Retguard asm macros for powerpc libc, ld.so

Add retguard to some, but not all, asm functions in libc.  Edit SYS.h
in libc to remove the PREFIX macros and add SYSENTRY (more like
aarch64 and powerpc64), so we can insert RETGUARD_SETUP after
SYSENTRY.  Some .S files in this commit don't get retguard, but do
stop using the old prefix macros.

Tested by deraadt@, who put this diff in a macppc snap.

11 files changed, 134 insertions, 67 deletions

diff --git a/lib/libc/arch/powerpc/SYS.h b/lib/libc/arch/powerpc/SYS.h
index 5a90d928327..8705241b48a 100644
--- a/lib/libc/arch/powerpc/SYS.h
+++ b/lib/libc/arch/powerpc/SYS.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: SYS.h,v 1.23 2019/07/14 03:36:37 guenther Exp $	*/
+/*	$OpenBSD: SYS.h,v 1.24 2020/10/26 22:07:05 gkoehler Exp $	*/
 /*-
  * Copyright (c) 1994
  *	Andrew Cagney.  All rights reserved.
@@ -75,48 +75,42 @@
 #define	END_STRONG(x)	END(x); _HIDDEN_FALIAS(x,x); END(_HIDDEN(x))
 #define	END_WEAK(x)	END_STRONG(x); .weak x
 
-
-#define _CONCAT(x,y)	x##y
-#define PSEUDO_PREFIX(p,x,y)	\
-			ENTRY(p##x) \
-				li 0, SYS_##y ; \
-				/* sc */
-#define PSEUDO_SUFFIX		cmpwi 0, 0 ; \
-				beqlr+ ; \
-				stw	0, R2_OFFSET_ERRNO(2); \
-				li	3, -1; \
-				li	4, -1; /* for __syscall(lseek) */ \
-				blr
-
-#define PSEUDO_NOERROR_SUFFIX	blr
-
-#define __END_HIDDEN(p,x)	END(p##x);			\
-				_HIDDEN_FALIAS(x,p##x);		\
+#define SYSENTRY(x)		WEAK_ALIAS(x, _thread_sys_ ## x);	\
+				ENTRY(_thread_sys_ ## x)
+#define SYSENTRY_HIDDEN(x)	ENTRY(_thread_sys_ ## x)
+#define __END_HIDDEN(x)		END(_thread_sys_ ## x);			\
+				_HIDDEN_FALIAS(x, _thread_sys_ ## x);	\
 				END(_HIDDEN(x))
-#define __END(p,x)		__END_HIDDEN(p,x); END(x)
-
-
-#define ALIAS(x,y)		WEAK_ALIAS(y,_CONCAT(x,y));
-		
-#define PREFIX_HIDDEN(x)	PSEUDO_PREFIX(_thread_sys_,x,x)
-#define PREFIX(x)		ALIAS(_thread_sys_,x) \
-				PREFIX_HIDDEN(x)
-#define	PSEUDO_NOERROR(x,y)	ALIAS(_thread_sys_,x) \
-				PSEUDO_PREFIX(_thread_sys_,x,y) ; \
-				sc ; \
-				PSEUDO_NOERROR_SUFFIX; \
-				__END(_thread_sys_,x)
-
-#define	PSEUDO_HIDDEN(x,y)	PSEUDO_PREFIX(_thread_sys_,x,y) ; \
-				sc ; \
-				PSEUDO_SUFFIX; \
-				__END_HIDDEN(_thread_sys_,x)
-#define	PSEUDO(x,y)		ALIAS(_thread_sys_,x) \
-				PSEUDO_HIDDEN(x,y); \
+#define __END(x)		__END_HIDDEN(x); END(x)
+
+#define	PSEUDO_NOERROR(x,y)	SYSENTRY(x)				\
+				RETGUARD_SETUP(x);			\
+				li	%r0, SYS_ ## y ;		\
+				sc;					\
+				RETGUARD_CHECK(x);			\
+				blr;					\
+				__END(x)
+
+#define	PSEUDO_HIDDEN(x,y)	SYSENTRY_HIDDEN(x)			\
+				RETGUARD_SETUP(x);			\
+				li	%r0, SYS_ ## y;			\
+				sc;					\
+				cmpwi	%r0, 0;				\
+				beq+	.L_ret;				\
+				stw	%r0, R2_OFFSET_ERRNO(2);	\
+				li	%r3, -1;			\
+				li	%r4, -1; /* for __syscall(lseek) */ \
+			.L_ret:						\
+				RETGUARD_CHECK(x);			\
+				blr;					\
+				__END_HIDDEN(x)
+
+#define	PSEUDO(x,y)		WEAK_ALIAS(x, _thread_sys_ ## x);	\
+				PSEUDO_HIDDEN(x,y);			\
 				END(x)
 
