[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     645f3565be0d4dce743c0b1a2b71093f0889d815
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 30 10:29:51 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Apr 30 10:29:51 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=645f3565

Linux patch 4.14.38

 0000_README              |    4 +
 1037_linux-4.14.38.patch | 4524 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 4528 insertions(+)

diff --git a/0000_README b/0000_README
index 73aafae..03b1461 100644
--- a/0000_README
+++ b/0000_README
@@ -191,6 +191,10 @@ Patch:  1036_linux-4.14.37.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.37
 
+Patch:  1037_linux-4.14.38.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.38
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1037_linux-4.14.38.patch b/1037_linux-4.14.38.patch
new file mode 100644
index 0000000..4612b61
--- /dev/null
+++ b/1037_linux-4.14.38.patch
@@ -0,0 +1,4524 @@
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index fb385af482ff..8cfb44ffe853 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -2541,6 +2541,9 @@
+ 
+ 	noalign		[KNL,ARM]
+ 
++	noaltinstr	[S390] Disables alternative instructions patching
++			(CPU alternatives feature).
++
+ 	noapic		[SMP,APIC] Tells the kernel to not make use of any
+ 			IOAPICs that may be present in the system.
+ 
+diff --git a/Makefile b/Makefile
+index ee330f5449e6..27a8d5c37180 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 37
++SUBLEVEL = 38
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+index 910628d18add..1fc5060d7027 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+@@ -155,17 +155,6 @@
+ 		regulator-min-microvolt = <5000000>;
+ 		regulator-max-microvolt = <5000000>;
+ 	};
+-
+-	vdd_log: vdd-log {
+-		compatible = "pwm-regulator";
+-		pwms = <&pwm2 0 25000 0>;
+-		regulator-name = "vdd_log";
+-		regulator-min-microvolt = <800000>;
+-		regulator-max-microvolt = <1400000>;
+-		regulator-always-on;
+-		regulator-boot-on;
+-		status = "okay";
+-	};
+ };
+ 
+ &cpu_b0 {
+diff --git a/arch/microblaze/Kconfig.platform b/arch/microblaze/Kconfig.platform
+index 1b3d8c849101..f7f1739c11b9 100644
+--- a/arch/microblaze/Kconfig.platform
++++ b/arch/microblaze/Kconfig.platform
+@@ -20,6 +20,7 @@ config OPT_LIB_FUNCTION
+ config OPT_LIB_ASM
+ 	bool "Optimalized lib function ASM"
+ 	depends on OPT_LIB_FUNCTION && (XILINX_MICROBLAZE0_USE_BARREL = 1)
++	depends on CPU_BIG_ENDIAN
+ 	default n
+ 	help
+ 	  Allows turn on optimalized library function (memcpy and memmove).
+diff --git a/arch/microblaze/lib/fastcopy.S b/arch/microblaze/lib/fastcopy.S
+index 62021d7e249e..fdc48bb065d8 100644
+--- a/arch/microblaze/lib/fastcopy.S
++++ b/arch/microblaze/lib/fastcopy.S
+@@ -29,10 +29,6 @@
+  *	between mem locations with size of xfer spec'd in bytes
+  */
+ 
+-#ifdef __MICROBLAZEEL__
+-#error Microblaze LE not support ASM optimized lib func. Disable OPT_LIB_ASM.
+-#endif
+-
+ #include <linux/linkage.h>
+ 	.text
+ 	.globl	memcpy
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index ae55e715cc74..49fb6614ea8c 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -121,6 +121,7 @@ config S390
+ 	select GENERIC_CLOCKEVENTS
+ 	select GENERIC_CPU_AUTOPROBE
+ 	select GENERIC_CPU_DEVICES if !SMP
++	select GENERIC_CPU_VULNERABILITIES
+ 	select GENERIC_FIND_FIRST_BIT
+ 	select GENERIC_SMP_IDLE_THREAD
+ 	select GENERIC_TIME_VSYSCALL
+@@ -538,6 +539,51 @@ config ARCH_RANDOM
+ 
+ 	  If unsure, say Y.
+ 
++config KERNEL_NOBP
++	def_bool n
++	prompt "Enable modified branch prediction for the kernel by default"
++	help
++	  If this option is selected the kernel will switch to a modified
++	  branch prediction mode if the firmware interface is available.
++	  The modified branch prediction mode improves the behaviour in
++	  regard to speculative execution.
++
++	  With the option enabled the kernel parameter "nobp=0" or "nospec"
++	  can be used to run the kernel in the normal branch prediction mode.
++
++	  With the option disabled the modified branch prediction mode is
++	  enabled with the "nobp=1" kernel parameter.
++
++	  If unsure, say N.
++
++config EXPOLINE
++	def_bool n
++	prompt "Avoid speculative indirect branches in the kernel"
++	help
++	  Compile the kernel with the expoline compiler options to guard
++	  against kernel-to-user data leaks by avoiding speculative indirect
++	  branches.
++	  Requires a compiler with -mindirect-branch=thunk support for full
++	  protection. The kernel may run slower.
++
++	  If unsure, say N.
++
++choice
++	prompt "Expoline default"
++	depends on EXPOLINE
++	default EXPOLINE_FULL
++
++config EXPOLINE_OFF
++	bool "spectre_v2=off"
++
++config EXPOLINE_AUTO
++	bool "spectre_v2=auto"
++
++config EXPOLINE_FULL
++	bool "spectre_v2=on"
++
++endchoice
++
+ endmenu
+ 
+ menu "Memory setup"
+@@ -812,6 +858,7 @@ config PFAULT
+ config SHARED_KERNEL
+ 	bool "VM shared kernel support"
+ 	depends on !JUMP_LABEL
++	depends on !ALTERNATIVES
+ 	help
+ 	  Select this option, if you want to share the text segment of the
+ 	  Linux kernel between different VM guests. This reduces memory
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index dac821cfcd43..ec3fa105f448 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -81,6 +81,16 @@ ifeq ($(call cc-option-yn,-mwarn-dynamicstack),y)
+ cflags-$(CONFIG_WARN_DYNAMIC_STACK) += -mwarn-dynamicstack
+ endif
+ 
++ifdef CONFIG_EXPOLINE
++  ifeq ($(call cc-option-yn,$(CC_FLAGS_MARCH) -mindirect-branch=thunk),y)
++    CC_FLAGS_EXPOLINE := -mindirect-branch=thunk
++    CC_FLAGS_EXPOLINE += -mfunction-return=thunk
++    CC_FLAGS_EXPOLINE += -mindirect-branch-table
++    export CC_FLAGS_EXPOLINE
++    cflags-y += $(CC_FLAGS_EXPOLINE) -DCC_USING_EXPOLINE
++  endif
++endif
++
+ ifdef CONFIG_FUNCTION_TRACER
+ # make use of hotpatch feature if the compiler supports it
+ cc_hotpatch	:= -mhotpatch=0,3
+diff --git a/arch/s390/include/asm/alternative.h b/arch/s390/include/asm/alternative.h
+new file mode 100644
+index 000000000000..a72002056b54
+--- /dev/null
++++ b/arch/s390/include/asm/alternative.h
+@@ -0,0 +1,149 @@
++#ifndef _ASM_S390_ALTERNATIVE_H
++#define _ASM_S390_ALTERNATIVE_H
++
++#ifndef __ASSEMBLY__
++
++#include <linux/types.h>
++#include <linux/stddef.h>
++#include <linux/stringify.h>
++
++struct alt_instr {
++	s32 instr_offset;	/* original instruction */
++	s32 repl_offset;	/* offset to replacement instruction */
++	u16 facility;		/* facility bit set for replacement */
++	u8  instrlen;		/* length of original instruction */
++	u8  replacementlen;	/* length of new instruction */
++} __packed;
++
++void apply_alternative_instructions(void);
++void apply_alternatives(struct alt_instr *start, struct alt_instr *end);
++
++/*
++ * |661:       |662:	  |6620      |663:
++ * +-----------+---------------------+
++ * | oldinstr  | oldinstr_padding    |
++ * |	       +----------+----------+
++ * |	       |	  |	     |
++ * |	       | >6 bytes |6/4/2 nops|
++ * |	       |6 bytes jg----------->
++ * +-----------+---------------------+
++ *		 ^^ static padding ^^
++ *
++ * .altinstr_replacement section
++ * +---------------------+-----------+
++ * |6641:			     |6651:
++ * | alternative instr 1	     |
++ * +-----------+---------+- - - - - -+
++ * |6642:		 |6652:      |
++ * | alternative instr 2 | padding
++ * +---------------------+- - - - - -+
++ *			  ^ runtime ^
++ *
++ * .altinstructions section
++ * +---------------------------------+
++ * | alt_instr entries for each      |
++ * | alternative instr		     |
++ * +---------------------------------+
++ */
++
++#define b_altinstr(num)	"664"#num
++#define e_altinstr(num)	"665"#num
++
++#define e_oldinstr_pad_end	"663"
++#define oldinstr_len		"662b-661b"
++#define oldinstr_total_len	e_oldinstr_pad_end"b-661b"
++#define altinstr_len(num)	e_altinstr(num)"b-"b_altinstr(num)"b"
++#define oldinstr_pad_len(num) \
++	"-(((" altinstr_len(num) ")-(" oldinstr_len ")) > 0) * " \
++	"((" altinstr_len(num) ")-(" oldinstr_len "))"
++
++#define INSTR_LEN_SANITY_CHECK(len)					\
++	".if " len " > 254\n"						\
++	"\t.error \"cpu alternatives does not support instructions "	\
++		"blocks > 254 bytes\"\n"				\
++	".endif\n"							\
++	".if (" len ") %% 2\n"						\
++	"\t.error \"cpu alternatives instructions length is odd\"\n"	\
++	".endif\n"
++
++#define OLDINSTR_PADDING(oldinstr, num)					\
++	".if " oldinstr_pad_len(num) " > 6\n"				\
++	"\tjg " e_oldinstr_pad_end "f\n"				\
++	"6620:\n"							\
++	"\t.fill (" oldinstr_pad_len(num) " - (6620b-662b)) / 2, 2, 0x0700\n" \
++	".else\n"							\
++	"\t.fill " oldinstr_pad_len(num) " / 6, 6, 0xc0040000\n"	\
++	"\t.fill " oldinstr_pad_len(num) " %% 6 / 4, 4, 0x47000000\n"	\
++	"\t.fill " oldinstr_pad_len(num) " %% 6 %% 4 / 2, 2, 0x0700\n"	\
++	".endif\n"
++
++#define OLDINSTR(oldinstr, num)						\
++	"661:\n\t" oldinstr "\n662:\n"					\
++	OLDINSTR_PADDING(oldinstr, num)					\
++	e_oldinstr_pad_end ":\n"					\
++	INSTR_LEN_SANITY_CHECK(oldinstr_len)
++
++#define OLDINSTR_2(oldinstr, num1, num2)				\
++	"661:\n\t" oldinstr "\n662:\n"					\
++	".if " altinstr_len(num1) " < " altinstr_len(num2) "\n"		\
++	OLDINSTR_PADDING(oldinstr, num2)				\
++	".else\n"							\
++	OLDINSTR_PADDING(oldinstr, num1)				\
++	".endif\n"							\
++	e_oldinstr_pad_end ":\n"					\
++	INSTR_LEN_SANITY_CHECK(oldinstr_len)
++
++#define ALTINSTR_ENTRY(facility, num)					\
++	"\t.long 661b - .\n"			/* old instruction */	\
++	"\t.long " b_altinstr(num)"b - .\n"	/* alt instruction */	\
++	"\t.word " __stringify(facility) "\n"	/* facility bit    */	\
++	"\t.byte " oldinstr_total_len "\n"	/* source len	   */	\
++	"\t.byte " altinstr_len(num) "\n"	/* alt instruction len */
++
++#define ALTINSTR_REPLACEMENT(altinstr, num)	/* replacement */	\
++	b_altinstr(num)":\n\t" altinstr "\n" e_altinstr(num) ":\n"	\
++	INSTR_LEN_SANITY_CHECK(altinstr_len(num))
++
++/* alternative assembly primitive: */
++#define ALTERNATIVE(oldinstr, altinstr, facility) \
++	".pushsection .altinstr_replacement, \"ax\"\n"			\
++	ALTINSTR_REPLACEMENT(altinstr, 1)				\
++	".popsection\n"							\
++	OLDINSTR(oldinstr, 1)						\
++	".pushsection .altinstructions,\"a\"\n"				\
++	ALTINSTR_ENTRY(facility, 1)					\
++	".popsection\n"
++
++#define ALTERNATIVE_2(oldinstr, altinstr1, facility1, altinstr2, facility2)\
++	".pushsection .altinstr_replacement, \"ax\"\n"			\
++	ALTINSTR_REPLACEMENT(altinstr1, 1)				\
++	ALTINSTR_REPLACEMENT(altinstr2, 2)				\
++	".popsection\n"							\
++	OLDINSTR_2(oldinstr, 1, 2)					\
++	".pushsection .altinstructions,\"a\"\n"				\
++	ALTINSTR_ENTRY(facility1, 1)					\
++	ALTINSTR_ENTRY(facility2, 2)					\
++	".popsection\n"
++
++/*
++ * Alternative instructions for different CPU types or capabilities.
