Patch "MIPS: Flush RPS on kernel entry with EVA" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

MIPS: Flush RPS on kernel entry with EVA

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
mips-flush-rps-on-kernel-entry-with-eva.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: James Hogan <[email protected]>
Date: Fri, 31 Jul 2015 16:29:38 +0100
Subject: MIPS: Flush RPS on kernel entry with EVA

From: James Hogan <[email protected]>

commit 3aff47c062b944a5e1f9af56a37a23f5295628fc upstream.

When EVA is enabled, flush the Return Prediction Stack (RPS) present on some MIPS cores on entry to the kernel from user mode.

This is important specifically for interAptiv with EVA enabled, otherwise kernel mode RPS mispredicts may trigger speculative fetches of user return addresses, which may be sensitive in the kernel address space due to EVA's overlapping user/kernel address spaces.

Patchwork: https://patchwork.linux-mips.org/patch/10812/

---
 arch/mips/include/asm/stackframe.h |   25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

@@ -152,6 +152,31 @@
 		.set	noreorder
 		bltz	k0, 8f
 		 move	k1, sp
+#ifdef CONFIG_EVA
+		/*
+		 * Flush interAptiv's Return Prediction Stack (RPS) by writing
+		 * EntryHi. Toggling Config7.RPS is slower and less portable.
+		 *
+		 * The RPS isn't automatically flushed when exceptions are
+		 * taken, which can result in kernel mode speculative accesses
+		 * to user addresses if the RPS mispredicts. That's harmless
+		 * when user and kernel share the same address space, but with
+		 * EVA the same user segments may be unmapped to kernel mode,
+		 * even containing sensitive MMIO regions or invalid memory.
+		 *
+		 * This can happen when the kernel sets the return address to
+		 * ret_from_* and jr's to the exception handler, which looks
+		 * more like a tail call than a function call. If nested calls
+		 * don't evict the last user address in the RPS, it will
+		 * mispredict the return and fetch from a user controlled
+		 * address into the icache.
+		 *
+		 * More recent EVA-capable cores with MAAR to restrict
+		 * speculative accesses aren't affected.
+		 */
+		MFC0	k0, CP0_ENTRYHI
+		MTC0	k0, CP0_ENTRYHI
+#endif
 		.set	reorder
 		/* Called from user mode, new stack. */
 		get_saved_sp

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/mips-show_stack-fix-stack-trace-with-eva.patch queue-4.1/mips-flush-rps-on-kernel-entry-with-eva.patch queue-4.1/mips-do_mcheck-fix-kernel-code-dump-with-eva.patch queue-4.1/mips-malta-don-t-reinitialise-rtc.patch