1======================
2Control Flow Integrity
3======================
4
5.. toctree::
6   :hidden:
7
8   ControlFlowIntegrityDesign
9
10.. contents::
11   :local:
12
13Introduction
14============
15
16Clang includes an implementation of a number of control flow integrity (CFI)
17schemes, which are designed to abort the program upon detecting certain forms
18of undefined behavior that can potentially allow attackers to subvert the
19program's control flow. These schemes have been optimized for performance,
20allowing developers to enable them in release builds.
21
22To enable Clang's available CFI schemes, use the flag ``-fsanitize=cfi``.
23As currently implemented, CFI relies on link-time optimization (LTO); the CFI
24schemes imply ``-flto``, and the linker used must support LTO, for example
25via the `gold plugin`_. To allow the checks to be implemented efficiently,
26the program must be structured such that certain object files are compiled
27with CFI enabled, and are statically linked into the program. This may
28preclude the use of shared libraries in some cases.
29
30Clang currently implements forward-edge CFI for virtual calls. More schemes
31are under development.
32
33.. _gold plugin: http://llvm.org/docs/GoldPlugin.html
34
35Forward-Edge CFI for Virtual Calls
36----------------------------------
37
38This scheme checks that virtual calls take place using a vptr of the correct
39dynamic type; that is, the dynamic type of the called object must be a
40derived class of the static type of the object used to make the call.
41This CFI scheme can be enabled on its own using ``-fsanitize=cfi-vptr``.
42
43For this scheme to work, all translation units containing the definition
44of a virtual member function (whether inline or not) must be compiled
45with ``-fsanitize=cfi-vptr`` enabled and be statically linked into the
46program. Classes in the C++ standard library (under namespace ``std``) are
47exempted from checking, and therefore programs may be linked against a
48pre-built standard library, but this may change in the future.
49
50Performance
51~~~~~~~~~~~
52
53A performance overhead of less than 1% has been measured by running the
54Dromaeo benchmark suite against an instrumented version of the Chromium
55web browser. Another good performance benchmark for this mechanism is the
56virtual-call-heavy SPEC 2006 xalancbmk.
57
58Note that this scheme has not yet been optimized for binary size; an increase
59of up to 15% has been observed for Chromium.
60
61Design
62------
63
64Please refer to the :doc:`design document<ControlFlowIntegrityDesign>`.
65
66Publications
67------------
68
69`Control-Flow Integrity: Principles, Implementations, and Applications <http://research.microsoft.com/pubs/64250/ccs05.pdf>`_.
70Martin Abadi, Mihai Budiu, Úlfar Erlingsson, Jay Ligatti.
71
72`Enforcing Forward-Edge Control-Flow Integrity in GCC & LLVM <http://www.pcc.me.uk/~peter/acad/usenix14.pdf>`_.
73Caroline Tice, Tom Roeder, Peter Collingbourne, Stephen Checkoway,
74Úlfar Erlingsson, Luis Lozano, Geoff Pike.
75