Split early startup code out of locore.S into locore0.S. Adjust link

run so that this locore0.o is always at the start of the executable.
But randomize the link order of all other .o files in the kernel, so
that their exec/rodata/data/bss segments land all over the place.

As a result, the internal layout of every newly build bsd kernel is
different from past kernels.  Internal relative offsets are not known
to an outside attacker.  The only known offsets are in the startup code
(which will be gone when it is smashed).

The bootstrap code unmapping or smashing isn't done yet, and there is
some potential for more bits from locore.S to move to locore0.S

4 files changed, 164 insertions, 88 deletions

diff --git a/sys/arch/macppc/conf/Makefile.macppc b/sys/arch/macppc/conf/Makefile.macppc
index a5edef7ea7a..3a827ddf541 100644
--- a/sys/arch/macppc/conf/Makefile.macppc
+++ b/sys/arch/macppc/conf/Makefile.macppc
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile.macppc,v 1.82 2017/06/11 22:51:21 deraadt Exp $
+#	$OpenBSD: Makefile.macppc,v 1.83 2017/06/13 01:44:27 deraadt Exp $
 
 # For instructions on building kernels consult the config(8) and options(4)
 # manual pages.
@@ -31,9 +31,13 @@ CMACHFLAGS=	-msoft-float -Wa,-many
 CMACHFLAGS+=	-fno-builtin-printf -fno-builtin-snprintf \
 		-fno-builtin-vsnprintf -fno-builtin-log \
 		-fno-builtin-log2 -fno-builtin-malloc ${NOPIE_FLAGS}
+SORTR=		sort -R
 .if ${IDENT:M-DNO_PROPOLICE}
 CMACHFLAGS+=	-fno-stack-protector
 .endif
+.if ${IDENT:M-DSMALL_KERNEL}
+SORTR=		cat
+.endif
 
 DEBUG?=		-g
 COPTS?=		-O2
@@ -67,13 +71,14 @@ NORMAL_S=	${CC} ${AFLAGS} ${CPPFLAGS} -c $<
 #	${SYSTEM_LD_HEAD}
 #	${SYSTEM_LD} swapxxx.o
 #	${SYSTEM_LD_TAIL}
-SYSTEM_HEAD=	locore.o param.o ioconf.o
-SYSTEM_OBJ=	${SYSTEM_HEAD} ${OBJS}
-SYSTEM_DEP=	Makefile ${SYSTEM_OBJ}
+SYSTEM_HEAD=	locore0.o gap.o
+SYSTEM_OBJ=	${SYSTEM_HEAD} ${OBJS} param.o ioconf.o
+SYSTEM_DEP=	Makefile ${SYSTEM_OBJ} ld.script
 SYSTEM_LD_HEAD=	@rm -f $@
 SYSTEM_LD=	@echo ${LD} ${LINKFLAGS} -o $@ '$${SYSTEM_HEAD} vers.o $${OBJS}'; \
 		umask 007; \
-		${LD} ${LINKFLAGS} -o $@ ${SYSTEM_HEAD} vers.o ${OBJS}
+		echo ${OBJS} param.o ioconf.o vers.o | tr " " "\n" | ${SORTR} > lorder; \
+		${LD} ${LINKFLAGS} -o $@ ${SYSTEM_HEAD} `cat lorder`
 SYSTEM_LD_TAIL=	@${SIZE} $@
 
 .if ${DEBUG} == "-g"
@@ -88,6 +93,12 @@ LINKFLAGS+=	-S
 
 %LOAD
 
+newbsd:
+	${SYSTEM_LD_HEAD}
+	${SYSTEM_LD} swapgeneric.o
+	${SYSTEM_LD_TAIL}
+	mv -f newbsd bsd
+
 # cc's -MD puts the source and output paths in the dependency file;
 # since those are temp files here we need to fix it up.  It also
 # puts the file in /tmp, so we use -MF to put it in the current
@@ -113,12 +124,22 @@ mcount.o: $S/lib/libkern/mcount.c Makefile
 ioconf.o: ioconf.c
 	${NORMAL_C}
 
+ld.script: ${_machdir}/conf/ld.script
+	cp ${_machdir}/conf/ld.script $@
+
 vers.o: ${SYSTEM_DEP:Ngap.o} ${SYSTEM_SWAP_DEP}
 	sh $S/conf/newvers.sh
 	${CC} ${CFLAGS} ${CPPFLAGS} ${PROF} -c vers.c
 
+gap.S:	${SYSTEM_SWAP_DEP} Makefile
+	umask 007; sh $S/conf/makegap.sh 0xcc > gap.S
+
+gap.o:	gap.S
+	umask 007; ${CC} ${AFLAGS} ${CPPFLAGS} ${PROF} -c gap.S
+
 clean:
-	rm -f *bsd *bsd.gdb *.[dio] [a-z]*.s assym.* ${DB_STRUCTINFO} param.c
+	rm -f *bsd *bsd.gdb *.[dio] [a-z]*.s assym.* ${DB_STRUCTINFO} \
+	    gap.S lorder param.c
 
 cleandir: clean
 	rm -f Makefile *.h ioconf.c options machine ${_mach} vers.c
@@ -130,6 +151,7 @@ db_structinfo.h: $S/ddb/db_structinfo.c $S/ddb/parse_structinfo.pl
 	objdump -g db_structinfo.o | perl $S/ddb/parse_structinfo.pl > $@
 	rm -f db_structinfo.o
 
