Integrate clang support for full CFG
Categories
(Core :: Security, enhancement)
Tracking
()
People
(Reporter: tjr, Unassigned)
References
(Depends on 1 open bug)
Details
(Keywords: sec-want)
Clang may soon get support for CFG in whole, rather than just marking it on system dll's. When that happens we should be careful when upgrading clang as we might automatically enable it. However, it would be nice to enable it - just knowingly. And perhaps with tests.
Cool, thanks for the pointer!
Since LLVM just began a new release cycle, it would be at least six months until we pick this up in the normal course of things. But I think as soon as the feature lands, we should do try pushes with perf tests so that this doesn't take us by surprise.
Note that Win64 builds will need to pick up https://bugs.llvm.org/show_bug.cgi?id=44049.
I haven't tested thoroughly yet but initial numbers suggest that the full CFG might cost us 1-1.5% on Speedometer.
|
||
Comment 4•5 years ago
|
||
Nice! I think that's the same as what we were expecting out of clang's cfi_icall scheme.
No further work needed here, the last piece was bug 1660340. Resolving to appease bug managers.
Description
•