From 884a0a9ff71bec47ceec423e5ceb39eddb4aa00a Mon Sep 17 00:00:00 2001
From: deraadt <deraadt@openbsd.org>
Date: Sat, 1 Feb 2020 23:09:46 +0000
Subject: Also insert two nop instructions after svc instructions for SYS_exit
 and SYS_sigreturn in the sigtramp.  As these control-flow into a jump or
 process termination, we never do the +8 dance over the instructions, however
 the speculation prevention (once these nops are replaced with a speculation
 barrier) is required. oversight noticed by Anthony Steinhauser.

---
 sys/arch/arm64/arm64/locore.S | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/sys/arch/arm64/arm64/locore.S b/sys/arch/arm64/arm64/locore.S
index a8f92a57826..01917a3de82 100644
--- a/sys/arch/arm64/arm64/locore.S
+++ b/sys/arch/arm64/arm64/locore.S
@@ -1,4 +1,4 @@
-/* $OpenBSD: locore.S,v 1.25 2019/05/28 20:32:30 patrick Exp $ */
+/* $OpenBSD: locore.S,v 1.26 2020/02/01 23:09:46 deraadt Exp $ */
 /*-
  * Copyright (c) 2012-2014 Andrew Turner
  * All rights reserved.
@@ -347,12 +347,16 @@ _C_LABEL(sigcode):
 1:
 	mov	x8, #SYS_sigreturn
 	svc	0
+	nop
+	nop
 	.globl  _C_LABEL(sigcoderet)
 _C_LABEL(sigcoderet):
 
 	/* sigreturn failed, exit */
 	mov	x8, #SYS_exit
 	svc	0
+	nop
+	nop
 
 	b	1b
 END(sigcode)
-- 
cgit v1.3-18-gd494