On Tue, Nov 15, 2022 at 02:23:42AM +0100, Stefano Brivio wrote:
> CPPFLAGS allow the user to pass pre-processor flags. This is unlikely
> to be needed at the moment, but the Debian Hardening Walkthrough
> reasonably requests it to be handled in order to fully support
> hardened build flags:
>   https://wiki.debian.org/HardeningWalkthrough#Handling_dpkg-buildflags_in_your_upstream_build_system
> 
> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

Possible refinement, though:  if we moved our own flags which are
really for the preprocessor (-D*) to CPPFLAGS, then we can probably
pass just CPPFLAGS, not CFLAGS to the static checkers and avoid the
ugly filter/filter-out expressions.

> ---
>  Makefile | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/Makefile b/Makefile
> index 6b22408..a6e3164 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -60,8 +60,8 @@ HEADERS = $(PASST_HEADERS) seccomp.h
>  # csum_unaligned(). Mark csum_unaligned() as "noipa" as a quick work-around,
>  # while we figure out if a corresponding gcc issue has already been reported.
>  ifeq (,$(filter-out 11 12, $(shell $(CC) -dumpversion)))
> -ifneq (,$(filter -flto%,$(FLAGS) $(CFLAGS)))
> -ifneq (,$(filter -O2,$(FLAGS) $(CFLAGS)))
> +ifneq (,$(filter -flto%,$(FLAGS) $(CFLAGS) $(CPPFLAGS)))
> +ifneq (,$(filter -O2,$(FLAGS) $(CFLAGS) $(CPPFLAGS)))
>  	FLAGS += -DTCP_HASH_NOINLINE
>  	FLAGS += -DSIPHASH_20B_NOINLINE
>  	FLAGS += -DCSUM_UNALIGNED_NO_IPA
> @@ -121,11 +121,11 @@ seccomp.h: seccomp.sh $(PASST_SRCS) $(PASST_HEADERS)
>  	@ EXTRA_SYSCALLS="$(EXTRA_SYSCALLS)" ./seccomp.sh $(PASST_SRCS) $(PASST_HEADERS)
>  
>  passt: $(PASST_SRCS) $(HEADERS)
> -	$(CC) $(FLAGS) $(CFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS)
> +	$(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(PASST_SRCS) -o passt $(LDFLAGS)
>  
>  passt.avx2: FLAGS += -Ofast -mavx2 -ftree-vectorize -funroll-loops
>  passt.avx2: $(PASST_SRCS) $(HEADERS)
> -	$(CC) $(filter-out -O2,$(FLAGS) $(CFLAGS)) \
> +	$(CC) $(filter-out -O2,$(FLAGS) $(CFLAGS) $(CPPFLAGS)) \
>  		$(PASST_SRCS) -o passt.avx2 $(LDFLAGS)
>  
>  passt.avx2: passt
> @@ -134,7 +134,7 @@ pasta.avx2 pasta.1 pasta: pasta%: passt%
>  	ln -s $< $@
>  
>  qrap: $(QRAP_SRCS) passt.h
> -	$(CC) $(FLAGS) $(CFLAGS) $(QRAP_SRCS) -o qrap $(LDFLAGS)
> +	$(CC) $(FLAGS) $(CFLAGS) $(CPPFLAGS) $(QRAP_SRCS) -o qrap $(LDFLAGS)
>  
>  valgrind: EXTRA_SYSCALLS += rt_sigprocmask rt_sigtimedwait rt_sigaction	\
>  			    getpid gettid kill clock_gettime mmap	\
> @@ -283,7 +283,7 @@ clang-tidy: $(SRCS) $(HEADERS)
>  	-concurrency-mt-unsafe,\
>  	-readability-identifier-length \
>  	-config='{CheckOptions: [{key: bugprone-suspicious-string-compare.WarnOnImplicitComparison, value: "false"}]}' \
> -	--warnings-as-errors=* $(SRCS) -- $(filter-out -pie,$(FLAGS) $(CFLAGS))
> +	--warnings-as-errors=* $(SRCS) -- $(filter-out -pie,$(FLAGS) $(CFLAGS) $(CPPFLAGS))
>  
>  SYSTEM_INCLUDES := /usr/include $(wildcard /usr/include/$(TARGET))
>  ifeq ($(shell $(CC) -v 2>&1 | grep -c "gcc version"),1)
> @@ -299,5 +299,5 @@ cppcheck: $(SRCS) $(HEADERS)
>  	$(SYSTEM_INCLUDES:%=--suppress=unmatchedSuppression:%/*)	\
>  	--inline-suppr							\
>  	--suppress=unusedStructMember					\
> -	$(filter -D%,$(FLAGS) $(CFLAGS))				\
> +	$(filter -D%,$(FLAGS) $(CFLAGS) $(CPPFLAGS))			\
>  	.

-- 
David Gibson			| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_ _other_
				| _way_ _around_!
http://www.ozlabs.org/~dgibson