 #define RSYSCALL(x)		PSEUDO(x,x)
 #define RSYSCALL_HIDDEN(x)	PSEUDO_HIDDEN(x,x)
-#define SYSCALL_END_HIDDEN(x)	__END_HIDDEN(_thread_sys_,x)
-#define SYSCALL_END(x)		__END(_thread_sys_,x)
+#define SYSCALL_END_HIDDEN(x)	__END_HIDDEN(x)
+#define SYSCALL_END(x)		__END(x)
 
diff --git a/lib/libc/arch/powerpc/string/ffs.S b/lib/libc/arch/powerpc/string/ffs.S
index d7091526d41..c8a6eacc128 100644
--- a/lib/libc/arch/powerpc/string/ffs.S
+++ b/lib/libc/arch/powerpc/string/ffs.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ffs.S,v 1.1 2020/06/26 20:16:21 naddy Exp $ */
+/*	$OpenBSD: ffs.S,v 1.2 2020/10/26 22:07:05 gkoehler Exp $ */
 /*
  * Written by Christian Weisgerber <naddy@openbsd.org>.
  * Public domain.
@@ -7,10 +7,12 @@
 #include "SYS.h"
 
 ENTRY(ffs)
+	RETGUARD_SETUP(ffs)
 	neg	%r4, %r3
 	and	%r3, %r3, %r4
 	cntlzw	%r3, %r3
 	subfic	%r3, %r3, 32
+	RETGUARD_CHECK(ffs)
 	blr
 END(ffs)
 .protected
diff --git a/lib/libc/arch/powerpc/string/memmove.S b/lib/libc/arch/powerpc/string/memmove.S
index 80aca10ce78..4b6ba3cc82b 100644
--- a/lib/libc/arch/powerpc/string/memmove.S
+++ b/lib/libc/arch/powerpc/string/memmove.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: memmove.S,v 1.2 2015/08/31 02:53:57 guenther Exp $ */
+/* $OpenBSD: memmove.S,v 1.3 2020/10/26 22:07:05 gkoehler Exp $ */
 /* $NetBSD: memmove.S,v 1.3 2011/01/15 07:31:12 matt Exp $ */
 
 /* stropt/memmove.S, pl_string_common, pl_linux 10/11/04 11:45:37
@@ -44,9 +44,12 @@
         .text
 
 /* void *memcpy(void *to, const void *from, size_t len) */
-// ENTRY(memcpy)
+#if 0
+ENTRY(memcpy)
+	RETGUARD_SETUP(memmove)
 	mr	%r8, %r3		/* Save dst (return value)	*/
 	b	fwd
+#endif
 
 /* void bcopy(void *, void *, size_t) */
 ENTRY(bcopy)
@@ -56,6 +59,7 @@ ENTRY(bcopy)
 
 /* void *memmove(void *, const void *, size_t) */
 ENTRY(memmove)
+	RETGUARD_SETUP(memmove)
 	mr	%r8, %r3		/* Save dst (return value)	*/
 
 	cmpw	%r4, %r8		/* Branch to reverse if 	*/
@@ -97,21 +101,20 @@ last:
 last1:					/* Byte-by-byte copy		*/
 
 	clrlwi.	%r5,%r5,30		/* If count -> 0, then ...	*/
-	beqlr				/* we're done			*/
+	beq	done			/* we're done			*/
 
 	mtctr	%r5			/* else load count for loop	*/
 
 	lbzu	%r6, 4(%r4)		/* 1st byte: update addr by 4	*/
 	stbu	%r6, 4(%r8)		/* since we pre-adjusted by 4	*/
-	bdzlr-				/* in anticipation of main loop */
+	bdz-	done			/* in anticipation of main loop */
 
 last2:
 
 	lbzu	%r6, 1(%r4)		/* But handle the rest by	*/
 	stbu	%r6, 1(%r8)		/* updating addr by 1		*/
 	bdnz+	last2
-
-	blr
+	b	done
 