++ *
++ * This allows to use optimized instructions even on generic binary
++ * kernels.
++ *
++ * oldinstr is padded with jump and nops at compile time if altinstr is
++ * longer. altinstr is padded with jump and nops at run-time during patching.
++ *
++ * For non barrier like inlines please define new variants
++ * without volatile and memory clobber.
++ */
++#define alternative(oldinstr, altinstr, facility)			\
++	asm volatile(ALTERNATIVE(oldinstr, altinstr, facility) : : : "memory")
++
++#define alternative_2(oldinstr, altinstr1, facility1, altinstr2, facility2) \
++	asm volatile(ALTERNATIVE_2(oldinstr, altinstr1, facility1,	    \
++				   altinstr2, facility2) ::: "memory")
++
++#endif /* __ASSEMBLY__ */
++
++#endif /* _ASM_S390_ALTERNATIVE_H */
+diff --git a/arch/s390/include/asm/barrier.h b/arch/s390/include/asm/barrier.h
+index 10432607a573..f9eddbca79d2 100644
+--- a/arch/s390/include/asm/barrier.h
++++ b/arch/s390/include/asm/barrier.h
+@@ -49,6 +49,30 @@ do {									\
+ #define __smp_mb__before_atomic()	barrier()
+ #define __smp_mb__after_atomic()	barrier()
+ 
++/**
++ * array_index_mask_nospec - generate a mask for array_idx() that is
++ * ~0UL when the bounds check succeeds and 0 otherwise
++ * @index: array element index
++ * @size: number of elements in array
++ */
++#define array_index_mask_nospec array_index_mask_nospec
++static inline unsigned long array_index_mask_nospec(unsigned long index,
++						    unsigned long size)
++{
++	unsigned long mask;
++
++	if (__builtin_constant_p(size) && size > 0) {
++		asm("	clgr	%2,%1\n"
++		    "	slbgr	%0,%0\n"
++		    :"=d" (mask) : "d" (size-1), "d" (index) :"cc");
++		return mask;
++	}
++	asm("	clgr	%1,%2\n"
++	    "	slbgr	%0,%0\n"
++	    :"=d" (mask) : "d" (size), "d" (index) :"cc");
++	return ~mask;
++}
++
+ #include <asm-generic/barrier.h>
+ 
+ #endif /* __ASM_BARRIER_H */
+diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
+index f040644575b7..2d58478c2745 100644
+--- a/arch/s390/include/asm/facility.h
++++ b/arch/s390/include/asm/facility.h
+@@ -15,6 +15,24 @@
+ 
+ #define MAX_FACILITY_BIT (sizeof(((struct lowcore *)0)->stfle_fac_list) * 8)
+ 
++static inline void __set_facility(unsigned long nr, void *facilities)
++{
++	unsigned char *ptr = (unsigned char *) facilities;
++
++	if (nr >= MAX_FACILITY_BIT)
++		return;
++	ptr[nr >> 3] |= 0x80 >> (nr & 7);
++}
++
++static inline void __clear_facility(unsigned long nr, void *facilities)
++{
++	unsigned char *ptr = (unsigned char *) facilities;
++
++	if (nr >= MAX_FACILITY_BIT)
++		return;
++	ptr[nr >> 3] &= ~(0x80 >> (nr & 7));
++}
++
+ static inline int __test_facility(unsigned long nr, void *facilities)
+ {
+ 	unsigned char *ptr;
+diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
+index 51375e766e90..d660e784e445 100644
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -210,7 +210,8 @@ struct kvm_s390_sie_block {
+ 	__u16	ipa;			/* 0x0056 */
+ 	__u32	ipb;			/* 0x0058 */
+ 	__u32	scaoh;			/* 0x005c */
+-	__u8	reserved60;		/* 0x0060 */
++#define FPF_BPBC 	0x20
++	__u8	fpf;			/* 0x0060 */
+ #define ECB_GS		0x40
+ #define ECB_TE		0x10
+ #define ECB_SRSI	0x04
+diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
+index 917f7344cab6..88a212df0dbc 100644
+--- a/arch/s390/include/asm/lowcore.h
++++ b/arch/s390/include/asm/lowcore.h
+@@ -140,7 +140,9 @@ struct lowcore {
+ 	/* Per cpu primary space access list */
+ 	__u32	paste[16];			/* 0x0400 */
+ 
+-	__u8	pad_0x04c0[0x0e00-0x0440];	/* 0x0440 */
++	/* br %r1 trampoline */
++	__u16	br_r1_trampoline;		/* 0x0440 */
++	__u8	pad_0x0442[0x0e00-0x0442];	/* 0x0442 */
+ 
+ 	/*
+ 	 * 0xe00 contains the address of the IPL Parameter Information
+@@ -155,7 +157,8 @@ struct lowcore {
+ 	__u8	pad_0x0e20[0x0f00-0x0e20];	/* 0x0e20 */
+ 
+ 	/* Extended facility list */
+-	__u64	stfle_fac_list[32];		/* 0x0f00 */
++	__u64	stfle_fac_list[16];		/* 0x0f00 */
++	__u64	alt_stfle_fac_list[16];		/* 0x0f80 */
+ 	__u8	pad_0x1000[0x11b0-0x1000];	/* 0x1000 */
+ 
+ 	/* Pointer to the machine check extended save area */
+diff --git a/arch/s390/include/asm/nospec-branch.h b/arch/s390/include/asm/nospec-branch.h
+new file mode 100644
+index 000000000000..b4bd8c41e9d3
+--- /dev/null
++++ b/arch/s390/include/asm/nospec-branch.h
+@@ -0,0 +1,17 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_S390_EXPOLINE_H
++#define _ASM_S390_EXPOLINE_H
++
++#ifndef __ASSEMBLY__
++
++#include <linux/types.h>
++
++extern int nospec_disable;
++
++void nospec_init_branches(void);
++void nospec_auto_detect(void);
++void nospec_revert(s32 *start, s32 *end);
++
++#endif /* __ASSEMBLY__ */
++
++#endif /* _ASM_S390_EXPOLINE_H */
+diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
+index 9cf92abe23c3..0a39cd102c49 100644
+--- a/arch/s390/include/asm/processor.h
++++ b/arch/s390/include/asm/processor.h
+@@ -89,6 +89,7 @@ void cpu_detect_mhz_feature(void);
+ extern const struct seq_operations cpuinfo_op;
+ extern int sysctl_ieee_emulation_warnings;
+ extern void execve_tail(void);
++extern void __bpon(void);
+ 
+ /*
+  * User space process size: 2GB for 31 bit, 4TB or 8PT for 64 bit.
+@@ -377,6 +378,9 @@ extern void memcpy_absolute(void *, void *, size_t);
+ 	memcpy_absolute(&(dest), &__tmp, sizeof(__tmp));	\
+ } while (0)
+ 
++extern int s390_isolate_bp(void);
++extern int s390_isolate_bp_guest(void);
++
+ #endif /* __ASSEMBLY__ */
+ 
+ #endif /* __ASM_S390_PROCESSOR_H */
+diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h
+index 0880a37b6d3b..301b4f70bf31 100644
+--- a/arch/s390/include/asm/thread_info.h
++++ b/arch/s390/include/asm/thread_info.h
+@@ -60,6 +60,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
+ #define TIF_GUARDED_STORAGE	4	/* load guarded storage control block */
+ #define TIF_PATCH_PENDING	5	/* pending live patching update */
+ #define TIF_PGSTE		6	/* New mm's will use 4K page tables */
++#define TIF_ISOLATE_BP		8	/* Run process with isolated BP */
++#define TIF_ISOLATE_BP_GUEST	9	/* Run KVM guests with isolated BP */
+ 
+ #define TIF_31BIT		16	/* 32bit process */
+ #define TIF_MEMDIE		17	/* is terminating due to OOM killer */
+@@ -80,6 +82,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
+ #define _TIF_UPROBE		_BITUL(TIF_UPROBE)
+ #define _TIF_GUARDED_STORAGE	_BITUL(TIF_GUARDED_STORAGE)
+ #define _TIF_PATCH_PENDING	_BITUL(TIF_PATCH_PENDING)
++#define _TIF_ISOLATE_BP		_BITUL(TIF_ISOLATE_BP)
++#define _TIF_ISOLATE_BP_GUEST	_BITUL(TIF_ISOLATE_BP_GUEST)
+ 
+ #define _TIF_31BIT		_BITUL(TIF_31BIT)
+ #define _TIF_SINGLE_STEP	_BITUL(TIF_SINGLE_STEP)
+diff --git a/arch/s390/include/uapi/asm/kvm.h b/arch/s390/include/uapi/asm/kvm.h
+index 9ad172dcd912..a3938db010f7 100644
+--- a/arch/s390/include/uapi/asm/kvm.h
++++ b/arch/s390/include/uapi/asm/kvm.h
+@@ -228,6 +228,7 @@ struct kvm_guest_debug_arch {
+ #define KVM_SYNC_RICCB  (1UL << 7)
+ #define KVM_SYNC_FPRS   (1UL << 8)
+ #define KVM_SYNC_GSCB   (1UL << 9)
++#define KVM_SYNC_BPBC   (1UL << 10)
+ /* length and alignment of the sdnx as a power of two */
+ #define SDNXC 8
+ #define SDNXL (1UL << SDNXC)
+@@ -251,7 +252,9 @@ struct kvm_sync_regs {
+ 	};
+ 	__u8  reserved[512];	/* for future vector expansion */
+ 	__u32 fpc;		/* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */
+-	__u8 padding1[52];	/* riccb needs to be 64byte aligned */
++	__u8 bpbc : 1;		/* bp mode */
++	__u8 reserved2 : 7;
++	__u8 padding1[51];	/* riccb needs to be 64byte aligned */
+ 	__u8 riccb[64];		/* runtime instrumentation controls block */
+ 	__u8 padding2[192];	/* sdnx needs to be 256byte aligned */
+ 	union {
+diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
+index 4ce2d05929a7..a3a4cafb6080 100644
+--- a/arch/s390/kernel/Makefile
++++ b/arch/s390/kernel/Makefile
+@@ -29,6 +29,7 @@ UBSAN_SANITIZE_early.o	:= n
+ #
+ ifneq ($(CC_FLAGS_MARCH),-march=z900)
+ CFLAGS_REMOVE_als.o	+= $(CC_FLAGS_MARCH)
++CFLAGS_REMOVE_als.o	+= $(CC_FLAGS_EXPOLINE)
+ CFLAGS_als.o		+= -march=z900
+ AFLAGS_REMOVE_head.o	+= $(CC_FLAGS_MARCH)
+ AFLAGS_head.o		+= -march=z900
+@@ -57,10 +58,13 @@ obj-y	+= processor.o sys_s390.o ptrace.o signal.o cpcmd.o ebcdic.o nmi.o
+ obj-y	+= debug.o irq.o ipl.o dis.o diag.o vdso.o als.o
+ obj-y	+= sysinfo.o jump_label.o lgr.o os_info.o machine_kexec.o pgm_check.o
+ obj-y	+= runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o
+-obj-y	+= entry.o reipl.o relocate_kernel.o kdebugfs.o
++obj-y	+= entry.o reipl.o relocate_kernel.o kdebugfs.o alternative.o
++obj-y	+= nospec-branch.o
+ 
+ extra-y				+= head.o head64.o vmlinux.lds
+ 
++CFLAGS_REMOVE_nospec-branch.o	+= $(CC_FLAGS_EXPOLINE)
++
+ obj-$(CONFIG_MODULES)		+= module.o
+ obj-$(CONFIG_SMP)		+= smp.o
+ obj-$(CONFIG_SCHED_TOPOLOGY)	+= topology.o
+diff --git a/arch/s390/kernel/alternative.c b/arch/s390/kernel/alternative.c
+new file mode 100644
+index 000000000000..b57b293998dc
+--- /dev/null
++++ b/arch/s390/kernel/alternative.c
+@@ -0,0 +1,112 @@
++#include <linux/module.h>
++#include <asm/alternative.h>
++#include <asm/facility.h>
++#include <asm/nospec-branch.h>
++
++#define MAX_PATCH_LEN (255 - 1)
++
++static int __initdata_or_module alt_instr_disabled;
++
++static int __init disable_alternative_instructions(char *str)
++{
++	alt_instr_disabled = 1;
++	return 0;
++}
++
++early_param("noaltinstr", disable_alternative_instructions);
++
++struct brcl_insn {
++	u16 opc;
++	s32 disp;
++} __packed;
++
++static u16 __initdata_or_module nop16 = 0x0700;
++static u32 __initdata_or_module nop32 = 0x47000000;
++static struct brcl_insn __initdata_or_module nop48 = {
++	0xc004, 0
++};
++
++static const void *nops[] __initdata_or_module = {
++	&nop16,
++	&nop32,
++	&nop48
++};
++
++static void __init_or_module add_jump_padding(void *insns, unsigned int len)
++{
++	struct brcl_insn brcl = {
++		0xc0f4,
++		len / 2
++	};
++
++	memcpy(insns, &brcl, sizeof(brcl));
++	insns += sizeof(brcl);
++	len -= sizeof(brcl);
++
++	while (len > 0) {
++		memcpy(insns, &nop16, 2);
++		insns += 2;
++		len -= 2;
++	}
++}
++
++static void __init_or_module add_padding(void *insns, unsigned int len)
++{
++	if (len > 6)
++		add_jump_padding(insns, len);
++	else if (len >= 2)
++		memcpy(insns, nops[len / 2 - 1], len);
++}
++
++static void __init_or_module __apply_alternatives(struct alt_instr *start,
++						  struct alt_instr *end)
++{
++	struct alt_instr *a;
++	u8 *instr, *replacement;
++	u8 insnbuf[MAX_PATCH_LEN];
++
++	/*
++	 * The scan order should be from start to end. A later scanned
++	 * alternative code can overwrite previously scanned alternative code.
