Emit variable length trap padding in retguard epilogue.

This adds more trap padding before the return while ensuring that the
return is still in the same cache line.

ok deraadt@

1 files changed, 21 insertions, 0 deletions

diff --git a/gnu/llvm/lib/Target/X86/X86MCInstLower.cpp b/gnu/llvm/lib/Target/X86/X86MCInstLower.cpp
index bcb5a788f08..73d99c08052 100644
--- a/gnu/llvm/lib/Target/X86/X86MCInstLower.cpp
+++ b/gnu/llvm/lib/Target/X86/X86MCInstLower.cpp
@@ -1832,11 +1832,32 @@ void X86AsmPrinter::EmitInstruction(const MachineInstr *MI) {
     return;
 
   case X86::RETGUARD_JMP_TRAP: {
+    // Make a symbol for the end of the trapsled and emit a jump to it
     MCSymbol *RGSuccSym = OutContext.createTempSymbol();
     const MCExpr *RGSuccExpr = MCSymbolRefExpr::create(RGSuccSym, OutContext);
     EmitAndCountInstruction(MCInstBuilder(X86::JE_1).addExpr(RGSuccExpr));
+
+    // Emit at least two trap instructions
     EmitAndCountInstruction(MCInstBuilder(X86::INT3));
     EmitAndCountInstruction(MCInstBuilder(X86::INT3));
+
+    // Now .fill up to 0xe byte, so the ret happens on 0xf
+    MCSymbol *Dot = OutContext.createTempSymbol();
+    OutStreamer->EmitLabel(Dot);
+    const MCExpr *DotE = MCSymbolRefExpr::create(Dot, OutContext);
+    const MCExpr *BaseE = MCSymbolRefExpr::create(
+        TM.getSymbol(&MF->getFunction()), OutContext);
+    // .fill (0xf - ((DotE - BaseE) & 0xf)), 1, 0xcc
+    const MCExpr *FillE = MCBinaryExpr::createSub(
+        MCConstantExpr::create(0xf, OutContext),
+        MCBinaryExpr::createAnd(
+          MCBinaryExpr::createSub(DotE, BaseE, OutContext),
+          MCConstantExpr::create(0xf, OutContext),
+          OutContext),
+        OutContext);
+    OutStreamer->emitFill(*FillE, 0xCC);
+
+    // And finally emit the jump target symbol
     OutStreamer->EmitLabel(RGSuccSym);
     return;
   }