From owner-freebsd-arch@FreeBSD.ORG Wed Nov 5 12:26:19 2014 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E1B729DE; Wed, 5 Nov 2014 12:26:18 +0000 (UTC) Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 83D90FB9; Wed, 5 Nov 2014 12:26:18 +0000 (UTC) Received: from tom.home (kostik@localhost [127.0.0.1]) by kib.kiev.ua (8.14.9/8.14.9) with ESMTP id sA5CQC8k065390 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 5 Nov 2014 14:26:12 +0200 (EET) (envelope-from kostikbel@gmail.com) DKIM-Filter: OpenDKIM Filter v2.9.2 kib.kiev.ua sA5CQC8k065390 Received: (from kostik@localhost) by tom.home (8.14.9/8.14.9/Submit) id sA5CQCrQ065389; Wed, 5 Nov 2014 14:26:12 +0200 (EET) (envelope-from kostikbel@gmail.com) X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com using -f Date: Wed, 5 Nov 2014 14:26:12 +0200 From: Konstantin Belousov To: Baptiste Daroussin Subject: Re: PIE/PIC support on base Message-ID: <20141105122612.GC53947@kib.kiev.ua> References: <315B4DC5-0E04-4F6B-BBB0-477D049025BF@bsdimp.com> <20141105090215.GF10388@ivaldir.etoilebsd.net> <20141105092614.GB53947@kib.kiev.ua> <20141105114855.GH10388@ivaldir.etoilebsd.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20141105114855.GH10388@ivaldir.etoilebsd.net> User-Agent: Mutt/1.5.23 (2014-03-12) X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no autolearn_force=no version=3.4.0 X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on tom.home Cc: PaX Team , FreeBSD Arch , Shawn Webb X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Nov 2014 12:26:19 -0000 On Wed, Nov 05, 2014 at 12:48:55PM +0100, Baptiste Daroussin wrote: > On Wed, Nov 05, 2014 at 11:26:14AM +0200, Konstantin Belousov wrote: > > On Wed, Nov 05, 2014 at 10:02:15AM +0100, Baptiste Daroussin wrote: > > > On amd64 WANTS_PIE will be useless as we can easily activate PIE on every places > > > For i386 we would propably prefer cherry picking the what we want to see built > > > with PIE. Don't know for other arches. > > > > > > So here is what I do propose: > > > if MK_PIE=no: no PIE at all > > > if MK_PIE=yes: > > > - on amd64/(platforms without performance penalty): build everything with PIE > > > from libs to prog > > See below. > > > > > - on i386/(platforms with performance penalty): build with PIE if WANTS_PIE > > > is defined. > > > > > > So the difference with the previous approach are: > > > - No way to opt out PIE for a single binary either totally disable or enable (I > > > have encountered no binary so far in the base system which fails with PIE > > > enabled - again only tested on amd64) > > > - Activate PIE for both binaries and libraries (no reason not to include > > > libraries) > > What does it mean 'PIE for library' ? There is simply no such thing. > > Sorry I badly explained, I was meaning PIC for libs PIE for binaries. > > > > Also, I strongly oppose compiling everything with PIC, even on amd64. > > I described somewhere else that using PIC code changes symbol lookup > > rules for binaries. So despite not having performance impact, the > > thing does impact runtime behaviour in subtle ways. The most affected > > programs are those which support dynamic modules. Please do not ignore this ^^^^^^ issue. > > > > Also, what is the state of static binaries + PIE ? Do our binutils > > support this at all ? The csu is definitely not ready for 'everything > > PIE'. > > Only dynamic binaries will receive PIE support (and in case of using an > INTERNALLIB will link to the libbla_pic.a) static ones will remain non PIE. And what about libX.a libraries, required by those static binaries ? It is wrong to compile the .o files for those static libraries in pic mode. More, take look at things which are done with -DPIC, e.g. in the lib/libc/sys/stack_protector*.c. There, it is critical for correctness.