+locore0.o: ${_machdir}/${_mach}/locore0.S assym.h
 locore.o: ${_machdir}/${_mach}/locore.S assym.h
 mutex.o: assym.h
 
diff --git a/sys/arch/macppc/conf/files.macppc b/sys/arch/macppc/conf/files.macppc
index de66b63c4fe..f237bd0295a 100644
--- a/sys/arch/macppc/conf/files.macppc
+++ b/sys/arch/macppc/conf/files.macppc
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.macppc,v 1.87 2016/05/20 21:45:04 mglocker Exp $
+#	$OpenBSD: files.macppc,v 1.88 2017/06/13 01:44:27 deraadt Exp $
 
 #
 # macppc-specific configuration info
@@ -17,6 +17,7 @@ file	arch/macppc/macppc/mem.c
 file	arch/macppc/macppc/ofw_machdep.c
 file	arch/macppc/macppc/openfirm.c
 file	arch/macppc/macppc/openprom.c
+file	arch/macppc/macppc/locore.o
 file	dev/cninit.c
 file	arch/macppc/macppc/ofwreal.S
 
diff --git a/sys/arch/macppc/macppc/locore.S b/sys/arch/macppc/macppc/locore.S
index ce18aaf1f2b..305b24b9fe3 100644
--- a/sys/arch/macppc/macppc/locore.S
+++ b/sys/arch/macppc/macppc/locore.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: locore.S,v 1.55 2016/05/23 20:11:49 deraadt Exp $	*/
+/*	$OpenBSD: locore.S,v 1.56 2017/06/13 01:44:29 deraadt Exp $	*/
 /*	$NetBSD: locore.S,v 1.2 1996/10/16 19:33:09 ws Exp $	*/
 
 /*
@@ -48,87 +48,8 @@
 #define	SPILLSTK	(1*1024)
 #define	DDBSTK		(7*1024)
 
-/*
- * Globals
- */
-	.globl	_C_LABEL(esym),_C_LABEL(proc0paddr)
-	.type	_C_LABEL(esym),@object
-	.type	_C_LABEL(proc0paddr),@object
-	.data
-_C_LABEL(esym):		.long	0	/* end of symbol table */
-_C_LABEL(proc0paddr):	.long	0	/* proc0 p_addr */
-
-fwargsave:
-			.long 0
-			.long 0
-
-/*
- * Startup entry
- */
-_ENTRY(_C_LABEL(kernel_text))
-_ENTRY(_ASM_LABEL(start))
-/* arguments to start
- * r1 - stack provided by firmware/bootloader
- * r3 - unused
- * r4 - unused
- * r5 - firmware pointer (NULL for PPC1bug)
- * r6 - arg list
- * r7 - length
- */
-	.globl	start
-	.type start,@function
-start:
-	lis	%r3, fwargsave@ha
-	stw	%r6, fwargsave@l(%r3)
-	stw	%r7, fwargsave@l+4(%r3)
-	bl	ofw_init
-	li	%r0,0
-	mtmsr	%r0			/* Disable FPU/MMU/exceptions */
-	isync
+	.text
 
