This effectively reverts r124752.
There's no reason this should be different. It resulted in needing NO_PIE in
the original opt-out NO_PIE commit as this was not using the proper framework.
Reported by: peter
1. 50+% of NO_PIE use is fixed by adding -fPIC to INTERNALLIB and other
build-only utility libraries.
2. Another 40% is fixed by generating _pic.a variants of various libraries.
3. Some of the NO_PIE use is a bit absurd as it is disabling PIE (and ASLR)
where it never would work anyhow, such as csu or loader. This suggests
there may be better ways of adding support to the tree. Many of these
cases can be fixed such that -fPIE will work but there is really no
reason to have it in those cases.
4. Some of the uses are working around hacks done to some Makefiles that are
really building libraries but have been using bsd.prog.mk because the code
is cleaner. Had they been using bsd.lib.mk then NO_PIE would not have
been needed.
We likely do want to enable PIE by default (opt-out) for non-tree consumers
(such as ports). For in-tree though we probably want to only enable PIE
(opt-in) for common attack targets such as remote service daemons and setuid
utilities. This is also a great performance compromise since ASLR is expected
to reduce performance. As such it does not make sense to enable it in all
utilities such as ls(1) that have little benefit to having it enabled.
Reported by: kib
This includes:
o All directories named *ia64*
o All files named *ia64*
o All ia64-specific code guarded by __ia64__
o All ia64-specific makefile logic
o Mention of ia64 in comments and documentation
This excludes:
o Everything under contrib/
o Everything under crypto/
o sys/xen/interface
o sys/sys/elf_common.h
Discussed at: BSDcan
This is currently an opt-in build flag. Once ASLR support is ready and stable
it should changed to opt-out and be enabled by default along with ASLR.
Each application Makefile uses opt-out to ensure that ASLR will be enabled by
default in new directories when the system is compiled with PIE/ASLR. [2]
Mark known build failures as NO_PIE for now.
The only known runtime failure was rtld.
[1] http://www.bsdcan.org/2014/schedule/events/452.en.html
Submitted by: Shawn Webb <lattera@gmail.com>
Discussed between: des@ and Shawn Webb [2]
for. This is useful for software needing to know which architecture a
binary is built for as arm and armv6 have slight differences meaning only
some binaries build for one will work as expected on the other. It is
expected pkgng will be able to make use of this to simplify the logic to
determine which package ABI to use.
Approved by: re (kib)
This compiler flag enforces that that people either mark variables
static or use an external declarations for the variable, similar to how
-Wmissing-prototypes works for functions.
Due to the fact that Yacc/Lex generate code that cannot trivially be
changed to not warn because of this (lots of yy* variables), add a
NO_WMISSING_VARIABLE_DECLARATIONS that can be used to turn off this
specific compiler warning.
Announced on: toolchain@
Preloaded library could have changed the environment, and
unconditional assingment to the environ undoes the customization.
The binaries needs to be recompiled to get the fix.
Move the common code to set up environ and __progname into the helper.
Note that ia64 possibly not fixed, due to it still using old csu.
Reported and tested by: John Hein <jhein@symmetricom.com>
Reviewed by: kan, scf
Approved by: secteam (simon)
MFC after: 2 weeks
way: first they are compiled to assembly, then some sed'ing is done on
the assembly, and lastly the assembly is compiled to an object file.
This last step is done using ${CC}, and not ${AS}, because when the
compiler is clang, it outputs directives that are too advanced for our
old gas. So we use clang's integrated assembler instead. (When the
compiler is gcc, it just calls gas, and nothing is different, except one
extra fork.)
However, in the .s to .o rules in lib/csu/$ARCH/Makefile, I still passed
CFLAGS to the compiler, instead of ACFLAGS, which are specifically for
compiling .s files.
In case you are using '-g' for debug info anywhere in your CFLAGS, it
causes the .s files to already contain debug information in the assembly
itself. In the next step, the .s files are also compiled using '-g',
and if the compiler is clang, it complains: "error: input can't have
.file dwarf directives when -g is used to generate dwarf debug info for
assembly code".
Fix this by using ${ACFLAGS} for compiling the .s files instead.
Reported by: jasone
MFC after: 1 week
properly reloaded when calling _fini() in large binaries with multiple
TOC sections (e.g. GCC), leading to a segmentation fault. Adding -mlongcall
to crt1 flags causes the compiler to emit explicit TOC load instructions
for all function calls, including _fini().
