summaryrefslogtreecommitdiff
path: root/arch/mips/include/asm/stackframe.h
diff options
context:
space:
mode:
authorNeilBrown <neilb@suse.com>2015-09-05 11:07:04 +0200
committerNeilBrown <neilb@suse.com>2015-09-05 11:08:32 +0200
commite89c6fdf9e0eb1b5a03574d4ca73e83eae8deb91 (patch)
treef9df292ed03a5a3c4ddc658ae3646f02a1ffafce /arch/mips/include/asm/stackframe.h
parentc3cce6cda162eb2b2960a85d9c8992f4f3be85d0 (diff)
parent1081230b748de8f03f37f80c53dfa89feda9b8de (diff)
Merge linux-block/for-4.3/core into md/for-linux
There were a few conflicts that are fairly easy to resolve. Signed-off-by: NeilBrown <neilb@suse.com>
Diffstat (limited to 'arch/mips/include/asm/stackframe.h')
-rw-r--r--arch/mips/include/asm/stackframe.h25
1 files changed, 25 insertions, 0 deletions
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index 28d6d9364bd1..a71da576883c 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -152,6 +152,31 @@
.set noreorder
bltz k0, 8f
move k1, sp
+#ifdef CONFIG_EVA
+ /*
+ * Flush interAptiv's Return Prediction Stack (RPS) by writing
+ * EntryHi. Toggling Config7.RPS is slower and less portable.
+ *
+ * The RPS isn't automatically flushed when exceptions are
+ * taken, which can result in kernel mode speculative accesses
+ * to user addresses if the RPS mispredicts. That's harmless
+ * when user and kernel share the same address space, but with
+ * EVA the same user segments may be unmapped to kernel mode,
+ * even containing sensitive MMIO regions or invalid memory.
+ *
+ * This can happen when the kernel sets the return address to
+ * ret_from_* and jr's to the exception handler, which looks
+ * more like a tail call than a function call. If nested calls
+ * don't evict the last user address in the RPS, it will
+ * mispredict the return and fetch from a user controlled
+ * address into the icache.
+ *
+ * More recent EVA-capable cores with MAAR to restrict
+ * speculative accesses aren't affected.
+ */
+ MFC0 k0, CP0_ENTRYHI
+ MTC0 k0, CP0_ENTRYHI
+#endif
.set reorder
/* Called from user mode, new stack. */
get_saved_sp