-/* compute end of kernel memory */
-	lis	%r8,_end@ha
-	addi	%r8,%r8,_end@l
-	lis	%r3, fwargsave@ha
-	lwz	%r6, fwargsave@l(%r3)
-	lwz	%r7, fwargsave@l+4(%r3)
-#if defined(DDB)
-	cmpwi	%r6, 0
-	beq	1f
-	add	%r9,%r6,%r7
-	lwz	%r9, -4(%r9)
-	cmpwi   %r9,0
-	beq	1f
-	lis	%r8,_C_LABEL(esym)@ha
-	stw	%r9,_C_LABEL(esym)@l(%r8)
-	mr	%r8, %r9
-1:
-#endif
-	li	%r9,PGOFSET
-	add	%r8,%r8,%r9
-	andc	%r8,%r8,%r9
-	lis	%r9,_C_LABEL(cpu_info)@ha
-	addi	%r9,%r9,_C_LABEL(cpu_info)@l
-	mtsprg	0,%r9
-	addi	%r8,%r8,INTSTK
-	stw	%r8,CI_INTSTK(%r9)
-	li	%r0,-1
-	stw	%r0,CI_INTRDEPTH(%r9)
-	addi	%r8,%r8,SPILLSTK+DDBSTK	/* leave room for spillstk and ddbstk */
-	lis	%r9,_C_LABEL(proc0paddr)@ha
-	stw	%r8,_C_LABEL(proc0paddr)@l(%r9)
-	addi	%r1,%r8,USPACE-FRAMELEN	/* stackpointer for proc0 */
-	mr	%r4,%r1			/* end of mem reserved for kernel */
-	li	%r0,0
-	stwu	%r0,-16(%r1)		/* end of stack chain */
-
-	lis	%r3,start@ha
-	addi	%r3,%r3,start@l
-	mr	%r5,%r6			/* args string */
-	bl	_C_LABEL(initppc)
-	bl	_C_LABEL(main)
-	b	_C_LABEL(OF_exit)
-
 #ifdef MULTIPROCESSOR
 _ENTRY(_C_LABEL(cpu_spinup_trampoline))
 	lis	%r3,_C_LABEL(cpu_hatch_stack)@ha
diff --git a/sys/arch/macppc/macppc/locore0.S b/sys/arch/macppc/macppc/locore0.S
new file mode 100644
index 00000000000..3bc89c2a441
--- /dev/null
+++ b/sys/arch/macppc/macppc/locore0.S
@@ -0,0 +1,132 @@
+/*	$OpenBSD: locore0.S,v 1.1 2017/06/13 01:44:29 deraadt Exp $	*/
+/*	$NetBSD: locore.S,v 1.2 1996/10/16 19:33:09 ws Exp $	*/
+
+/*
+ * Copyright (C) 1995, 1996 Wolfgang Solfrank.
+ * Copyright (C) 1995, 1996 TooLs GmbH.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by TooLs GmbH.
+ * 4. The name of TooLs GmbH may not be used to endorse or promote products
+ *    derived from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+ * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "assym.h"
+
+#include <sys/syscall.h>
+
+#include <machine/asm.h>
+#include <machine/param.h>
+#include <machine/pmap.h>
+#include <machine/psl.h>
+#include <machine/trap.h>
+
+#define GET_CPUINFO(r)	mfsprg r,0
+
+#define	INTSTK		(8*1024)	/* 8K interrupt stack */
+#define	SPILLSTK	(1*1024)
+#define	DDBSTK		(7*1024)
+
+/*
+ * Globals
+ */
+	.globl	_C_LABEL(esym),_C_LABEL(proc0paddr)
+	.type	_C_LABEL(esym),@object
+	.type	_C_LABEL(proc0paddr),@object
+	.data
+_C_LABEL(esym):		.long	0	/* end of symbol table */
+_C_LABEL(proc0paddr):	.long	0	/* proc0 p_addr */
+
+	.globl	fwargsave
+fwargsave:
+			.long 0
+			.long 0
+
+	.text
+/*
+ * Startup entry
+ */
+_ENTRY(_C_LABEL(kernel_text))
+_ENTRY(_ASM_LABEL(start))
+/* arguments to start
+ * r1 - stack provided by firmware/bootloader
+ * r3 - unused
+ * r4 - unused
+ * r5 - firmware pointer (NULL for PPC1bug)
+ * r6 - arg list
+ * r7 - length
+ */
+	.globl	start
+	.type start,@function
+start:
+	lis	%r3, fwargsave@ha
+	stw	%r6, fwargsave@l(%r3)
+	stw	%r7, fwargsave@l+4(%r3)
+	bl	ofw_init
+	li	%r0,0
+	mtmsr	%r0			/* Disable FPU/MMU/exceptions */
+	isync
+
+/* compute end of kernel memory */
+	lis	%r8,_end@ha
+	addi	%r8,%r8,_end@l
+	lis	%r3, fwargsave@ha
+	lwz	%r6, fwargsave@l(%r3)
+	lwz	%r7, fwargsave@l+4(%r3)
+#if defined(DDB)
+	cmpwi	%r6, 0
+	beq	1f
+	add	%r9,%r6,%r7
+	lwz	%r9, -4(%r9)
+	cmpwi   %r9,0
+	beq	1f
+	lis	%r8,_C_LABEL(esym)@ha
+	stw	%r9,_C_LABEL(esym)@l(%r8)
+	mr	%r8, %r9
+1:
+#endif
+	li	%r9,PGOFSET
+	add	%r8,%r8,%r9
+	andc	%r8,%r8,%r9
+	lis	%r9,_C_LABEL(cpu_info)@ha
+	addi	%r9,%r9,_C_LABEL(cpu_info)@l
+	mtsprg	0,%r9
+	addi	%r8,%r8,INTSTK
+	stw	%r8,CI_INTSTK(%r9)
+	li	%r0,-1
+	stw	%r0,CI_INTRDEPTH(%r9)
+	addi	%r8,%r8,SPILLSTK+DDBSTK	/* leave room for spillstk and ddbstk */
+	lis	%r9,_C_LABEL(proc0paddr)@ha
+	stw	%r8,_C_LABEL(proc0paddr)@l(%r9)
+	addi	%r1,%r8,USPACE-FRAMELEN	/* stackpointer for proc0 */
+	mr	%r4,%r1			/* end of mem reserved for kernel */
+	li	%r0,0
+	stwu	%r0,-16(%r1)		/* end of stack chain */
+
+	lis	%r3,start@ha
+	addi	%r3,%r3,start@l
+	mr	%r5,%r6			/* args string */
+	bl	_C_LABEL(initppc)
+	bl	_C_LABEL(main)
+	b	_C_LABEL(OF_exit)