Allow enabling control flow guard in Windows build

[zooba]

BPO	44381
Nosy	@pfmoore, @tjguk, @zware, @zooba, @miss-islington, @neonene
PRs	bpo-44381: Windows build now allows enabling control flow guard #26645 [3.10] bpo-44381: Windows build now allows enabling control flow guard (GH-26645) #26681 [3.9] bpo-44381: Windows build now allows enabling control flow guard (GH-26645) #26682

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/zooba'
closed_at = <Date 2021-06-11.21:39:25.558>
created_at = <Date 2021-06-10.17:07:15.163>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', 'build', 'OS-windows']
title = 'Allow enabling control flow guard in Windows build'
updated_at = <Date 2021-08-25.19:34:26.981>
user = 'https://github.com/zooba'

bugs.python.org fields:

activity = <Date 2021-08-25.19:34:26.981>
actor = 'steve.dower'
assignee = 'steve.dower'
closed = True
closed_date = <Date 2021-06-11.21:39:25.558>
closer = 'steve.dower'
components = ['Build', 'Windows']
creation = <Date 2021-06-10.17:07:15.163>
creator = 'steve.dower'
dependencies = []
files = []
hgrepos = []
issue_num = 44381
keywords = ['patch']
message_count = 7.0
messages = ['395556', '395557', '395661', '395662', '395663', '400281', '400294']
nosy_count = 6.0
nosy_names = ['paul.moore', 'tim.golden', 'zach.ware', 'steve.dower', 'miss-islington', 'neonene']
pr_nums = ['26645', '26681', '26682']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue44381'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

[zooba]

Currently we don't enable CFG (which is runtime protection against code injection into tables), because it likely has a performance impact and the kind of attack is outside our scope.

However, we should make it easier to build CPython with CFG enabled, so that third-parties who do want to include it in their scope can do so.

[zooba]

FWIW, I don't actually know what the performance impact is. I'm not set up for running the perf benchmarks, and I don't know if anyone else is (on Windows), but if someone would like to then it'll be easier once the environment option to enable it is in there.

[zooba]

New changeset 5af56c6 by Steve Dower in branch 'main':
bpo-44381: Windows build now allows enabling control flow guard (GH-26645)
5af56c6

[zooba]

New changeset 9580d38 by Miss Islington (bot) in branch '3.9':
bpo-44381: Windows build now allows enabling control flow guard (GH-26645)
9580d38

[miss-islington]

New changeset 42612db by Miss Islington (bot) in branch '3.10':
bpo-44381: Windows build now allows enabling control flow guard (GH-26645)
42612db

[neonene]

I'd like to leave my pyperformance (x64) results here.
cpython: ae52591 (2021-8-23)

1. release + CFG : 1.00x

2. release + CFG,/Ob3 : 1.05x faster | 41 faster
   | 9 slower
   | 8 not significant

3. release (default) : 1.07x faster | 52 faster
   | 4 slower (regex_v8,
   | regex_effbot,
   | nbody,
   | hexiom)
   | 2 not significant

4. release + /Ob3 : 1.11x faster | 56 faster
   | 1 slower (regex_v8)
   | 1 not significant (regex_dna)

5. PGO + CFG : 1.15x faster | 53 faster
   | 2 slower (regex_dna,
   | pidigits)
   | 3 not significant

6. PGO + CFG,/Ob3 : 1.15x faster | 54 faster
   | 1 slower (regex_dna)
   | 3 not significant

7. PGO (default) : 1.21x faster | 56 faster
   | 1 slower (regex_dna)
   | 1 not significant (regex_effbot)

8. PGO + /Ob3 : 1.21x faster | 57 faster
   | 1 slower (regex_dna)
   | 0 not significant

[zooba]

That looks to me like no impact at all, which is great to see!