++	 */
++	for (a = start; a < end; a++) {
++		int insnbuf_sz = 0;
++
++		instr = (u8 *)&a->instr_offset + a->instr_offset;
++		replacement = (u8 *)&a->repl_offset + a->repl_offset;
++
++		if (!__test_facility(a->facility,
++				     S390_lowcore.alt_stfle_fac_list))
++			continue;
++
++		if (unlikely(a->instrlen % 2 || a->replacementlen % 2)) {
++			WARN_ONCE(1, "cpu alternatives instructions length is "
++				     "odd, skipping patching\n");
++			continue;
++		}
++
++		memcpy(insnbuf, replacement, a->replacementlen);
++		insnbuf_sz = a->replacementlen;
++
++		if (a->instrlen > a->replacementlen) {
++			add_padding(insnbuf + a->replacementlen,
++				    a->instrlen - a->replacementlen);
++			insnbuf_sz += a->instrlen - a->replacementlen;
++		}
++
++		s390_kernel_write(instr, insnbuf, insnbuf_sz);
++	}
++}
++
++void __init_or_module apply_alternatives(struct alt_instr *start,
++					 struct alt_instr *end)
++{
++	if (!alt_instr_disabled)
++		__apply_alternatives(start, end);
++}
++
++extern struct alt_instr __alt_instructions[], __alt_instructions_end[];
++void __init apply_alternative_instructions(void)
++{
++	apply_alternatives(__alt_instructions, __alt_instructions_end);
++}
+diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c
+index f7b280f0ab16..a3219837fa70 100644
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -329,6 +329,11 @@ static noinline __init void setup_facility_list(void)
+ {
+ 	stfle(S390_lowcore.stfle_fac_list,
+ 	      ARRAY_SIZE(S390_lowcore.stfle_fac_list));
++	memcpy(S390_lowcore.alt_stfle_fac_list,
++	       S390_lowcore.stfle_fac_list,
++	       sizeof(S390_lowcore.alt_stfle_fac_list));
++	if (!IS_ENABLED(CONFIG_KERNEL_NOBP))
++		__clear_facility(82, S390_lowcore.alt_stfle_fac_list);
+ }
+ 
+ static __init void detect_diag9c(void)
+diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
+index 7c6904d616d8..ed9aaa212d4a 100644
+--- a/arch/s390/kernel/entry.S
++++ b/arch/s390/kernel/entry.S
+@@ -106,6 +106,7 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
+ 	aghi	%r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
+ 	j	3f
+ 1:	UPDATE_VTIME %r14,%r15,\timer
++	BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
+ 2:	lg	%r15,__LC_ASYNC_STACK	# load async stack
+ 3:	la	%r11,STACK_FRAME_OVERHEAD(%r15)
+ 	.endm
+@@ -158,6 +159,130 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
+ 		tm	off+\addr, \mask
+ 	.endm
+ 
++	.macro BPOFF
++	.pushsection .altinstr_replacement, "ax"
++660:	.long	0xb2e8c000
++	.popsection
++661:	.long	0x47000000
++	.pushsection .altinstructions, "a"
++	.long 661b - .
++	.long 660b - .
++	.word 82
++	.byte 4
++	.byte 4
++	.popsection
++	.endm
++
++	.macro BPON
++	.pushsection .altinstr_replacement, "ax"
++662:	.long	0xb2e8d000
++	.popsection
++663:	.long	0x47000000
++	.pushsection .altinstructions, "a"
++	.long 663b - .
++	.long 662b - .
++	.word 82
++	.byte 4
++	.byte 4
++	.popsection
++	.endm
++
++	.macro BPENTER tif_ptr,tif_mask
++	.pushsection .altinstr_replacement, "ax"
++662:	.word	0xc004, 0x0000, 0x0000	# 6 byte nop
++	.word	0xc004, 0x0000, 0x0000	# 6 byte nop
++	.popsection
++664:	TSTMSK	\tif_ptr,\tif_mask
++	jz	. + 8
++	.long	0xb2e8d000
++	.pushsection .altinstructions, "a"
++	.long 664b - .
++	.long 662b - .
++	.word 82
++	.byte 12
++	.byte 12
++	.popsection
++	.endm
++
++	.macro BPEXIT tif_ptr,tif_mask
++	TSTMSK	\tif_ptr,\tif_mask
++	.pushsection .altinstr_replacement, "ax"
++662:	jnz	. + 8
++	.long	0xb2e8d000
++	.popsection
++664:	jz	. + 8
++	.long	0xb2e8c000
++	.pushsection .altinstructions, "a"
++	.long 664b - .
++	.long 662b - .
++	.word 82
++	.byte 8
++	.byte 8
++	.popsection
++	.endm
++
++#ifdef CONFIG_EXPOLINE
++
++	.macro GEN_BR_THUNK name,reg,tmp
++	.section .text.\name,"axG",@progbits,\name,comdat
++	.globl \name
++	.hidden \name
++	.type \name,@function
++\name:
++	.cfi_startproc
++#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES
++	exrl	0,0f
++#else
++	larl	\tmp,0f
++	ex	0,0(\tmp)
++#endif
++	j	.
++0:	br	\reg
++	.cfi_endproc
++	.endm
++
++	GEN_BR_THUNK __s390x_indirect_jump_r1use_r9,%r9,%r1
++	GEN_BR_THUNK __s390x_indirect_jump_r1use_r14,%r14,%r1
++	GEN_BR_THUNK __s390x_indirect_jump_r11use_r14,%r14,%r11
++
++	.macro BASR_R14_R9
++0:	brasl	%r14,__s390x_indirect_jump_r1use_r9
++	.pushsection .s390_indirect_branches,"a",@progbits
++	.long	0b-.
++	.popsection
++	.endm
++
++	.macro BR_R1USE_R14
++0:	jg	__s390x_indirect_jump_r1use_r14
++	.pushsection .s390_indirect_branches,"a",@progbits
++	.long	0b-.
++	.popsection
++	.endm
++
++	.macro BR_R11USE_R14
++0:	jg	__s390x_indirect_jump_r11use_r14
++	.pushsection .s390_indirect_branches,"a",@progbits
++	.long	0b-.
++	.popsection
++	.endm
++
++#else	/* CONFIG_EXPOLINE */
++
++	.macro BASR_R14_R9
++	basr	%r14,%r9
++	.endm
++
++	.macro BR_R1USE_R14
++	br	%r14
++	.endm
++
++	.macro BR_R11USE_R14
++	br	%r14
++	.endm
++
++#endif /* CONFIG_EXPOLINE */
++
++
+ 	.section .kprobes.text, "ax"
+ .Ldummy:
+ 	/*
+@@ -170,6 +295,11 @@ _PIF_WORK	= (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART)
+ 	 */
+ 	nop	0
+ 
++ENTRY(__bpon)
++	.globl __bpon
++	BPON
++	BR_R1USE_R14
++
+ /*
+  * Scheduler resume function, called by switch_to
+  *  gpr2 = (task_struct *) prev
+@@ -193,9 +323,9 @@ ENTRY(__switch_to)
+ 	mvc	__LC_CURRENT_PID(4,%r0),__TASK_pid(%r3) # store pid of next
+ 	lmg	%r6,%r15,__SF_GPRS(%r15)	# load gprs of next task
+ 	TSTMSK	__LC_MACHINE_FLAGS,MACHINE_FLAG_LPP
+-	bzr	%r14
++	jz	0f
+ 	.insn	s,0xb2800000,__LC_LPP		# set program parameter
+-	br	%r14
++0:	BR_R1USE_R14
+ 
+ .L__critical_start:
+ 
+@@ -207,9 +337,11 @@ ENTRY(__switch_to)
+  */
+ ENTRY(sie64a)
+ 	stmg	%r6,%r14,__SF_GPRS(%r15)	# save kernel registers
++	lg	%r12,__LC_CURRENT
+ 	stg	%r2,__SF_EMPTY(%r15)		# save control block pointer
+ 	stg	%r3,__SF_EMPTY+8(%r15)		# save guest register save area
+ 	xc	__SF_EMPTY+16(8,%r15),__SF_EMPTY+16(%r15) # reason code = 0
++	mvc	__SF_EMPTY+24(8,%r15),__TI_flags(%r12) # copy thread flags
+ 	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU		# load guest fp/vx registers ?
+ 	jno	.Lsie_load_guest_gprs
+ 	brasl	%r14,load_fpu_regs		# load guest fp/vx regs
+@@ -226,8 +358,12 @@ ENTRY(sie64a)
+ 	jnz	.Lsie_skip
+ 	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU
+ 	jo	.Lsie_skip			# exit if fp/vx regs changed
++	BPEXIT	__SF_EMPTY+24(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST)
+ .Lsie_entry:
+ 	sie	0(%r14)
++.Lsie_exit:
++	BPOFF
++	BPENTER	__SF_EMPTY+24(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST)
+ .Lsie_skip:
+ 	ni	__SIE_PROG0C+3(%r14),0xfe	# no longer in SIE
+ 	lctlg	%c1,%c1,__LC_USER_ASCE		# load primary asce
+@@ -248,9 +384,15 @@ ENTRY(sie64a)
+ sie_exit:
+ 	lg	%r14,__SF_EMPTY+8(%r15)		# load guest register save area
+ 	stmg	%r0,%r13,0(%r14)		# save guest gprs 0-13
++	xgr	%r0,%r0				# clear guest registers to
++	xgr	%r1,%r1				# prevent speculative use
++	xgr	%r2,%r2
++	xgr	%r3,%r3
++	xgr	%r4,%r4
++	xgr	%r5,%r5
+ 	lmg	%r6,%r14,__SF_GPRS(%r15)	# restore kernel registers
+ 	lg	%r2,__SF_EMPTY+16(%r15)		# return exit reason code
+-	br	%r14
++	BR_R1USE_R14
+ .Lsie_fault:
+ 	lghi	%r14,-EFAULT
+ 	stg	%r14,__SF_EMPTY+16(%r15)	# set exit reason code
+@@ -273,6 +415,7 @@ ENTRY(system_call)
+ 	stpt	__LC_SYNC_ENTER_TIMER
+ .Lsysc_stmg:
+ 	stmg	%r8,%r15,__LC_SAVE_AREA_SYNC
++	BPOFF
+ 	lg	%r12,__LC_CURRENT
+ 	lghi	%r13,__TASK_thread
+ 	lghi	%r14,_PIF_SYSCALL
+@@ -281,12 +424,15 @@ ENTRY(system_call)
+ 	la	%r11,STACK_FRAME_OVERHEAD(%r15)	# pointer to pt_regs
+ .Lsysc_vtime:
+ 	UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER
++	BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
+ 	stmg	%r0,%r7,__PT_R0(%r11)
+ 	mvc	__PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
+ 	mvc	__PT_PSW(16,%r11),__LC_SVC_OLD_PSW
+ 	mvc	__PT_INT_CODE(4,%r11),__LC_SVC_ILC
+ 	stg	%r14,__PT_FLAGS(%r11)
+ .Lsysc_do_svc:
++	# clear user controlled register to prevent speculative use
++	xgr	%r0,%r0
+ 	# load address of system call table
+ 	lg	%r10,__THREAD_sysc_table(%r13,%r12)
+ 	llgh	%r8,__PT_INT_CODE+2(%r11)
+@@ -305,7 +451,7 @@ ENTRY(system_call)
+ 	lgf	%r9,0(%r8,%r10)			# get system call add.
