Rietveld Code Review Tool
Help | Bug tracker | Discussion group | Source code | Sign in
(511)

Issue 6303078: [PATCH] Add a new option "-fstack-protector-strong"

Can't Edit
Can't Publish+Mail
Start Review
Created:
11 years, 9 months ago by shenhan
Modified:
11 years, 9 months ago
Reviewers:
CC:
gcc-patches_gcc.gnu.org, asharif1, jingyu, Diego Novillo, keescook_google.com
Visibility:
Public.

Description

This is to port the patch from google/main to trunk, which provides a new stack protection option - "fstack-protector-strong". Previous review for google trunk is here - http://codereview.appspot.com/5461043 Status - it has been used in google/main for 2 quarters, building the whole chromiumos with no securiy degradation. Benefit - gain big performance while sacrificing little security (for scenarios using -fstack-protector-all) Background - some times stack-protector is too-simple while stack-protector-all over-kills, for example, to build one of our core systems, we forcibly add "-fstack-protector-all" to all compile commands, which brings big performance penalty (due to extra stack guard/check insns on function prologue and epilogue) on both atom and arm. To use "-fstack-protector" is just regarded as not secure enough (only "protects" <2% functions) by the system secure team. So I'd like to add the option "-fstack-protector-strong", that hits the balance between "-fstack-protector" and "-fstack-protector-all". Detail - https://docs.google.com/a/google.com/document/d/1xXBH6rRZue4f296vGt9YQcuLVQHeE516stHwt8M9xyU/edit?hl=en_US Tested - building chromiumos from scratch.

Patch Set 1 #

Patch Set 2 : Merged with up-to-date trunk #

Patch Set 3 : Merged with up-to-date trunk #

Patch Set 4 : Fixed minor issues #

Unified diffs Side-by-side diffs Delta from patch set Stats (+250 lines, -13 lines) Patch
M gcc/cfgexpand.c View 1 2 3 7 chunks +62 lines, -7 lines 0 comments Download
M gcc/common.opt View 1 2 1 chunk +5 lines, -1 line 0 comments Download
M gcc/doc/invoke.texi View 1 2 2 chunks +13 lines, -5 lines 0 comments Download
A gcc/testsuite/g++.dg/fstack-protector-strong.C View 1 2 1 chunk +35 lines, -0 lines 0 comments Download
A gcc/testsuite/gcc.dg/fstack-protector-strong.c View 1 2 1 chunk +135 lines, -0 lines 0 comments Download

Messages

Total messages: 1
shenhan
11 years, 9 months ago (2012-06-14 22:30:51 UTC) #1
Hi, this is to port the patch from google/main to trunk, which provides a new
stack protection option - "fstack-protector-strong".

Previous review for google trunk is here - http://codereview.appspot.com/5461043

Status - it has been used in google/main for 2 quarters, building the whole
chromiumos with no securiy degradation.

Benefit - gain big performance while sacrificing little security (for scenarios
using -fstack-protector-all)

Background - some times stack-protector is too-simple while stack-protector-all
over-kills, for example, to build one of our core systems, we forcibly add
"-fstack-protector-all" to all compile commands, which brings big performance
penalty (due to extra stack guard/check insns on function prologue and epilogue)
on both atom and arm. To use "-fstack-protector" is just regarded as not secure
enough (only "protects" <2% functions) by the system secure team. So I'd like to
add the option "-fstack-protector-strong", that hits the balance between
"-fstack-protector" and "-fstack-protector-all".

Detail -
https://docs.google.com/a/google.com/document/d/1xXBH6rRZue4f296vGt9YQcuLVQHe...

Tested - dejagnu, building chromiumos from scratch.

Ok for trunk?

Thank,
-Han
Sign in to reply to this message.

Powered by Google App Engine
RSS Feeds Recent Issues | This issue
This is Rietveld f62528b