MDSv6

index 6d6122524711..9ef6c5dc00dc 100644
@@ -381,5 +381,6 @@
 #define X86_BUG_SPECTRE_V2		X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
 #define X86_BUG_SPEC_STORE_BYPASS	X86_BUG(17) /* CPU is affected by speculative store bypass attack */
 #define X86_BUG_L1TF			X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
+#define X86_BUG_MDS			X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
 
 #endif /* _ASM_X86_CPUFEATURES_H */

index 8e40c2446fd1..3e486d9d6e6c 100644
@@ -77,6 +77,7 @@
 						    * attack, so no Speculative Store Bypass
 						    * control required.
 						    */
+#define ARCH_CAP_MDS_NO			(1 << 5)   /* No Microarchitectural data sampling */
 
 #define MSR_IA32_FLUSH_CMD		0x0000010b
 #define L1D_FLUSH			(1 << 0)   /*

index cb28e98a0659..bac5a3a38f0d 100644
@@ -998,6 +998,14 @@ static const __initconst struct x86_cpu_id cpu_no_l1tf[] = {
 	{}
 };
 
+static const __initconst struct x86_cpu_id cpu_no_mds[] = {
+	/* in addition to cpu_no_speculation */
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_GOLDMONT	},
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_GOLDMONT_X	},
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_GOLDMONT_PLUS	},
+	{}
+};
+
 static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 {
 	u64 ia32_cap = 0;

@@ -1019,6 +1027,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 	if (ia32_cap & ARCH_CAP_IBRS_ALL)
 		setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
 
+	if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
+	    !x86_match_cpu(cpu_no_mds)) &&
+	    !(ia32_cap & ARCH_CAP_MDS_NO))
+		setup_force_cpu_bug(X86_BUG_MDS);
+
 	if (x86_match_cpu(cpu_no_meltdown))
 		return;
 

index 39a2c6ccf31d..7f0d847ca501 100644
@@ -28,6 +28,7 @@
 #include <linux/string.h>
 #include <linux/crc32.h>
 #include <linux/uaccess.h>
+#include <linux/clearcpu.h>
 #include <asm/div64.h>
 
 #include <media/dvb_demux.h>

@@ -515,6 +516,8 @@ void dvb_dmx_swfilter_packets(struct dvb_demux *demux, const u8 *buf,
 	}
 
 	spin_unlock_irqrestore(&demux->lock, flags);
+
+	lazy_clear_cpu_interrupt();
 }
 
 EXPORT_SYMBOL(dvb_dmx_swfilter_packets);

index 30e802bae2ca..b6f3a7184531 100644
@@ -6,6 +6,29 @@
 #include <linux/sched/smt.h>
 #include <asm/alternative.h>
 
+/*
+ * We cannot directly include the trace point header here
+ * because it leads to include loops with other trace point
+ * files pulling this one in. Define the static
+ * key manually here, which handles noping the fast path,
+ * and the actual tracing is done out of line.
+ */
+#ifdef CONFIG_TRACEPOINTS
+#include <asm/atomic.h>
+#include <linux/tracepoint-defs.h>
+
+extern struct tracepoint __tracepoint_clear_cpu;
+extern struct tracepoint __tracepoint_lazy_clear_cpu;
+#define cc_tracepoint_active(t) static_key_false(&(t).key)
+
+extern void do_trace_clear_cpu(void);
+extern void do_trace_lazy_clear_cpu(void);
+#else
+#define cc_tracepoint_active(t) false
+static inline void do_trace_clear_cpu(void) {}
+static inline void do_trace_lazy_clear_cpu(void) {}
+#endif
+
 DECLARE_PER_CPU(bool, clear_cpu_flag);
 
 /*

@@ -13,7 +36,7 @@ DECLARE_PER_CPU(bool, clear_cpu_flag);
  * We use microcode as a side effect of the obsolete VERW instruction
  */
 
-static inline void clear_cpu(void)
+static inline void __clear_cpu(void)
 {
 	unsigned kernel_ds = __KERNEL_DS;
 	/* Has to be memory form, don't modify to use an register */

@@ -21,6 +44,13 @@ static inline void clear_cpu(void)
 		[kernelds] "m" (kernel_ds));
 }
 
+static inline void clear_cpu(void)
+{
+	if (cc_tracepoint_active(__tracepoint_clear_cpu))
+		do_trace_clear_cpu();
+	__clear_cpu();
+}
+
 /*
  * Clear CPU buffers before going idle, so that no state is leaked to SMT
  * siblings taking over thread resources.

@@ -37,12 +67,14 @@ static inline void clear_cpu_idle(void)
 {
 	if (sched_smt_active()) {
 		__this_cpu_write(clear_cpu_flag, false);
-		clear_cpu();
+		__clear_cpu();
 	}
 }
 
 static inline void lazy_clear_cpu(void)
 {
+	if (cc_tracepoint_active(__tracepoint_lazy_clear_cpu))
+		do_trace_lazy_clear_cpu();
 	__this_cpu_write(clear_cpu_flag, true);
 }
 

new file mode 100644
index 000000000000..e742b5cd8ee9
@@ -0,0 +1,27 @@
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM clearcpu
+
+#if !defined(_TRACE_CLEARCPU_H) || defined(TRACE_HEADER_MULTI_READ)
+
+#include <linux/tracepoint.h>
+
+DECLARE_EVENT_CLASS(clear_cpu,
+		    TP_PROTO(int dummy),
+		    TP_ARGS(dummy),
+		    TP_STRUCT__entry(__field(int, dummy)),
+		    TP_fast_assign(),
+		    TP_printk("%d", __entry->dummy));
+
+DEFINE_EVENT(clear_cpu, clear_cpu, TP_PROTO(int dummy), TP_ARGS(dummy));
+DEFINE_EVENT(clear_cpu, lazy_clear_cpu, TP_PROTO(int dummy), TP_ARGS(dummy));
+
+#define _TRACE_CLEARCPU_H
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH asm/trace/
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE clearcpu
+#endif /* _TRACE_CLEARCPU_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>

index a756c57979be..146f9abc1931 100644
@@ -1061,6 +1061,23 @@ early_param("l1tf", l1tf_cmdline);
 
 #undef pr_fmt
 
+#define CREATE_TRACE_POINTS
+#include <asm/trace/clearcpu.h>
+
+void do_trace_clear_cpu(void)
+{
+	trace_clear_cpu(0);
+}
+EXPORT_SYMBOL(do_trace_clear_cpu);
+EXPORT_TRACEPOINT_SYMBOL(clear_cpu);
+
+void do_trace_lazy_clear_cpu(void)
+{
+	trace_lazy_clear_cpu(0);
+}
+EXPORT_SYMBOL(do_trace_lazy_clear_cpu);
+EXPORT_TRACEPOINT_SYMBOL(lazy_clear_cpu);
+
 DEFINE_PER_CPU(bool, clear_cpu_flag);
 EXPORT_PER_CPU_SYMBOL(clear_cpu_flag);
 

index 320ab978fb1f..976722d8b537 100644
@@ -2,6 +2,7 @@
 //
 // Code shared between 32 and 64 bit
 
+#include <linux/clearcpu.h>
 #include <asm/spec-ctrl.h>
 
 void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p);

index 999d6d8f0bef..995420034f57 100644
@@ -342,6 +342,13 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
 				 !cpumask_test_cpu(cpu, mm_cpumask(next))))
 			cpumask_set_cpu(cpu, mm_cpumask(next));
 
+		/*
+		 * We switched through a kernel thread, so schedule
+		 * a cpu clear to protect the thread.
+		 */
+		if (static_cpu_has_bug(X86_BUG_MDS) && was_lazy)
+			lazy_clear_cpu();
+
 		/*
 		 * If the CPU is not in lazy TLB mode, we are just switching
 		 * from one thread in a process to another thread in the same

@@ -376,6 +383,13 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
 		 */
 		cond_ibpb(tsk);
 
+		/*
+		 * We're switching to a different process, so schedule
+		 * a cpu clear.
+		 */
+		if (static_cpu_has_bug(X86_BUG_MDS))
+			lazy_clear_cpu();
+
 		if (IS_ENABLED(CONFIG_VMAP_STACK)) {
 			/*
 			 * If our current stack is in vmalloc space and isn't

index 1da885793805..d4a5e43311a8 100644
@@ -20,4 +20,22 @@ static inline void clear_cpu(void)
 		[kernelds] "m" (kernel_ds));
 }
 
+/*
+ * Clear CPU buffers before going idle, so that no state is leaked to SMT
+ * siblings taking over thread resources.
+ * Out of line to avoid include hell.
+ *
+ * Assumes that interrupts are disabled and only get reenabled
+ * before idle, otherwise the data from a racing interrupt might not
+ * get cleared. There are some callers who violate this,
+ * but they are only used in unattackable cases, like CPU
+ * offlining.
+ */
+
+static inline void clear_cpu_idle(void)
+{
+	if (sched_smt_active())
+		clear_cpu();
+}
+
 #endif

index 158ad1483c43..48adea5afacf 100644
@@ -14,6 +14,7 @@
 #include <acpi/processor.h>
 #include <asm/mwait.h>
 #include <asm/special_insns.h>
+#include <asm/clearcpu.h>
 
 /*
  * Initialize bm_flags based on the CPU cache properties

@@ -157,6 +158,7 @@ void __cpuidle acpi_processor_ffh_cstate_enter(struct acpi_processor_cx *cx)
 	unsigned int cpu = smp_processor_id();
 	struct cstate_entry *percpu_entry;
 
+	clear_cpu_idle();
 	percpu_entry = per_cpu_ptr(cpu_cstate_entry, cpu);
 	mwait_idle_with_hints(percpu_entry->states[cx->index].eax,
 	                      percpu_entry->states[cx->index].ecx);

index 5c93a65ee1e5..5352a60a3b9b 100644
@@ -159,6 +159,7 @@ void kvm_async_pf_task_wait(u32 token, int interrupt_kernel)
 			/*
 			 * We cannot reschedule. So halt.
 			 */
+			clear_cpu_idle();
 			native_safe_halt();
 			local_irq_disable();
 		}

@@ -788,6 +789,8 @@ static void kvm_wait(u8 *ptr, u8 val)
 	if (READ_ONCE(*ptr) != val)
 		goto out;
 
+	clear_cpu_idle();
+
 	/*
 	 * halt until it's our turn and kicked. Note that we do safe halt
 	 * for irq enabled case to avoid hang when lock info is overwritten

index 90ae0ca51083..9d9f2d2b209d 100644
@@ -42,6 +42,7 @@
 #include <asm/prctl.h>
 #include <asm/spec-ctrl.h>
 #include <asm/proto.h>
+#include <asm/clearcpu.h>
 
 #include "process.h"
 

@@ -589,6 +590,8 @@ void stop_this_cpu(void *dummy)
 	disable_local_APIC();
 	mcheck_cpu_clear(this_cpu_ptr(&cpu_info));
 
+	clear_cpu_idle();
+
 	/*
 	 * Use wbinvd on processors that support SME. This provides support
 	 * for performing a successful kexec when going from SME inactive

@@ -675,6 +678,8 @@ static __cpuidle void mwait_idle(void)
 			mb(); /* quirk */
 		}
 
+		clear_cpu_idle();
+
 		__monitor((void *)&current_thread_info()->flags, 0, 0);
 		if (!need_resched())
 			__sti_mwait(0, 0);

index ccd1f2a8e557..c7fff6b09253 100644
@@ -81,6 +81,7 @@
 #include <asm/cpu_device_id.h>
 #include <asm/spec-ctrl.h>
 #include <asm/hw_irq.h>
+#include <asm/clearcpu.h>
 
 /* representing HT siblings of each logical CPU */
 DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_sibling_map);

@@ -1635,6 +1636,7 @@ static inline void mwait_play_dead(void)
 	wbinvd();
 
 	while (1) {
+		clear_cpu_idle();
 		/*
 		 * The CLFLUSH is a workaround for erratum AAI65 for
 		 * the Xeon 7400 series.  It's not clear it is actually

@@ -1662,6 +1664,7 @@ void hlt_play_dead(void)
 		wbinvd();
 
 	while (1) {
+		clear_cpu_idle();
 		native_halt();
 		/*
 		 * If NMI wants to wake up CPU0, start CPU0.

index a47676a55b84..a9b24637f1a8 100644
@@ -26,6 +26,7 @@
 #include <linux/tick.h>
 #include <linux/slab.h>
 #include <linux/acpi.h>
+#include <linux/clearcpu.h>
 #include <asm/mwait.h>
 #include <xen/xen.h>
 

@@ -175,6 +176,7 @@ static int power_saving_thread(void *data)
 			tick_broadcast_enable();
 			tick_broadcast_enter();
 			stop_critical_timings();
+			clear_cpu_idle();
 
 			mwait_idle_with_hints(power_saving_mwait_eax, 1);
 

index b2131c4ea124..b4406ca1dfd7 100644
@@ -33,6 +33,7 @@
 #include <linux/cpuidle.h>
 #include <linux/cpu.h>
 #include <acpi/processor.h>
+#include <asm/clearcpu.h>
 
 /*
  * Include the apic definitions for x86 to have the APIC timer related defines

@@ -121,6 +122,7 @@ static const struct dmi_system_id processor_power_dmi_table[] = {
 static void __cpuidle acpi_safe_halt(void)
 {
 	if (!tif_need_resched()) {
+		clear_cpu_idle();
 		safe_halt();
 		local_irq_disable();
 	}

@@ -681,6 +683,7 @@ static int acpi_idle_play_dead(struct cpuidle_device *dev, int index)
 
 	ACPI_FLUSH_CPU_CACHE();
 
+	clear_cpu_idle();
 	while (1) {
 
 		if (cx->entry_method == ACPI_CSTATE_HALT)

index 8b5d85c91e9d..ddaa7603d53a 100644
@@ -65,6 +65,7 @@
 #include <asm/intel-family.h>
 #include <asm/mwait.h>
 #include <asm/msr.h>
+#include <asm/clearcpu.h>
 
 #define INTEL_IDLE_VERSION "0.4.1"
 

@@ -933,6 +934,8 @@ static __cpuidle int intel_idle(struct cpuidle_device *dev,
 		}
 	}
 
+	clear_cpu_idle();
+
 	mwait_idle_with_hints(eax, ecx);
 
 	if (!static_cpu_has(X86_FEATURE_ARAT) && tick)