+ 	TSTMSK	__TI_flags(%r12),_TIF_TRACE
+ 	jnz	.Lsysc_tracesys
+-	basr	%r14,%r9			# call sys_xxxx
++	BASR_R14_R9				# call sys_xxxx
+ 	stg	%r2,__PT_R2(%r11)		# store return value
+ 
+ .Lsysc_return:
+@@ -317,6 +463,7 @@ ENTRY(system_call)
+ 	jnz	.Lsysc_work			# check for work
+ 	TSTMSK	__LC_CPU_FLAGS,_CIF_WORK
+ 	jnz	.Lsysc_work
++	BPEXIT	__TI_flags(%r12),_TIF_ISOLATE_BP
+ .Lsysc_restore:
+ 	lg	%r14,__LC_VDSO_PER_CPU
+ 	lmg	%r0,%r10,__PT_R0(%r11)
+@@ -481,7 +628,7 @@ ENTRY(system_call)
+ 	lmg	%r3,%r7,__PT_R3(%r11)
+ 	stg	%r7,STACK_FRAME_OVERHEAD(%r15)
+ 	lg	%r2,__PT_ORIG_GPR2(%r11)
+-	basr	%r14,%r9		# call sys_xxx
++	BASR_R14_R9			# call sys_xxx
+ 	stg	%r2,__PT_R2(%r11)	# store return value
+ .Lsysc_tracenogo:
+ 	TSTMSK	__TI_flags(%r12),_TIF_TRACE
+@@ -505,7 +652,7 @@ ENTRY(ret_from_fork)
+ 	lmg	%r9,%r10,__PT_R9(%r11)	# load gprs
+ ENTRY(kernel_thread_starter)
+ 	la	%r2,0(%r10)
+-	basr	%r14,%r9
++	BASR_R14_R9
+ 	j	.Lsysc_tracenogo
+ 
+ /*
+@@ -514,6 +661,7 @@ ENTRY(kernel_thread_starter)
+ 
+ ENTRY(pgm_check_handler)
+ 	stpt	__LC_SYNC_ENTER_TIMER
++	BPOFF
+ 	stmg	%r8,%r15,__LC_SAVE_AREA_SYNC
+ 	lg	%r10,__LC_LAST_BREAK
+ 	lg	%r12,__LC_CURRENT
+@@ -540,6 +688,7 @@ ENTRY(pgm_check_handler)
+ 	aghi	%r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE)
+ 	j	4f
+ 2:	UPDATE_VTIME %r14,%r15,__LC_SYNC_ENTER_TIMER
++	BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
+ 	lg	%r15,__LC_KERNEL_STACK
+ 	lgr	%r14,%r12
+ 	aghi	%r14,__TASK_thread	# pointer to thread_struct
+@@ -550,6 +699,15 @@ ENTRY(pgm_check_handler)
+ 3:	stg	%r10,__THREAD_last_break(%r14)
+ 4:	la	%r11,STACK_FRAME_OVERHEAD(%r15)
+ 	stmg	%r0,%r7,__PT_R0(%r11)
++	# clear user controlled registers to prevent speculative use
++	xgr	%r0,%r0
++	xgr	%r1,%r1
++	xgr	%r2,%r2
++	xgr	%r3,%r3
++	xgr	%r4,%r4
++	xgr	%r5,%r5
++	xgr	%r6,%r6
++	xgr	%r7,%r7
+ 	mvc	__PT_R8(64,%r11),__LC_SAVE_AREA_SYNC
+ 	stmg	%r8,%r9,__PT_PSW(%r11)
+ 	mvc	__PT_INT_CODE(4,%r11),__LC_PGM_ILC
+@@ -571,9 +729,9 @@ ENTRY(pgm_check_handler)
+ 	nill	%r10,0x007f
+ 	sll	%r10,2
+ 	je	.Lpgm_return
+-	lgf	%r1,0(%r10,%r1)		# load address of handler routine
++	lgf	%r9,0(%r10,%r1)		# load address of handler routine
+ 	lgr	%r2,%r11		# pass pointer to pt_regs
+-	basr	%r14,%r1		# branch to interrupt-handler
++	BASR_R14_R9			# branch to interrupt-handler
+ .Lpgm_return:
+ 	LOCKDEP_SYS_EXIT
+ 	tm	__PT_PSW+1(%r11),0x01	# returning to user ?
+@@ -609,12 +767,23 @@ ENTRY(pgm_check_handler)
+ ENTRY(io_int_handler)
+ 	STCK	__LC_INT_CLOCK
+ 	stpt	__LC_ASYNC_ENTER_TIMER
++	BPOFF
+ 	stmg	%r8,%r15,__LC_SAVE_AREA_ASYNC
+ 	lg	%r12,__LC_CURRENT
+ 	larl	%r13,cleanup_critical
+ 	lmg	%r8,%r9,__LC_IO_OLD_PSW
+ 	SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER
+ 	stmg	%r0,%r7,__PT_R0(%r11)
++	# clear user controlled registers to prevent speculative use
++	xgr	%r0,%r0
++	xgr	%r1,%r1
++	xgr	%r2,%r2
++	xgr	%r3,%r3
++	xgr	%r4,%r4
++	xgr	%r5,%r5
++	xgr	%r6,%r6
++	xgr	%r7,%r7
++	xgr	%r10,%r10
+ 	mvc	__PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC
+ 	stmg	%r8,%r9,__PT_PSW(%r11)
+ 	mvc	__PT_INT_CODE(12,%r11),__LC_SUBCHANNEL_ID
+@@ -649,9 +818,13 @@ ENTRY(io_int_handler)
+ 	lg	%r14,__LC_VDSO_PER_CPU
+ 	lmg	%r0,%r10,__PT_R0(%r11)
+ 	mvc	__LC_RETURN_PSW(16),__PT_PSW(%r11)
++	tm	__PT_PSW+1(%r11),0x01	# returning to user ?
++	jno	.Lio_exit_kernel
++	BPEXIT	__TI_flags(%r12),_TIF_ISOLATE_BP
+ .Lio_exit_timer:
+ 	stpt	__LC_EXIT_TIMER
+ 	mvc	__VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
++.Lio_exit_kernel:
+ 	lmg	%r11,%r15,__PT_R11(%r11)
+ 	lpswe	__LC_RETURN_PSW
+ .Lio_done:
+@@ -814,12 +987,23 @@ ENTRY(io_int_handler)
+ ENTRY(ext_int_handler)
+ 	STCK	__LC_INT_CLOCK
+ 	stpt	__LC_ASYNC_ENTER_TIMER
++	BPOFF
+ 	stmg	%r8,%r15,__LC_SAVE_AREA_ASYNC
+ 	lg	%r12,__LC_CURRENT
+ 	larl	%r13,cleanup_critical
+ 	lmg	%r8,%r9,__LC_EXT_OLD_PSW
+ 	SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER
+ 	stmg	%r0,%r7,__PT_R0(%r11)
++	# clear user controlled registers to prevent speculative use
++	xgr	%r0,%r0
++	xgr	%r1,%r1
++	xgr	%r2,%r2
++	xgr	%r3,%r3
++	xgr	%r4,%r4
++	xgr	%r5,%r5
++	xgr	%r6,%r6
++	xgr	%r7,%r7
++	xgr	%r10,%r10
+ 	mvc	__PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC
+ 	stmg	%r8,%r9,__PT_PSW(%r11)
+ 	lghi	%r1,__LC_EXT_PARAMS2
+@@ -852,11 +1036,12 @@ ENTRY(psw_idle)
+ .Lpsw_idle_stcctm:
+ #endif
+ 	oi	__LC_CPU_FLAGS+7,_CIF_ENABLED_WAIT
++	BPON
+ 	STCK	__CLOCK_IDLE_ENTER(%r2)
+ 	stpt	__TIMER_IDLE_ENTER(%r2)
+ .Lpsw_idle_lpsw:
+ 	lpswe	__SF_EMPTY(%r15)
+-	br	%r14
++	BR_R1USE_R14
+ .Lpsw_idle_end:
+ 
+ /*
+@@ -870,7 +1055,7 @@ ENTRY(save_fpu_regs)
+ 	lg	%r2,__LC_CURRENT
+ 	aghi	%r2,__TASK_thread
+ 	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU
+-	bor	%r14
++	jo	.Lsave_fpu_regs_exit
+ 	stfpc	__THREAD_FPU_fpc(%r2)
+ 	lg	%r3,__THREAD_FPU_regs(%r2)
+ 	TSTMSK	__LC_MACHINE_FLAGS,MACHINE_FLAG_VX
+@@ -897,7 +1082,8 @@ ENTRY(save_fpu_regs)
+ 	std	15,120(%r3)
+ .Lsave_fpu_regs_done:
+ 	oi	__LC_CPU_FLAGS+7,_CIF_FPU
+-	br	%r14
++.Lsave_fpu_regs_exit:
++	BR_R1USE_R14
+ .Lsave_fpu_regs_end:
+ EXPORT_SYMBOL(save_fpu_regs)
+ 
+@@ -915,7 +1101,7 @@ load_fpu_regs:
+ 	lg	%r4,__LC_CURRENT
+ 	aghi	%r4,__TASK_thread
+ 	TSTMSK	__LC_CPU_FLAGS,_CIF_FPU
+-	bnor	%r14
++	jno	.Lload_fpu_regs_exit
+ 	lfpc	__THREAD_FPU_fpc(%r4)
+ 	TSTMSK	__LC_MACHINE_FLAGS,MACHINE_FLAG_VX
+ 	lg	%r4,__THREAD_FPU_regs(%r4)	# %r4 <- reg save area
+@@ -942,7 +1128,8 @@ load_fpu_regs:
+ 	ld	15,120(%r4)
+ .Lload_fpu_regs_done:
+ 	ni	__LC_CPU_FLAGS+7,255-_CIF_FPU
+-	br	%r14
++.Lload_fpu_regs_exit:
++	BR_R1USE_R14
+ .Lload_fpu_regs_end:
+ 
+ .L__critical_end:
+@@ -952,6 +1139,7 @@ load_fpu_regs:
+  */
+ ENTRY(mcck_int_handler)
+ 	STCK	__LC_MCCK_CLOCK
++	BPOFF
+ 	la	%r1,4095		# revalidate r1
+ 	spt	__LC_CPU_TIMER_SAVE_AREA-4095(%r1)	# revalidate cpu timer
+ 	lmg	%r0,%r15,__LC_GPREGS_SAVE_AREA-4095(%r1)# revalidate gprs
+@@ -982,6 +1170,16 @@ ENTRY(mcck_int_handler)
+ .Lmcck_skip:
+ 	lghi	%r14,__LC_GPREGS_SAVE_AREA+64
+ 	stmg	%r0,%r7,__PT_R0(%r11)
++	# clear user controlled registers to prevent speculative use
++	xgr	%r0,%r0
++	xgr	%r1,%r1
++	xgr	%r2,%r2
++	xgr	%r3,%r3
++	xgr	%r4,%r4
++	xgr	%r5,%r5
++	xgr	%r6,%r6
++	xgr	%r7,%r7
++	xgr	%r10,%r10
+ 	mvc	__PT_R8(64,%r11),0(%r14)
+ 	stmg	%r8,%r9,__PT_PSW(%r11)
+ 	xc	__PT_FLAGS(8,%r11),__PT_FLAGS(%r11)
+@@ -1007,6 +1205,7 @@ ENTRY(mcck_int_handler)
+ 	mvc	__LC_RETURN_MCCK_PSW(16),__PT_PSW(%r11) # move return PSW
+ 	tm	__LC_RETURN_MCCK_PSW+1,0x01 # returning to user ?
