fix build system

add preliminary cfi option

arch/posix/CMakeLists.txt

@@ -158,6 +158,11 @@ endif()
 # Support for the LLVM Sanitizer toolchain instrumentation frameworks
 # (supported by current gcc's as well)
 #
+if(CONFIG_CFI)
+  zephyr_compile_options(-flto)
+  target_compile_options(native_simulator INTERFACE "-flto")
+  list(APPEND LLVM_SANITIZERS "cfi")
+endif()
 
 if(CONFIG_ASAN)
   list(APPEND LLVM_SANITIZERS "address")

cmake/modules/python.cmake

@@ -19,6 +19,8 @@ if(NOT DEFINED Python3_EXECUTABLE AND DEFINED WEST_PYTHON)
   set(Python3_EXECUTABLE "${WEST_PYTHON}")
 endif()
 
+set(Python3_EXECUTABLE "$ENV{WEST_PYTHON}")
+
 if(NOT Python3_EXECUTABLE)
   # We are using foreach here, instead of
   # find_program(PYTHON_EXECUTABLE_SYSTEM_DEFAULT "python" "python3")

samples/basic/blinky/prj.conf

@@ -1 +1,3 @@
 CONFIG_GPIO=y
+CONFIG_ASAN=y
+CONFIG_CFI=y

scripts/west_commands/runners/jlink.py

@@ -182,7 +182,7 @@ class JLinkBinaryRunner(ZephyrBinaryRunner):
                 self.logger.warning(f'unknown platform {plat}; assuming UNIX')
                 libname = sdk + '.so'
 
-            lib = Library(dllpath=os.fspath(Path(self.commander).parent /
+            lib = Library(dllpath=os.fspath(Path(self.commander).parent.parent / "lib/JLink" /
                                             libname))
             version = int(lib.dll().JLINKARM_GetDLLVersion())
             self.logger.debug('JLINKARM_GetDLLVersion()=%s', version)

subsys/debug/Kconfig

@@ -108,6 +108,20 @@ config GPROF
 	  Generate call graph profile data for the application that can be
 	  analyzed with gprof
 
+config CFI
+	bool "Build with control flow integrity sanitizer"
+	depends on ARCH_POSIX
+	help
+	  Builds Zephyr with Address Sanitizer enabled. This is currently
+	  only supported by boards based on the posix architecture, and requires a
+	  recent-ish compiler with the ``-fsanitize=address`` command line option,
+	  and the libasan library.
+
+	  Note that at exit leak detection is disabled for 64-bit boards when
+	  GCC is used due to potential risk of a deadlock in libasan.
+	  This behavior can be changes by adding leak_check_at_exit=1 to the
+	  environment variable ASAN_OPTIONS.
+
 config ASAN
 	bool "Build with address sanitizer"
 	depends on ARCH_POSIX