Reviewed by: kib
Pointy hat to: kib
call preinit, init and fini arrays methods from crt1 for static binaries.
Mark new crt1 with FreeBSD-specific ELF note.
Move some common crt1 code into new MI file ignore_init.c, to reduce
duplication. Also, conservatively adjust nearby sources for style.
Reviewed by: kan
Tested by: andrew (arm), flo (sparc64)
MFC after: 3 weeks
generated from lib/csu/common/crtbrand.c (which ultimately ends up in
executables and shared libraries, via crt1.o, gcrt1.o or Scrt1.o).
For all arches except sparc, gcc emits the section directive for the
abitag struct in crtbrand.c with a PROGBITS type. However, newer
versions of binutils (after 2.16.90) require the section to be of NOTE
type, to guarantee that the .note.ABI-tag section correctly ends up in
the first page of the final executable.
Unfortunately, there is no clean way to tell gcc to use another section
type, so crtbrand.c (or the C files that include it) must be compiled in
multiple steps:
- Compile the .c file to a .s file.
- Edit the .s file to change the 'progbits' type to 'note', for the section
directive that defines the .note.ABI-tag section.
- Compile the .s file to an object file.
These steps are done in the invididual Makefiles for each applicable arch.
Reviewed by: kib
in crt1.o. On other architectures crtbrand.c is included from crt1.c,
but that's not a C source code file on ia64. Instead it is compiled
separately and included in crt1.o using incremental linking.
Tested by: dim (previous version)
Approved by: kib (mentor)
Scrt1_c.o was accidentally compiled with -DGCRT (profiling), like gcrt1_c.o.
This problem is i386-specific, the other architectures are OK.
If you have problems with PIE executables such as samba and cups leaving
behind gmon files, rebuild them after installing this change.
PR: ports/143924
Reviewed by: kib
MFC after: 3 days
Similar to libexec/, do the same with lib/. Make WARNS=6 the norm and
lower it when needed.
I'm setting WARNS?=0 for secure/. It seems secure/ includes the
Makefile.inc provided by lib/. I'm not going to touch that directory.
Most of the code there is contributed anyway.
Scrt1.o instead of crt1.o, since the later is built as non-PIC.
Separate i386-elf crt1.c into the pure assembler part and C code,
supplying all data extracted by assembler stub as explicit parameters [1].
Hide and localize _start1 symbol used as an interface between asm and
C code.
In collaboration with: kan
Inspired by: PR i386/127387 [1]
Prodded and tested by: rdivacky [1]
MFC after: 3 weeks
For gcc' __builtin_frame_address() to work, all call frames need to save
frame pointer. In particular, this is important for the upper frame that
should terminate the chain.
No objections from: jhb
PR: amd64/126543
MFC after: 1 week
- It is opt-out for now so as to give it maximum testing, but it may be
turned opt-in for stable branches depending on the consensus. You
can turn it off with WITHOUT_SSP.
- WITHOUT_SSP was previously used to disable the build of GNU libssp.
It is harmless to steal the knob as SSP symbols have been provided
by libc for a long time, GNU libssp should not have been much used.
- SSP is disabled in a few corners such as system bootstrap programs
(sys/boot), process bootstrap code (rtld, csu) and SSP symbols themselves.
- It should be safe to use -fstack-protector-all to build world, however
libc will be automatically downgraded to -fstack-protector because it
breaks rtld otherwise.
- This option is unavailable on ia64.
Enable GCC stack protection (aka Propolice) for kernel:
- It is opt-out for now so as to give it maximum testing.
- Do not compile your kernel with -fstack-protector-all, it won't work.
Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
in 1993 in rev.1.5 of the i386 a.out version (csu/i386/crt0.c).
Profiling uses a magic label "eprol" to delimit the start of the part
of the text section covered by profiling. This label must be placed
before the call to main() to get main() properly profiled. It was
placed there in rev.1.1 of crt0.c. Rev.1.5 imported the initial
implementation of shared libraries in FreeBSD and misplaced the label.
Fortunately, the misplaced label was misspelled and the old label
wasn't removed, so the new label had no effect. Unfortunately, when
profiling was implemented for the ELF in 1998 in rev.1.2 of
csu/i386-elf/crt1.c, only the incorrectly placed label was copied
(after fixing its name). The bug was then copied to all other arches.
The label seems to be still misplaced in NetBSD for most arches. It
is in common.c for most arches so it is even further from being inside
the function that calls main().