+ 	jno	0f
++	BPEXIT	__TI_flags(%r12),_TIF_ISOLATE_BP
+ 	stpt	__LC_EXIT_TIMER
+ 	mvc	__VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
+ 0:	lmg	%r11,%r15,__PT_R11(%r11)
+@@ -1102,7 +1301,7 @@ cleanup_critical:
+ 	jl	0f
+ 	clg	%r9,BASED(.Lcleanup_table+104)	# .Lload_fpu_regs_end
+ 	jl	.Lcleanup_load_fpu_regs
+-0:	br	%r14
++0:	BR_R11USE_R14
+ 
+ 	.align	8
+ .Lcleanup_table:
+@@ -1133,11 +1332,12 @@ cleanup_critical:
+ 	clg     %r9,BASED(.Lsie_crit_mcck_length)
+ 	jh      1f
+ 	oi      __LC_CPU_FLAGS+7, _CIF_MCCK_GUEST
+-1:	lg	%r9,__SF_EMPTY(%r15)		# get control block pointer
++1:	BPENTER __SF_EMPTY+24(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST)
++	lg	%r9,__SF_EMPTY(%r15)		# get control block pointer
+ 	ni	__SIE_PROG0C+3(%r9),0xfe	# no longer in SIE
+ 	lctlg	%c1,%c1,__LC_USER_ASCE		# load primary asce
+ 	larl	%r9,sie_exit			# skip forward to sie_exit
+-	br	%r14
++	BR_R11USE_R14
+ #endif
+ 
+ .Lcleanup_system_call:
+@@ -1175,6 +1375,7 @@ cleanup_critical:
+ 	stg	%r15,__LC_SYSTEM_TIMER
+ 0:	# update accounting time stamp
+ 	mvc	__LC_LAST_UPDATE_TIMER(8),__LC_SYNC_ENTER_TIMER
++	BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP
+ 	# set up saved register r11
+ 	lg	%r15,__LC_KERNEL_STACK
+ 	la	%r9,STACK_FRAME_OVERHEAD(%r15)
+@@ -1190,7 +1391,7 @@ cleanup_critical:
+ 	stg	%r15,56(%r11)		# r15 stack pointer
+ 	# set new psw address and exit
+ 	larl	%r9,.Lsysc_do_svc
+-	br	%r14
++	BR_R11USE_R14
+ .Lcleanup_system_call_insn:
+ 	.quad	system_call
+ 	.quad	.Lsysc_stmg
+@@ -1202,7 +1403,7 @@ cleanup_critical:
+ 
+ .Lcleanup_sysc_tif:
+ 	larl	%r9,.Lsysc_tif
+-	br	%r14
++	BR_R11USE_R14
+ 
+ .Lcleanup_sysc_restore:
+ 	# check if stpt has been executed
+@@ -1219,14 +1420,14 @@ cleanup_critical:
+ 	mvc	0(64,%r11),__PT_R8(%r9)
+ 	lmg	%r0,%r7,__PT_R0(%r9)
+ 1:	lmg	%r8,%r9,__LC_RETURN_PSW
+-	br	%r14
++	BR_R11USE_R14
+ .Lcleanup_sysc_restore_insn:
+ 	.quad	.Lsysc_exit_timer
+ 	.quad	.Lsysc_done - 4
+ 
+ .Lcleanup_io_tif:
+ 	larl	%r9,.Lio_tif
+-	br	%r14
++	BR_R11USE_R14
+ 
+ .Lcleanup_io_restore:
+ 	# check if stpt has been executed
+@@ -1240,7 +1441,7 @@ cleanup_critical:
+ 	mvc	0(64,%r11),__PT_R8(%r9)
+ 	lmg	%r0,%r7,__PT_R0(%r9)
+ 1:	lmg	%r8,%r9,__LC_RETURN_PSW
+-	br	%r14
++	BR_R11USE_R14
+ .Lcleanup_io_restore_insn:
+ 	.quad	.Lio_exit_timer
+ 	.quad	.Lio_done - 4
+@@ -1293,17 +1494,17 @@ cleanup_critical:
+ 	# prepare return psw
+ 	nihh	%r8,0xfcfd		# clear irq & wait state bits
+ 	lg	%r9,48(%r11)		# return from psw_idle
+-	br	%r14
++	BR_R11USE_R14
+ .Lcleanup_idle_insn:
+ 	.quad	.Lpsw_idle_lpsw
+ 
+ .Lcleanup_save_fpu_regs:
+ 	larl	%r9,save_fpu_regs
+-	br	%r14
++	BR_R11USE_R14
+ 
+ .Lcleanup_load_fpu_regs:
+ 	larl	%r9,load_fpu_regs
+-	br	%r14
++	BR_R11USE_R14
+ 
+ /*
+  * Integer constants
+@@ -1323,7 +1524,6 @@ cleanup_critical:
+ .Lsie_crit_mcck_length:
+ 	.quad   .Lsie_skip - .Lsie_entry
+ #endif
+-
+ 	.section .rodata, "a"
+ #define SYSCALL(esame,emu)	.long esame
+ 	.globl	sys_call_table
+diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
+index d1a0e2c521d7..b565e784bae8 100644
+--- a/arch/s390/kernel/ipl.c
++++ b/arch/s390/kernel/ipl.c
+@@ -564,6 +564,7 @@ static struct kset *ipl_kset;
+ 
+ static void __ipl_run(void *unused)
+ {
++	__bpon();
+ 	diag308(DIAG308_LOAD_CLEAR, NULL);
+ 	if (MACHINE_IS_VM)
+ 		__cpcmd("IPL", NULL, 0, NULL);
+diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
+index 1a27f307a920..b441e069e674 100644
+--- a/arch/s390/kernel/module.c
++++ b/arch/s390/kernel/module.c
+@@ -31,6 +31,9 @@
+ #include <linux/kernel.h>
+ #include <linux/moduleloader.h>
+ #include <linux/bug.h>
++#include <asm/alternative.h>
++#include <asm/nospec-branch.h>
++#include <asm/facility.h>
+ 
+ #if 0
+ #define DEBUGP printk
+@@ -168,7 +171,11 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
+ 	me->arch.got_offset = me->core_layout.size;
+ 	me->core_layout.size += me->arch.got_size;
+ 	me->arch.plt_offset = me->core_layout.size;
+-	me->core_layout.size += me->arch.plt_size;
++	if (me->arch.plt_size) {
++		if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable)
++			me->arch.plt_size += PLT_ENTRY_SIZE;
++		me->core_layout.size += me->arch.plt_size;
++	}
+ 	return 0;
+ }
+ 
+@@ -322,9 +329,20 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
+ 			unsigned int *ip;
+ 			ip = me->core_layout.base + me->arch.plt_offset +
+ 				info->plt_offset;
+-			ip[0] = 0x0d10e310; /* basr 1,0; lg 1,10(1); br 1 */
+-			ip[1] = 0x100a0004;
+-			ip[2] = 0x07f10000;
++			ip[0] = 0x0d10e310;	/* basr 1,0  */
++			ip[1] = 0x100a0004;	/* lg	1,10(1) */
++			if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) {
++				unsigned int *ij;
++				ij = me->core_layout.base +
++					me->arch.plt_offset +
++					me->arch.plt_size - PLT_ENTRY_SIZE;
++				ip[2] = 0xa7f40000 +	/* j __jump_r1 */
++					(unsigned int)(u16)
++					(((unsigned long) ij - 8 -
++					  (unsigned long) ip) / 2);
++			} else {
++				ip[2] = 0x07f10000;	/* br %r1 */
++			}
+ 			ip[3] = (unsigned int) (val >> 32);
+ 			ip[4] = (unsigned int) val;
+ 			info->plt_initialized = 1;
+@@ -429,6 +447,45 @@ int module_finalize(const Elf_Ehdr *hdr,
+ 		    const Elf_Shdr *sechdrs,
+ 		    struct module *me)
+ {
++	const Elf_Shdr *s;
++	char *secstrings, *secname;
++	void *aseg;
++
++	if (IS_ENABLED(CONFIG_EXPOLINE) &&
++	    !nospec_disable && me->arch.plt_size) {
++		unsigned int *ij;
++
++		ij = me->core_layout.base + me->arch.plt_offset +
++			me->arch.plt_size - PLT_ENTRY_SIZE;
++		if (test_facility(35)) {
++			ij[0] = 0xc6000000;	/* exrl	%r0,.+10	*/
++			ij[1] = 0x0005a7f4;	/* j	.		*/
++			ij[2] = 0x000007f1;	/* br	%r1		*/
++		} else {
++			ij[0] = 0x44000000 | (unsigned int)
++				offsetof(struct lowcore, br_r1_trampoline);
++			ij[1] = 0xa7f40000;	/* j	.		*/
++		}
++	}
++
++	secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
++	for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
++		aseg = (void *) s->sh_addr;
++		secname = secstrings + s->sh_name;
++
++		if (!strcmp(".altinstructions", secname))
++			/* patch .altinstructions */
++			apply_alternatives(aseg, aseg + s->sh_size);
++
++		if (IS_ENABLED(CONFIG_EXPOLINE) &&
++		    (!strncmp(".s390_indirect", secname, 14)))
++			nospec_revert(aseg, aseg + s->sh_size);
++
++		if (IS_ENABLED(CONFIG_EXPOLINE) &&
++		    (!strncmp(".s390_return", secname, 12)))
++			nospec_revert(aseg, aseg + s->sh_size);
++	}
++
+ 	jump_label_apply_nops(me);
+ 	return 0;
+ }
+diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
+new file mode 100644
+index 000000000000..9f3b5b382743
+--- /dev/null
++++ b/arch/s390/kernel/nospec-branch.c
+@@ -0,0 +1,169 @@
++// SPDX-License-Identifier: GPL-2.0
++#include <linux/module.h>
++#include <linux/device.h>
++#include <asm/facility.h>
++#include <asm/nospec-branch.h>
++
++static int __init nobp_setup_early(char *str)
++{
++	bool enabled;
++	int rc;
++
++	rc = kstrtobool(str, &enabled);
++	if (rc)
++		return rc;
++	if (enabled && test_facility(82)) {
++		/*
++		 * The user explicitely requested nobp=1, enable it and
++		 * disable the expoline support.
++		 */
++		__set_facility(82, S390_lowcore.alt_stfle_fac_list);
++		if (IS_ENABLED(CONFIG_EXPOLINE))
++			nospec_disable = 1;
++	} else {
++		__clear_facility(82, S390_lowcore.alt_stfle_fac_list);
++	}
++	return 0;
++}
++early_param("nobp", nobp_setup_early);
++
++static int __init nospec_setup_early(char *str)
++{
++	__clear_facility(82, S390_lowcore.alt_stfle_fac_list);
++	return 0;
++}
++early_param("nospec", nospec_setup_early);
++
++static int __init nospec_report(void)
++{
++	if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable)
++		pr_info("Spectre V2 mitigation: execute trampolines.\n");
++	if (__test_facility(82, S390_lowcore.alt_stfle_fac_list))
++		pr_info("Spectre V2 mitigation: limited branch prediction.\n");
++	return 0;
++}
++arch_initcall(nospec_report);
++
++#ifdef CONFIG_SYSFS
++ssize_t cpu_show_spectre_v1(struct device *dev,
++			    struct device_attribute *attr, char *buf)
++{
++	return sprintf(buf, "Mitigation: __user pointer sanitization\n");
++}
++
++ssize_t cpu_show_spectre_v2(struct device *dev,
++			    struct device_attribute *attr, char *buf)
++{
++	if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable)
++		return sprintf(buf, "Mitigation: execute trampolines\n");
++	if (__test_facility(82, S390_lowcore.alt_stfle_fac_list))
++		return sprintf(buf, "Mitigation: limited branch prediction.\n");
++	return sprintf(buf, "Vulnerable\n");
++}
++#endif
++
++#ifdef CONFIG_EXPOLINE
++
++int nospec_disable = IS_ENABLED(CONFIG_EXPOLINE_OFF);
++
++static int __init nospectre_v2_setup_early(char *str)
++{
++	nospec_disable = 1;
++	return 0;
++}
++early_param("nospectre_v2", nospectre_v2_setup_early);
++
++void __init nospec_auto_detect(void)
++{
++	if (IS_ENABLED(CC_USING_EXPOLINE)) {
++		/*
++		 * The kernel has been compiled with expolines.
++		 * Keep expolines enabled and disable nobp.
++		 */
++		nospec_disable = 0;
++		__clear_facility(82, S390_lowcore.alt_stfle_fac_list);
++	}
++	/*
++	 * If the kernel has not been compiled with expolines the
++	 * nobp setting decides what is done, this depends on the
++	 * CONFIG_KERNEL_NP option and the nobp/nospec parameters.