 	/* We're here since src < dest. Don't want to overwrite end of	*/
 	/* src with start of dest					*/
@@ -154,7 +157,7 @@ rlast:
 rlast1:					/* Byte-by-byte copy		*/
 
 	clrlwi.	%r5,%r5,30		/* If count -> 0, then...	*/
-	beqlr				/* ... we're done 		*/
+	beq	done			/* ... we're done 		*/
 
 	mtctr	%r5			/* else load count for loop 	*/
 
@@ -165,6 +168,8 @@ rlast2:
 
 	bdnz+	rlast2		 	/* Dec ctr, and branch if more	*/
 					/* bytes left			*/
+done:
+	RETGUARD_CHECK(memmove)
 	blr
 END_STRONG(memmove)
 END_WEAK(bcopy)
diff --git a/lib/libc/arch/powerpc/sys/brk.S b/lib/libc/arch/powerpc/sys/brk.S
index 1ef586e126c..d8247bd7d94 100644
--- a/lib/libc/arch/powerpc/sys/brk.S
+++ b/lib/libc/arch/powerpc/sys/brk.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: brk.S,v 1.14 2016/05/30 05:18:52 guenther Exp $ */
+/* $OpenBSD: brk.S,v 1.15 2020/10/26 22:07:05 gkoehler Exp $ */
 
 /*
  * Copyright (c) 1996 Dale Rahn
@@ -32,7 +32,7 @@
 
 	.weak	brk
 
-PSEUDO_PREFIX(,brk,break)
+ENTRY(brk)
 	
 	/* check >= _end, if not make the call for _end */
 #ifndef __PIC__
@@ -61,6 +61,7 @@ PSEUDO_PREFIX(,brk,break)
 	lwz	6,__curbrk@got(9)
 #endif
 
+	li	0, SYS_break
 	sc
 
 	/* check for error */
diff --git a/lib/libc/arch/powerpc/sys/sbrk.S b/lib/libc/arch/powerpc/sys/sbrk.S
index fb4d7647216..c676a65c5f5 100644
--- a/lib/libc/arch/powerpc/sys/sbrk.S
+++ b/lib/libc/arch/powerpc/sys/sbrk.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sbrk.S,v 1.13 2016/05/30 05:18:52 guenther Exp $ */
+/* $OpenBSD: sbrk.S,v 1.14 2020/10/26 22:07:05 gkoehler Exp $ */
 
 /*
  * Copyright (c) 1996 Dale Rahn
@@ -39,7 +39,7 @@ __curbrk:
 	.weak	sbrk
 
 	.text
-PSEUDO_PREFIX(,sbrk,break)
+ENTRY(sbrk)
 	
 	/* call break(__curbrk + size) */
 #ifndef __PIC__
@@ -58,6 +58,7 @@ PSEUDO_PREFIX(,sbrk,break)
 	add	3, 5, 3		/* # 3 = new_curbrk */
 	mr	7, 3
 
+	li	0, SYS_break
 	sc
 
 	/* check for error */
diff --git a/lib/libc/arch/powerpc/sys/sigpending.S b/lib/libc/arch/powerpc/sys/sigpending.S
index 4767cfb14d3..0136633fef5 100644
--- a/lib/libc/arch/powerpc/sys/sigpending.S
+++ b/lib/libc/arch/powerpc/sys/sigpending.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sigpending.S,v 1.6 2015/09/05 06:22:47 guenther Exp $ */
+/* $OpenBSD: sigpending.S,v 1.7 2020/10/26 22:07:05 gkoehler Exp $ */
 /*
  * Copyright (c) 2012 Mark Kettenis
  *
@@ -20,10 +20,13 @@
 #include "SYS.h"
 
 	.text
-PREFIX(sigpending)
+SYSENTRY(sigpending)
+	RETGUARD_SETUP(sigpending)
 	mr	%r5, %r3
+	li	%r0, SYS_sigpending
 	sc
 	stw	%r3, 0(%r5)
 	li	%r3, 0
+	RETGUARD_CHECK(sigpending)
 	blr
 SYSCALL_END(sigpending)
diff --git a/lib/libc/arch/powerpc/sys/sigprocmask.S b/lib/libc/arch/powerpc/sys/sigprocmask.S
index 6b10a5c6063..57b0987b542 100644
--- a/lib/libc/arch/powerpc/sys/sigprocmask.S
+++ b/lib/libc/arch/powerpc/sys/sigprocmask.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sigprocmask.S,v 1.12 2016/05/15 00:15:10 guenther Exp $ */
+/* $OpenBSD: sigprocmask.S,v 1.13 2020/10/26 22:07:06 gkoehler Exp $ */
 
