6 ms·

Why duplicate the efforts of valgrind and address sanitizer?

irdc 4y ago
This is available by default and integrates with existing tools (notably ktrace), making it easier to detect memory leaks on all platforms OpenBSD supports.
avar 4y ago
Both of those are very useful, but slow, especially valgrind. I don't know OpenBSD, but presumably this is analogous to glibc's relatively faster memory sanity checking. For GCC and clang you'd also want LSAN for this, not ASAN. ASAN is more accurate for edge cases, but much slower. "Slow" here means that even for development the runtime can be prohibitively expensive. E.g. I regularly run git's test suite, optimized/LSAN/ASAN/valgrind runtime is on the order of 3m/15m/30m/24 hours. The basic glibc sanity checking only adds a minute or two to the optimized run. An advantage of any malloc based detection is also that you can run it on any existing binary. Whereas the likes of LSAN and ASAN require a custom debugging build (or to have that tracing overhead present in your production build).
Someone 4y ago
In addition to what others said, Valgrind is GPL-licensed. That conflicts with the OpenBSD copyright policy (https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html), which says: “The GNU Public License and licenses modeled on it impose the restriction that source code must be distributed or made available for all works that are derivatives of the GNU copyrighted code. While this may superficially look like a noble strategy, it is a condition that is typically unacceptable for commercial use of software. So in practice, it usually ends up hindering free sharing and reuse of code and ideas rather than encouraging it. As a consequence, no additional software bound by the GPL terms will be considered for inclusion into the OpenBSD base system.” As to clang’s Address Sanitizer, that’s under the Apache License v2.0 with LLVM Exceptions (https://github.com/google/sanitizers/blob/master/LICENSE.TXT https://github.com/google/sanitizers/blob/master/LICENSE.TXT), of which the same page says: “The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent.”
- jmclnx 4y ago
  True, but I think having this check in the kernel may work better than valgrind on Linux. With that said, valgrind works great and I like its output, time will tell if I will like the output from this OpenBSD change.
- alberth 4y ago
  I had no idea that OpenBSD didn't accept Apache 2 code https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
  - asveikau 4y ago
    They maintained apache 1.x in base for a long time. For a small number of releases they switched to nginx and then i think they wrote their own.
    - whydoyoucare 4y ago
      Yes, httpd. https://man.openbsd.org/httpd.8 https://man.openbsd.org/httpd.8
    - maximilianburke 4y ago
      Parent is referring to the Apache 2 license, not version 2 of the Apache HTTPD server.
      - nequo 4y ago
        I think that’s what your parent is saying too. The last non-Apache-2-licensed version of the Apache HTTP server was version 1.3.x, and because the OpenBSD project did not accept the Apache 2 license, they forked the Apache HTTP server’s 1.3.x code base.
      - asveikau 4y ago
        It's not coincidental. It was early in the Apache 2.0 lifecycle that the Apache License 2.0 came about (google says 2.0.49). OpenBSD's continued maintenance of a 1.x fork from 2004-2011 or so was mainly about licensing.

irdc 4y ago

This is available by default and integrates with existing tools (notably ktrace), making it easier to detect memory leaks on all platforms OpenBSD supports.

avar 4y ago

Both of those are very useful, but slow, especially valgrind. I don't know OpenBSD, but presumably this is analogous to glibc's relatively faster memory sanity checking. For GCC and clang you'd also want LSAN for this, not ASAN. ASAN is more accurate for edge cases, but much slower. "Slow" here means that even for development the runtime can be prohibitively expensive. E.g. I regularly run git's test suite, optimized/LSAN/ASAN/valgrind runtime is on the order of 3m/15m/30m/24 hours. The basic glibc sanity checking only adds a minute or two to the optimized run. An advantage of any malloc based detection is also that you can run it on any existing binary. Whereas the likes of LSAN and ASAN require a custom debugging build (or to have that tracing overhead present in your production build).

Someone 4y ago

In addition to what others said, Valgrind is GPL-licensed. That conflicts with the OpenBSD copyright policy (https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html), which says: “The GNU Public License and licenses modeled on it impose the restriction that source code must be distributed or made available for all works that are derivatives of the GNU copyrighted code. While this may superficially look like a noble strategy, it is a condition that is typically unacceptable for commercial use of software. So in practice, it usually ends up hindering free sharing and reuse of code and ideas rather than encouraging it. As a consequence, no additional software bound by the GPL terms will be considered for inclusion into the OpenBSD base system.” As to clang’s Address Sanitizer, that’s under the Apache License v2.0 with LLVM Exceptions (https://github.com/google/sanitizers/blob/master/LICENSE.TXT https://github.com/google/sanitizers/blob/master/LICENSE.TXT), of which the same page says: “The original Apache license was similar to the Berkeley license, but source code published under version 2 of the Apache license is subject to additional restrictions and cannot be included into OpenBSD. In particular, if you use code under the Apache 2 license, some of your rights will terminate if you claim in court that the code violates a patent.”

jmclnx 4y ago
True, but I think having this check in the kernel may work better than valgrind on Linux. With that said, valgrind works great and I like its output, time will tell if I will like the output from this OpenBSD change.
alberth 4y ago
I had no idea that OpenBSD didn't accept Apache 2 code https://www.openbsd.org/policy.html https://www.openbsd.org/policy.html
- asveikau 4y ago
  They maintained apache 1.x in base for a long time. For a small number of releases they switched to nginx and then i think they wrote their own.
  - whydoyoucare 4y ago
    Yes, httpd. https://man.openbsd.org/httpd.8 https://man.openbsd.org/httpd.8
  - maximilianburke 4y ago
    Parent is referring to the Apache 2 license, not version 2 of the Apache HTTPD server.
    - nequo 4y ago
      I think that’s what your parent is saying too. The last non-Apache-2-licensed version of the Apache HTTP server was version 1.3.x, and because the OpenBSD project did not accept the Apache 2 license, they forked the Apache HTTP server’s 1.3.x code base.
    - asveikau 4y ago
      It's not coincidental. It was early in the Apache 2.0 lifecycle that the Apache License 2.0 came about (google says 2.0.49). OpenBSD's continued maintenance of a 1.x fork from 2004-2011 or so was mainly about licensing.