++	 */
++}
++
++static int __init spectre_v2_setup_early(char *str)
++{
++	if (str && !strncmp(str, "on", 2)) {
++		nospec_disable = 0;
++		__clear_facility(82, S390_lowcore.alt_stfle_fac_list);
++	}
++	if (str && !strncmp(str, "off", 3))
++		nospec_disable = 1;
++	if (str && !strncmp(str, "auto", 4))
++		nospec_auto_detect();
++	return 0;
++}
++early_param("spectre_v2", spectre_v2_setup_early);
++
++static void __init_or_module __nospec_revert(s32 *start, s32 *end)
++{
++	enum { BRCL_EXPOLINE, BRASL_EXPOLINE } type;
++	u8 *instr, *thunk, *br;
++	u8 insnbuf[6];
++	s32 *epo;
++
++	/* Second part of the instruction replace is always a nop */
++	memcpy(insnbuf + 2, (char[]) { 0x47, 0x00, 0x00, 0x00 }, 4);
++	for (epo = start; epo < end; epo++) {
++		instr = (u8 *) epo + *epo;
++		if (instr[0] == 0xc0 && (instr[1] & 0x0f) == 0x04)
++			type = BRCL_EXPOLINE;	/* brcl instruction */
++		else if (instr[0] == 0xc0 && (instr[1] & 0x0f) == 0x05)
++			type = BRASL_EXPOLINE;	/* brasl instruction */
++		else
++			continue;
++		thunk = instr + (*(int *)(instr + 2)) * 2;
++		if (thunk[0] == 0xc6 && thunk[1] == 0x00)
++			/* exrl %r0,<target-br> */
++			br = thunk + (*(int *)(thunk + 2)) * 2;
++		else if (thunk[0] == 0xc0 && (thunk[1] & 0x0f) == 0x00 &&
++			 thunk[6] == 0x44 && thunk[7] == 0x00 &&
++			 (thunk[8] & 0x0f) == 0x00 && thunk[9] == 0x00 &&
++			 (thunk[1] & 0xf0) == (thunk[8] & 0xf0))
++			/* larl %rx,<target br> + ex %r0,0(%rx) */
++			br = thunk + (*(int *)(thunk + 2)) * 2;
++		else
++			continue;
++		if (br[0] != 0x07 || (br[1] & 0xf0) != 0xf0)
++			continue;
++		switch (type) {
++		case BRCL_EXPOLINE:
++			/* brcl to thunk, replace with br + nop */
++			insnbuf[0] = br[0];
++			insnbuf[1] = (instr[1] & 0xf0) | (br[1] & 0x0f);
++			break;
++		case BRASL_EXPOLINE:
++			/* brasl to thunk, replace with basr + nop */
++			insnbuf[0] = 0x0d;
++			insnbuf[1] = (instr[1] & 0xf0) | (br[1] & 0x0f);
++			break;
++		}
++
++		s390_kernel_write(instr, insnbuf, 6);
++	}
++}
++
++void __init_or_module nospec_revert(s32 *start, s32 *end)
++{
++	if (nospec_disable)
++		__nospec_revert(start, end);
++}
++
++extern s32 __nospec_call_start[], __nospec_call_end[];
++extern s32 __nospec_return_start[], __nospec_return_end[];
++void __init nospec_init_branches(void)
++{
++	nospec_revert(__nospec_call_start, __nospec_call_end);
++	nospec_revert(__nospec_return_start, __nospec_return_end);
++}
++
++#endif /* CONFIG_EXPOLINE */
+diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c
+index 5362fd868d0d..6fe2e1875058 100644
+--- a/arch/s390/kernel/processor.c
++++ b/arch/s390/kernel/processor.c
+@@ -197,3 +197,21 @@ const struct seq_operations cpuinfo_op = {
+ 	.stop	= c_stop,
+ 	.show	= show_cpuinfo,
+ };
++
++int s390_isolate_bp(void)
++{
++	if (!test_facility(82))
++		return -EOPNOTSUPP;
++	set_thread_flag(TIF_ISOLATE_BP);
++	return 0;
++}
++EXPORT_SYMBOL(s390_isolate_bp);
++
++int s390_isolate_bp_guest(void)
++{
++	if (!test_facility(82))
++		return -EOPNOTSUPP;
++	set_thread_flag(TIF_ISOLATE_BP_GUEST);
++	return 0;
++}
++EXPORT_SYMBOL(s390_isolate_bp_guest);
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 164a1e16b53e..98c1f7941142 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -66,6 +66,8 @@
+ #include <asm/sclp.h>
+ #include <asm/sysinfo.h>
+ #include <asm/numa.h>
++#include <asm/alternative.h>
++#include <asm/nospec-branch.h>
+ #include "entry.h"
+ 
+ /*
+@@ -338,7 +340,9 @@ static void __init setup_lowcore(void)
+ 	lc->preempt_count = S390_lowcore.preempt_count;
+ 	lc->stfl_fac_list = S390_lowcore.stfl_fac_list;
+ 	memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
+-	       MAX_FACILITY_BIT/8);
++	       sizeof(lc->stfle_fac_list));
++	memcpy(lc->alt_stfle_fac_list, S390_lowcore.alt_stfle_fac_list,
++	       sizeof(lc->alt_stfle_fac_list));
+ 	if (MACHINE_HAS_VX || MACHINE_HAS_GS) {
+ 		unsigned long bits, size;
+ 
+@@ -381,6 +385,7 @@ static void __init setup_lowcore(void)
+ #ifdef CONFIG_SMP
+ 	lc->spinlock_lockval = arch_spin_lockval(0);
+ #endif
++	lc->br_r1_trampoline = 0x07f1;	/* br %r1 */
+ 
+ 	set_prefix((u32)(unsigned long) lc);
+ 	lowcore_ptr[0] = lc;
+@@ -892,6 +897,9 @@ void __init setup_arch(char **cmdline_p)
+ 	init_mm.end_data = (unsigned long) &_edata;
+ 	init_mm.brk = (unsigned long) &_end;
+ 
++	if (IS_ENABLED(CONFIG_EXPOLINE_AUTO))
++		nospec_auto_detect();
++
+ 	parse_early_param();
+ #ifdef CONFIG_CRASH_DUMP
+ 	/* Deactivate elfcorehdr= kernel parameter */
+@@ -955,6 +963,10 @@ void __init setup_arch(char **cmdline_p)
+ 	conmode_default();
+ 	set_preferred_console();
+ 
++	apply_alternative_instructions();
++	if (IS_ENABLED(CONFIG_EXPOLINE))
++		nospec_init_branches();
++
+ 	/* Setup zfcpdump support */
+ 	setup_zfcpdump();
+ 
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 7ffaf9fd6d19..ae5df4177803 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -228,6 +228,7 @@ static int pcpu_alloc_lowcore(struct pcpu *pcpu, int cpu)
+ 	lc->mcesad = mcesa_origin | mcesa_bits;
+ 	lc->cpu_nr = cpu;
+ 	lc->spinlock_lockval = arch_spin_lockval(cpu);
++	lc->br_r1_trampoline = 0x07f1;	/* br %r1 */
+ 	if (vdso_alloc_per_cpu(lc))
+ 		goto out;
+ 	lowcore_ptr[cpu] = lc;
+@@ -282,7 +283,9 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
+ 	__ctl_store(lc->cregs_save_area, 0, 15);
+ 	save_access_regs((unsigned int *) lc->access_regs_save_area);
+ 	memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
+-	       MAX_FACILITY_BIT/8);
++	       sizeof(lc->stfle_fac_list));
++	memcpy(lc->alt_stfle_fac_list, S390_lowcore.alt_stfle_fac_list,
++	       sizeof(lc->alt_stfle_fac_list));
+ }
+ 
+ static void pcpu_attach_task(struct pcpu *pcpu, struct task_struct *tsk)
+@@ -332,6 +335,7 @@ static void pcpu_delegate(struct pcpu *pcpu, void (*func)(void *),
+ 	mem_assign_absolute(lc->restart_fn, (unsigned long) func);
+ 	mem_assign_absolute(lc->restart_data, (unsigned long) data);
+ 	mem_assign_absolute(lc->restart_source, source_cpu);
++	__bpon();
+ 	asm volatile(
+ 		"0:	sigp	0,%0,%2	# sigp restart to target cpu\n"
+ 		"	brc	2,0b	# busy, try again\n"
+@@ -907,6 +911,7 @@ void __cpu_die(unsigned int cpu)
+ void __noreturn cpu_die(void)
+ {
+ 	idle_task_exit();
++	__bpon();
+ 	pcpu_sigp_retry(pcpu_devices + smp_processor_id(), SIGP_STOP, 0);
+ 	for (;;) ;
+ }
+diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
+index d9d1f512f019..5007fac01bb5 100644
+--- a/arch/s390/kernel/uprobes.c
++++ b/arch/s390/kernel/uprobes.c
+@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
+ 	return orig;
+ }
+ 
++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
++			     struct pt_regs *regs)
++{
++	if (ctx == RP_CHECK_CHAIN_CALL)
++		return user_stack_pointer(regs) <= ret->stack;
++	else
++		return user_stack_pointer(regs) < ret->stack;
++}
++
+ /* Instruction Emulation */
+ 
+ static void adjust_psw_addr(psw_t *psw, unsigned long len)
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 96a713a470e7..85dd3c7bdd86 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -105,6 +105,43 @@ SECTIONS
+ 		EXIT_DATA
+ 	}
+ 
++	/*
++	 * struct alt_inst entries. From the header (alternative.h):
++	 * "Alternative instructions for different CPU types or capabilities"
++	 * Think locking instructions on spinlocks.
++	 * Note, that it is a part of __init region.
++	 */
++	. = ALIGN(8);
++	.altinstructions : {
++		__alt_instructions = .;
++		*(.altinstructions)
++		__alt_instructions_end = .;
++	}
++
++	/*
++	 * And here are the replacement instructions. The linker sticks
++	 * them as binary blobs. The .altinstructions has enough data to
++	 * get the address and the length of them to patch the kernel safely.
++	 * Note, that it is a part of __init region.
++	 */
++	.altinstr_replacement : {
++		*(.altinstr_replacement)
++	}
++
++	/*
++	 * Table with the patch locations to undo expolines
++	*/
++	.nospec_call_table : {
++		__nospec_call_start = . ;
++		*(.s390_indirect*)
++		__nospec_call_end = . ;
++	}
++	.nospec_return_table : {
++		__nospec_return_start = . ;
++		*(.s390_return*)
++		__nospec_return_end = . ;
++	}
++
+ 	/* early.c uses stsi, which requires page aligned data. */
+ 	. = ALIGN(PAGE_SIZE);
+ 	INIT_DATA_SECTION(0x100)
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 0bce918db11a..4f6adbea592b 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -449,6 +449,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
+ 	case KVM_CAP_S390_GS:
+ 		r = test_facility(133);
+ 		break;
++	case KVM_CAP_S390_BPB:
++		r = test_facility(82);
++		break;
+ 	default:
+ 		r = 0;
+ 	}
+@@ -2231,6 +2234,8 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ 	kvm_s390_set_prefix(vcpu, 0);
+ 	if (test_kvm_facility(vcpu->kvm, 64))
+ 		vcpu->run->kvm_valid_regs |= KVM_SYNC_RICCB;
++	if (test_kvm_facility(vcpu->kvm, 82))
++		vcpu->run->kvm_valid_regs |= KVM_SYNC_BPBC;
+ 	if (test_kvm_facility(vcpu->kvm, 133))
+ 		vcpu->run->kvm_valid_regs |= KVM_SYNC_GSCB;
+ 	/* fprs can be synchronized via vrs, even if the guest has no vx. With
+@@ -2372,6 +2377,7 @@ static void kvm_s390_vcpu_initial_reset(struct kvm_vcpu *vcpu)
+ 	current->thread.fpu.fpc = 0;
+ 	vcpu->arch.sie_block->gbea = 1;
+ 	vcpu->arch.sie_block->pp = 0;
++	vcpu->arch.sie_block->fpf &= ~FPF_BPBC;
+ 	vcpu->arch.pfault_token = KVM_S390_PFAULT_TOKEN_INVALID;
+ 	kvm_clear_async_pf_completion_queue(vcpu);
+ 	if (!kvm_s390_user_cpu_state_ctrl(vcpu->kvm))
+@@ -3318,6 +3324,11 @@ static void sync_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ 		vcpu->arch.sie_block->ecd |= ECD_HOSTREGMGMT;
+ 		vcpu->arch.gs_enabled = 1;
+ 	}
++	if ((kvm_run->kvm_dirty_regs & KVM_SYNC_BPBC) &&
++	    test_kvm_facility(vcpu->kvm, 82)) {
++		vcpu->arch.sie_block->fpf &= ~FPF_BPBC;
++		vcpu->arch.sie_block->fpf |= kvm_run->s.regs.bpbc ? FPF_BPBC : 0;
++	}
+ 	save_access_regs(vcpu->arch.host_acrs);
+ 	restore_access_regs(vcpu->run->s.regs.acrs);
+ 	/* save host (userspace) fprs/vrs */
+@@ -3364,6 +3375,7 @@ static void store_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run)
+ 	kvm_run->s.regs.pft = vcpu->arch.pfault_token;
+ 	kvm_run->s.regs.pfs = vcpu->arch.pfault_select;
+ 	kvm_run->s.regs.pfc = vcpu->arch.pfault_compare;
++	kvm_run->s.regs.bpbc = (vcpu->arch.sie_block->fpf & FPF_BPBC) == FPF_BPBC;
+ 	save_access_regs(vcpu->run->s.regs.acrs);
+ 	restore_access_regs(vcpu->arch.host_acrs);
+ 	/* Save guest register state */
+diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
+index a74204db759b..eb7b530d1783 100644
+--- a/arch/s390/kvm/vsie.c
++++ b/arch/s390/kvm/vsie.c
+@@ -234,6 +234,12 @@ static void unshadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ 	memcpy(scb_o->gcr, scb_s->gcr, 128);
+ 	scb_o->pp = scb_s->pp;
+ 
++	/* branch prediction */
++	if (test_kvm_facility(vcpu->kvm, 82)) {
++		scb_o->fpf &= ~FPF_BPBC;
++		scb_o->fpf |= scb_s->fpf & FPF_BPBC;
++	}
++
+ 	/* interrupt intercept */
+ 	switch (scb_s->icptcode) {
+ 	case ICPT_PROGI:
+@@ -280,6 +286,7 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ 	scb_s->ecb3 = 0;
+ 	scb_s->ecd = 0;
+ 	scb_s->fac = 0;
++	scb_s->fpf = 0;
+ 
+ 	rc = prepare_cpuflags(vcpu, vsie_page);
+ 	if (rc)
+@@ -339,6 +346,9 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ 			prefix_unmapped(vsie_page);
+ 		scb_s->ecb |= ECB_TE;
+ 	}
++	/* branch prediction */
++	if (test_kvm_facility(vcpu->kvm, 82))
++		scb_s->fpf |= scb_o->fpf & FPF_BPBC;
+ 	/* SIMD */
+ 	if (test_kvm_facility(vcpu->kvm, 129)) {
+ 		scb_s->eca |= scb_o->eca & ECA_VX;
+@@ -821,6 +831,7 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ {
+ 	struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
+ 	struct kvm_s390_sie_block *scb_o = vsie_page->scb_o;
++	int guest_bp_isolation;
+ 	int rc;
+ 
+ 	handle_last_fault(vcpu, vsie_page);
+@@ -831,6 +842,20 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ 		s390_handle_mcck();
+ 
+ 	srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx);
++
++	/* save current guest state of bp isolation override */
++	guest_bp_isolation = test_thread_flag(TIF_ISOLATE_BP_GUEST);
++
++	/*
++	 * The guest is running with BPBC, so we have to force it on for our
++	 * nested guest. This is done by enabling BPBC globally, so the BPBC
++	 * control in the SCB (which the nested guest can modify) is simply
++	 * ignored.