 /*
  * Copyright (c) 1996 Dale Rahn
@@ -30,7 +30,8 @@
 #include "SYS.h"
 
 	.text
-PREFIX_HIDDEN(sigprocmask)
+SYSENTRY_HIDDEN(sigprocmask)
+	RETGUARD_SETUP(sigprocmask)
 	stwu	1, -16(1)
 	stw	5, 12(1)
 	
@@ -43,7 +44,8 @@ PREFIX_HIDDEN(sigprocmask)
 .L_load_set:
 	lwz	4, 0(4)	/* get new mask */
 .L_do_call:
-	
+
+	li	0, SYS_sigprocmask
 	sc
 	
 	/* didnt work? */
@@ -51,7 +53,7 @@ PREFIX_HIDDEN(sigprocmask)
 	beq+	.L_sigprocmask_ok
 	stw	0, R2_OFFSET_ERRNO(2)
 	li	3, -1
-	blr
+	b	.L_end
 
 .L_sigprocmask_ok:
 	lwz	5, 12(1)
@@ -61,5 +63,7 @@ PREFIX_HIDDEN(sigprocmask)
 .L_sigprocmask_done:
 	li	3, 0
 	addi	1, 1, 16
+.L_end:
+	RETGUARD_CHECK(sigprocmask)
 	blr
 SYSCALL_END_HIDDEN(sigprocmask)
diff --git a/lib/libc/arch/powerpc/sys/sigsuspend.S b/lib/libc/arch/powerpc/sys/sigsuspend.S
index cbdd4ca971e..822345dd448 100644
--- a/lib/libc/arch/powerpc/sys/sigsuspend.S
+++ b/lib/libc/arch/powerpc/sys/sigsuspend.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: sigsuspend.S,v 1.5 2016/05/07 19:05:22 guenther Exp $ */
+/* $OpenBSD: sigsuspend.S,v 1.6 2020/10/26 22:07:06 gkoehler Exp $ */
 
 /*
  * Copyright (c) 1996 Dale Rahn
@@ -30,8 +30,18 @@
 #include "SYS.h"
 
 	.text
-PREFIX_HIDDEN(sigsuspend)
-	lwz 3, 0(3)		/* load the mask */
+SYSENTRY_HIDDEN(sigsuspend)
+	RETGUARD_SETUP(sigsuspend)
+	li	%r0, SYS_sigsuspend
+
+	lwz	%r3, 0(%r3)		/* load the mask */
 	sc
-	PSEUDO_SUFFIX
+
+	cmpwi	%r0, 0
+	beq+	.L_ret
+	stw	%r0, R2_OFFSET_ERRNO(2)
+	li	%r3, -1
+.L_ret:
+	RETGUARD_CHECK(sigsuspend)
+	blr
 SYSCALL_END_HIDDEN(sigsuspend)
diff --git a/lib/libc/arch/powerpc/sys/tfork_thread.S b/lib/libc/arch/powerpc/sys/tfork_thread.S
index 2c218b028e4..b33ef21c937 100644
--- a/lib/libc/arch/powerpc/sys/tfork_thread.S
+++ b/lib/libc/arch/powerpc/sys/tfork_thread.S
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tfork_thread.S,v 1.8 2020/10/18 14:28:18 deraadt Exp $	*/
+/*	$OpenBSD: tfork_thread.S,v 1.9 2020/10/26 22:07:06 gkoehler Exp $	*/
 
 /*
  * Copyright (c) 2005 Tim Wiess <tim@nop.cx>
@@ -19,6 +19,7 @@
 #include "SYS.h"
 
 ENTRY(__tfork_thread)
+	RETGUARD_SETUP(__tfork_thread)
 	/* call __tfork */
 	li	%r0, SYS___tfork
 	sc
@@ -27,7 +28,7 @@ ENTRY(__tfork_thread)
 	