I think "eprol" is short for "end of prologue", but it must be placed
before the end of the prologue so that it covers main(). crt0.c has
it before the calls atexit(_mcleanup) and monstartup(...), but it
cannot affect these calls so I moved it after the call to monstartup().
It now also covers the call to _init() but not the newer call to
_init_tls(). Profiling of _init() seems to be harmless, and the call
to _init_tls() seems to be misplaced.
Reviewed by: jdp (long ago, for a slightly different i386 version)
that use SSE. The compiler does attempt to do this in main() but not very
successfully - it still manages to use unaligned offsets from %ebp in some
cases. Also we need to have an aligned stack in case something uses SSE
via _init().
MFC After: 1 week
GP register, because it's clobbered for calls across load modules. The
previous commit inserted the call to _init_tls() between the call to
atexit() and the restoration of the GP register clobbered by it. Fix:
restore GP before we call _init_tls().
Pointy hat: dfr@
section alignnment of 16 bytes for amd64 and this breaks file(1).
Before:
./cp: ELF 64-bit LSB executable, AMD x86-64, version 1 (FreeBSD), for \
FreeBSD 127.7.9, statically linked, stripped
after: ^^^^^^^
./ls: ELF 64-bit LSB executable, AMD x86-64, version 1 (FreeBSD), for \
FreeBSD 5.0.1, dynamically linked (uses shared libs), stripped
The reason for this is that the NOTE sections are not contiguous
internally. If the note section has an alignment of 16, then anything
that looks for the data is supposed to round up the payload start to
the next multiple of the alignment. But FreeBSD/amd64 broke because the
structure is declared as a single structure, not a (header,payload) group,
where the payload had an explicit alignment roundup.
The alternative is to change things like file(1) to ignore the ELF payload
alignment rules for the PT_NOTE section only for FreeBSD.
don't call it according to the runtime specification and especially
WRT to gp this can cause trouble. The gcc 3.3.1 import broke the
ia64 runtime because the compiler saved gp prior to us being able
to set it properly. Restoring gp after the calls would then invalidate
gp and cause segmentation faults later on.
By rewriting _start() as an assembly function, we also avoided even
more gcc dependences, by trying to use gcc specific features to work
around the problem.
This version of _start() does not reference _DYNAMIC. We register the
cleanup function when it's a non-NULL pointer. The kernel will always
pass a NULL pointer and dynamic linkers may pass a non-NULL pointer.
The machine independent code to set __progname now unfortunately is
written in assembly. So be it.
- -elf in CFLAGS had no effect except to reduce portability.
- -elf in LDFLAGS had even less effect, since LDFLAGS is not used.
- -Wall in CFLAGS had no effect except to reduce portability and break
overriding of WARNS, since the setting of WARNS implies -Wall.
since it has been MFC'ed. See the log message for the previous commit
for more details. The alignment bug in gcc-3 has not been fixed, but
it is not very serious and the previous commit just moved it (as intended).
Approved by: re (murray)
-fomit-frame-pointer is not used). This is mostly moot for -current
because gcc-3 does the alignment (slightly incorrectly) in main().
This patch is intended for easy MFC'ing and should be backed out in
-current soon since it causes compiler warnings and better fixes are
possible in -current. The best fix is to do nothing here and wait for
gcc to do stack alignment right. gcc-3 aligns the stack in main(), but
does it too late for main()'s local variables and too late for anything
called before main(). A misaligned stack is now more than an efficiency
problem, since some SSE instructions in some or all (hardware)
implementations trap on misaligned operands even if alignment checking
is not enabled.
PR: 41528:
Submitted by: NIIMI Satoshi <sa2c@sa2c.net> (original version)
MFC after: 3 days
Assembler macros are tidied up and made as similar as sanely possible.
The macros are translated into C (__inline static) functions for lint.
Declaration orders are made the same.
Declarations are all ISOfied and tidied up.
Comment contents have gratuitous diffs removed.
The net result is a bunch of crt1.c's that are 90% the same.
It may be possible to now encapsulate the differences in one
MD header, and have only one MI crt1.c file (although the macros
to do this may be ugly).
Helpful comments by: obrien, bde
Alpha tested by: des
i386-elf tested by: markm
Get rid of the INTERNALSTATICLIB knob and just use plain INTERNALLIB.
INTERNALLIB now means to build static library only and don't install
anything. Added a NOINSTALLLIB knob for libpam/modules. To not
build any library at all, just do not set LIB.
