1 files changed, 15 insertions, 2 deletions

diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 85f6ccb80b91..a399c1ebf6f0 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -6,6 +6,7 @@
 #include <asm/pgtable.h>
 #include <asm/processor-flags.h>
 #include <asm/tlb.h>
+#include <asm/nospec-branch.h>
 
 /*
  * We map the EFI regions needed for runtime services non-contiguously,
@@ -36,8 +37,18 @@
 
 extern asmlinkage unsigned long efi_call_phys(void *, ...);
 
-#define arch_efi_call_virt_setup()      kernel_fpu_begin()
-#define arch_efi_call_virt_teardown()   kernel_fpu_end()
+#define arch_efi_call_virt_setup()                                      \
+({                                                                      \
+        kernel_fpu_begin();                                             \
+        firmware_restrict_branch_speculation_start();                   \
+})
+
+#define arch_efi_call_virt_teardown()                                   \
+({                                                                      \
+        firmware_restrict_branch_speculation_end();                     \
+        kernel_fpu_end();                                               \
+})
+
 
 /*
  * Wrap all the virtual calls in a way that forces the parameters on the stack.
@@ -73,6 +84,7 @@ struct efi_scratch {
         efi_sync_low_kernel_mappings();                                 \
         preempt_disable();                                              \
         __kernel_fpu_begin();                                           \
+        firmware_restrict_branch_speculation_start();                   \
                                                                         \
         if (efi_scratch.use_pgd) {                                      \
                 efi_scratch.prev_cr3 = __read_cr3();                    \
@@ -91,6 +103,7 @@ struct efi_scratch {
                 __flush_tlb_all();                                      \
         }                                                               \
                                                                         \
+        firmware_restrict_branch_speculation_end();                     \
         __kernel_fpu_end();                                             \
         preempt_enable();                                               \
 })