diff options
| author | Daniele Buono | 2020-12-05 00:06:14 +0100 |
|---|---|---|
| committer | Paolo Bonzini | 2021-01-02 21:03:36 +0100 |
| commit | 9e62ba48ea7e4a95892f6032f89801e5dcb5c261 (patch) | |
| tree | df8ee4df0955260743db7e2ac7542121f7093cf9 /meson_options.txt | |
| parent | check-block: enable iotests with cfi-icall (diff) | |
| download | qemu-9e62ba48ea7e4a95892f6032f89801e5dcb5c261.tar.gz qemu-9e62ba48ea7e4a95892f6032f89801e5dcb5c261.tar.xz qemu-9e62ba48ea7e4a95892f6032f89801e5dcb5c261.zip | |
configure,meson: support Control-Flow Integrity
This patch adds a flag to enable/disable control flow integrity checks
on indirect function calls.
This feature only allows indirect function calls at runtime to functions
with compatible signatures.
This feature is only provided by LLVM/Clang, and depends on link-time
optimization which is currently supported only with LLVM/Clang >= 6.0
We also add an option to enable a debugging version of cfi, with verbose
output in case of a CFI violation.
CFI on indirect function calls does not support calls to functions in
shared libraries (since they were not known at compile time), and such
calls are forbidden. QEMU relies on dlopen/dlsym when using modules,
so we make modules incompatible with CFI.
All the checks are performed in meson.build. configure is only used to
forward the flags to meson
Signed-off-by: Daniele Buono <dbuono@linux.vnet.ibm.com>
Message-Id: <20201204230615.2392-5-dbuono@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'meson_options.txt')
| -rw-r--r-- | meson_options.txt | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/meson_options.txt b/meson_options.txt index f8f053b5c8..242e0769fb 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -35,6 +35,10 @@ option('xen_pci_passthrough', type: 'feature', value: 'auto', description: 'Xen PCI passthrough support') option('tcg', type: 'feature', value: 'auto', description: 'TCG support') +option('cfi', type: 'boolean', value: 'false', + description: 'Control-Flow Integrity (CFI)') +option('cfi_debug', type: 'boolean', value: 'false', + description: 'Verbose errors in case of CFI violation') option('cocoa', type : 'feature', value : 'auto', description: 'Cocoa user interface (macOS only)') |