#
# Copyright (C) 2006-2010 OpenWrt.org
#
# This is free software, licensed under the GNU General Public License v2.
# See /LICENSE for more information.
#

ifneq ($(__zyxel_rules_inc),1)
__zyxel_rules_inc=1

########################################################################
###    init
########################################################################
#sotre Zyxel common cflags
ZYXEL_COMMON_CFLAGS:=

#specific for userspace "process" and inherit the setting in ZYXEL_COMMON_CFLAGS
ZYXEL_APP_CFLAGS:=
ZYXEL_APP_LDFLAGS:=

#specific for userspace "libraries" and inherit the setting in ZYXEL_COMMON_CFLAGS
ZYXEL_LIB_CFLAGS:=
ZYXEL_LIB_LDFLAGS:=


########################################################################
###    START: Zyxel common compile flags
########################################################################



########################################################################
###    END: Zyxel common compile flags
########################################################################
ZYXEL_APP_CFLAGS += $(ZYXEL_COMMON_CFLAGS)
ZYXEL_APP_LDFLAGS += $(ZYXEL_COMMON_LDFLAGS)
ZYXEL_LIB_CFLAGS += $(ZYXEL_COMMON_CFLAGS)
ZYXEL_LIB_LDFLAGS += $(ZYXEL_COMMON_LDFLAGS)

########################################################################
###    Enhance compile options
########################################################################
# SECURITY: Support Stack Canaries
# -fstack-protector and -fstack-protector-all are support start from gcc 4.2
# -fstack-protector-strong only support after gcc 4.9
# Econet SDK use gcc 4.6.3
# Broadcom SDK 4.16L.05 use gcc 4.6.2
# Broadcom SDK 5.02L.05 and latter use 5.5.0
# when use -fstack-protector, we may also use --param=ssp-buffer-size=n, default is 8, to control functions with char arrays of at least n(8) bytes
# it means the default setting for "char tmp[2]" will result compile error "stack protector not protecting function: all local arrays are less than 4 bytes long"
ZYXEL_ENHANCE_COMPILE_FLAGS:=
ifeq (1,1)
  ifeq ("$(strip ${ZCFG_PLATFORM})","ECONET")
    ifneq ("$(CONFIG_EN75XXSDK_TCSUPPORT_CPU_EN7512)","y")
      #ZYXEL_ENHANCE_COMPILE_FLAGS += -fstack-protector -Wstack-protector --param=ssp-buffer-size=1
    endif
  endif
  ifeq ("$(strip ${ZCFG_PLATFORM})","BROADCOM")
    ifeq ("$(CONFIG_BRCM963xx_SDK_VER_502L07)","y")
    ZYXEL_ENHANCE_COMPILE_FLAGS += -fstack-protector-strong -Wstack-protector
    else
    ZYXEL_ENHANCE_COMPILE_FLAGS += -fstack-protector -Wstack-protector --param=ssp-buffer-size=1
    endif
  endif
else
  ZYXEL_ENHANCE_COMPILE_FLAGS += -fstack-protector-all -Wstack-protector
endif
#end of ifeq (1,1)
# end of Support Stack Canaries

# SECURITY: FORTIFY_SOURCE
ZYXEL_ENHANCE_COMPILE_FLAGS += -D_FORTIFY_SOURCE=1 -O1

# SECURITY:  RELRO (read only relocation)
# Partial RELRO, gcc default have this setting
#ZYXEL_COMMON_CFLAGS += -Wl,-z,relro
# Full RELRO
ZYXEL_ENHANCE_COMPILE_FLAGS += -Wl,-z,relro,-z,now

# SECURITY: PIE (Position Independent Executable)
# use PIE with level 1
#ZYXEL_ENHANCE_COMPILE_FLAGS += -fpie -pie
# use PIE with level 2
ZYXEL_APP_CFLAGS += $(ZYXEL_ENHANCE_COMPILE_FLAGS) -fPIE -pie
ZYXEL_APP_LDFLAGS += $(ZYXEL_ENHANCE_COMPILE_FLAGS) -fPIE -pie
# libraries use PIC, not PIE
ZYXEL_LIB_CFLAGS += $(ZYXEL_ENHANCE_COMPILE_FLAGS)
ZYXEL_LIB_LDFLAGS += $(ZYXEL_ENHANCE_COMPILE_FLAGS)

endif #__zyxel_rules_inc