++	 */
++	if (test_kvm_facility(vcpu->kvm, 82) &&
++	    vcpu->arch.sie_block->fpf & FPF_BPBC)
++		set_thread_flag(TIF_ISOLATE_BP_GUEST);
++
+ 	local_irq_disable();
+ 	guest_enter_irqoff();
+ 	local_irq_enable();
+@@ -840,6 +865,11 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
+ 	local_irq_disable();
+ 	guest_exit_irqoff();
+ 	local_irq_enable();
++
++	/* restore guest state for bp isolation override */
++	if (!guest_bp_isolation)
++		clear_thread_flag(TIF_ISOLATE_BP_GUEST);
++
+ 	vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu);
+ 
+ 	if (rc == -EINTR) {
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index f53ccc680238..dbdd460a9958 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
+ 	return opregion;
+ }
+ 
++static bool dmi_is_desktop(void)
++{
++	const char *chassis_type;
++
++	chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
++	if (!chassis_type)
++		return false;
++
++	if (!strcmp(chassis_type, "3") || /*  3: Desktop */
++	    !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
++	    !strcmp(chassis_type, "5") || /*  5: Pizza Box */
++	    !strcmp(chassis_type, "6") || /*  6: Mini Tower */
++	    !strcmp(chassis_type, "7") || /*  7: Tower */
++	    !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
++		return true;
++
++	return false;
++}
++
+ int acpi_video_register(void)
+ {
+ 	int ret = 0;
+@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
+ 	 * win8 ready (where we also prefer the native backlight driver, so
+ 	 * normally the acpi_video code should not register there anyways).
+ 	 */
+-	if (only_lcd == -1)
+-		only_lcd = acpi_osi_is_win8();
++	if (only_lcd == -1) {
++		if (dmi_is_desktop() && acpi_osi_is_win8())
++			only_lcd = true;
++		else
++			only_lcd = false;
++	}
+ 
+ 	dmi_check_system(video_dmi_table);
+ 
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 84434d3ea19b..e88d50f75a4a 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -110,7 +110,7 @@ struct iwm {
+ /* Select values for swim_select and swim_readbit */
+ 
+ #define READ_DATA_0	0x074
+-#define TWOMEG_DRIVE	0x075
++#define ONEMEG_DRIVE	0x075
+ #define SINGLE_SIDED	0x076
+ #define DRIVE_PRESENT	0x077
+ #define DISK_IN		0x170
+@@ -118,9 +118,9 @@ struct iwm {
+ #define TRACK_ZERO	0x172
+ #define TACHO		0x173
+ #define READ_DATA_1	0x174
+-#define MFM_MODE	0x175
++#define GCR_MODE	0x175
+ #define SEEK_COMPLETE	0x176
+-#define ONEMEG_MEDIA	0x177
++#define TWOMEG_MEDIA	0x177
+ 
+ /* Bits in handshake register */
+ 
+@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
+ 		struct floppy_struct *g;
+ 		fs->disk_in = 1;
+ 		fs->write_protected = swim_readbit(base, WRITE_PROT);
+-		fs->type = swim_readbit(base, ONEMEG_MEDIA);
+ 
+ 		if (swim_track00(base))
+ 			printk(KERN_ERR
+@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
+ 
+ 		swim_track00(base);
+ 
++		fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
++			HD_MEDIA : DD_MEDIA;
++		fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
+ 		get_floppy_geometry(fs, 0, &g);
+ 		fs->total_secs = g->size;
+ 		fs->secpercyl = g->head * g->sect;
+@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 
+ 	swim_write(base, setup, S_IBM_DRIVE  | S_FCLK_DIV2);
+ 	udelay(10);
+-	swim_drive(base, INTERNAL_DRIVE);
++	swim_drive(base, fs->location);
+ 	swim_motor(base, ON);
+ 	swim_action(base, SETMFM);
+ 	if (fs->ejected)
+@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ 		goto out;
+ 	}
+ 
++	set_capacity(fs->disk, fs->total_secs);
++
+ 	if (mode & FMODE_NDELAY)
+ 		return 0;
+ 
+@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
+ 		if (copy_to_user((void __user *) param, (void *) &floppy_type,
+ 				 sizeof(struct floppy_struct)))
+ 			return -EFAULT;
+-		break;
+-
+-	default:
+-		printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
+-		       cmd);
+-		return -ENOSYS;
++		return 0;
+ 	}
+-	return 0;
++	return -ENOTTY;
+ }
+ 
+ static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
+ 	struct swim_priv *swd = data;
+ 	int drive = (*part & 3);
+ 
+-	if (drive > swd->floppy_count)
++	if (drive >= swd->floppy_count)
+ 		return NULL;
+ 
+ 	*part = 0;
+@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
+ 
+ 	swim_motor(base, OFF);
+ 
+-	if (swim_readbit(base, SINGLE_SIDED))
+-		fs->head_number = 1;
+-	else
+-		fs->head_number = 2;
++	fs->type = HD_MEDIA;
++	fs->head_number = 2;
++
+ 	fs->ref_count = 0;
+ 	fs->ejected = 1;
+ 
+@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
+ 	/* scan floppy drives */
+ 
+ 	swim_drive(base, INTERNAL_DRIVE);
+-	if (swim_readbit(base, DRIVE_PRESENT))
++	if (swim_readbit(base, DRIVE_PRESENT) &&
++	    !swim_readbit(base, ONEMEG_DRIVE))
+ 		swim_add_floppy(swd, INTERNAL_DRIVE);
+ 	swim_drive(base, EXTERNAL_DRIVE);
+-	if (swim_readbit(base, DRIVE_PRESENT))
++	if (swim_readbit(base, DRIVE_PRESENT) &&
++	    !swim_readbit(base, ONEMEG_DRIVE))
+ 		swim_add_floppy(swd, EXTERNAL_DRIVE);
+ 
+ 	/* register floppy drives */
+@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
+ 							      &swd->lock);
+ 		if (!swd->unit[drive].disk->queue) {
+ 			err = -ENOMEM;
+-			put_disk(swd->unit[drive].disk);
+ 			goto exit_put_disks;
+ 		}
+ 		blk_queue_bounce_limit(swd->unit[drive].disk->queue,
+@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
+ 		goto out;
+ 	}
+ 
+-	swim_base = ioremap(res->start, resource_size(res));
++	swim_base = (struct swim __iomem *)res->start;
+ 	if (!swim_base) {
+ 		ret = -ENOMEM;
+ 		goto out_release_io;
+@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
+ 	if (!get_swim_mode(swim_base)) {
+ 		printk(KERN_INFO "SWIM device not found !\n");
+ 		ret = -ENODEV;
+-		goto out_iounmap;
++		goto out_release_io;
+ 	}
+ 
+ 	/* set platform driver data */
+@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
+ 	swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
+ 	if (!swd) {
+ 		ret = -ENOMEM;
+-		goto out_iounmap;
++		goto out_release_io;
+ 	}
+ 	platform_set_drvdata(dev, swd);
+ 
+@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
+ 
+ out_kfree:
+ 	kfree(swd);
+-out_iounmap:
+-	iounmap(swim_base);
+ out_release_io:
+ 	release_mem_region(res->start, resource_size(res));
+ out:
+@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
+ 	for (drive = 0; drive < swd->floppy_count; drive++)
+ 		floppy_eject(&swd->unit[drive]);
+ 
+-	iounmap(swd->base);
+-
+ 	res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ 	if (res)
+ 		release_mem_region(res->start, resource_size(res));
+diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
+index 9f931f8f6b4c..0d7527c6825a 100644
+--- a/drivers/block/swim3.c
++++ b/drivers/block/swim3.c
+@@ -148,7 +148,7 @@ struct swim3 {
+ #define MOTOR_ON	2
+ #define RELAX		3	/* also eject in progress */
+ #define READ_DATA_0	4
+-#define TWOMEG_DRIVE	5
++#define ONEMEG_DRIVE	5
+ #define SINGLE_SIDED	6	/* drive or diskette is 4MB type? */
+ #define DRIVE_PRESENT	7
+ #define DISK_IN		8
+@@ -156,9 +156,9 @@ struct swim3 {
+ #define TRACK_ZERO	10
+ #define TACHO		11
+ #define READ_DATA_1	12
+-#define MFM_MODE	13
++#define GCR_MODE	13
+ #define SEEK_COMPLETE	14
+-#define ONEMEG_MEDIA	15
++#define TWOMEG_MEDIA	15
+ 
+ /* Definitions of values used in writing and formatting */
+ #define DATA_ESCAPE	0x99
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index e36d160c458f..5f7d86509f2f 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
+ 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
+ 		return media_changed(cdi, 1);
+ 
+-	if ((unsigned int)arg >= cdi->capacity)
++	if (arg >= cdi->capacity)
+ 		return -EINVAL;
+ 
+ 	info = kmalloc(sizeof(*info), GFP_KERNEL);
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 1d01a8f77db1..dba5259def60 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -369,20 +369,40 @@ static int tpm_validate_command(struct tpm_chip *chip,
+ 	return -EINVAL;
+ }
+ 
+-/**
+- * tmp_transmit - Internal kernel interface to transmit TPM commands.
+- *
+- * @chip: TPM chip to use
+- * @buf: TPM command buffer
+- * @bufsiz: length of the TPM command buffer
+- * @flags: tpm transmit flags - bitmap
+- *
+- * Return:
+- *     0 when the operation is successful.
+- *     A negative number for system errors (errno).