@@ -953,6 +956,8 @@ static void intel_idle_s2idle(struct cpuidle_device *dev,
 	unsigned long ecx = 1; /* break on interrupt flag */
 	unsigned long eax = flg2MWAIT(drv->states[index].flags);
 
+	clear_cpu_idle();
+
 	mwait_idle_with_hints(eax, ecx);
 }
 

new file mode 100644
index 000000000000..3da885e4eb29
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_CLEARBPF_H
+#define _ASM_CLEARBPF_H 1
+
+#include <linux/clearcpu.h>
+#include <linux/cred.h>
+#include <asm/cpufeatures.h>
+
+/*
+ * When the BPF program was loaded unprivileged, clear the CPU
+ * to prevent any exploits written in BPF using side channels to read
+ * data leaked from other kernel code. In some cases, like
+ * process context with the same uid, we can avoid it.
+ *
+ * See Documentation/clearcpu.txt for more details.
+ */
+static inline void arch_bpf_prepare_nonpriv(kuid_t uid)
+{
+	if (!static_cpu_has(X86_BUG_MDS))
+		return;
+	if (in_interrupt() ||
+	    __this_cpu_read(clear_cpu_flag) ||
+	    !uid_eq(current_euid(), uid)) {
+		clear_cpu();
+		__this_cpu_write(clear_cpu_flag, 0);
+	}
+}
+
+#endif

index e532fcc6e4b5..2c7f62f8047a 100644
@@ -20,12 +20,21 @@
 #include <linux/set_memory.h>
 #include <linux/kallsyms.h>
 #include <linux/if_vlan.h>
+#include <linux/clearcpu.h>
 
 #include <net/sch_generic.h>
 
 #include <uapi/linux/filter.h>
 #include <uapi/linux/bpf.h>
 
+#ifdef CONFIG_ARCH_HAS_CLEAR_CPU
+#include <asm/clearbpf.h>
+#else
+static inline void arch_bpf_prepare_nonpriv(kuid_t uid)
+{
+}
+#endif
+
 struct sk_buff;
 struct sock;
 struct seccomp_data;

@@ -490,7 +499,9 @@ struct bpf_prog {
 				blinded:1,	/* Was blinded */
 				is_func:1,	/* program is a bpf function */
 				kprobe_override:1, /* Do we override a kprobe? */
-				has_callchain_buf:1; /* callchain buffer allocated? */
+				has_callchain_buf:1, /* callchain buffer allocated? */
+				priv:1;		/* Was loaded privileged */
+	kuid_t			uid;		/* Original uid who created it */
 	enum bpf_prog_type	type;		/* Type of BPF program */
 	enum bpf_attach_type	expected_attach_type; /* For some prog types */
 	u32			len;		/* Number of filter blocks */

@@ -513,7 +524,13 @@ struct sk_filter {
 	struct bpf_prog	*prog;
 };
 
-#define BPF_PROG_RUN(filter, ctx)  (*(filter)->bpf_func)(ctx, (filter)->insnsi)
+static inline unsigned _bpf_prog_run(const struct bpf_prog *bp, const void *ctx)
+{
+	if (!bp->priv)
+		arch_bpf_prepare_nonpriv(bp->uid);
+	return bp->bpf_func(ctx, bp->insnsi);
+}
+#define BPF_PROG_RUN(filter, ctx) _bpf_prog_run(filter, ctx)
 
 #define BPF_SKB_CB_LEN QDISC_CB_PRIV_LEN
 

index f908b9356025..67d845229d46 100644
@@ -99,6 +99,8 @@ struct bpf_prog *bpf_prog_alloc(unsigned int size, gfp_t gfp_extra_flags)
 	fp->aux = aux;
 	fp->aux->prog = fp;
 	fp->jit_requested = ebpf_jit_enabled();
+	fp->priv = !!capable(CAP_SYS_ADMIN);
+	fp->uid = current_euid();
 
 	INIT_LIST_HEAD_RCU(&fp->aux->ksym_lnode);
 

index 8974b3755670..a5c9764168f9 100644
@@ -376,6 +376,9 @@ static void __cpu_map_entry_free(struct rcu_head *rcu)
 
 		/* No concurrent bq_enqueue can run at this point */
 		bq_flush_to_queue(rcpu, bq, false);
+
+		/* Do lazy_clear_cpu_interrupt here? */
+
 	}
 	free_percpu(rcpu->bulkq);
 	/* Cannot kthread_stop() here, last put free rcpu resources */

index 88ab27694aa6..15d25c2436da 100644
@@ -5,7 +5,8 @@
 #include <linux/jump_label.h>
 #include <linux/sched/smt.h>
 #include <asm/alternative.h>
-#include <linux/thread_info.h>
+
+DECLARE_PER_CPU(bool, clear_cpu_flag);
 
 /*
  * Clear CPU buffers to avoid side channels.

@@ -34,8 +35,15 @@ static inline void clear_cpu(void)
 
 static inline void clear_cpu_idle(void)
 {
-	if (sched_smt_active())
+	if (sched_smt_active()) {
+		__this_cpu_write(clear_cpu_flag, false);
 		clear_cpu();
+	}
+}
+
+static inline void lazy_clear_cpu(void)
+{
+	__this_cpu_write(clear_cpu_flag, true);
 }
 
 #endif

index 26b890f18239..067309190a6a 100644
@@ -1061,6 +1061,9 @@ early_param("l1tf", l1tf_cmdline);
 
 #undef pr_fmt
 
+DEFINE_PER_CPU(bool, clear_cpu_flag);
+EXPORT_PER_CPU_SYMBOL(clear_cpu_flag);
+
 static void mds_select_mitigation(void)
 {
 	if (!boot_cpu_has(X86_BUG_MDS))

new file mode 100644
index 000000000000..63a6952b46fa
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _LINUX_CLEARCPU_H
+#define _LINUX_CLEARCPU_H 1
+
+#include <linux/preempt.h>
+
+#ifdef CONFIG_ARCH_HAS_CLEAR_CPU
+#include <asm/clearcpu.h>
+#else
+static inline void lazy_clear_cpu(void)
+{
+}
+#endif
+
+/*
+ * Use this function when potentially touching (reading or writing)
+ * user data in an interrupt. In this case schedule to clear the
+ * CPU buffers on kernel exit to avoid any potential side channels.
+ *
+ * If not in an interrupt we assume the touched data belongs to the
+ * current process and doesn't need to be cleared.
+ *
+ * This version is for code who might be in an interrupt.
+ * If you know for sure you're in interrupt context call
+ * lazy_clear_cpu directly.
+ *
+ * lazy_clear_cpu is reasonably cheap (just sets a bit) and
+ * can be used in fast paths.
+ */
+static inline void lazy_clear_cpu_interrupt(void)
+{
+	if (in_interrupt())
+		lazy_clear_cpu();
+}
+
+#endif

index 1fb6fd68b9c7..6123174a5f2c 100644
@@ -34,6 +34,7 @@
 #include <linux/scatterlist.h>
 #include <linux/mem_encrypt.h>
 #include <linux/set_memory.h>
+#include <linux/clearcpu.h>
 
 #include <asm/io.h>
 #include <asm/dma.h>

@@ -422,6 +423,7 @@ static void swiotlb_bounce(phys_addr_t orig_addr, phys_addr_t tlb_addr,
 	} else {
 		memcpy(phys_to_virt(orig_addr), vaddr, size);
 	}
+	lazy_clear_cpu_interrupt();
 }
 
 phys_addr_t swiotlb_tbl_map_single(struct device *hwdev,

index a6eacf2099c3..b13611a203c6 100644
@@ -1357,6 +1357,7 @@ static void ena_setup_mgmnt_intr(struct ena_adapter *adapter)
 	snprintf(adapter->irq_tbl[ENA_MGMNT_IRQ_IDX].name,
 		 ENA_IRQNAME_SIZE, "ena-mgmnt@pci:%s",
 		 pci_name(adapter->pdev));
+	adapter->irq_tbl[ENA_MGMNT_IRQ_IDX].flags = IRQF_USER_DATA;
 	adapter->irq_tbl[ENA_MGMNT_IRQ_IDX].handler =
 		ena_intr_msix_mgmnt;
 	adapter->irq_tbl[ENA_MGMNT_IRQ_IDX].data = adapter;

@@ -1381,6 +1382,7 @@ static void ena_setup_io_intr(struct ena_adapter *adapter)
 
 		snprintf(adapter->irq_tbl[irq_idx].name, ENA_IRQNAME_SIZE,
 			 "%s-Tx-Rx-%d", netdev->name, i);
+		adapter->irq_tbl[irq_idx].flags = 0;
 		adapter->irq_tbl[irq_idx].handler = ena_intr_msix_io;
 		adapter->irq_tbl[irq_idx].data = &adapter->ena_napi[i];
 		adapter->irq_tbl[irq_idx].vector =

@@ -1394,12 +1396,11 @@ static void ena_setup_io_intr(struct ena_adapter *adapter)
 
 static int ena_request_mgmnt_irq(struct ena_adapter *adapter)
 {
-	unsigned long flags = 0;
 	struct ena_irq *irq;
 	int rc;
 
 	irq = &adapter->irq_tbl[ENA_MGMNT_IRQ_IDX];
-	rc = request_irq(irq->vector, irq->handler, flags, irq->name,
+	rc = request_irq(irq->vector, irq->handler, irq->flags, irq->name,
 			 irq->data);
 	if (rc) {
 		netif_err(adapter, probe, adapter->netdev,

index 63870072cbbd..8e8394553dc7 100644
@@ -140,6 +140,7 @@
 
 struct ena_irq {
 	irq_handler_t handler;
+	unsigned flags;
 	void *data;
 	int cpu;
 	u32 vector;

index ffcc24620ec9..cd6e044d6599 100644
@@ -212,8 +212,12 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
 	ti->status &= ~(TS_COMPAT|TS_I386_REGS_POKED);
 #endif
 
-	if (static_key_enabled(&force_cpu_clear))
+	if (static_cpu_has(X86_BUG_MDS) &&
+		(static_key_enabled(&force_cpu_clear) ||
+		 __this_cpu_read(clear_cpu_flag))) {
 		clear_cpu();
+		__this_cpu_write(clear_cpu_flag, false);
+	}
 
 	user_enter_irqoff();
 }

index f8c703426c90..bc6e792ac677 100644
@@ -1841,7 +1841,8 @@ static int eni_start(struct atm_dev *dev)
 	     eni_dev->vci,eni_dev->rx_dma,eni_dev->tx_dma,
 	     eni_dev->service,buf);
 	spin_lock_init(&eni_dev->lock);
-	tasklet_init(&eni_dev->task,eni_tasklet,(unsigned long) dev);
+	tasklet_init_flags(&eni_dev->task, eni_tasklet, (unsigned long)dev,
+			   TASKLET_USER_DATA);
 	eni_dev->events = 0;
 	/* initialize memory management */
 	buffer_mem = eni_dev->mem - (buf - eni_dev->ram);

index 211607986134..36f5d53ac41c 100644
@@ -383,7 +383,8 @@ static int he_init_one(struct pci_dev *pci_dev,
 	he_dev->atm_dev->dev_data = he_dev;
 	atm_dev->dev_data = he_dev;
 	he_dev->number = atm_dev->number;
-	tasklet_init(&he_dev->tasklet, he_tasklet, (unsigned long) he_dev);
+	tasklet_init_flags(&he_dev->tasklet, he_tasklet,
+			   (unsigned long)he_dev, TASKLET_USER_DATA);
 	spin_lock_init(&he_dev->global_lock);
 
 	if (he_start(atm_dev)) {

index a6b3aa5bbb82..b5dd8d49920f 100644
@@ -1004,7 +1004,8 @@ static int ace_setup(struct ace_device *ace)
 	/*
 	 * Initialize the state machine tasklet and stall timer
 	 */
-	tasklet_init(&ace->fsm_tasklet, ace_fsm_tasklet, (unsigned long)ace);
+	tasklet_init_flags(&ace->fsm_tasklet, ace_fsm_tasklet,
+			   (unsigned long)ace, TASKLET_USER_DATA);
 	timer_setup(&ace->stall_timer, ace_stall_timer, TIMER_USER_DATA);
 
 	/*

index 1b0d156bb9be..142562b2dee2 100644
@@ -499,7 +499,8 @@ static int init_ixp_crypto(struct device *dev)
 		goto err;
 	}
 	qmgr_set_irq(RECV_QID, QUEUE_IRQ_SRC_NOT_EMPTY, irqhandler, NULL);
-	tasklet_init(&crypto_done_tasklet, crypto_done_action, 0);
+	tasklet_init_flags(&crypto_done_tasklet, crypto_done_action, 0,
+			   TASKLET_USER_DATA);
 
 	qmgr_enable_irq(RECV_QID);
 	return 0;

index cd1cdf5305bc..23c053fb0d67 100644
@@ -283,9 +283,10 @@ static int adf_setup_bh(struct adf_accel_dev *accel_dev)
 	int i;
 
 	for (i = 0; i < hw_data->num_banks; i++)
-		tasklet_init(&priv_data->banks[i].resp_handler,
-			     adf_response_handler,
-			     (unsigned long)&priv_data->banks[i]);
+		tasklet_init_flags(&priv_data->banks[i].resp_handler,
+				   adf_response_handler,
+				   (unsigned long)&priv_data->banks[i],
+				   TASKLET_USER_DATA);
 	return 0;
 }
 

index b36d8653b1ba..e9d188baffee 100644
@@ -125,9 +125,9 @@ static int adf_enable_sriov(struct adf_accel_dev *accel_dev)
 		vf_info->accel_dev = accel_dev;
 		vf_info->vf_nr = i;
 
-		tasklet_init(&vf_info->vf2pf_bh_tasklet,
-			     (void *)adf_vf2pf_bh_handler,
-			     (unsigned long)vf_info);
+		tasklet_init_flags(&vf_info->vf2pf_bh_tasklet,
+				   (void *)adf_vf2pf_bh_handler,
+				   (unsigned long)vf_info, TASKLET_USER_DATA);
 		mutex_init(&vf_info->pf2vf_lock);
 		ratelimit_state_init(&vf_info->vf2pf_ratelimit,
 				     DEFAULT_RATELIMIT_INTERVAL,

index 4a73fc70f7a9..ee92578c51a9 100644
@@ -182,8 +182,9 @@ static void adf_pf2vf_bh_handler(void *data)
 
 static int adf_setup_pf2vf_bh(struct adf_accel_dev *accel_dev)
 {
-	tasklet_init(&accel_dev->vf.pf2vf_bh_tasklet,
-		     (void *)adf_pf2vf_bh_handler, (unsigned long)accel_dev);
+	tasklet_init_flags(&accel_dev->vf.pf2vf_bh_tasklet,
+			   (void *)adf_pf2vf_bh_handler,
+			   (unsigned long)accel_dev, TASKLET_USER_DATA);
 
 	mutex_init(&accel_dev->vf.vf2pf_lock);
 	return 0;

