diff options
Diffstat (limited to '')
| -rw-r--r-- | .gitlab-ci.d/cirrus.yml | 2 | ||||
| -rw-r--r-- | docs/conf.py | 10 | ||||
| -rw-r--r-- | meson.build | 17 |
3 files changed, 17 insertions, 12 deletions
diff --git a/.gitlab-ci.d/cirrus.yml b/.gitlab-ci.d/cirrus.yml index 64f2e25afa..b45f9de62f 100644 --- a/.gitlab-ci.d/cirrus.yml +++ b/.gitlab-ci.d/cirrus.yml @@ -52,7 +52,7 @@ x64-freebsd-13-build: NAME: freebsd-13 CIRRUS_VM_INSTANCE_TYPE: freebsd_instance CIRRUS_VM_IMAGE_SELECTOR: image_family - CIRRUS_VM_IMAGE_NAME: freebsd-13-2 + CIRRUS_VM_IMAGE_NAME: freebsd-13-3 CIRRUS_VM_CPUS: 8 CIRRUS_VM_RAM: 8G UPDATE_COMMAND: pkg update; pkg upgrade -y diff --git a/docs/conf.py b/docs/conf.py index e84a95e71c..1b2afa241c 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -29,7 +29,6 @@ import os import sys import sphinx -from distutils.version import LooseVersion from sphinx.errors import ConfigError # The per-manual conf.py will set qemu_docdir for a single-manual build; @@ -165,11 +164,10 @@ html_theme = 'sphinx_rtd_theme' # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. -if LooseVersion(sphinx_rtd_theme.__version__) >= LooseVersion("0.4.3"): - html_theme_options = { - "style_nav_header_background": "#802400", - "navigation_with_keys": True, - } +html_theme_options = { + "style_nav_header_background": "#802400", + "navigation_with_keys": True, +} html_logo = os.path.join(qemu_docdir, "../ui/icons/qemu_128x128.png") diff --git a/meson.build b/meson.build index 0ef1654e86..c59ca496f2 100644 --- a/meson.build +++ b/meson.build @@ -555,17 +555,24 @@ endif # Check further flags that make QEMU more robust against malicious parties hardening_flags = [ - # Zero out registers used during a function call - # upon its return. This makes it harder to assemble - # ROP gadgets into something usable - '-fzero-call-used-regs=used-gpr', - # Initialize all stack variables to zero. This makes # it harder to take advantage of uninitialized stack # data to drive exploits '-ftrivial-auto-var-init=zero', ] +# Zero out registers used during a function call +# upon its return. This makes it harder to assemble +# ROP gadgets into something usable +# +# NB: Clang 17 is broken and SEGVs +# https://github.com/llvm/llvm-project/issues/75168 +if cc.compiles('extern struct { void (*cb)(void); } s; void f(void) { s.cb(); }', + name: '-fzero-call-used-regs=used-gpr', + args: ['-O2', '-fzero-call-used-regs=used-gpr']) + hardening_flags += '-fzero-call-used-regs=used-gpr' +endif + qemu_common_flags += cc.get_supported_arguments(hardening_flags) add_global_arguments(qemu_common_flags, native: false, language: all_languages) |