Comparing GCC and Clang security features [LWN.net]

Comparing GCC and Clang security features

Posted Sep 14, 2019 2:23 UTC (Sat) by willy (subscriber, #9762)
Parent article: Comparing GCC and Clang security features

Rather than C++, Rust has its advocates:

https://github.com/fishinabarrel/linux-kernel-module-rust

(click the link to the LSSNA presentation for some of their reasoning)

to post comments

Comparing GCC and Clang security features

Posted Sep 14, 2019 8:49 UTC (Sat) by alonz (subscriber, #815) [Link] (2 responses)

That's quite different: switching to Rust implies a full rewrite of relevant code. Switching the kernel to compile as C++ is expected to be several orders of magnitude easier - at least in theory, much of the code should just compile as-is, and much of the rest can be fixed mechanically.

(I agree that Rust would provide more value—but at a hugely higher cost.)

Comparing GCC and Clang security features

Posted Sep 17, 2019 2:48 UTC (Tue) by roc (subscriber, #30627) [Link] (1 responses)

C++ isn't ideal for implementing wrappers around integer types. It's too easy for your wrapper type to be "non-trivial for the purposes of calls" (http://itanium-cxx-abi.github.io/cxx-abi/abi.html#non-tri...), in which case function parameters and results of that type must be passed by reference instead of by value, imposing significant performance penalties in some cases.

Comparing GCC and Clang security features

Posted Sep 17, 2019 13:10 UTC (Tue) by foom (subscriber, #14868) [Link]

While that can be true in general, it won't be for an integer wrapping type. There is no reason to write a custom move/copy constructor, or destructor, for such a type.

Additionally, if you're ok using a compiler extension, Clang has an attribute that can be used to force trivial abi, if you do have a type which can be passed in registers despite having non-trivial constructors/destructors: https://clang.llvm.org/docs/AttributeReference.html#trivi...