utility for wireless devices. It supports all new drivers that have been added to the kernel recently."
+# iw fails at runtime with lto enabled
+PKG_BUILD_FLAGS="-lto"
 
 pre_configure_target() {
-  # iw fails at runtime with lto enabled
-  strip_lto
-
   export LDFLAGS="$LDFLAGS -pthread"
 }
 

packages/addons/addon-depends/network-tools-depends/udpxy/package.mk

@@ -28,10 +28,10 @@ PKG_SECTION="tools"
 PKG_SHORTDESC="udpxy is a UDP-to-HTTP multicast traffic relay daemon"
 PKG_LONGDESC="udpxy is a UDP-to-HTTP multicast traffic relay daemon"
 PKG_DISCLAIMER="this is an unofficial addon. please don't ask for support in openelec forum / irc channel"
+# fails to build with gcc 4.9 + lto
+PKG_BUILD_FLAGS="-lto"
 
 pre_configure_target() {
-  # fails to build with gcc 4.9 + lto
-  strip_lto
   CFLAGS="$CFLAGS -Wno-error=unused-const-variable"
 }
 

packages/addons/addon-depends/network-tools-depends/wireless_tools/package.mk

@@ -28,11 +28,8 @@ PKG_DEPENDS_TARGET="toolchain"
 PKG_SECTION="debug/tools"
 PKG_SHORTDESC="wireless-tools: tools allowing to manipulate the Wireless Extensions"
 PKG_LONGDESC="The Wireless Tools (WT) is a set of tools allowing to manipulate the Wireless Extensions. They use a textual interface and are rather crude, but aim to support the full Wireless Extension. There are many other tools you can use with Wireless Extensions, however Wireless Tools is the reference implementation."
-
-pre_configure_Target() {
-  # wireless_tools fails to build on some systems with LTO enabled
-  strip_lto
-}
+# wireless_tools fails to build on some systems with LTO enabled
+PKG_BUILD_FLAGS="-lto"
 
 make_target() {
   make PREFIX=/usr CC="$CC" AR="$AR" \

packages/addons/addon-depends/system-tools-depends/depends/efivar/package.mk

@@ -29,13 +29,13 @@ PKG_DEPENDS_TARGET="toolchain efivar:host"
 PKG_SECTION="tools"
 PKG_SHORTDESC="evivar: maniulate EFI Variables"
 PKG_LONGDESC="Tools and library to manipulate EFI variables."
+PKG_BUILD_FLAGS="-lto"
 
 make_host() {
   make -C src/ makeguids
 }
 
 make_target() {
-  strip_lto
   make -C src/ libefivar.a efivar-guids.h efivar.h
 }
 

packages/addons/addon-depends/system-tools-depends/efibootmgr/package.mk

@@ -28,9 +28,9 @@ PKG_DEPENDS_TARGET="toolchain efivar pciutils zlib"
 PKG_SECTION="tools"
 PKG_SHORTDESC="EFI Boot Manager"
 PKG_LONGDESC="This is a Linux user-space application to modify the Intel Extensible Firmware Interface (EFI) Boot Manager configuration. This application can create and destroy boot entries, change the boot order, change the next running boot option, and more."
+PKG_BUILD_FLAGS="-lto"
 
 pre_make_target() {
-  strip_lto
   export EXTRA_CFLAGS="$CFLAGS -I$SYSROOT_PREFIX/usr/include -I$SYSROOT_PREFIX/usr/include/efivar -fgnu89-inline"
   export LDFLAGS="$LDFLAGS -L$SYSROOT_PREFIX/usr/lib -ludev -ldl"
 }

packages/addons/addon-depends/vdr-plugins/vdr-plugin-live/package.mk

@@ -30,11 +30,10 @@ PKG_SECTION="multimedia"
 PKG_SHORTDESC="vdr-live: the LIVE Interactive VDR Environment/"
 PKG_LONGDESC="vdr-live allows a comfortable operation of VDR and some of its plugins trough a web interface"
 PKG_TOOLCHAIN="manual"
+PKG_BUILD_FLAGS="+pic"
 
 pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC"
-  export CXXFLAGS="$CXXFLAGS -fPIC"
-  export LDFLAGS="$LDFLAGS -fPIC -L$SYSROOT_PREFIX/usr/lib/iconv"
+  export LDFLAGS="$LDFLAGS -L$SYSROOT_PREFIX/usr/lib/iconv"
 }
 
 make_target() {

packages/addons/addon-depends/vdr-plugins/vdr-plugin-wirbelscan/package.mk

@@ -30,12 +30,7 @@ PKG_SECTION="multimedia"
 PKG_SHORTDESC="Performs a channel scans for DVB-T, DVB-C and DVB-S"
 PKG_LONGDESC="Performs a channel scans for DVB-T, DVB-C and DVB-S"
 PKG_TOOLCHAIN="manual"
-
-pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC"
-  export CXXFLAGS="$CXXFLAGS -fPIC"
-  export LDFLAGS="$LDFLAGS -fPIC"
-}
+PKG_BUILD_FLAGS="+pic"
 
 make_target() {
   VDR_DIR=$(get_build_dir vdr)

packages/addons/addon-depends/vdr-plugins/vdr-plugin-wirbelscancontrol/package.mk

@@ -30,12 +30,7 @@ PKG_SECTION="multimedia"
 PKG_SHORTDESC="Adds menu entry for wirbelscan at VDR."
 PKG_LONGDESC="Adds menu entry for wirbelscan at VDR."
 PKG_TOOLCHAIN="manual"
-
-pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC"
-  export CXXFLAGS="$CXXFLAGS -fPIC"
-  export LDFLAGS="$LDFLAGS -fPIC"
-}
+PKG_BUILD_FLAGS="+pic"
 
 pre_build_target() {
   WIRBELSCAN_DIR=$(get_build_dir vdr-plugin-wirbelscan)

packages/addons/addon-depends/vdr-plugins/vdr-plugin-xmltv2vdr/package.mk

@@ -29,11 +29,10 @@ PKG_SECTION="multimedia"
 PKG_SHORTDESC="xmltv2vdr imports data in xmltv format"
 PKG_LONGDESC="xmltv2vdr imports data in xmltv format"
 PKG_TOOLCHAIN="manual"
+PKG_BUILD_FLAGS="+pic"
 
 pre_configure_target() {
-  export CFLAGS="$CFLAGS -fPIC"
-  export CXXFLAGS="$CXXFLAGS -fPIC -Wno-narrowing"
-  export LDFLAGS="$LDFLAGS -fPIC"
+  export CXXFLAGS="$CXXFLAGS -Wno-narrowing"
   export LIBS="-L$SYSROOT_PREFIX/usr/lib/iconv -lpcre -lpcrecpp"
 }