This effectively reverts r124752.
There's no reason this should be different. It resulted in needing NO_PIE in
the original opt-out NO_PIE commit as this was not using the proper framework.
Reported by: peter
1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
where it never would work anyhow, such as csu or loader. This suggests
there may be better ways of adding support to the tree. Many of these
cases can be fixed such that -fPIE will work but there is really no
reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
really building libraries but have been using bsd.prog.mk because the code
is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
been needed.
We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.
Reported by: kib
This includes:
o All directories named *ia64*
o All files named *ia64*
o All ia64-specific code guarded by __ia64__
o All ia64-specific makefile logic
o Mention of ia64 in comments and documentation
This excludes:
o Everything under contrib/
o Everything under crypto/
o sys/xen/interface
o sys/sys/elf_common.h
Discussed at: BSDcan
This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.
Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]
Mark known build failures as NO_PIE for now.
The only known runtime failure was rtld.
[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by: Shawn Webb <lattera@gmail.com>
Discussed between: des@ and Shawn Webb [2]
for. This is useful for software needing to know which architecture a
binary is built for as arm and armv6 have slight differences meaning only
some binaries build for one will work as expected on the other. It is
expected pkgng will be able to make use of this to simplify the logic to
determine which package ABI to use.
Approved by: re (kib)
This compiler flag enforces that that people either mark variables
static or use an external declarations for the variable, similar to how
-Wmissing-prototypes works for functions.
Due to the fact that Yacc/Lex generate code that cannot trivially be
changed to not warn because of this (lots of yy* variables), add a
NO_WMISSING_VARIABLE_DECLARATIONS that can be used to turn off this
specific compiler warning.
Announced on: toolchain@
Preloaded library could have changed the environment, and
unconditional assingment to the environ undoes the customization.
The binaries needs to be recompiled to get the fix.
Move the common code to set up environ and __progname into the helper.
Note that ia64 possibly not fixed, due to it still using old csu.
Reported and tested by: John Hein <jhein@symmetricom.com>
Reviewed by: kan, scf
Approved by: secteam (simon)
MFC after: 2 weeks
way: first they are compiled to assembly, then some sed'ing is done on
the assembly, and lastly the assembly is compiled to an object file.
This last step is done using ${CC}, and not ${AS}, because when the
compiler is clang, it outputs directives that are too advanced for our
old gas. So we use clang's integrated assembler instead. (When the
compiler is gcc, it just calls gas, and nothing is different, except one
extra fork.)
However, in the .s to .o rules in lib/csu/$ARCH/Makefile, I still passed
CFLAGS to the compiler, instead of ACFLAGS, which are specifically for
compiling .s files.
In case you are using '-g' for debug info anywhere in your CFLAGS, it
causes the .s files to already contain debug information in the assembly
itself. In the next step, the .s files are also compiled using '-g',
and if the compiler is clang, it complains: "error: input can't have
.file dwarf directives when -g is used to generate dwarf debug info for
assembly code".
Fix this by using ${ACFLAGS} for compiling the .s files instead.
Reported by: jasone
MFC after: 1 week
properly reloaded when calling _fini() in large binaries with multiple
TOC sections (e.g. GCC), leading to a segmentation fault. Adding -mlongcall
to crt1 flags causes the compiler to emit explicit TOC load instructions
for all function calls, including _fini().
Reviewed by: kib
Pointy hat to: kib
call preinit, init and fini arrays methods from crt1 for static binaries.
Mark new crt1 with FreeBSD-specific ELF note.
Move some common crt1 code into new MI file ignore_init.c, to reduce
duplication. Also, conservatively adjust nearby sources for style.
Reviewed by: kan
Tested by: andrew (arm), flo (sparc64)
MFC after: 3 weeks
generated from lib/csu/common/crtbrand.c (which ultimately ends up in
executables and shared libraries, via crt1.o, gcrt1.o or Scrt1.o).
For all arches except sparc, gcc emits the section directive for the
abitag struct in crtbrand.c with a PROGBITS type. However, newer
versions of binutils (after 2.16.90) require the section to be of NOTE
type, to guarantee that the .note.ABI-tag section correctly ends up in
the first page of the final executable.
Unfortunately, there is no clean way to tell gcc to use another section
type, so crtbrand.c (or the C files that include it) must be compiled in
multiple steps:
- Compile the .c file to a .s file.
- Edit the .s file to change the 'progbits' type to 'note', for the section
directive that defines the .note.ABI-tag section.
- Compile the .s file to an object file.
These steps are done in the invididual Makefiles for each applicable arch.
Reviewed by: kib
in crt1.o. On other architectures crtbrand.c is included from crt1.c,
but that's not a C source code file on ia64. Instead it is compiled
separately and included in crt1.o using incremental linking.
Tested by: dim (previous version)
Approved by: kib (mentor)
Scrt1_c.o was accidentally compiled with -DGCRT (profiling), like gcrt1_c.o.
This problem is i386-specific, the other architectures are OK.
If you have problems with PIE executables such as samba and cups leaving
behind gmon files, rebuild them after installing this change.
PR: ports/143924
Reviewed by: kib
MFC after: 3 days
Similar to libexec/, do the same with lib/. Make WARNS=6 the norm and
lower it when needed.
I'm setting WARNS?=0 for secure/. It seems secure/ includes the
Makefile.inc provided by lib/. I'm not going to touch that directory.
Most of the code there is contributed anyway.
Scrt1.o instead of crt1.o, since the later is built as non-PIC.
Separate i386-elf crt1.c into the pure assembler part and C code,
supplying all data extracted by assembler stub as explicit parameters [1].
Hide and localize _start1 symbol used as an interface between asm and
C code.
In collaboration with: kan
Inspired by: PR i386/127387 [1]
Prodded and tested by: rdivacky [1]
MFC after: 3 weeks
For gcc' __builtin_frame_address() to work, all call frames need to save
frame pointer. In particular, this is important for the upper frame that
should terminate the chain.
No objections from: jhb
PR: amd64/126543
MFC after: 1 week
- It is opt-out for now so as to give it maximum testing, but it may be
turned opt-in for stable branches depending on the consensus. You
can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
It is harmless to steal the knob as SSP symbols have been provided
by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
(sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
libc will be automatically downgraded to -fstack-protector because it
breaks rtld otherwise.
- This option is unavailable on ia64.
Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.
Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
in 1993 in rev.1.5 of the i386 a.out version (csu/i386/crt0.c).
Profiling uses a magic label "eprol" to delimit the start of the part
of the text section covered by profiling. This label must be placed
before the call to main() to get main() properly profiled. It was
placed there in rev.1.1 of crt0.c. Rev.1.5 imported the initial
implementation of shared libraries in FreeBSD and misplaced the label.
Fortunately, the misplaced label was misspelled and the old label
wasn't removed, so the new label had no effect. Unfortunately, when
profiling was implemented for the ELF in 1998 in rev.1.2 of
csu/i386-elf/crt1.c, only the incorrectly placed label was copied
(after fixing its name). The bug was then copied to all other arches.
The label seems to be still misplaced in NetBSD for most arches. It
is in common.c for most arches so it is even further from being inside
the function that calls main().
I think "eprol" is short for "end of prologue", but it must be placed
before the end of the prologue so that it covers main(). crt0.c has
it before the calls atexit(_mcleanup) and monstartup(...), but it
cannot affect these calls so I moved it after the call to monstartup().
It now also covers the call to _init() but not the newer call to
_init_tls(). Profiling of _init() seems to be harmless, and the call
to _init_tls() seems to be misplaced.
Reviewed by: jdp (long ago, for a slightly different i386 version)