@@ -259,8 +260,9 @@ static int adf_setup_bh(struct adf_accel_dev *accel_dev)
 {
 	struct adf_etr_data *priv_data = accel_dev->transport;
 
-	tasklet_init(&priv_data->banks[0].resp_handler, adf_response_handler,
-		     (unsigned long)priv_data->banks);
+	tasklet_init_flags(&priv_data->banks[0].resp_handler,
+			   adf_response_handler,
+			   (unsigned long)priv_data->banks, TASKLET_USER_DATA);
 	return 0;
 }
 

index dc053e62f894..c5ff06c87592 100644
@@ -1271,7 +1271,8 @@ int dw_dma_probe(struct dw_dma_chip *chip)
 		goto err_pdata;
 	}
 
-	tasklet_init(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw);
+	tasklet_init_flags(&dw->tasklet, dw_dma_tasklet, (unsigned long)dw,
+			   TASKLET_USER_DATA);
 
 	err = request_irq(chip->irq, dw_dma_interrupt, IRQF_SHARED,
 			  dw->name, dw);

index 2d810dfcdc48..72fa81a88f39 100644
@@ -760,7 +760,8 @@ ioat_init_channel(struct ioatdma_device *ioat_dma,
 	list_add_tail(&ioat_chan->dma_chan.device_node, &dma->channels);
 	ioat_dma->idx[idx] = ioat_chan;
 	timer_setup(&ioat_chan->timer, ioat_timer_event, 0);
-	tasklet_init(&ioat_chan->cleanup_task, ioat_cleanup_event, data);
+	tasklet_init_flags(&ioat_chan->cleanup_task, ioat_cleanup_event, data,
+			   TASKLET_USER_DATA);
 }
 
 #define IOAT_NUM_SRC_TEST 6 /* must be <= 8 */

index 88ad8ed2a8d6..c3bf2fd20ca2 100644
@@ -139,7 +139,8 @@ void vchan_init(struct virt_dma_chan *vc, struct dma_device *dmadev)
 	INIT_LIST_HEAD(&vc->desc_issued);
 	INIT_LIST_HEAD(&vc->desc_completed);
 
-	tasklet_init(&vc->task, vchan_complete, (unsigned long)vc);
+	tasklet_init_flags(&vc->task, vchan_complete, (unsigned long)vc,
+			   TASKLET_USER_DATA);
 
 	vc->chan.device = dmadev;
 	list_add_tail(&vc->chan.device_node, &dmadev->channels);

index eab9341a5152..61466f7877e1 100644
@@ -2231,8 +2231,9 @@ logical_ring_setup(struct intel_engine_cs *engine)
 	/* Intentionally left blank. */
 	engine->buffer = NULL;
 
-	tasklet_init(&engine->execlists.tasklet,
-		     execlists_submission_tasklet, (unsigned long)engine);
+	tasklet_init_flags(&engine->execlists.tasklet,
+			   execlists_submission_tasklet,
+			   (unsigned long)engine, TASKLET_USER_DATA);
 
 	logical_ring_default_vfuncs(engine);
 	logical_ring_default_irqs(engine);

index d01689079e9b..d904f0bfc367 100644
@@ -333,8 +333,8 @@ static struct vmbus_channel *alloc_channel(void)
 	INIT_LIST_HEAD(&channel->sc_list);
 	INIT_LIST_HEAD(&channel->percpu_list);
 
-	tasklet_init(&channel->callback_event,
-		     vmbus_on_event, (unsigned long)channel);
+	tasklet_init_flags(&channel->callback_event, vmbus_on_event,
+			   (unsigned long)channel, TASKLET_USER_DATA);
 
 	return channel;
 }

index 632d25674e7f..28df050834d1 100644
@@ -209,8 +209,8 @@ int hv_synic_alloc(void)
 	for_each_present_cpu(cpu) {
 		hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
 
-		tasklet_init(&hv_cpu->msg_dpc,
-			     vmbus_on_msg_dpc, (unsigned long) hv_cpu);
+		tasklet_init_flags(&hv_cpu->msg_dpc, vmbus_on_msg_dpc,
+				   (unsigned long)hv_cpu, TASKLET_USER_DATA);
 
 		hv_cpu->clk_evt = kzalloc(sizeof(struct clock_event_device),
 					  GFP_KERNEL);

index b98b054148cd..d437c3926455 100644
@@ -380,8 +380,8 @@ int bnxt_qplib_nq_start_irq(struct bnxt_qplib_nq *nq, int nq_indx,
 
 	nq->vector = msix_vector;
 	if (need_init)
-		tasklet_init(&nq->worker, bnxt_qplib_service_nq,
-			     (unsigned long)nq);
+		tasklet_init_flags(&nq->worker, bnxt_qplib_service_nq,
+				   (unsigned long)nq, TASKLET_USER_DATA);
 	else
 		tasklet_enable(&nq->worker);
 

index 19551aa43850..2e584b626b89 100644
@@ -654,8 +654,8 @@ int bnxt_qplib_rcfw_start_irq(struct bnxt_qplib_rcfw *rcfw, int msix_vector,
 
 	rcfw->vector = msix_vector;
 	if (need_init)
-		tasklet_init(&rcfw->worker,
-			     bnxt_qplib_service_creq, (unsigned long)rcfw);
+		tasklet_init_flags(&rcfw->worker, bnxt_qplib_service_creq,
+				   (unsigned long)rcfw, TASKLET_USER_DATA);
 	else
 		tasklet_enable(&rcfw->worker);
 	rc = request_irq(rcfw->vector, bnxt_qplib_creq_irq, 0,

index 68095f00d08f..07fcef01a383 100644
@@ -689,10 +689,12 @@ static enum i40iw_status_code i40iw_configure_ceq_vector(struct i40iw_device *iw
 	enum i40iw_status_code status;
 
 	if (iwdev->msix_shared && !ceq_id) {
-		tasklet_init(&iwdev->dpc_tasklet, i40iw_dpc, (unsigned long)iwdev);
+		tasklet_init_flags(&iwdev->dpc_tasklet, i40iw_dpc,
+				   (unsigned long)iwdev, TASKLET_USER_DATA);
 		status = request_irq(msix_vec->irq, i40iw_irq_handler, 0, "AEQCEQ", iwdev);
 	} else {
-		tasklet_init(&iwceq->dpc_tasklet, i40iw_ceq_dpc, (unsigned long)iwceq);
+		tasklet_init_flags(&iwceq->dpc_tasklet, i40iw_ceq_dpc,
+				   (unsigned long)iwceq, TASKLET_USER_DATA);
 		status = request_irq(msix_vec->irq, i40iw_ceq_handler, 0, "CEQ", iwceq);
 	}
 

@@ -841,7 +843,8 @@ static enum i40iw_status_code i40iw_configure_aeq_vector(struct i40iw_device *iw
 	u32 ret = 0;
 
 	if (!iwdev->msix_shared) {
-		tasklet_init(&iwdev->dpc_tasklet, i40iw_dpc, (unsigned long)iwdev);
+		tasklet_init_flags(&iwdev->dpc_tasklet, i40iw_dpc,
+				   (unsigned long)iwdev, TASKLET_USER_DATA);
 		ret = request_irq(msix_vec->irq, i40iw_irq_handler, 0, "i40iw", iwdev);
 	}
 	if (ret) {

index 3d64081c4819..52a9513f683a 100644
@@ -436,8 +436,8 @@ int qib_setup_sdma(struct qib_pportdata *ppd)
 
 	INIT_LIST_HEAD(&ppd->sdma_activelist);
 
-	tasklet_init(&ppd->sdma_sw_clean_up_task, sdma_sw_clean_up_task,
-		(unsigned long)ppd);
+	tasklet_init_flags(&ppd->sdma_sw_clean_up_task, sdma_sw_clean_up_task,
+			   (unsigned long)ppd, TASKLET_USER_DATA);
 
 	ret = dd->f_init_sdma_regs(ppd);
 	if (ret)

index a57276f2cb84..b8e0ad6cea0f 100644
@@ -107,7 +107,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
 
 	cq->is_dying = false;
 
-	tasklet_init(&cq->comp_task, rxe_send_complete, (unsigned long)cq);
+	tasklet_init_flags(&cq->comp_task, rxe_send_complete,
+			   (unsigned long)cq, TASKLET_USER_DATA);
 
 	spin_lock_init(&cq->cq_lock);
 	cq->ibcq.cqe = cqe;

index e1423f7648d6..7760e143568a 100644
@@ -77,7 +77,7 @@ static struct timer_list	hil_mlcs_kicker;
 static int			hil_mlcs_probe;
 
 static void hil_mlcs_process(unsigned long unused);
-static DECLARE_TASKLET_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0);
+static DECLARE_TASKLET_USERDATA_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0);
 
 
 /* #define HIL_MLC_DEBUG */

index ecdeb89645d0..23ad5c21db4c 100644
@@ -2146,8 +2146,8 @@ static int gigaset_initbcshw(struct bc_state *bcs)
 		bcs->hw.bas = NULL;
 		return -ENOMEM;
 	}
-	tasklet_init(&ubc->sent_tasklet,
-		     write_iso_tasklet, (unsigned long) bcs);
+	tasklet_init_flags(&ubc->sent_tasklet, write_iso_tasklet,
+			   (unsigned long)bcs, TASKLET_USER_DATA);
 
 	spin_lock_init(&ubc->isoinlock);
 	for (i = 0; i < BAS_INURBS; ++i)

@@ -2167,8 +2167,8 @@ static int gigaset_initbcshw(struct bc_state *bcs)
 	ubc->aborts = 0;
 	ubc->shared0s = 0;
 	ubc->stolen0s = 0;
-	tasklet_init(&ubc->rcvd_tasklet,
-		     read_iso_tasklet, (unsigned long) bcs);
+	tasklet_init_flags(&ubc->rcvd_tasklet, read_iso_tasklet,
+			   (unsigned long)bcs, TASKLET_USER_DATA);
 	return 0;
 }
 

index 76b5407b5277..8e66e2dac9e7 100644
@@ -692,8 +692,8 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
 	cs->ev_tail = 0;
 	cs->ev_head = 0;
 
-	tasklet_init(&cs->event_tasklet, gigaset_handle_event,
-		     (unsigned long) cs);
+	tasklet_init_flags(&cs->event_tasklet, gigaset_handle_event,
+			   (unsigned long)cs, TASKLET_USER_DATA);
 	tty_port_init(&cs->port);
 	cs->commands_pending = 0;
 	cs->cur_at_seq = 0;

index ab0b63a4d045..39e2427c5f52 100644
@@ -403,8 +403,8 @@ static int gigaset_initcshw(struct cardstate *cs)
 		return rc;
 	}
 
-	tasklet_init(&cs->write_tasklet,
-		     gigaset_modem_fill, (unsigned long) cs);
+	tasklet_init_flags(&cs->write_tasklet, gigaset_modem_fill,
+			   (unsigned long)cs, TASKLET_USER_DATA);
 	return 0;
 }
 

index eade36dafa34..2b243239bcb8 100644
@@ -590,8 +590,8 @@ static int gigaset_initcshw(struct cardstate *cs)
 	ucs->bulk_out_buffer = NULL;
 	ucs->bulk_out_urb = NULL;
 	ucs->read_urb = NULL;
-	tasklet_init(&cs->write_tasklet,
-		     gigaset_modem_fill, (unsigned long) cs);
+	tasklet_init_flags(&cs->write_tasklet, gigaset_modem_fill,
+			   (unsigned long)cs, TASKLET_USER_DATA);
 
 	return 0;
 }

index b46fbe557dd9..71844d7cb4ba 100644
@@ -787,7 +787,8 @@ static int dvb_bt8xx_load_card(struct dvb_bt8xx_card *card, u32 type)
 		goto err_disconnect_frontend;
 	}
 
-	tasklet_init(&card->bt->tasklet, dvb_bt8xx_task, (unsigned long) card);
+	tasklet_init_flags(&card->bt->tasklet, dvb_bt8xx_task,
+			   (unsigned long)card, TASKLET_USER_DATA);
 
 	frontend_init(card, type);
 

index 54dbaa700fa3..30b739da90e5 100644
@@ -217,7 +217,8 @@ int mantis_dvb_init(struct mantis_pci *mantis)
 	}
 
 	dvb_net_init(&mantis->dvb_adapter, &mantis->dvbnet, &mantis->demux.dmx);
-	tasklet_init(&mantis->tasklet, mantis_dma_xfer, (unsigned long) mantis);
+	tasklet_init_flags(&mantis->tasklet, mantis_dma_xfer,
+			   (unsigned long)mantis, TASKLET_USER_DATA);
 	tasklet_disable(&mantis->tasklet);
 	if (mantis->hwconfig) {
 		result = config->frontend_init(mantis, mantis->fe);

index 4d5ddbcb3514..234758f89eee 100644
@@ -431,7 +431,8 @@ static int smi_port_init(struct smi_port *port, int dmaChanUsed)
 	}
 
 	smi_port_disableInterrupt(port);
-	tasklet_init(&port->tasklet, smi_dma_xfer, (unsigned long)port);
+	tasklet_init_flags(&port->tasklet, smi_dma_xfer, (unsigned long)port,
+			   TASKLET_USER_DATA);
 	tasklet_disable(&port->tasklet);
 	port->enable = 1;
 	return 0;

index 409defc75c05..62ddcb7c36e4 100644
@@ -2533,7 +2533,8 @@ static int av7110_attach(struct saa7146_dev* dev,
 		saa7146_write(dev, NUM_LINE_BYTE3, (TS_HEIGHT << 16) | TS_WIDTH);
 		saa7146_write(dev, MC2, MASK_04 | MASK_20);
 
