Fix PIE

64-bit ABIs comes with different default API level, which is higher than
the first level requires executable to be built with PIE.  If APP_PLATFORM
isn't specified and APP_ABI contains both 32- and 64-bit ABIs, make sure
64-bit get PIE and 32-bit doesn't, unless "-static" is specified

Change-Id: Ic798b45c0bf63435b0ebe5e0bcff060e53dddf50

4 files changed, 26 insertions, 10 deletions

diff --git a/build/core/add-application.mk b/build/core/add-application.mk
index d3fb81ca8..a89a91d96 100644
--- a/build/core/add-application.mk
+++ b/build/core/add-application.mk
@@ -113,12 +113,12 @@ ifneq ($(strip $(subst android-,,$(APP_PLATFORM))),$(APP_PLATFORM_LEVEL))
     $(call ndk_log,  Adjusting APP_PLATFORM android-$(APP_PLATFORM_LEVEL) to $(APP_PLATFORM))
 endif
 
-# If APP_PIE isn't defined, set it to true for android-16 and above
+# If APP_PIE isn't defined, set it to true for android-$(NDK_PIE_PLATFORM_LEVEL) and above
 #
 APP_PIE := $(strip $(APP_PIE))
 $(call ndk_log,  APP_PIE is $(APP_PIE))
 ifndef APP_PIE
-    ifneq (,$(call gte,$(APP_PLATFORM_LEVEL),16))
+    ifneq (,$(call gte,$(APP_PLATFORM_LEVEL),$(NDK_PIE_PLATFORM_LEVEL)))
         APP_PIE := true
         $(call ndk_log,  Enabling -fPIE)
     else
diff --git a/build/core/build-binary.mk b/build/core/build-binary.mk
index f8a555698..310526094 100644
--- a/build/core/build-binary.mk
+++ b/build/core/build-binary.mk
@@ -145,14 +145,6 @@ LOCAL_RS_OBJECTS :=
 #
 LOCAL_CFLAGS := -DANDROID $(LOCAL_CFLAGS)
 
-# enable PIE for executable beyond certain API level
-ifeq ($(NDK_APP_PIE),true)
-  ifeq ($(call module-get-class,$(LOCAL_MODULE)),EXECUTABLE)
-    LOCAL_CFLAGS += -fPIE
-    LOCAL_LDFLAGS += -fPIE -pie
-  endif
-endif
-
 #
 # Add the default system shared libraries to the build
 #
@@ -213,6 +205,16 @@ else
   LOCAL_CFLAGS += $($(my)FORMAT_STRING_CFLAGS)
 endif
 
+# enable PIE for executable beyond certain API level, unless "-static"
+ifneq (,$(filter true,$(NDK_APP_PIE) $(TARGET_PIE)))
+  ifeq ($(call module-get-class,$(LOCAL_MODULE)),EXECUTABLE)
+    ifeq (,$(filter -static,$(TARGET_LDFLAGS) $(LOCAL_LDFLAGS) $(NDK_APP_LDFLAGS)))
+      LOCAL_CFLAGS += -fPIE
+      LOCAL_LDFLAGS += -fPIE -pie
+    endif
+  endif
+endif
+
 #
 # The original Android build system allows you to use the .arm prefix
 # to a source file name to indicate that it should be defined in either
diff --git a/build/core/init.mk b/build/core/init.mk
index 20a7913d8..894d68032 100644
--- a/build/core/init.mk
+++ b/build/core/init.mk
@@ -539,6 +539,8 @@ NDK_APP_ABI_ALL_EXPANDED := $(NDK_KNOWN_ABIS)
 else
 NDK_APP_ABI_ALL_EXPANDED := $(NDK_KNOWN_DEVICE_ABIS)
 endif
+# The first API level ndk-build enforces -fPIE for executable
+NDK_PIE_PLATFORM_LEVEL := 16
 
 # the list of all toolchains in this NDK
 NDK_ALL_TOOLCHAINS :=
diff --git a/build/core/setup-abi.mk b/build/core/setup-abi.mk
index 89b0aea68..930e644a2 100644
--- a/build/core/setup-abi.mk
+++ b/build/core/setup-abi.mk
@@ -43,6 +43,18 @@ $(foreach _plat,3 4 5 8 9 10 11 12 13 14 15 16 17 18 19 20 21,\
 )
 endif
 
+TARGET_PLATFORM_LEVEL := $(strip $(subst android-,,$(TARGET_PLATFORM)))
+ifneq ($(TARGET_PLATFORM_LEVEL),$(NDK_PREVIEW_LEVEL))
+    ifneq (,$(call gte,$(TARGET_PLATFORM_LEVEL),$(NDK_PIE_PLATFORM_LEVEL)))
+        TARGET_PIE := true
+        $(call ndk_log,  Enabling -fPIE for TARGET_PLATFORM $(TARGET_PLATFORM))
+    else
+        TARGET_PIE := false
+    endif
+else
+    TARGET_PIE := true
+endif
+
 # Separate the debug and release objects. This prevents rebuilding
 # everything when you switch between these two modes. For projects
 # with lots of C++ sources, this can be a considerable time saver.