From: deraadt Date: Tue, 13 Jun 2017 01:44:27 +0000 (+0000) Subject: Split early startup code out of locore.S into locore0.S. Adjust link X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=2b08e4fe0444d9f1f89bbb659d8ab96f79be346e;p=openbsd Split early startup code out of locore.S into locore0.S. Adjust link run so that this locore0.o is always at the start of the executable. But randomize the link order of all other .o files in the kernel, so that their exec/rodata/data/bss segments land all over the place. As a result, the internal layout of every newly build bsd kernel is different from past kernels. Internal relative offsets are not known to an outside attacker. The only known offsets are in the startup code (which will be gone when it is smashed). The bootstrap code unmapping or smashing isn't done yet, and there is some potential for more bits from locore.S to move to locore0.S --- diff --git a/sys/arch/macppc/conf/Makefile.macppc b/sys/arch/macppc/conf/Makefile.macppc index a5edef7ea7a..3a827ddf541 100644 --- a/sys/arch/macppc/conf/Makefile.macppc +++ b/sys/arch/macppc/conf/Makefile.macppc @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile.macppc,v 1.82 2017/06/11 22:51:21 deraadt Exp $ +# $OpenBSD: Makefile.macppc,v 1.83 2017/06/13 01:44:27 deraadt Exp $ # For instructions on building kernels consult the config(8) and options(4) # manual pages. @@ -31,9 +31,13 @@ CMACHFLAGS= -msoft-float -Wa,-many CMACHFLAGS+= -fno-builtin-printf -fno-builtin-snprintf \ -fno-builtin-vsnprintf -fno-builtin-log \ -fno-builtin-log2 -fno-builtin-malloc ${NOPIE_FLAGS} +SORTR= sort -R .if ${IDENT:M-DNO_PROPOLICE} CMACHFLAGS+= -fno-stack-protector .endif +.if ${IDENT:M-DSMALL_KERNEL} +SORTR= cat +.endif DEBUG?= -g COPTS?= -O2 @@ -67,13 +71,14 @@ NORMAL_S= ${CC} ${AFLAGS} ${CPPFLAGS} -c $< # ${SYSTEM_LD_HEAD} # ${SYSTEM_LD} swapxxx.o # ${SYSTEM_LD_TAIL} -SYSTEM_HEAD= locore.o param.o ioconf.o -SYSTEM_OBJ= ${SYSTEM_HEAD} ${OBJS} -SYSTEM_DEP= Makefile ${SYSTEM_OBJ} +SYSTEM_HEAD= locore0.o gap.o +SYSTEM_OBJ= ${SYSTEM_HEAD} ${OBJS} param.o ioconf.o +SYSTEM_DEP= Makefile ${SYSTEM_OBJ} ld.script SYSTEM_LD_HEAD= @rm -f $@ SYSTEM_LD= @echo ${LD} ${LINKFLAGS} -o $@ '$${SYSTEM_HEAD} vers.o $${OBJS}'; \ umask 007; \ - ${LD} ${LINKFLAGS} -o $@ ${SYSTEM_HEAD} vers.o ${OBJS} + echo ${OBJS} param.o ioconf.o vers.o | tr " " "\n" | ${SORTR} > lorder; \ + ${LD} ${LINKFLAGS} -o $@ ${SYSTEM_HEAD} `cat lorder` SYSTEM_LD_TAIL= @${SIZE} $@ .if ${DEBUG} == "-g" @@ -88,6 +93,12 @@ LINKFLAGS+= -S %LOAD +newbsd: + ${SYSTEM_LD_HEAD} + ${SYSTEM_LD} swapgeneric.o + ${SYSTEM_LD_TAIL} + mv -f newbsd bsd + # cc's -MD puts the source and output paths in the dependency file; # since those are temp files here we need to fix it up. It also # puts the file in /tmp, so we use -MF to put it in the current @@ -113,12 +124,22 @@ mcount.o: $S/lib/libkern/mcount.c Makefile ioconf.o: ioconf.c ${NORMAL_C} +ld.script: ${_machdir}/conf/ld.script + cp ${_machdir}/conf/ld.script $@ + vers.o: ${SYSTEM_DEP:Ngap.o} ${SYSTEM_SWAP_DEP} sh $S/conf/newvers.sh ${CC} ${CFLAGS} ${CPPFLAGS} ${PROF} -c vers.c +gap.S: ${SYSTEM_SWAP_DEP} Makefile + umask 007; sh $S/conf/makegap.sh 0xcc > gap.S + +gap.o: gap.S + umask 007; ${CC} ${AFLAGS} ${CPPFLAGS} ${PROF} -c gap.S + clean: - rm -f *bsd *bsd.gdb *.