-		tasklet_init(&av7110->vpe_tasklet, vpeirq, (unsigned long) av7110);
+		tasklet_init_flags(&av7110->vpe_tasklet, vpeirq,
+				   (unsigned long)av7110, TASKLET_USER_DATA);
 
 	} else if (budgetpatch) {
 		spin_lock_init(&av7110->feedlock1);

@@ -2614,7 +2615,8 @@ static int av7110_attach(struct saa7146_dev* dev,
 		saa7146_write(dev, MC1, (MASK_13 | MASK_29));
 
 		/* end of budgetpatch register initialization */
-		tasklet_init (&av7110->vpe_tasklet,  vpeirq,  (unsigned long) av7110);
+		tasklet_init_flags(&av7110->vpe_tasklet, vpeirq,
+				   (unsigned long)av7110, TASKLET_USER_DATA);
 	} else {
 		saa7146_write(dev, PCI_BT_V1, 0x1c00101f);
 		saa7146_write(dev, BCS_CTRL, 0x80400040);

@@ -2629,8 +2631,10 @@ static int av7110_attach(struct saa7146_dev* dev,
 		saa7146_write(dev, GPIO_CTRL, 0x000000);
 	}
 
-	tasklet_init (&av7110->debi_tasklet, debiirq, (unsigned long) av7110);
-	tasklet_init (&av7110->gpio_tasklet, gpioirq, (unsigned long) av7110);
+	tasklet_init_flags(&av7110->debi_tasklet, debiirq,
+			   (unsigned long)av7110, TASKLET_USER_DATA);
+	tasklet_init_flags(&av7110->gpio_tasklet, gpioirq,
+			   (unsigned long)av7110, TASKLET_USER_DATA);
 
 	mutex_init(&av7110->pid_mutex);
 

index ec8f92540f7c..78e3cbfa312f 100644
@@ -243,8 +243,9 @@ static int msp430_ir_init(struct budget_ci *budget_ci)
 
 	budget_ci->ir.dev = dev;
 
-	tasklet_init(&budget_ci->ir.msp430_irq_tasklet, msp430_ir_interrupt,
-		     (unsigned long) budget_ci);
+	tasklet_init_flags(&budget_ci->ir.msp430_irq_tasklet,
+			   msp430_ir_interrupt, (unsigned long)budget_ci,
+			   TASKLET_USER_DATA);
 
 	SAA7146_IER_ENABLE(saa, MASK_06);
 	saa7146_setgpio(saa, 3, SAA7146_GPIO_IRQHI);

@@ -505,7 +506,9 @@ static int ciintf_init(struct budget_ci *budget_ci)
 
 	// Setup CI slot IRQ
 	if (budget_ci->ci_irq) {
-		tasklet_init(&budget_ci->ciintf_irq_tasklet, ciintf_interrupt, (unsigned long) budget_ci);
+		tasklet_init_flags(&budget_ci->ciintf_irq_tasklet,
+				   ciintf_interrupt, (unsigned long)budget_ci,
+				   TASKLET_USER_DATA);
 		if (budget_ci->slot_status != SLOTSTATUS_NONE) {
 			saa7146_setgpio(saa, 0, SAA7146_GPIO_IRQLO);
 		} else {

index 35b696bdb2df..9962b1413a9e 100644
@@ -528,7 +528,8 @@ int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
 	/* upload all */
 	saa7146_write(dev, GPIO_CTRL, 0x000000);
 
-	tasklet_init(&budget->vpe_tasklet, vpeirq, (unsigned long) budget);
+	tasklet_init_flags(&budget->vpe_tasklet, vpeirq,
+			   (unsigned long)budget, TASKLET_USER_DATA);
 
 	/* frontend power on */
 	if (bi->type != BUDGET_FS_ACTIVY)

index 5a1f3aa4101a..811a22ae797f 100644
@@ -1066,8 +1066,8 @@ int tw5864_video_init(struct tw5864_dev *dev, int *video_nr)
 	dev->irqmask |= TW5864_INTR_VLC_DONE | TW5864_INTR_TIMER;
 	tw5864_irqmask_apply(dev);
 
-	tasklet_init(&dev->tasklet, tw5864_handle_frame_task,
-		     (unsigned long)dev);
+	tasklet_init_flags(&dev->tasklet, tw5864_handle_frame_task,
+			   (unsigned long)dev, TASKLET_USER_DATA);
 
 	for (i = 0; i < TW5864_INPUTS; i++) {
 		dev->inputs[i].root = dev;

index f1b301810260..c066db5d329c 100644
@@ -1280,8 +1280,8 @@ static int mcam_setup_vb2(struct mcam_camera *cam)
 		break;
 	case B_vmalloc:
 #ifdef MCAM_MODE_VMALLOC
-		tasklet_init(&cam->s_tasklet, mcam_frame_tasklet,
-				(unsigned long) cam);
+		tasklet_init_flags(&cam->s_tasklet, mcam_frame_tasklet,
+				   (unsigned long)cam, TASKLET_USER_DATA);
 		vq->ops = &mcam_vb2_ops;
 		vq->mem_ops = &vb2_vmalloc_memops;
 		cam->dma_setup = mcam_ctlr_dma_vmalloc;

index f2b0598d62e5..01d7728613fe 100644
@@ -1540,11 +1540,13 @@ int fmc_prepare(struct fmdev *fmdev)
 
 	/* Initialize TX queue and TX tasklet */
 	skb_queue_head_init(&fmdev->tx_q);
-	tasklet_init(&fmdev->tx_task, send_tasklet, (unsigned long)fmdev);
+	tasklet_init_flags(&fmdev->tx_task, send_tasklet,
+			   (unsigned long)fmdev, TASKLET_USER_DATA);
 
 	/* Initialize RX Queue and RX tasklet */
 	skb_queue_head_init(&fmdev->rx_q);
-	tasklet_init(&fmdev->rx_task, recv_tasklet, (unsigned long)fmdev);
+	tasklet_init_flags(&fmdev->rx_task, recv_tasklet,
+			   (unsigned long)fmdev, TASKLET_USER_DATA);
 
 	fmdev->irq_info.stage = 0;
 	atomic_set(&fmdev->tx_cnt, 1);

index 44ca66cb9b8f..571b6a69b28d 100644
@@ -1218,8 +1218,9 @@ static void ttusb_dec_init_tasklet(struct ttusb_dec *dec)
 {
 	spin_lock_init(&dec->urb_frame_list_lock);
 	INIT_LIST_HEAD(&dec->urb_frame_list);
-	tasklet_init(&dec->urb_tasklet, ttusb_dec_process_urb_frame_list,
-		     (unsigned long)dec);
+	tasklet_init_flags(&dec->urb_tasklet,
+			   ttusb_dec_process_urb_frame_list,
+			   (unsigned long)dec, TASKLET_USER_DATA);
 }
 
 static int ttusb_init_rc( struct ttusb_dec *dec)

index 13b969c106ff..374e269a03fa 100644
@@ -893,7 +893,8 @@ static struct memstick_host *jmb38x_ms_alloc_host(struct jmb38x_ms *jm, int cnt)
 	host->irq = jm->pdev->irq;
 	host->timeout_jiffies = msecs_to_jiffies(1000);
 
-	tasklet_init(&host->notify, jmb38x_ms_req_tasklet, (unsigned long)msh);
+	tasklet_init_flags(&host->notify, jmb38x_ms_req_tasklet,
+			   (unsigned long)msh, TASKLET_USER_DATA);
 	msh->request = jmb38x_ms_submit_req;
 	msh->set_param = jmb38x_ms_set_param;
 

index dad5abee656e..c4b6d8698776 100644
@@ -467,10 +467,10 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
 	vmci_dev->exclusive_vectors = false;
 	vmci_dev->iobase = iobase;
 
-	tasklet_init(&vmci_dev->datagram_tasklet,
-		     vmci_dispatch_dgs, (unsigned long)vmci_dev);
-	tasklet_init(&vmci_dev->bm_tasklet,
-		     vmci_process_bitmap, (unsigned long)vmci_dev);
+	tasklet_init_flags(&vmci_dev->datagram_tasklet, vmci_dispatch_dgs,
+			   (unsigned long)vmci_dev, TASKLET_USER_DATA);
+	tasklet_init_flags(&vmci_dev->bm_tasklet, vmci_process_bitmap,
+			   (unsigned long)vmci_dev, TASKLET_USER_DATA);
 
 	vmci_dev->data_buffer = vmalloc(VMCI_MAX_DG_SIZE);
 	if (!vmci_dev->data_buffer) {

index 1e54bbf13d75..b8b607a71eb1 100644
@@ -1452,16 +1452,16 @@ static int wbsd_request_irq(struct wbsd_host *host, int irq)
 	/*
 	 * Set up tasklets. Must be done before requesting interrupt.
 	 */
-	tasklet_init(&host->card_tasklet, wbsd_tasklet_card,
-			(unsigned long)host);
-	tasklet_init(&host->fifo_tasklet, wbsd_tasklet_fifo,
-			(unsigned long)host);
-	tasklet_init(&host->crc_tasklet, wbsd_tasklet_crc,
-			(unsigned long)host);
-	tasklet_init(&host->timeout_tasklet, wbsd_tasklet_timeout,
-			(unsigned long)host);
-	tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish,
-			(unsigned long)host);
+	tasklet_init_flags(&host->card_tasklet, wbsd_tasklet_card,
+			   (unsigned long)host, TASKLET_USER_DATA);
+	tasklet_init_flags(&host->fifo_tasklet, wbsd_tasklet_fifo,
+			   (unsigned long)host, TASKLET_USER_DATA);
+	tasklet_init_flags(&host->crc_tasklet, wbsd_tasklet_crc,
+			   (unsigned long)host, TASKLET_USER_DATA);
+	tasklet_init_flags(&host->timeout_tasklet, wbsd_tasklet_timeout,
+			   (unsigned long)host, TASKLET_USER_DATA);
+	tasklet_init_flags(&host->finish_tasklet, wbsd_tasklet_finish,
+			   (unsigned long)host, TASKLET_USER_DATA);
 
 	/*
 	 * Allocate interrupt.

index 510dfc1c236b..26fce29ab463 100644
@@ -4456,8 +4456,8 @@ static int cnic_init_bnx2_irq(struct cnic_dev *dev)
 		CNIC_WR(dev, base + BNX2_HC_CMD_TICKS_OFF, (64 << 16) | 220);
 
 		cp->last_status_idx = cp->status_blk.bnx2->status_idx;
-		tasklet_init(&cp->cnic_irq_task, cnic_service_bnx2_msix,
-			     (unsigned long) dev);
+		tasklet_init_flags(&cp->cnic_irq_task, cnic_service_bnx2_msix,
+				   (unsigned long)dev, TASKLET_USER_DATA);
 		err = cnic_request_irq(dev);
 		if (err)
 			return err;

@@ -4866,8 +4866,8 @@ static int cnic_init_bnx2x_irq(struct cnic_dev *dev)
 	struct cnic_eth_dev *ethdev = cp->ethdev;
 	int err = 0;
 
-	tasklet_init(&cp->cnic_irq_task, cnic_service_bnx2x_bh,
-		     (unsigned long) dev);
+	tasklet_init_flags(&cp->cnic_irq_task, cnic_service_bnx2x_bh,
+			   (unsigned long)dev, TASKLET_USER_DATA);
 	if (ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
 		err = cnic_request_irq(dev);
 

index 2b2882615e8b..c6a916f52558 100644
@@ -4131,8 +4131,8 @@ static int macb_probe(struct platform_device *pdev)
 		goto err_out_unregister_mdio;
 	}
 
-	tasklet_init(&bp->hresp_err_tasklet, macb_hresp_error_task,
-		     (unsigned long)bp);
+	tasklet_init_flags(&bp->hresp_err_tasklet, macb_hresp_error_task,
+			   (unsigned long)bp, TASKLET_USER_DATA);
 
 	phy_attached_info(phydev);
 

index e3d7c74d47bb..17d7f1fffac5 100644
@@ -967,8 +967,8 @@ static int ks8842_alloc_dma_bufs(struct net_device *netdev)
 		goto err;
 	}
 
-	tasklet_init(&rx_ctl->tasklet, ks8842_rx_frame_dma_tasklet,
-		(unsigned long)netdev);
+	tasklet_init_flags(&rx_ctl->tasklet, ks8842_rx_frame_dma_tasklet,
+			   (unsigned long)netdev, TASKLET_USER_DATA);
 
 	return 0;
 err:

@@ -1187,7 +1187,8 @@ static int ks8842_probe(struct platform_device *pdev)
 		adapter->dma_tx.channel = -1;
 	}
 
-	tasklet_init(&adapter->tasklet, ks8842_tasklet, (unsigned long)netdev);
+	tasklet_init_flags(&adapter->tasklet, ks8842_tasklet,
+			   (unsigned long)netdev, TASKLET_USER_DATA);
 	spin_lock_init(&adapter->lock);
 
 	netdev->netdev_ops = &ks8842_netdev_ops;

index b287bb811875..22e4f5a62daf 100644
@@ -183,7 +183,8 @@ ppp_asynctty_open(struct tty_struct *tty)
 	ap->lcp_fcs = -1;
 
 	skb_queue_head_init(&ap->rqueue);
-	tasklet_init(&ap->tsk, ppp_async_process, (unsigned long) ap);
+	tasklet_init_flags(&ap->tsk, ppp_async_process, (unsigned long)ap,
+			   TASKLET_USER_DATA);
 
 	refcount_set(&ap->refcnt, 1);
 	init_completion(&ap->dead);

index d02ba2494d93..5d5a61944ad8 100644
@@ -181,7 +181,8 @@ ppp_sync_open(struct tty_struct *tty)
 	ap->raccm = ~0U;
 
 	skb_queue_head_init(&ap->rqueue);
-	tasklet_init(&ap->tsk, ppp_sync_process, (unsigned long) ap);
+	tasklet_init_flags(&ap->tsk, ppp_sync_process, (unsigned long)ap,
+			   TASKLET_USER_DATA);
 
 	refcount_set(&ap->refcnt, 1);
 	init_completion(&ap->dead_cmp);

index 50c05d0f44cb..12cabae87dbd 100644
@@ -779,7 +779,8 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
 
 	hrtimer_init(&ctx->tx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
 	ctx->tx_timer.function = &cdc_ncm_tx_timer_cb;
-	tasklet_init(&ctx->bh, cdc_ncm_txpath_bh, (unsigned long)dev);
+	tasklet_init_flags(&ctx->bh, cdc_ncm_txpath_bh, (unsigned long)dev,
+			   TASKLET_USER_DATA);
 	atomic_set(&ctx->stop, 0);
 	spin_lock_init(&ctx->mtx);
 

index d6916f787fce..ae71221f4de4 100644
@@ -1278,9 +1278,9 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
 		serial->rx_state = RX_IDLE;
 		/* Force default termio settings */
 		_hso_serial_set_termios(tty, NULL);
-		tasklet_init(&serial->unthrottle_tasklet,
-			     (void (*)(unsigned long))hso_unthrottle_tasklet,
-			     (unsigned long)serial);
+		tasklet_init_flags(&serial->unthrottle_tasklet,
+				   (void(*)(unsigned long))hso_unthrottle_tasklet,
+				   (unsigned long)serial, TASKLET_USER_DATA);
 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
 		if (result) {
 			hso_stop_serial_device(serial->parent);

index 070dee4a1ac6..a0b4e44cdb64 100644
@@ -573,8 +573,8 @@ static void do_bottom_half_rx(struct fst_card_info *card);
 static void fst_process_tx_work_q(unsigned long work_q);
 static void fst_process_int_work_q(unsigned long work_q);
 
