[llvm-dev] Asan code size overhead

[Shi, Steven via llvm-dev]

Hi Kcc,
Thank your advices.

>Start from switching from inline instrumentation to instrumentation with calls:
>With Clang that is "-mllvm -asan-instrumentation-with-call-threshold=0", gcc should have something similar.
I see the call-threshold option force to use the calls and have same effect as -fsanitize=kernel-address in below code. Thanks.
http://llvm.org/svn/llvm-project/llvm/trunk/lib/Transforms/Instrumentation/AddressSanitizer.cpp
line 1956:
  bool UseCalls =
      CompileKernel ||
      (ClInstrumentationWithCallsThreshold >= 0 &&
       ToInstrument.size() > (unsigned)ClInstrumentationWithCallsThreshold);

>Obviously, there is a cost in performance.
The call cost to my firmware should be very low. (1) Not like CPU-intensive application, my firmware is an IO-intensive software, the boot performance bottleneck is usually because of slow IO response. If Asan instrumentation mainly bring overhead to CPU, it is not a big problem to my firmware. (2) Not like memory-intensive application, my firmware usually have sufficient system memory to use. If Asan mainly bring overhead to system memory consumption for shadow memory metadata, it is not a big problem for me too.

But my firmware usually care the code size, even in debug version. If my Asan-enabled firmware image size is too big, I cannot easily apply and run it on real HW.


>Clang (and recent gcc) also have a convenience flag -fsanitize=kernel-address:
>          movq   %rdi, %rbx
>          callq     __asan_load4_noabort
>          movl    (%rbx), %eax
I like the -fsanitize=kernel-address option, and I believe it better fit my firmware scenario rather than -fsanitize=address. I but after take a look at the current LLVM Asan implementation, I have some concerns that kernel-address might disable the global and stack instrumentations by default as below code. Does LLVM Asan really support -fsanitize=kernel-address to check glabal and stack buffer issues?

http://llvm.org/svn/llvm-project/llvm/trunk/lib/Transforms/Instrumentation/AddressSanitizer.cpp
line 1723:
  // TODO(glider): temporarily disabled globals instrumentation for KASan.
  if (ClGlobals && !CompileKernel) {
    Function *CtorFunc = M.getFunction(kAsanModuleCtorName);
    assert(CtorFunc);
    IRBuilder<> IRB(CtorFunc->getEntryBlock().getTerminator());
    Changed |= InstrumentGlobals(IRB, M);
  }

Line2287:
  bool DoStackMalloc = ClUseAfterReturn && !ASan.CompileKernel &&
                       LocalStackSize <= kMaxStackMallocSize;


Thanks
Steven
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20161102/2bf3d6bb/attachment.html>