[dio] [a-z]*.s assym.* ${DB_STRUCTINFO} param.c + rm -f *bsd *bsd.gdb *.[dio] [a-z]*.s assym.* ${DB_STRUCTINFO} \ + gap.S lorder param.c cleandir: clean rm -f Makefile *.h ioconf.c options machine ${_mach} vers.c @@ -130,6 +151,7 @@ db_structinfo.h: $S/ddb/db_structinfo.c $S/ddb/parse_structinfo.pl objdump -g db_structinfo.o | perl $S/ddb/parse_structinfo.pl > $@ rm -f db_structinfo.o +locore0.o: ${_machdir}/${_mach}/locore0.S assym.h locore.o: ${_machdir}/${_mach}/locore.S assym.h mutex.o: assym.h diff --git a/sys/arch/macppc/conf/files.macppc b/sys/arch/macppc/conf/files.macppc index de66b63c4fe..f237bd0295a 100644 --- a/sys/arch/macppc/conf/files.macppc +++ b/sys/arch/macppc/conf/files.macppc @@ -1,4 +1,4 @@ -# $OpenBSD: files.macppc,v 1.87 2016/05/20 21:45:04 mglocker Exp $ +# $OpenBSD: files.macppc,v 1.88 2017/06/13 01:44:27 deraadt Exp $ # # macppc-specific configuration info @@ -17,6 +17,7 @@ file arch/macppc/macppc/mem.c file arch/macppc/macppc/ofw_machdep.c file arch/macppc/macppc/openfirm.c file arch/macppc/macppc/openprom.c +file arch/macppc/macppc/locore.o file dev/cninit.c file arch/macppc/macppc/ofwreal.S diff --git a/sys/arch/macppc/macppc/locore.S b/sys/arch/macppc/macppc/locore.S index ce18aaf1f2b..305b24b9fe3 100644 --- a/sys/arch/macppc/macppc/locore.S +++ b/sys/arch/macppc/macppc/locore.S @@ -1,4 +1,4 @@ -/* $OpenBSD: locore.S,v 1.55 2016/05/23 20:11:49 deraadt Exp $ */ +/* $OpenBSD: locore.S,v 1.56 2017/06/13 01:44:29 deraadt Exp $ */ /* $NetBSD: locore.S,v 1.2 1996/10/16 19:33:09 ws Exp $ */ /* @@ -48,87 +48,8 @@ #define SPILLSTK (1*1024) #define DDBSTK (7*1024) -/* - * Globals - */ - .globl _C_LABEL(esym),_C_LABEL(proc0paddr) - .type _C_LABEL(esym),@object - .type _C_LABEL(proc0paddr),@object - .data -_C_LABEL(esym): .long 0 /* end of symbol table */ -_C_LABEL(proc0paddr): .long 0 /* proc0 p_addr */ - -fwargsave: - .long 0 - .long 0 - -/* - * Startup entry - */ -_ENTRY(_C_LABEL(kernel_text)) -_ENTRY(_ASM_LABEL(start)) -/* arguments to start - * r1 - stack provided by firmware/bootloader - * r3 - unused - * r4 - unused - * r5 - firmware pointer (NULL for PPC1bug) - * r6 - arg list - * r7 - length - */ - .globl start - .type start,@function -start: - lis %r3, fwargsave@ha - stw %r6, fwargsave@l(%r3) - stw %r7, fwargsave@l+4(%r3) - bl ofw_init - li %r0,0 - mtmsr %r0 /* Disable FPU/MMU/exceptions */ - isync + .text -/* compute end of kernel memory */ - lis %r8,_end@ha - addi %r8,%r8,_end@l - lis %r3, fwargsave@ha - lwz %r6, fwargsave@l(%r3) - lwz %r7, fwargsave@l+4(%r3) -#if defined(DDB) - cmpwi %r6, 0 - beq 1f - add %r9,%r6,%r7 - lwz %r9, -4(%r9) - cmpwi %r9,0 - beq 1f - lis %r8,_C_LABEL(esym)@ha - stw %r9,_C_LABEL(esym)@l(%r8) - mr %r8, %r9 -1: -#endif - li %r9,PGOFSET - add %r8,%r8,%r9 - andc %r8,%r8,%r9 - lis %r9,_C_LABEL(cpu_info)@ha - addi %r9,%r9,_C_LABEL(cpu_info)@l - mtsprg 0,%r9 - addi %r8,%r8,INTSTK - stw %r8,CI_INTSTK(%r9) - li %r0,-1 - stw %r0,CI_INTRDEPTH(%r9) - addi %r8,%r8,SPILLSTK+DDBSTK /* leave room for spillstk and ddbstk */ - lis %r9,_C_LABEL(proc0paddr)@ha - stw %r8,_C_LABEL(proc0paddr)@l(%r9) - addi %r1,%r8,USPACE-FRAMELEN /* stackpointer for proc0 */ - mr %r4,%r1 /* end of mem reserved for kernel */ - li %r0,0 - stwu %r0,-16(%r1) /* end of