-static DECLARE_TASKLET(fst_tx_task, fst_process_tx_work_q, 0);
-static DECLARE_TASKLET(fst_int_task, fst_process_int_work_q, 0);
+static DECLARE_TASKLET_USERDATA(fst_tx_task, fst_process_tx_work_q, 0);
+static DECLARE_TASKLET_USERDATA(fst_int_task, fst_process_int_work_q, 0);
 
 static struct fst_card_info *fst_card_array[FST_MAX_CARDS];
 static spinlock_t fst_work_q_lock;

index e7c3f3b8457d..5643ee0f8795 100644
@@ -1085,8 +1085,8 @@ static int carl9170_usb_probe(struct usb_interface *intf,
 	init_completion(&ar->cmd_wait);
 	init_completion(&ar->fw_boot_wait);
 	init_completion(&ar->fw_load_wait);
-	tasklet_init(&ar->usb_tasklet, carl9170_usb_tasklet,
-		     (unsigned long)ar);
+	tasklet_init_flags(&ar->usb_tasklet, carl9170_usb_tasklet,
+			   (unsigned long)ar, TASKLET_USER_DATA);
 
 	atomic_set(&ar->tx_cmd_urbs, 0);
 	atomic_set(&ar->tx_anch_urbs, 0);

index e61752e584dd..6c08c2b73d7a 100644
@@ -3774,9 +3774,9 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
 	wldev->wl = wl;
 	b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
 	wldev->bad_frames_preempt = modparam_bad_frames_preempt;
-	tasklet_init(&wldev->isr_tasklet,
-		     (void (*)(unsigned long))b43legacy_interrupt_tasklet,
-		     (unsigned long)wldev);
+	tasklet_init_flags(&wldev->isr_tasklet,
+			   (void(*)(unsigned long))b43legacy_interrupt_tasklet,
+			   (unsigned long)wldev, TASKLET_USER_DATA);
 	if (modparam_pio)
 		wldev->__using_pio = true;
 	INIT_LIST_HEAD(&wldev->list);

index 282eedec675e..669ab1ec2d23 100644
@@ -344,8 +344,8 @@ struct b43legacy_pioqueue *b43legacy_setup_pioqueue(struct b43legacy_wldev *dev,
 	INIT_LIST_HEAD(&queue->txfree);
 	INIT_LIST_HEAD(&queue->txqueue);
 	INIT_LIST_HEAD(&queue->txrunning);
-	tasklet_init(&queue->txtask, tx_tasklet,
-		     (unsigned long)queue);
+	tasklet_init_flags(&queue->txtask, tx_tasklet, (unsigned long)queue,
+			   TASKLET_USER_DATA);
 
 	value = b43legacy_read32(dev, B43legacy_MMIO_MACCTL);
 	value &= ~B43legacy_MACCTL_BE;

index 0b8c2275ec55..f396eda80074 100644
@@ -6151,8 +6151,9 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
 	INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
 	INIT_DELAYED_WORK(&priv->scan_event, ipw2100_scan_event);
 
-	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
-		     ipw2100_irq_tasklet, (unsigned long)priv);
+	tasklet_init_flags(&priv->irq_tasklet,
+			   (void(*)(unsigned long))ipw2100_irq_tasklet,
+			   (unsigned long)priv, TASKLET_USER_DATA);
 
 	/* NOTE:  We do not start the deferred work for status checks yet */
 	priv->stop_rf_kill = 1;

index 33931a4435e3..79d2008fe4d7 100644
@@ -10694,8 +10694,9 @@ static int ipw_setup_deferred_work(struct ipw_priv *priv)
 	INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
 #endif				/* CONFIG_IPW2200_QOS */
 
-	tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
-		     ipw_irq_tasklet, (unsigned long)priv);
+	tasklet_init_flags(&priv->irq_tasklet,
+			   (void(*)(unsigned long))ipw_irq_tasklet,
+			   (unsigned long)priv, TASKLET_USER_DATA);
 
 	return ret;
 }

index 48cdce4a6ca0..96db8a4462b7 100644
@@ -3418,9 +3418,9 @@ il3945_setup_deferred_work(struct il_priv *il)
 
 	timer_setup(&il->watchdog, il_bg_watchdog, 0);
 
-	tasklet_init(&il->irq_tasklet,
-		     (void (*)(unsigned long))il3945_irq_tasklet,
-		     (unsigned long)il);
+	tasklet_init_flags(&il->irq_tasklet,
+			   (void(*)(unsigned long))il3945_irq_tasklet,
+			   (unsigned long)il, TASKLET_USER_DATA);
 }
 
 static void

index 8132d6964923..0b464f09c9b5 100644
@@ -6256,9 +6256,9 @@ il4965_setup_deferred_work(struct il_priv *il)
 
 	timer_setup(&il->watchdog, il_bg_watchdog, 0);
 
-	tasklet_init(&il->irq_tasklet,
-		     (void (*)(unsigned long))il4965_irq_tasklet,
-		     (unsigned long)il);
+	tasklet_init_flags(&il->irq_tasklet,
+			   (void(*)(unsigned long))il4965_irq_tasklet,
+			   (unsigned long)il, TASKLET_USER_DATA);
 }
 
 static void

index 28dac36d7c4c..234cddb53d5d 100644
@@ -2198,8 +2198,8 @@ struct orinoco_private
 	INIT_WORK(&priv->wevent_work, orinoco_send_wevents);
 
 	INIT_LIST_HEAD(&priv->rx_list);
-	tasklet_init(&priv->rx_tasklet, orinoco_rx_isr_tasklet,
-		     (unsigned long) priv);
+	tasklet_init_flags(&priv->rx_tasklet, orinoco_rx_isr_tasklet,
+			   (unsigned long)priv, TASKLET_USER_DATA);
 
 	spin_lock_init(&priv->scan_lock);
 	INIT_LIST_HEAD(&priv->scan_list);

index 320edcac4699..d0cdd00ee6c4 100644
@@ -2919,9 +2919,9 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
 
 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
 
-	tasklet_hrtimer_init(&data->beacon_timer,
-			     mac80211_hwsim_beacon,
-			     CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+	tasklet_hrtimer_init(&data->beacon_timer, mac80211_hwsim_beacon,
+			     CLOCK_MONOTONIC,
+			     HRTIMER_MODE_ABS | HRTIMER_MODE_USER_DATA);
 
 	err = ieee80211_register_hw(hw);
 	if (err < 0) {

index 9a55fe1a2f0d..c4d4785fb80d 100644
@@ -6112,9 +6112,11 @@ static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
 	INIT_WORK(&priv->fw_reload, mwl8k_hw_restart_work);
 
 	/* TX reclaim and RX tasklets.  */
-	tasklet_init(&priv->poll_tx_task, mwl8k_tx_poll, (unsigned long)hw);
+	tasklet_init_flags(&priv->poll_tx_task, mwl8k_tx_poll,
+			   (unsigned long)hw, TASKLET_USER_DATA);
 	tasklet_disable(&priv->poll_tx_task);
-	tasklet_init(&priv->poll_rx_task, mwl8k_rx_poll, (unsigned long)hw);
+	tasklet_init_flags(&priv->poll_rx_task, mwl8k_rx_poll,
+			   (unsigned long)hw, TASKLET_USER_DATA);
 	tasklet_disable(&priv->poll_rx_task);
 
 	/* Power management cookie */

index 58b64849172a..7269e8d7a99d 100644
@@ -1213,12 +1213,12 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
 	rtlpci->acm_method = EACMWAY2_SW;
 
 	/*task */
-	tasklet_init(&rtlpriv->works.irq_tasklet,
-		     (void (*)(unsigned long))_rtl_pci_irq_tasklet,
-		     (unsigned long)hw);
-	tasklet_init(&rtlpriv->works.irq_prepare_bcn_tasklet,
-		     (void (*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
-		     (unsigned long)hw);
+	tasklet_init_flags(&rtlpriv->works.irq_tasklet,
+			   (void(*)(unsigned long))_rtl_pci_irq_tasklet,
+			   (unsigned long)hw, TASKLET_USER_DATA);
+	tasklet_init_flags(&rtlpriv->works.irq_prepare_bcn_tasklet,
+			   (void(*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
+			   (unsigned long)hw, TASKLET_USER_DATA);
 	INIT_WORK(&rtlpriv->works.lps_change_work,
 		  rtl_lps_change_work_callback);
 }

index 2bc7615193bd..a51ca4081ce4 100644
@@ -279,8 +279,8 @@ static int asd_init_dl(struct asd_ha_struct *asd_ha)
 	asd_ha->seq.dl = asd_ha->seq.actual_dl->vaddr;
 	asd_ha->seq.dl_toggle = ASD_DEF_DL_TOGGLE;
 	asd_ha->seq.dl_next = 0;
-	tasklet_init(&asd_ha->seq.dl_tasklet, asd_dl_tasklet_handler,
-		     (unsigned long) asd_ha);
+	tasklet_init_flags(&asd_ha->seq.dl_tasklet, asd_dl_tasklet_handler,
+			   (unsigned long)asd_ha, TASKLET_USER_DATA);
 
 	return 0;
 }

index 065bce193fac..0c16debab98f 100644
@@ -2194,7 +2194,8 @@ static inline void hostif_sme_init(struct ks_wlan_private *priv)
 	priv->sme_i.qtail = 0;
 	spin_lock_init(&priv->sme_i.sme_spin);
 	priv->sme_i.sme_flag = 0;
-	tasklet_init(&priv->sme_task, hostif_sme_task, (unsigned long)priv);
+	tasklet_init_flags(&priv->sme_task, hostif_sme_task,
+			   (unsigned long)priv, TASKLET_USER_DATA);
 }
 
 static inline void hostif_wpa_init(struct ks_wlan_private *priv)

index c0d51ba70a75..192d3327372d 100644
@@ -22,9 +22,9 @@ int	rtw_hal_init_recv_priv(struct adapter *padapter)
 	int	i, res = _SUCCESS;
 	struct recv_buf *precvbuf;
 
-	tasklet_init(&precvpriv->recv_tasklet,
-		     (void(*)(unsigned long))rtl8188eu_recv_tasklet,
-		     (unsigned long)padapter);
+	tasklet_init_flags(&precvpriv->recv_tasklet,
+			   (void(*)(unsigned long))rtl8188eu_recv_tasklet,
+			   (unsigned long)padapter, TASKLET_USER_DATA);
 
 	/* init recv_buf */
 	_rtw_init_queue(&precvpriv->free_recv_buf_queue);

index a72e069269b8..2de465fadead 100644
@@ -17,9 +17,9 @@ s32 rtw_hal_init_xmit_priv(struct adapter *adapt)
 {
 	struct xmit_priv *pxmitpriv = &adapt->xmitpriv;
 
-	tasklet_init(&pxmitpriv->xmit_tasklet,
-		     (void(*)(unsigned long))rtl8188eu_xmit_tasklet,
-		     (unsigned long)adapt);
+	tasklet_init_flags(&pxmitpriv->xmit_tasklet,
+			   (void(*)(unsigned long))rtl8188eu_xmit_tasklet,
+			   (unsigned long)adapt, TASKLET_USER_DATA);
 	return _SUCCESS;
 }
 

index 6070e3da1be6..a24ab322ee2a 100644
@@ -1018,15 +1018,15 @@ static void _rtl92e_init_priv_task(struct net_device *dev)
 			      (void *)rtl92e_hw_wakeup_wq, dev);
 	INIT_DELAYED_WORK_RSL(&priv->rtllib->hw_sleep_wq,
 			      (void *)rtl92e_hw_sleep_wq, dev);
-	tasklet_init(&priv->irq_rx_tasklet,
-		     (void(*)(unsigned long))_rtl92e_irq_rx_tasklet,
-		     (unsigned long)priv);
-	tasklet_init(&priv->irq_tx_tasklet,
-		     (void(*)(unsigned long))_rtl92e_irq_tx_tasklet,
-		     (unsigned long)priv);
-	tasklet_init(&priv->irq_prepare_beacon_tasklet,
-		     (void(*)(unsigned long))_rtl92e_prepare_beacon,
-		     (unsigned long)priv);
+	tasklet_init_flags(&priv->irq_rx_tasklet,
+			   (void(*)(unsigned long))_rtl92e_irq_rx_tasklet,
+			   (unsigned long)priv, TASKLET_USER_DATA);
+	tasklet_init_flags(&priv->irq_tx_tasklet,
+			   (void(*)(unsigned long))_rtl92e_irq_tx_tasklet,
+			   (unsigned long)priv, TASKLET_USER_DATA);
+	tasklet_init_flags(&priv->irq_prepare_beacon_tasklet,
+			   (void(*)(unsigned long))_rtl92e_prepare_beacon,
+			   (unsigned long)priv, TASKLET_USER_DATA);
 }
 
 static short _rtl92e_get_channel_map(struct net_device *dev)

index 287d0c11fa38..02e5abfa5664 100644
@@ -3040,9 +3040,9 @@ void rtllib_softmac_init(struct rtllib_device *ieee)
 	spin_lock_init(&ieee->mgmt_tx_lock);
 	spin_lock_init(&ieee->beacon_lock);
 