 	/* check if we are parent or child */
 	cmpwi	%r3, 0
-	bnelr
+	bne	9f
 	
 	/* child */
 	mtlr	%r5		/* fp */
@@ -43,5 +44,7 @@ ENTRY(__tfork_thread)
 1:
 	stw	0, R2_OFFSET_ERRNO(%r2)
 	li	%r3, -1
+9:
+	RETGUARD_CHECK(__tfork_thread)
 	blr
 END(__tfork_thread)
diff --git a/libexec/ld.so/powerpc/SYS.h b/libexec/ld.so/powerpc/SYS.h
index ea30a339c9d..4a585e2597f 100644
--- a/libexec/ld.so/powerpc/SYS.h
+++ b/libexec/ld.so/powerpc/SYS.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: SYS.h,v 1.2 2019/02/03 03:44:06 guenther Exp $ */
+/*	$OpenBSD: SYS.h,v 1.3 2020/10/26 22:07:06 gkoehler Exp $ */
 
 /*
  * Copyright (c) 1999 Dale Rahn
@@ -31,9 +31,12 @@
 
 #define	DL_SYSCALL(n)							\
 ENTRY(_dl_##n)								\
+	RETGUARD_SETUP(_dl_##n)						;\
 	li	0, SYS_##n						;\
 	sc								;\
 	cmpwi	0, 0							;\
-	beqlr+								;\
+	beq+	.L_end##n						;\
 	neg	3, 3							;\
+.L_end##n:								;\
+	RETGUARD_CHECK(_dl_##n)						;\
 	blr
diff --git a/sys/arch/powerpc/include/asm.h b/sys/arch/powerpc/include/asm.h
index 467c8724c29..60fbac38f17 100644
--- a/sys/arch/powerpc/include/asm.h
+++ b/sys/arch/powerpc/include/asm.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: asm.h,v 1.14 2017/06/29 17:36:16 deraadt Exp $	*/
+/*	$OpenBSD: asm.h,v 1.15 2020/10/26 22:07:06 gkoehler Exp $	*/
 /*	$NetBSD: asm.h,v 1.1 1996/09/30 16:34:20 ws Exp $	*/
 
 /*
@@ -97,4 +97,45 @@ _TMP_LABEL(y):; \
 #define WEAK_ALIAS(alias,sym) \
 	.weak alias; .set alias,sym
 
+#if defined(_RET_PROTECTOR)
+# if defined(__PIC__)
+#  define RETGUARD_LOAD_RANDOM(x, reg)					\
+	bcl	20, 31, 66f;						\
+66:	mflr	reg;							\
+	addis	reg, reg, (__retguard_ ## x - 66b)@ha;			\
+	lwz	reg, ((__retguard_ ## x - 66b)@l)(reg)
+# else
+#  define RETGUARD_LOAD_RANDOM(x, reg)					\
+	lis	reg, (__retguard_ ## x)@ha;				\
+	lwz	reg, ((__retguard_ ## x)@l)(reg)
+# endif
+# define RETGUARD_SETUP(x)						\
+	RETGUARD_SYMBOL(x);						\
+	mflr	%r12;							\
+	RETGUARD_LOAD_RANDOM(x, %r11);					\
+	xor	%r11, %r11, %r12
+# define RETGUARD_CHECK(x)						\
+	xor	%r11, %r11, %r12;					\
+	RETGUARD_LOAD_RANDOM(x, %r10);					\
+	mtlr	%r12;							\
+	twne	%r11, %r10
+# define RETGUARD_SYMBOL(x)						\
+	.ifndef __retguard_ ## x;					\
+	.hidden __retguard_ ## x;					\
+	.type   __retguard_ ## x,@object;				\
+	.pushsection .openbsd.randomdata.retguard,"aw",@progbits; 	\
+	.weak   __retguard_ ## x;					\
+	.p2align 2;							\
+	__retguard_ ## x: ;						\
+	.long 0;							\
+	.size __retguard_ ## x, 4;					\
+	.popsection;							\
+	.endif
+#else
+# define RETGUARD_LOAD_RANDOM(x, reg)
+# define RETGUARD_SETUP(x)
+# define RETGUARD_CHECK(x)
+# define RETGUARD_SYMBOL(x)
+#endif
+
 #endif /* !_POWERPC_ASM_H_ */