stack chain */ - - lis %r3,start@ha - addi %r3,%r3,start@l - mr %r5,%r6 /* args string */ - bl _C_LABEL(initppc) - bl _C_LABEL(main) - b _C_LABEL(OF_exit) - #ifdef MULTIPROCESSOR _ENTRY(_C_LABEL(cpu_spinup_trampoline)) lis %r3,_C_LABEL(cpu_hatch_stack)@ha diff --git a/sys/arch/macppc/macppc/locore0.S b/sys/arch/macppc/macppc/locore0.S new file mode 100644 index 00000000000..3bc89c2a441 --- /dev/null +++ b/sys/arch/macppc/macppc/locore0.S @@ -0,0 +1,132 @@ +/* $OpenBSD: locore0.S,v 1.1 2017/06/13 01:44:29 deraadt Exp $ */ +/* $NetBSD: locore.S,v 1.2 1996/10/16 19:33:09 ws Exp $ */ + +/* + * Copyright (C) 1995, 1996 Wolfgang Solfrank. + * Copyright (C) 1995, 1996 TooLs GmbH. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. All advertising materials mentioning features or use of this software + * must display the following acknowledgement: + * This product includes software developed by TooLs GmbH. + * 4. The name of TooLs GmbH may not be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, + * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; + * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR + * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF + * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include "assym.h" + +#include + +#include +#include +#include +#include +#include + +#define GET_CPUINFO(r) mfsprg r,0 + +#define INTSTK (8*1024) /* 8K interrupt stack */ +#define SPILLSTK (1*1024) +#define DDBSTK (7*1024) + +/* + * Globals + */ + .globl _C_LABEL(esym),_C_LABEL(proc0paddr) + .type _C_LABEL(esym),@object + .type _C_LABEL(proc0paddr),@object + .data +_C_LABEL(esym): .long 0 /* end of symbol table */ +_C_LABEL(proc0paddr): .long 0 /* proc0 p_addr */ + + .globl fwargsave +fwargsave: + .long 0 + .long 0 + + .text +/* + * Startup entry + */ +_ENTRY(_C_LABEL(kernel_text)) +_ENTRY(_ASM_LABEL(start)) +/* arguments to start + * r1 - stack provided by firmware/bootloader + * r3 - unused + * r4 - unused + * r5 - firmware pointer (NULL for PPC1bug) + * r6 - arg list + * r7 - length + */ + .globl start + .type start,@function +start: + lis %r3, fwargsave@ha + stw %r6, fwargsave@l(%r3) + stw %r7, fwargsave@l+4(%r3) + bl ofw_init + li %r0,0 + mtmsr %r0 /* Disable FPU/MMU/exceptions */ + isync + +/* compute end of kernel memory */ + lis %r8,_end@ha + addi %r8,%r8,_end@l + lis %r3, fwargsave@ha + lwz %r6, fwargsave@l(%r3) + lwz %r7, fwargsave@l+4(%r3) +#if defined(DDB) + cmpwi %r6, 0 + beq 1f + add %r9,%r6,%r7 + lwz %r9, -4(%r9) + cmpwi %r9,0 + beq 1f + lis %r8,_C_LABEL(esym)@ha + stw %r9,_C_LABEL(esym)@l(%r8) + mr %r8, %r9 +1: +#endif + li %r9,PGOFSET + add %r8,%r8,%r9 + andc %r8,%r8,%r9 + lis %r9,_C_LABEL(cpu_info)@ha + addi %r9,%r9,_C_LABEL(cpu_info)@l + mtsprg 0,%r9 + addi %r8,%r8,INTSTK + stw %r8,CI_INTSTK(%r9) + li %r0,-1 + stw %r0,CI_INTRDEPTH(%r9) + addi %r8,%r8,SPILLSTK+DDBSTK /* leave room for spillstk and ddbstk */ + lis %r9,_C_LABEL(proc0paddr)@ha + stw %r8,_C_LABEL(proc0paddr)@l(%r9) + addi %r1,%r8,USPACE-FRAMELEN /* stackpointer for proc0 */ + mr %r4,%r1 /* end of mem reserved for kernel */ + li %r0,0 + stwu %r0,-16(%r1) /* end of stack chain */ + + lis %r3,start@ha + addi %r3,%r3,start@l + mr %r5,%r6 /* args string */ + bl _C_LABEL(initppc) + bl _C_LABEL(main) + b _C_LABEL(OF_exit)