-	tasklet_init(&ieee->ps_task,
-	     (void(*)(unsigned long)) rtllib_sta_ps,
-	     (unsigned long)ieee);
+	tasklet_init_flags(&ieee->ps_task,
+			   (void(*)(unsigned long))rtllib_sta_ps,
+			   (unsigned long)ieee, TASKLET_USER_DATA);
 
 }
 

index 5bf9070b7a28..6d8240ccacce 100644
@@ -66,9 +66,9 @@ int r8712_init_recv_priv(struct recv_priv *precvpriv, struct _adapter *padapter)
 		precvbuf++;
 	}
 	precvpriv->free_recv_buf_queue_cnt = NR_RECVBUFF;
-	tasklet_init(&precvpriv->recv_tasklet,
-	     (void(*)(unsigned long))recv_tasklet,
-	     (unsigned long)padapter);
+	tasklet_init_flags(&precvpriv->recv_tasklet,
+			   (void(*)(unsigned long))recv_tasklet,
+			   (unsigned long)padapter, TASKLET_USER_DATA);
 	skb_queue_head_init(&precvpriv->rx_skb_queue);
 
 	skb_queue_head_init(&precvpriv->free_recv_skb_queue);

index 5c7dc9c6f76b..12efecddc7ca 100644
@@ -142,9 +142,9 @@ sint _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,
 	INIT_WORK(&padapter->wkFilterRxFF0, r8712_SetFilter);
 	alloc_hwxmits(padapter);
 	init_hwxmits(pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);
-	tasklet_init(&pxmitpriv->xmit_tasklet,
-		(void(*)(unsigned long))r8712_xmit_bh,
-		(unsigned long)padapter);
+	tasklet_init_flags(&pxmitpriv->xmit_tasklet,
+			   (void(*)(unsigned long))r8712_xmit_bh,
+			   (unsigned long)padapter, TASKLET_USER_DATA);
 	return _SUCCESS;
 }
 

index 26742960ed65..49278c11e797 100644
@@ -468,11 +468,9 @@ s32 rtl8723bs_init_recv_priv(struct adapter *padapter)
 		goto initbuferror;
 
 	/* 3 2. init tasklet */
-	tasklet_init(
-		&precvpriv->recv_tasklet,
-		(void(*)(unsigned long))rtl8723bs_recv_tasklet,
-		(unsigned long)padapter
-	);
+	tasklet_init_flags(&precvpriv->recv_tasklet,
+			   (void(*)(unsigned long))rtl8723bs_recv_tasklet,
+			   (unsigned long)padapter, TASKLET_USER_DATA);
 
 	goto exit;
 

index b0baa4ce10f9..2274280ade21 100644
@@ -1633,7 +1633,8 @@ struct ipw_hardware *ipwireless_hardware_create(void)
 	INIT_LIST_HEAD(&hw->rx_queue);
 	INIT_LIST_HEAD(&hw->rx_pool);
 	spin_lock_init(&hw->lock);
-	tasklet_init(&hw->tasklet, ipwireless_do_tasklet, (unsigned long) hw);
+	tasklet_init_flags(&hw->tasklet, ipwireless_do_tasklet,
+			   (unsigned long)hw, TASKLET_USER_DATA);
 	INIT_WORK(&hw->work_rx, ipw_receive_data_work);
 	timer_setup(&hw->setup_timer, ipwireless_setup_timer, 0);
 

index 4d796a82f311..f12da1602c79 100644
@@ -1067,8 +1067,8 @@ static int ifx_spi_spi_probe(struct spi_device *spi)
 	init_waitqueue_head(&ifx_dev->mdm_reset_wait);
 
 	spi_set_drvdata(spi, ifx_dev);
-	tasklet_init(&ifx_dev->io_work_tasklet, ifx_spi_io,
-						(unsigned long)ifx_dev);
+	tasklet_init_flags(&ifx_dev->io_work_tasklet, ifx_spi_io,
+			   (unsigned long)ifx_dev, TASKLET_USER_DATA);
 
 	set_bit(IFX_SPI_STATE_PRESENT, &ifx_dev->flags);
 

index dbea28495e1d..8bcd259a3c6d 100644
@@ -1069,8 +1069,10 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
 
 	usbatm_init_channel(&instance->rx_channel);
 	usbatm_init_channel(&instance->tx_channel);
-	tasklet_init(&instance->rx_channel.tasklet, usbatm_rx_process, (unsigned long)instance);
-	tasklet_init(&instance->tx_channel.tasklet, usbatm_tx_process, (unsigned long)instance);
+	tasklet_init_flags(&instance->rx_channel.tasklet, usbatm_rx_process,
+			   (unsigned long)instance, TASKLET_USER_DATA);
+	tasklet_init_flags(&instance->tx_channel.tasklet, usbatm_tx_process,
+			   (unsigned long)instance, TASKLET_USER_DATA);
 	instance->rx_channel.stride = ATM_CELL_SIZE + driver->rx_padding;
 	instance->tx_channel.stride = ATM_CELL_SIZE + driver->tx_padding;
 	instance->rx_channel.usbatm = instance->tx_channel.usbatm = instance;

index 46af0aa07e2e..db59d687d9b4 100644
@@ -875,7 +875,8 @@ static int f_midi_bind(struct usb_configuration *c, struct usb_function *f)
 	int status, n, jack = 1, i = 0, endpoint_descriptor_index = 0;
 
 	midi->gadget = cdev->gadget;
-	tasklet_init(&midi->tasklet, f_midi_in_tasklet, (unsigned long) midi);
+	tasklet_init_flags(&midi->tasklet, f_midi_in_tasklet,
+			   (unsigned long)midi, TASKLET_USER_DATA);
 	status = f_midi_register_card(midi);
 	if (status < 0)
 		goto fail_register;

index fc52ac75fbf6..90a06d4e3dc0 100644
@@ -716,8 +716,8 @@ static int mos7715_parport_init(struct usb_serial *serial)
 	INIT_LIST_HEAD(&mos_parport->deferred_urbs);
 	usb_set_serial_data(serial, mos_parport); /* hijack private pointer */
 	mos_parport->serial = serial;
-	tasklet_init(&mos_parport->urb_tasklet, send_deferred_urbs,
-		     (unsigned long) mos_parport);
+	tasklet_init_flags(&mos_parport->urb_tasklet, send_deferred_urbs,
+			   (unsigned long)mos_parport, TASKLET_USER_DATA);
 	init_completion(&mos_parport->syncmsg_compl);
 
 	/* cycle parallel port reset bit */

index d84227d75717..cf28ba053868 100644
@@ -398,7 +398,7 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
 	 * Each PPPoATM instance has its own tasklet - this is just a
 	 * prototypical one used to initialize them
 	 */
-	static const DECLARE_TASKLET(tasklet_proto, pppoatm_wakeup_sender, 0);
+	static const DECLARE_TASKLET_USERDATA(tasklet_proto, pppoatm_wakeup_sender, 0);
 	if (copy_from_user(&be, arg, sizeof be))
 		return -EFAULT;
 	if (be.encaps != PPPOATM_ENCAPS_AUTODETECT &&

index 87a729926734..ccf3a220e957 100644
@@ -694,16 +694,16 @@ struct ieee80211_hw *ieee80211_alloc_hw_nm(size_t priv_data_len,
 		skb_queue_head_init(&local->pending[i]);
 		atomic_set(&local->agg_queue_stop[i], 0);
 	}
-	tasklet_init(&local->tx_pending_tasklet, ieee80211_tx_pending,
-		     (unsigned long)local);
+	tasklet_init_flags(&local->tx_pending_tasklet, ieee80211_tx_pending,
+			   (unsigned long)local, TASKLET_USER_DATA);
 
 	if (ops->wake_tx_queue)
-		tasklet_init(&local->wake_txqs_tasklet, ieee80211_wake_txqs,
-			     (unsigned long)local);
+		tasklet_init_flags(&local->wake_txqs_tasklet,
+				   ieee80211_wake_txqs, (unsigned long)local,
+				   TASKLET_USER_DATA);
 
-	tasklet_init(&local->tasklet,
-		     ieee80211_tasklet_handler,
-		     (unsigned long) local);
+	tasklet_init_flags(&local->tasklet, ieee80211_tasklet_handler,
+			   (unsigned long)local, TASKLET_USER_DATA);
 
 	skb_queue_head_init(&local->skb_queue);
 	skb_queue_head_init(&local->skb_queue_unreliable);

index bfbb31f0c7fd..9da2cffaaf6f 100644
@@ -1118,10 +1118,10 @@ int rds_ib_conn_alloc(struct rds_connection *conn, gfp_t gfp)
 	}
 
 	INIT_LIST_HEAD(&ic->ib_node);
-	tasklet_init(&ic->i_send_tasklet, rds_ib_tasklet_fn_send,
-		     (unsigned long)ic);
-	tasklet_init(&ic->i_recv_tasklet, rds_ib_tasklet_fn_recv,
-		     (unsigned long)ic);
+	tasklet_init_flags(&ic->i_send_tasklet, rds_ib_tasklet_fn_send,
+			   (unsigned long)ic, TASKLET_USER_DATA);
+	tasklet_init_flags(&ic->i_recv_tasklet, rds_ib_tasklet_fn_recv,
+			   (unsigned long)ic, TASKLET_USER_DATA);
 	mutex_init(&ic->i_recv_mutex);
 #ifndef KERNEL_HAS_ATOMIC64
 	spin_lock_init(&ic->i_ack_lock);

index 23c92891758a..4471d94d2372 100644
@@ -581,7 +581,8 @@ struct xfrm_state *xfrm_state_alloc(struct net *net)
 		INIT_HLIST_NODE(&x->bysrc);
 		INIT_HLIST_NODE(&x->byspi);
 		tasklet_hrtimer_init(&x->mtimer, xfrm_timer_handler,
-					CLOCK_BOOTTIME, HRTIMER_MODE_ABS);
+				     CLOCK_BOOTTIME,
+				     HRTIMER_MODE_ABS | HRTIMER_MODE_USER_DATA);
 		timer_setup(&x->rtimer, xfrm_replay_timer_handler, 0);
 		x->curlft.add_time = ktime_get_real_seconds();
 		x->lft.soft_byte_limit = XFRM_INF;

index c8a39813f609..578e97f0bb99 100644
@@ -909,8 +909,8 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
 	INIT_LIST_HEAD(&timer->ack_list_head);
 	INIT_LIST_HEAD(&timer->sack_list_head);
 	spin_lock_init(&timer->lock);
-	tasklet_init(&timer->task_queue, snd_timer_tasklet,
-		     (unsigned long)timer);
+	tasklet_init_flags(&timer->task_queue, snd_timer_tasklet,
+			   (unsigned long)timer, TASKLET_USER_DATA);
 	timer->max_instances = 1000; /* default limit per timer */
 	if (card != NULL) {
 		timer->module = card->module;

index aad74e809797..4c9c7c63c9f8 100644
@@ -2912,8 +2912,8 @@ static int snd_asihpi_probe(struct pci_dev *pci_dev,
 	if (hpi->interrupt_mode) {
 		asihpi->pcm_start = snd_card_asihpi_pcm_int_start;
 		asihpi->pcm_stop = snd_card_asihpi_pcm_int_stop;
-		tasklet_init(&asihpi->t, snd_card_asihpi_int_task,
-			(unsigned long)hpi);
+		tasklet_init_flags(&asihpi->t, snd_card_asihpi_int_task,
+				   (unsigned long)hpi, TASKLET_USER_DATA);
 		hpi->interrupt_callback = snd_card_asihpi_isr;
 	} else {
 		asihpi->pcm_start = snd_card_asihpi_pcm_timer_start;

index 9917f8a3c582..8620f3a5b3f6 100644
@@ -5204,7 +5204,8 @@ static int snd_hdsp_create(struct snd_card *card,
 
 	spin_lock_init(&hdsp->lock);
 
-	tasklet_init(&hdsp->midi_tasklet, hdsp_midi_tasklet, (unsigned long)hdsp);
+	tasklet_init_flags(&hdsp->midi_tasklet, hdsp_midi_tasklet,
+			   (unsigned long)hdsp, TASKLET_USER_DATA);
 
 	pci_read_config_word(hdsp->pci, PCI_CLASS_REVISION, &hdsp->firmware_rev);
 	hdsp->firmware_rev &= 0xff;

index ab86733e2d12..74c3bde6c6d0 100644
@@ -6856,8 +6856,8 @@ static int snd_hdspm_create(struct snd_card *card,
 
 	}
 
-	tasklet_init(&hdspm->midi_tasklet,
-			hdspm_midi_tasklet, (unsigned long) hdspm);
+	tasklet_init_flags(&hdspm->midi_tasklet, hdspm_midi_tasklet,
+			   (unsigned long)hdspm, TASKLET_USER_DATA);
 
 
 	if (hdspm->io_type != MADIface) {

index a929f1cf1265..19928bc86748 100644
@@ -1441,7 +1441,8 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi *umidi,
 	}
 
 	spin_lock_init(&ep->buffer_lock);
-	tasklet_init(&ep->tasklet, snd_usbmidi_out_tasklet, (unsigned long)ep);
+	tasklet_init_flags(&ep->tasklet, snd_usbmidi_out_tasklet,
+			   (unsigned long)ep, TASKLET_USER_DATA);
 	init_waitqueue_head(&ep->drain_wait);
 
 	for (i = 0; i < 0x10; ++i)

index a0b6d039017f..0c7a396c415d 100644
@@ -1247,8 +1247,8 @@ static int ua101_probe(struct usb_interface *interface,
 	spin_lock_init(&ua->lock);
 	mutex_init(&ua->mutex);
 	INIT_LIST_HEAD(&ua->ready_playback_urbs);
-	tasklet_init(&ua->playback_tasklet,
-		     playback_tasklet, (unsigned long)ua);
+	tasklet_init_flags(&ua->playback_tasklet, playback_tasklet,
+			   (unsigned long)ua, TASKLET_USER_DATA);
 	init_waitqueue_head(&ua->alsa_capture_wait);
 	init_waitqueue_head(&ua->rate_feedback_wait);
 	init_waitqueue_head(&ua->alsa_playback_wait);

index bbffa6c54697..d61272f50aed 100644
@@ -409,7 +409,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function,
 	/* cpuid 7.0.edx*/
 	const u32 kvm_cpuid_7_0_edx_x86_features =
 		F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) |
-		F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP);
+		F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES) | F(INTEL_STIBP) |
+		F(MD_CLEAR);
 
