From owner-freebsd-arch@FreeBSD.ORG Thu Oct 16 22:37:31 2014 Return-Path: Delivered-To: freebsd-arch@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8D585A05 for ; Thu, 16 Oct 2014 22:37:31 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 67799B12 for ; Thu, 16 Oct 2014 22:37:31 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.9/8.14.9) with ESMTP id s9GMbUkL058311 for ; Thu, 16 Oct 2014 22:37:30 GMT (envelope-from bdrewery@freefall.freebsd.org) Received: (from bdrewery@localhost) by freefall.freebsd.org (8.14.9/8.14.9/Submit) id s9GMbUuO058306 for freebsd-arch@freebsd.org; Thu, 16 Oct 2014 22:37:30 GMT (envelope-from bdrewery) Received: (qmail 93505 invoked from network); 16 Oct 2014 17:37:28 -0500 Received: from unknown (HELO ?10.10.0.24?) (freebsd@shatow.net@10.10.0.24) by sweb.xzibition.com with ESMTPA; 16 Oct 2014 17:37:28 -0500 Message-ID: <5440489F.3080602@FreeBSD.org> Date: Thu, 16 Oct 2014 17:37:19 -0500 From: Bryan Drewery Organization: FreeBSD User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: Shawn Webb , Jeremie Le Hen Subject: Re: PIE/PIC support on base References: In-Reply-To: OpenPGP: id=6E4697CF; url=http://www.shatow.net/bryan/bryan2.asc Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="6Tb6gTjdRxSCIkUiVFqTJCoctTLJg4Jju" Cc: hunger@hunger.hu, David Carlier , Oliver Pinter , Sean Bruno , Konstantin Belousov , freebsd-arch@freebsd.org, PaX Team X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Oct 2014 22:37:31 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6Tb6gTjdRxSCIkUiVFqTJCoctTLJg4Jju Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 10/16/2014 5:15 PM, Shawn Webb wrote: >=20 >=20 > On Thu, Oct 16, 2014 at 5:59 PM, Jeremie Le Hen > wrote: >=20 > On Thu, Oct 16, 2014 at 8:21 PM, David Carlier > > wrote: > > > > I chose the "atomic" approach, at the moment very few binaries ar= e > > concerned at the moment. So I applied INCLUDE_PIC_ARCHIVE in the = needed > > libraries plus created WITH_PIE which add fPIE/fpie -pie flags on= ly if you > > include > (which include= > >...) otherwise other > > binaries include > as usual henc= e does not apply. Look > > reasonable approach ? >=20 > I think I understand what you mean. But I think PIE is commonplace= > nowadays and I don't understand what you win by not enabling it for= > the whole system. Is it a performance concern? Is it to preserve > conservative minds from to much change? :) >=20 >=20 > Looping in Kostik, Bryan Drewery, the PaX team, Hunger, and Sean Bruno.= >=20 > On i386, there is a performance cost due to not having an extra registe= r > available for the relocation work that has to happen. PIE doesn't carry= > much of a performance penalty on amd64, though it still does carry some= > on first resolution of functions (due to the extra relocation step the > RTLD has to worry about). On amd64, after symbol resolution has taken > place, there is no further performance penalty due to amd64 having an > extra register to use for PIE/PIC. I'm unsure what, if any, performance= > penalty PIE carries on ARM, AArch64, and sparc64. >=20 I think if the performance impact can be well understood on all architectures, and that it is not more than a few % points, other people may be more willing to enable it on all. I can't speak for them, but if the impact is not significant then it is safer and simpler to enable everywhere and I would think that argument would win over anything else. What do I know though? That approach failed already. > Certain folk would prefer to see PIE enabled only in certain > applications. /bin/ls can't really make much use of PIE. But sshd can. = I > personally would like to see all of base's applications compiled as > PIEs, but that's a long ways off. It took OpenBSD several years to > accomplish that. Having certain high-visibility applications (like sshd= , > inetd, etc) is a great start. Providing a framework for application > developers to opt their application into PIE is another great start. >=20 > Those are my two cents. >=20 > Thanks, >=20 > Shawn=20 --=20 Regards, Bryan Drewery --6Tb6gTjdRxSCIkUiVFqTJCoctTLJg4Jju Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iQEcBAEBAgAGBQJUQEifAAoJEDXXcbtuRpfPGpcH/i2FCR+S5iFns4VqxcxupJRB Fx5Me/j1l8WPOIjnsCDAa6Ojz178YuaTl7SCAPSrCG7+NE0X1XpSmeqMXzx4TSZu IbxgMVQnHrgR0Wde02l0chStIRBPZs8RrOis8QvfrRtWKelSLe1swkSNguAR4onE xD6XpbOsM5/Kl1lwde9WAkL0/20vjuChl5k0FHEJNWifImiwz+5t5/NRpxYKX8en dph8Ownh0Iskp1Wl/2qVh7yOtl5rcOqKrSGb0+WPxfjowXMVx6C91xKQtmqLxaAg GFVArVU3hsWjxzrxhgLD2K/M4OJXy6Iy8/Jkr0pY/dDlqy/2T3iTWBCF5yiVMPA= =/Lxy -----END PGP SIGNATURE----- --6Tb6gTjdRxSCIkUiVFqTJCoctTLJg4Jju--