+- */
+-ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+-		     u8 *buf, size_t bufsiz, unsigned int flags)
++static int tpm_request_locality(struct tpm_chip *chip)
++{
++	int rc;
++
++	if (!chip->ops->request_locality)
++		return 0;
++
++	rc = chip->ops->request_locality(chip, 0);
++	if (rc < 0)
++		return rc;
++
++	chip->locality = rc;
++
++	return 0;
++}
++
++static void tpm_relinquish_locality(struct tpm_chip *chip)
++{
++	int rc;
++
++	if (!chip->ops->relinquish_locality)
++		return;
++
++	rc = chip->ops->relinquish_locality(chip, chip->locality);
++	if (rc)
++		dev_err(&chip->dev, "%s: : error %d\n", __func__, rc);
++
++	chip->locality = -1;
++}
++
++static ssize_t tpm_try_transmit(struct tpm_chip *chip,
++				struct tpm_space *space,
++				u8 *buf, size_t bufsiz,
++				unsigned int flags)
+ {
+ 	struct tpm_output_header *header = (void *)buf;
+ 	int rc;
+@@ -422,8 +442,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ 		mutex_lock(&chip->tpm_mutex);
+ 
+-	if (chip->dev.parent)
+-		pm_runtime_get_sync(chip->dev.parent);
+ 
+ 	if (chip->ops->clk_enable != NULL)
+ 		chip->ops->clk_enable(chip, true);
+@@ -431,14 +449,15 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	/* Store the decision as chip->locality will be changed. */
+ 	need_locality = chip->locality == -1;
+ 
+-	if (!(flags & TPM_TRANSMIT_RAW) &&
+-	    need_locality && chip->ops->request_locality)  {
+-		rc = chip->ops->request_locality(chip, 0);
++	if (!(flags & TPM_TRANSMIT_RAW) && need_locality) {
++		rc = tpm_request_locality(chip);
+ 		if (rc < 0)
+ 			goto out_no_locality;
+-		chip->locality = rc;
+ 	}
+ 
++	if (chip->dev.parent)
++		pm_runtime_get_sync(chip->dev.parent);
++
+ 	rc = tpm2_prepare_space(chip, space, ordinal, buf);
+ 	if (rc)
+ 		goto out;
+@@ -499,27 +518,83 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ 	rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
+ 
+ out:
+-	if (need_locality && chip->ops->relinquish_locality) {
+-		chip->ops->relinquish_locality(chip, chip->locality);
+-		chip->locality = -1;
+-	}
++	if (chip->dev.parent)
++		pm_runtime_put_sync(chip->dev.parent);
++
++	if (need_locality)
++		tpm_relinquish_locality(chip);
++
+ out_no_locality:
+ 	if (chip->ops->clk_enable != NULL)
+ 		chip->ops->clk_enable(chip, false);
+ 
+-	if (chip->dev.parent)
+-		pm_runtime_put_sync(chip->dev.parent);
+-
+ 	if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ 		mutex_unlock(&chip->tpm_mutex);
+ 	return rc ? rc : len;
+ }
+ 
+ /**
+- * tmp_transmit_cmd - send a tpm command to the device
++ * tpm_transmit - Internal kernel interface to transmit TPM commands.
++ *
++ * @chip: TPM chip to use
++ * @space: tpm space
++ * @buf: TPM command buffer
++ * @bufsiz: length of the TPM command buffer
++ * @flags: tpm transmit flags - bitmap
++ *
++ * A wrapper around tpm_try_transmit that handles TPM2_RC_RETRY
++ * returns from the TPM and retransmits the command after a delay up
++ * to a maximum wait of TPM2_DURATION_LONG.
++ *
++ * Note: TPM1 never returns TPM2_RC_RETRY so the retry logic is TPM2
++ * only
++ *
++ * Return:
++ *     the length of the return when the operation is successful.
++ *     A negative number for system errors (errno).
++ */
++ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
++		     u8 *buf, size_t bufsiz, unsigned int flags)
++{
++	struct tpm_output_header *header = (struct tpm_output_header *)buf;
++	/* space for header and handles */
++	u8 save[TPM_HEADER_SIZE + 3*sizeof(u32)];
++	unsigned int delay_msec = TPM2_DURATION_SHORT;
++	u32 rc = 0;
++	ssize_t ret;
++	const size_t save_size = min(space ? sizeof(save) : TPM_HEADER_SIZE,
++				     bufsiz);
++
++	/*
++	 * Subtlety here: if we have a space, the handles will be
++	 * transformed, so when we restore the header we also have to
++	 * restore the handles.
++	 */
++	memcpy(save, buf, save_size);
++
++	for (;;) {
++		ret = tpm_try_transmit(chip, space, buf, bufsiz, flags);
++		if (ret < 0)
++			break;
++		rc = be32_to_cpu(header->return_code);
++		if (rc != TPM2_RC_RETRY)
++			break;
++		delay_msec *= 2;
++		if (delay_msec > TPM2_DURATION_LONG) {
++			dev_err(&chip->dev, "TPM is in retry loop\n");
++			break;
++		}
++		tpm_msleep(delay_msec);
++		memcpy(buf, save, save_size);
++	}
++	return ret;
++}
++/**
++ * tpm_transmit_cmd - send a tpm command to the device
+  *    The function extracts tpm out header return code
+  *
+  * @chip: TPM chip to use
++ * @space: tpm space
+  * @buf: TPM command buffer
+  * @bufsiz: length of the buffer
+  * @min_rsp_body_length: minimum expected length of response body
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 0b5b499f726a..b83b30a3eea5 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -106,6 +106,7 @@ enum tpm2_return_codes {
+ 	TPM2_RC_COMMAND_CODE    = 0x0143,
+ 	TPM2_RC_TESTING		= 0x090A, /* RC_WARN */
+ 	TPM2_RC_REFERENCE_H0	= 0x0910,
++	TPM2_RC_RETRY		= 0x0922,
+ };
+ 
+ enum tpm2_algorithms {
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 8f0a98dea327..bb756ad7897e 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -117,6 +117,25 @@ struct tpm2_crb_smc {
+ 	u32 smc_func_id;
+ };
+ 
++static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
++				unsigned long timeout)
++{
++	ktime_t start;
++	ktime_t stop;
++
++	start = ktime_get();
++	stop = ktime_add(start, ms_to_ktime(timeout));
++
++	do {
++		if ((ioread32(reg) & mask) == value)
++			return true;
++
++		usleep_range(50, 100);
++	} while (ktime_before(ktime_get(), stop));
++
++	return ((ioread32(reg) & mask) == value);
++}
++
+ /**
+  * crb_go_idle - request tpm crb device to go the idle state
+  *
+@@ -132,37 +151,24 @@ struct tpm2_crb_smc {
+  *
+  * Return: 0 always
+  */
+-static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
++static int crb_go_idle(struct device *dev, struct crb_priv *priv)
+ {
+ 	if ((priv->flags & CRB_FL_ACPI_START) ||
+ 	    (priv->flags & CRB_FL_CRB_SMC_START))
+ 		return 0;
+ 
+ 	iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
+-	/* we don't really care when this settles */
+ 
++	if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
++				 CRB_CTRL_REQ_GO_IDLE/* mask */,
++				 0, /* value */
++				 TPM2_TIMEOUT_C)) {
++		dev_warn(dev, "goIdle timed out\n");
++		return -ETIME;
++	}
+ 	return 0;
+ }
+ 
+-static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+-				unsigned long timeout)
+-{
+-	ktime_t start;
+-	ktime_t stop;
+-
+-	start = ktime_get();
+-	stop = ktime_add(start, ms_to_ktime(timeout));
+-
+-	do {
+-		if ((ioread32(reg) & mask) == value)
+-			return true;
+-
+-		usleep_range(50, 100);
+-	} while (ktime_before(ktime_get(), stop));
+-
+-	return false;
+-}
+-
+ /**
+  * crb_cmd_ready - request tpm crb device to enter ready state
+  *
+@@ -177,8 +183,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+  *
+  * Return: 0 on success -ETIME on timeout;
+  */
+-static int __maybe_unused crb_cmd_ready(struct device *dev,
+-					struct crb_priv *priv)
++static int crb_cmd_ready(struct device *dev, struct crb_priv *priv)
+ {
+ 	if ((priv->flags & CRB_FL_ACPI_START) ||
+ 	    (priv->flags & CRB_FL_CRB_SMC_START))
+@@ -196,11 +201,11 @@ static int __maybe_unused crb_cmd_ready(struct device *dev,
+ 	return 0;
+ }
+ 
+-static int crb_request_locality(struct tpm_chip *chip, int loc)
++static int __crb_request_locality(struct device *dev,
++				  struct crb_priv *priv, int loc)
+ {
+-	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ 	u32 value = CRB_LOC_STATE_LOC_ASSIGNED |
+-		CRB_LOC_STATE_TPM_REG_VALID_STS;
++		    CRB_LOC_STATE_TPM_REG_VALID_STS;
+ 
+ 	if (!priv->regs_h)
+ 		return 0;
+@@ -208,21 +213,45 @@ static int crb_request_locality(struct tpm_chip *chip, int loc)
+ 	iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
+ 	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
+ 				 TPM2_TIMEOUT_C)) {
+-		dev_warn(&chip->dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
+ 		return -ETIME;
+ 	}
+ 
+ 	return 0;
+ }
+ 
+-static void crb_relinquish_locality(struct tpm_chip *chip, int loc)
++static int crb_request_locality(struct tpm_chip *chip, int loc)
+ {
+ 	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ 
++	return __crb_request_locality(&chip->dev, priv, loc);
++}
++
++static int __crb_relinquish_locality(struct device *dev,
++				     struct crb_priv *priv, int loc)
++{
++	u32 mask = CRB_LOC_STATE_LOC_ASSIGNED |
++		   CRB_LOC_STATE_TPM_REG_VALID_STS;
++	u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
++
+ 	if (!priv->regs_h)
+-		return;
++		return 0;
+ 
+ 	iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
++	if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
++				 TPM2_TIMEOUT_C)) {
++		dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++		return -ETIME;
++	}
++
++	return 0;
++}
++
++static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
++{
++	struct crb_priv *priv = dev_get_drvdata(&chip->dev);
++
++	return __crb_relinquish_locality(&chip->dev, priv, loc);
+ }
+ 
+ static u8 crb_status(struct tpm_chip *chip)
+@@ -466,6 +495,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 			dev_warn(dev, FW_BUG "Bad ACPI memory layout");
+ 	}
+ 
++	ret = __crb_request_locality(dev, priv, 0);
++	if (ret)
++		return ret;
++
+ 	priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address,
+ 				   sizeof(struct crb_regs_tail));
+ 	if (IS_ERR(priv->regs_t))
+@@ -522,6 +555,8 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ 
+ 	crb_go_idle(dev, priv);
+ 
++	__crb_relinquish_locality(dev, priv, 0);
++
+ 	return ret;
+ }
+ 
+@@ -589,10 +624,14 @@ static int crb_acpi_add(struct acpi_device *device)
+ 	chip->acpi_dev_handle = device->handle;
+ 	chip->flags = TPM_CHIP_FLAG_TPM2;
+ 
+-	rc  = crb_cmd_ready(dev, priv);
++	rc = __crb_request_locality(dev, priv, 0);
+ 	if (rc)
+ 		return rc;
+ 
++	rc  = crb_cmd_ready(dev, priv);
++	if (rc)
++		goto out;
++
+ 	pm_runtime_get_noresume(dev);
+ 	pm_runtime_set_active(dev);
+ 	pm_runtime_enable(dev);
+@@ -602,12 +641,15 @@ static int crb_acpi_add(struct acpi_device *device)
+ 		crb_go_idle(dev, priv);
+ 		pm_runtime_put_noidle(dev);
+ 		pm_runtime_disable(dev);
+-		return rc;
++		goto out;
+ 	}
+ 
+-	pm_runtime_put(dev);
++	pm_runtime_put_sync(dev);
+ 
+-	return 0;
++out:
++	__crb_relinquish_locality(dev, priv, 0);
++
++	return rc;
+ }
+ 
+ static int crb_acpi_remove(struct acpi_device *device)
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index a21e31c2b952..58123df6b5f6 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -77,11 +77,13 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ 	return false;
+ }
+ 
+-static void release_locality(struct tpm_chip *chip, int l)
++static int release_locality(struct tpm_chip *chip, int l)
+ {
+ 	struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+ 
+ 	tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++
++	return 0;
+ }
+ 
+ static int request_locality(struct tpm_chip *chip, int l)
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index bf14214fa464..4db31b89507c 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -1634,6 +1634,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ 	 * (and possibly on the platform). So far only i.MX6Q (v1.30a) and
+ 	 * i.MX6DL (v1.31a) have been identified as needing the workaround, with
+ 	 * 4 and 1 iterations respectively.
++	 * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing
++	 * the workaround with a single iteration.
+ 	 */
+ 
+ 	switch (hdmi->version) {
+@@ -1641,6 +1643,7 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ 		count = 4;
+ 		break;
+ 	case 0x131a:
++	case 0x201a:
+ 		count = 1;
+ 		break;
+ 	default:
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index 345f6035599e..f1d93676b0fc 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1995,6 +1995,7 @@ static struct scsi_host_template mptsas_driver_template = {
+ 	.cmd_per_lun			= 7,
+ 	.use_clustering			= ENABLE_CLUSTERING,
+ 	.shost_attrs			= mptscsih_host_attrs,
++	.no_write_same			= 1,
+ };
+ 
+ static int mptsas_get_linkerrors(struct sas_phy *phy)