 	/* all calls to cpuid_count() should be made on the same cpu */
 	get_cpu();

index 5aeaca24a28f..17e9f447472c 100644
@@ -881,7 +881,8 @@ static int init_irq (ide_hwif_t *hwif)
 		irq_handler = ide_intr;
 
 	if (!host->get_lock)
-		if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
+		if (request_irq(hwif->irq, irq_handler, sa | IRQF_USER_DATA,
+					hwif->name, hwif))
 			goto out_up;
 
 #if !defined(__mc68000__)

index 0f8ddb7ba09b..df795f2f5f34 100644
@@ -572,11 +572,22 @@ struct tasklet_struct name = { NULL, 0, ATOMIC_INIT(0), func, data }
 #define DECLARE_TASKLET_DISABLED(name, func, data) \
 struct tasklet_struct name = { NULL, 0, ATOMIC_INIT(1), func, data }
 
+#define DECLARE_TASKLET_USERDATA(name, func, data) \
+struct tasklet_struct name = { NULL, TASKLET_USER_DATA, ATOMIC_INIT(0), func, data }
+
+#define DECLARE_TASKLET_USERDATA_DISABLED(name, func, data) \
+struct tasklet_struct name = { NULL, TASKLET_USER_DATA, ATOMIC_INIT(1), func, data }
 
 enum
 {
 	TASKLET_STATE_SCHED,	/* Tasklet is scheduled for execution */
-	TASKLET_STATE_RUN	/* Tasklet is running (SMP only) */
+	TASKLET_STATE_RUN,	/* Tasklet is running (SMP only) */
+
+	/*
+	 * Set this flag when the tasklet is known to touch user data,
+	 * so needs extra CPU state clearing.
+	 */
+	TASKLET_USER_DATA	= 1 << 5,
 };
 
 #ifdef CONFIG_SMP

@@ -640,6 +651,9 @@ extern void tasklet_kill(struct tasklet_struct *t);
 extern void tasklet_kill_immediate(struct tasklet_struct *t, unsigned int cpu);
 extern void tasklet_init(struct tasklet_struct *t,
 			 void (*func)(unsigned long), unsigned long data);
+extern void tasklet_init_flags(struct tasklet_struct *t,
+			 void (*func)(unsigned long), unsigned long data,
+			 unsigned flags);
 
 struct tasklet_hrtimer {
 	struct hrtimer		timer;

index d28813306b2c..b2d348cc8b2e 100644
@@ -26,6 +26,7 @@
 #include <linux/smpboot.h>
 #include <linux/tick.h>
 #include <linux/irq.h>
+#include <linux/clearcpu.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/irq.h>

@@ -522,6 +523,8 @@ static void tasklet_action_common(struct softirq_action *a,
 					BUG();
 				t->func(t->data);
 				tasklet_unlock(t);
+				if (t->state & TASKLET_USER_DATA)
+					lazy_clear_cpu();
 				continue;
 			}
 			tasklet_unlock(t);

@@ -546,15 +549,23 @@ static __latent_entropy void tasklet_hi_action(struct softirq_action *a)
 	tasklet_action_common(a, this_cpu_ptr(&tasklet_hi_vec), HI_SOFTIRQ);
 }
 
-void tasklet_init(struct tasklet_struct *t,
-		  void (*func)(unsigned long), unsigned long data)
+void tasklet_init_flags(struct tasklet_struct *t,
+		  void (*func)(unsigned long), unsigned long data,
+		  unsigned flags)
 {
 	t->next = NULL;
-	t->state = 0;
+	t->state = flags;
 	atomic_set(&t->count, 0);
 	t->func = func;
 	t->data = data;
 }
+EXPORT_SYMBOL(tasklet_init_flags);
+
+void tasklet_init(struct tasklet_struct *t,
+		  void (*func)(unsigned long), unsigned long data)
+{
+	tasklet_init_flags(t, func, data, 0);
+}
 EXPORT_SYMBOL(tasklet_init);
 
 void tasklet_kill(struct tasklet_struct *t)

@@ -609,7 +620,8 @@ static void __tasklet_hrtimer_trampoline(unsigned long data)
  * @ttimer:	 tasklet_hrtimer which is initialized
  * @function:	 hrtimer callback function which gets called from softirq context
  * @which_clock: clock id (CLOCK_MONOTONIC/CLOCK_REALTIME)
- * @mode:	 hrtimer mode (HRTIMER_MODE_ABS/HRTIMER_MODE_REL)
+ * @mode:	 hrtimer mode (HRTIMER_MODE_ABS/HRTIMER_MODE_REL),
+ *		 HRTIMER_MODE_NO_USER
  */
 void tasklet_hrtimer_init(struct tasklet_hrtimer *ttimer,
 			  enum hrtimer_restart (*function)(struct hrtimer *),

@@ -617,8 +629,9 @@ void tasklet_hrtimer_init(struct tasklet_hrtimer *ttimer,
 {
 	hrtimer_init(&ttimer->timer, which_clock, mode);
 	ttimer->timer.function = __hrtimer_tasklet_trampoline;
-	tasklet_init(&ttimer->tasklet, __tasklet_hrtimer_trampoline,
-		     (unsigned long)ttimer);
+	tasklet_init_flags(&ttimer->tasklet, __tasklet_hrtimer_trampoline,
+		     (unsigned long)ttimer,
+		     (mode & HRTIMER_MODE_USER_DATA) ? TASKLET_USER_DATA : 0);
 	ttimer->function = function;
 }
 EXPORT_SYMBOL_GPL(tasklet_hrtimer_init);

index b93565ab20b3..4114b4f94c1d 100644
@@ -1192,6 +1192,24 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
 		if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV))
 			return l1tf_show_state(buf);
 		break;
+
+	case X86_BUG_MDS:
+		if (boot_cpu_has(X86_FEATURE_VERW) &&
+		    boot_cpu_has(X86_FEATURE_MD_CLEAR)) {
+			if (cpu_smt_control != CPU_SMT_ENABLED) {
+				/*
+				 * Avoid lying when a hypervisor didn't export
+				 * the SMT state.
+				 */
+				if (boot_cpu_has(X86_FEATURE_HYPERVISOR))
+					return sprintf(buf,
+						"Mitigation: microcode, SMT potentially vulnerable\n");
+				return sprintf(buf, "Mitigation: microcode\n");
+			}
+			return sprintf(buf, "Mitigation: microcode, SMT vulnerable\n");
+		}
+		return sprintf(buf, "Vulnerable\n");
+
 	default:
 		break;
 	}

@@ -1223,4 +1241,10 @@ ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *b
 {
 	return cpu_show_common(dev, attr, buf, X86_BUG_L1TF);
 }
+
+ssize_t cpu_show_mds(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	return cpu_show_common(dev, attr, buf, X86_BUG_MDS);
+}
+
 #endif

index eb9443d5bae1..2fd6ca1021c2 100644
@@ -546,11 +546,18 @@ ssize_t __weak cpu_show_l1tf(struct device *dev,
 	return sprintf(buf, "Not affected\n");
 }
 
+ssize_t __weak cpu_show_mds(struct device *dev,
+			    struct device_attribute *attr, char *buf)
+{
+	return sprintf(buf, "Not affected\n");
+}
+
 static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL);
 static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL);
 static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL);
 static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL);
 static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL);
+static DEVICE_ATTR(mds, 0444, cpu_show_mds, NULL);
 
 static struct attribute *cpu_root_vulnerabilities_attrs[] = {
 	&dev_attr_meltdown.attr,

@@ -558,6 +565,7 @@ static struct attribute *cpu_root_vulnerabilities_attrs[] = {
 	&dev_attr_spectre_v2.attr,
 	&dev_attr_spec_store_bypass.attr,
 	&dev_attr_l1tf.attr,
+	&dev_attr_mds.attr,
 	NULL
 };
 

index 95d25b010a25..7cd26e7b15d5 100644
@@ -40,6 +40,7 @@
 #include <linux/in6.h>
 #include <linux/if_packet.h>
 #include <net/flow.h>
+#include <linux/clearcpu.h>
 
 /* The interface for checksum offload between the stack and networking drivers
  * is as follows...

@@ -2093,6 +2094,7 @@ static inline void *__skb_put(struct sk_buff *skb, unsigned int len)
 	SKB_LINEAR_ASSERT(skb);
 	skb->tail += len;
 	skb->len  += len;
+	lazy_clear_cpu_interrupt();
 	return tmp;
 }
 

index 26d848484912..bd30d79b894d 100644
@@ -63,6 +63,7 @@
 #include <linux/errqueue.h>
 #include <linux/prefetch.h>
 #include <linux/if_vlan.h>
+#include <linux/clearcpu.h>
 
 #include <net/protocol.h>
 #include <net/dst.h>

@@ -1189,6 +1190,9 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
 	if (!num_frags)
 		goto release;
 
+	/* Likely to copy user data */
+	lazy_clear_cpu_interrupt();
+
 	new_frags = (__skb_pagelen(skb) + PAGE_SIZE - 1) >> PAGE_SHIFT;
 	for (i = 0; i < new_frags; i++) {
 		page = alloc_page(gfp_mask);

@@ -1353,6 +1357,9 @@ struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
 	if (!n)
 		return NULL;
 
+	/* Copies user data */
+	lazy_clear_cpu_interrupt();
+
 	/* Set the data pointer */
 	skb_reserve(n, headerlen);
 	/* Set the tail pointer and length */

@@ -1460,6 +1467,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 
 	size = SKB_DATA_ALIGN(size);
 
+	lazy_clear_cpu_interrupt();
 	if (skb_pfmemalloc(skb))
 		gfp_mask |= __GFP_MEMALLOC;
 	data = kmalloc_reserve(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),

@@ -1524,6 +1532,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
 	if (!skb->sk || skb->destructor == sock_edemux)
 		skb->truesize += size - osize;
 
+
 	return 0;
 
 nofrags:

@@ -1588,6 +1597,9 @@ struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
 	if (!n)
 		return NULL;
 
+	/* May copy user data */
+	lazy_clear_cpu_interrupt();
+
 	skb_reserve(n, newheadroom);
 
 	/* Set the tail pointer and length */

@@ -1676,6 +1688,8 @@ EXPORT_SYMBOL(__skb_pad);
 
 void *pskb_put(struct sk_buff *skb, struct sk_buff *tail, int len)
 {
+	/* Likely to be followed by a user data copy */
+	lazy_clear_cpu_interrupt();
 	if (tail != skb) {
 		skb->data_len += len;
 		skb->len += len;

@@ -1701,6 +1715,8 @@ void *skb_put(struct sk_buff *skb, unsigned int len)
 	skb->len  += len;
 	if (unlikely(skb->tail > skb->end))
 		skb_over_panic(skb, len, __builtin_return_address(0));
+	/* Likely to be followed by a user data copy */
+	lazy_clear_cpu_interrupt();
 	return tmp;
 }
 EXPORT_SYMBOL(skb_put);

@@ -1720,6 +1736,7 @@ void *skb_push(struct sk_buff *skb, unsigned int len)
 	skb->len  += len;
 	if (unlikely(skb->data < skb->head))
 		skb_under_panic(skb, len, __builtin_return_address(0));
+	/* No clear cpu, assume this is only header data */
 	return skb->data;
 }
 EXPORT_SYMBOL(skb_push);

@@ -2026,6 +2043,9 @@ int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len)
 	struct sk_buff *frag_iter;
 	int i, copy;
 
+	/* Copies user data */
+	lazy_clear_cpu_interrupt();
+
 	if (offset > (int)skb->len - len)
 		goto fault;
 

@@ -2113,6 +2133,8 @@ static struct page *linear_to_page(struct page *page, unsigned int *len,
 {
 	struct page_frag *pfrag = sk_page_frag(sk);
 
+	lazy_clear_cpu_interrupt();
+
 	if (!sk_page_frag_refill(sk, pfrag))
 		return NULL;
 

@@ -2387,6 +2409,9 @@ int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int len)
 	struct sk_buff *frag_iter;
 	int i, copy;
 
+	/* Copies user data */
+	lazy_clear_cpu_interrupt();
+
 	if (offset > (int)skb->len - len)
 		goto fault;
 

@@ -2467,6 +2492,9 @@ __wsum __skb_checksum(const struct sk_buff *skb, int offset, int len,
 	struct sk_buff *frag_iter;
 	int pos = 0;
 
+	/* Reads packet data */
+	lazy_clear_cpu_interrupt();
+
 	/* Checksum header. */
 	if (copy > 0) {
 		if (copy > len)

@@ -2559,6 +2587,9 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset,
 	struct sk_buff *frag_iter;
 	int pos = 0;
 
+	/* Reads packet data */
+	lazy_clear_cpu_interrupt();
+
 	/* Copy header. */
 	if (copy > 0) {
 		if (copy > len)

@@ -3445,6 +3476,7 @@ void *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
 	BUG_ON(len > skb->len);
 	__skb_pull(skb, len);
 	skb_postpull_rcsum(skb, data, len);
+	lazy_clear_cpu_interrupt();
 	return skb->data;
 }
 EXPORT_SYMBOL_GPL(skb_pull_rcsum);

index 6c0b30391ba9..d05599a8c660 100644
@@ -25,6 +25,7 @@
 #include <linux/time.h>
 #include <linux/math64.h>
 #include <linux/export.h>
+#include <linux/clearcpu.h>
 #include <sound/core.h>
 #include <sound/control.h>
 #include <sound/tlv.h>

@@ -1801,6 +1802,8 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
 		return;
 	runtime = substream->runtime;
 
+	lazy_clear_cpu();
+
 	snd_pcm_stream_lock_irqsave(substream, flags);
 	if (!snd_pcm_running(substream) ||
 	    snd_pcm_update_hw_ptr0(substream, 1) < 0)

index ee601d7f0926..5edd3f0eb114 100644
@@ -30,6 +30,7 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/mm.h>
+#include <linux/clearcpu.h>
 #include <sound/rawmidi.h>
 #include <sound/info.h>
 #include <sound/control.h>

