-fstack-protector-strong vs -fstack-protector-all under a runtime-overhead budget

A production GCC build requires stack-buffer-overflow mitigation under a runtime-overhead budget with attention to code size and instruction-cache effects. The decision is between -fstack-protector-strong and -fstack-protector-all, where coverage is not equivalent and overhead is workload and target dependent.

The build may target a custom or freestanding C library, so handling of a canary mismatch is a runtime dependency outside the compiler. The choice interacts with other hardening such as -D_FORTIFY_SOURCE=2, which addresses a different class of overflows.

Which function classes remain uninstrumented with -fstack-protector-strong for a typical C codebase and what threat model gap does that represent? What runtime dependency must be satisfied for canary failure handling on a target with a custom or freestanding C library? What factors dominate the overhead difference between strong and all under a defined runtime-overhead budget?