@@ -946,6 +947,7 @@ int snd_rawmidi_receive(struct snd_rawmidi_substream *substream,
 			wake_up(&runtime->sleep);
 	}
 	spin_unlock_irqrestore(&runtime->lock, flags);
+	lazy_clear_cpu();
 	return result;
 }
 EXPORT_SYMBOL(snd_rawmidi_receive);

@@ -1232,6 +1234,7 @@ int snd_rawmidi_transmit(struct snd_rawmidi_substream *substream,
 			result = __snd_rawmidi_transmit_ack(substream, count);
 	}
 	spin_unlock_irqrestore(&runtime->lock, flags);
+	lazy_clear_cpu();
 	return result;
 }
 EXPORT_SYMBOL(snd_rawmidi_transmit);

index 61a0cec6e1f6..c8a39813f609 100644
@@ -27,6 +27,7 @@
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/string.h>
+#include <linux/clearcpu.h>
 #include <linux/sched/signal.h>
 #include <sound/core.h>
 #include <sound/timer.h>

@@ -863,6 +864,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
 
 	if (use_tasklet)
 		tasklet_schedule(&timer->task_queue);
+
+	lazy_clear_cpu();
 }
 EXPORT_SYMBOL(snd_timer_interrupt);
 

index 3304aaaffe87..c22e8e167025 100644
@@ -27,6 +27,7 @@
 #include <linux/device.h>
 #include <linux/mutex.h>
 #include <linux/rcupdate.h>
+#include <linux/clearcpu.h>
 #include "input-compat.h"
 
 MODULE_AUTHOR("Vojtech Pavlik <[email protected]>");

@@ -436,6 +437,7 @@ void input_event(struct input_dev *dev,
 		input_handle_event(dev, type, code, value);
 		spin_unlock_irqrestore(&dev->event_lock, flags);
 	}
+	lazy_clear_cpu_interrupt();
 }
 EXPORT_SYMBOL(input_event);
 

@@ -468,6 +470,7 @@ void input_inject_event(struct input_handle *handle,
 
 		spin_unlock_irqrestore(&dev->event_lock, flags);
 	}
+	lazy_clear_cpu_interrupt();
 }
 EXPORT_SYMBOL(input_inject_event);
 

index 2e1fb0649260..9b3af41dc05b 100644
@@ -32,6 +32,7 @@
 #include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
+#include <linux/clearcpu.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <[email protected]>");
 MODULE_DESCRIPTION("Serio abstraction core");

@@ -1017,6 +1018,8 @@ irqreturn_t serio_interrupt(struct serio *serio,
 		ret = IRQ_HANDLED;
 	}
 
+	lazy_clear_cpu_interrupt();
+
 	spin_unlock_irqrestore(&serio->lock, flags);
 
 	return ret;

index 9e934626ea88..80ab5d026157 100644
@@ -353,6 +353,9 @@
 #define X86_FEATURE_ARCH_CAPABILITIES	(18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */
 #define X86_FEATURE_SPEC_CTRL_SSBD	(18*32+31) /* "" Speculative Store Bypass Disable */
 
+/* Linux defined features, word 19 */
+#define X86_FEATURE_MDS_VMENTRY_FLUSH	(19*32+0) /* MDS needs extra flush for vmentry */
+
 /*
  * BUG word(s)
  */

@@ -384,5 +387,6 @@
 #define X86_BUG_SPEC_STORE_BYPASS	X86_BUG(17) /* CPU is affected by speculative store bypass attack */
 #define X86_BUG_L1TF			X86_BUG(18) /* CPU is affected by L1 Terminal Fault */
 #define X86_BUG_MDS			X86_BUG(19) /* CPU is affected by Microarchitectural data sampling */
+#define X86_BUG_MDS_NO_L1TF		X86_BUG(20) /* MDS but no L1TF L1D flush */
 
 #endif /* _ASM_X86_CPUFEATURES_H */

index 4114b4f94c1d..26b890f18239 100644
@@ -1087,6 +1087,9 @@ static void mds_select_mitigation(void)
 	if (cmdline_find_option_bool(boot_command_line, "mds=full") ||
 	     cmdline_find_option_bool(boot_command_line, "mds=auto"))
 		setup_force_cpu_cap(X86_FEATURE_VERW);
+
+	if (boot_cpu_has(X86_FEATURE_VERW) && boot_cpu_has_bug(X86_BUG_MDS_NO_L1TF))
+		setup_force_cpu_cap(X86_FEATURE_MDS_VMENTRY_FLUSH);
 }
 
 #ifdef CONFIG_SYSFS

index bac5a3a38f0d..94d0eeb0a94b 100644
@@ -1006,6 +1006,15 @@ static const __initconst struct x86_cpu_id cpu_no_mds[] = {
 	{}
 };
 
+/* CPUs with MDS, but not L1TF, that don't have L1D flush */
+static const __initconst struct x86_cpu_id cpu_mds_no_l1d[] = {
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_AIRMONT		},
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_AIRMONT_MID	},
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_SILVERMONT	},
+	{ X86_VENDOR_INTEL,	6,	INTEL_FAM6_ATOM_SILVERMONT_X	},
+	{}
+};
+
 static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 {
 	u64 ia32_cap = 0;

@@ -1029,8 +1038,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
 
 	if ((boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
 	    !x86_match_cpu(cpu_no_mds)) &&
-	    !(ia32_cap & ARCH_CAP_MDS_NO))
+	    !(ia32_cap & ARCH_CAP_MDS_NO)) {
 		setup_force_cpu_bug(X86_BUG_MDS);
+		if (x86_match_cpu(cpu_mds_no_l1d))
+			setup_force_cpu_bug(X86_BUG_MDS_NO_L1TF);
+	}
 
 	if (x86_match_cpu(cpu_no_meltdown))
 		return;

index 30a6bcd735ec..fb2be25a4aa6 100644
@@ -5866,27 +5866,36 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
 static void vmx_l1d_flush(struct kvm_vcpu *vcpu)
 {
 	int size = PAGE_SIZE << L1D_CACHE_ORDER;
+	bool flush_l1d = vcpu->arch.l1tf_flush_l1d;
+
+	flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
+
+	/* CPUs with MDS_VMENTRY_FLUSH never use the L1D flush below. */
+	if (static_cpu_has(X86_FEATURE_MDS_VMENTRY_FLUSH)) {
+		vcpu->arch.l1tf_flush_l1d = false;
+		kvm_clear_cpu_l1tf_flush_l1d();
+		if (!flush_l1d && !static_key_enabled(&force_cpu_clear))
+			return;
+		clear_cpu();
+		return;
+	}
 
 	/*
 	 * This code is only executed when the the flush mode is 'cond' or
 	 * 'always'
 	 */
 	if (static_branch_likely(&vmx_l1d_flush_cond)) {
-		bool flush_l1d;
-
 		/*
 		 * Clear the per-vcpu flush bit, it gets set again
 		 * either from vcpu_run() or from one of the unsafe
 		 * VMEXIT handlers.
 		 */
-		flush_l1d = vcpu->arch.l1tf_flush_l1d;
 		vcpu->arch.l1tf_flush_l1d = false;
 
 		/*
 		 * Clear the per-cpu flush bit, it gets set again from
 		 * the interrupt handlers.
 		 */
-		flush_l1d |= kvm_get_cpu_l1tf_flush_l1d();
 		kvm_clear_cpu_l1tf_flush_l1d();
 
 		if (!flush_l1d)

@@ -6369,7 +6378,8 @@ static void __vmx_vcpu_run(struct kvm_vcpu *vcpu, struct vcpu_vmx *vmx)
 	evmcs_rsp = static_branch_unlikely(&enable_evmcs) ?
 		(unsigned long)&current_evmcs->host_rsp : 0;
 
-	if (static_branch_unlikely(&vmx_l1d_should_flush))
+	if (static_branch_unlikely(&vmx_l1d_should_flush) ||
+	    static_cpu_has(X86_FEATURE_MDS_VMENTRY_FLUSH))
 		vmx_l1d_flush(vcpu);
 
 	asm(

index 2e8957eac4d4..c8e3db15e55b 100644
@@ -32,6 +32,7 @@ struct hrtimer_cpu_base;
  *				  when starting the timer)
  * HRTIMER_MODE_SOFT		- Timer callback function will be executed in
  *				  soft irq context
+ * HRTIMER_MODE_USER_DATA	- Handler does touch user data.
  */
 enum hrtimer_mode {
 	HRTIMER_MODE_ABS	= 0x00,

@@ -48,6 +49,7 @@ enum hrtimer_mode {
 	HRTIMER_MODE_ABS_PINNED_SOFT = HRTIMER_MODE_ABS_PINNED | HRTIMER_MODE_SOFT,
 	HRTIMER_MODE_REL_PINNED_SOFT = HRTIMER_MODE_REL_PINNED | HRTIMER_MODE_SOFT,
 
+	HRTIMER_MODE_USER_DATA	= 0x08,
 };
 
 /*

@@ -101,6 +103,7 @@ enum hrtimer_restart {
  * @state:	state information (See bit values above)
  * @is_rel:	Set if the timer was armed relative
  * @is_soft:	Set if hrtimer will be expired in soft interrupt context.
+ * @user_data:	function does touch user data.
  *
  * The hrtimer structure must be initialized by hrtimer_init()
  */

@@ -112,6 +115,7 @@ struct hrtimer {
 	u8				state;
 	u8				is_rel;
 	u8				is_soft;
+	u8				user_data;
 };
 
 /**

index 7b066fd38248..78ae3602fbcd 100644
@@ -56,10 +56,13 @@ struct timer_list {
 #define TIMER_DEFERRABLE	0x00080000
 #define TIMER_PINNED		0x00100000
 #define TIMER_IRQSAFE		0x00200000
-#define TIMER_ARRAYSHIFT	22
-#define TIMER_ARRAYMASK		0xFFC00000
+#define TIMER_USER_DATA		0x00400000
+#define TIMER_ARRAYSHIFT	23
+#define TIMER_ARRAYMASK		0xFF800000
 
-#define TIMER_TRACE_FLAGMASK	(TIMER_MIGRATING | TIMER_DEFERRABLE | TIMER_PINNED | TIMER_IRQSAFE)
+#define TIMER_TRACE_FLAGMASK	\
+	(TIMER_MIGRATING | TIMER_DEFERRABLE | TIMER_PINNED | TIMER_IRQSAFE | \
+	 TIMER_USER_DATA)
 
 #define __TIMER_INITIALIZER(_function, _flags) {		\
 		.entry = { .next = TIMER_ENTRY_STATIC },	\

@@ -73,6 +76,11 @@ struct timer_list {
 	struct timer_list _name =				\
 		__TIMER_INITIALIZER(_function, 0)
 
+#define DEFINE_TIMER_USERDATA(_name, _function)			\
+	struct timer_list _name =				\
+		__TIMER_INITIALIZER(_function, TIMER_USER_DATA)
+
+
 /*
  * LOCKDEP and DEBUG timer interfaces.
  */

index f5cfa1b73d6f..4d8f419ab55f 100644
@@ -42,6 +42,7 @@
 #include <linux/timer.h>
 #include <linux/freezer.h>
 #include <linux/compat.h>
+#include <linux/clearcpu.h>
 
 #include <linux/uaccess.h>
 

@@ -1276,6 +1277,7 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id,
 		clock_id = CLOCK_MONOTONIC;
 
 	base += hrtimer_clockid_to_base(clock_id);
+	timer->user_data = !!(mode & HRTIMER_MODE_USER_DATA);
 	timer->is_soft = softtimer;
 	timer->base = &cpu_base->clock_base[base];
 	timerqueue_init(&timer->node);

@@ -1390,6 +1392,9 @@ static void __run_hrtimer(struct hrtimer_cpu_base *cpu_base,
 	trace_hrtimer_expire_exit(timer);
 	raw_spin_lock_irq(&cpu_base->lock);
 
+	if (timer->user_data)
+		lazy_clear_cpu();
+
 	/*
 	 * Note: We clear the running state after enqueue_hrtimer and
 	 * we do not reprogram the event hardware. Happens either in

index 444156debfa0..caaa87b91268 100644
@@ -43,6 +43,7 @@
 #include <linux/sched/debug.h>
 #include <linux/slab.h>
 #include <linux/compat.h>
+#include <linux/clearcpu.h>
 
 #include <linux/uaccess.h>
 #include <asm/unistd.h>

@@ -1338,6 +1339,13 @@ static void call_timer_fn(struct timer_list *timer, void (*fn)(struct timer_list
 		 */
 		preempt_count_set(count);
 	}
+
+	/*
+	 * The timer might have touched user data. Schedule
+	 * a cpu clear on the next kernel exit.
+	 */
+	if (timer->flags & TIMER_USER_DATA)
+		lazy_clear_cpu();
 }
 
 static void expire_timers(struct timer_base *base, struct hlist_head *head)

index 7dc3a411bece..7f37056fe973 100644
@@ -25,6 +25,7 @@
 #include <linux/rwsem.h>
 #include <linux/interrupt.h>
 #include <linux/idr.h>
+#include <linux/clearcpu.h>
 
 #define MAX_TOPO_LEVEL		6
 

@@ -688,8 +689,10 @@ static inline void usbmon_urb_submit_error(struct usb_bus *bus, struct urb *urb,
 static inline void usbmon_urb_complete(struct usb_bus *bus, struct urb *urb,
 		int status)
 {
-	if (bus->monitored)
+	if (bus->monitored) {
 		(*mon_ops->urb_complete)(bus, urb, status);
+		lazy_clear_cpu_interrupt();
+	}
 }
 
 int usb_mon_register(const struct usb_mon_operations *ops);

index 686247db3106..19e2208eaa94 100644
@@ -40,6 +40,7 @@
 
 #include <linux/string.h>
 #include <linux/compiler.h>
+#include <linux/clearcpu.h>
 #include <asm/page.h>
 #include <asm/early_ioremap.h>
 #include <asm/pgtable_types.h>

@@ -321,6 +322,7 @@ static inline void outs##bwl(int port, const void *addr, unsigned long count) \
 			     : "+S"(addr), "+c"(count)			\
 			     : "d"(port) : "memory");			\
 	}								\
+	lazy_clear_cpu_interrupt();					\
 }									\
 									\
 static inline void ins##bwl(int port, void *addr, unsigned long count)	\

@@ -337,6 +339,7 @@ static inline void ins##bwl(int port, void *addr, unsigned long count)	\
 			     : "+D"(addr), "+c"(count)			\
 			     : "d"(port) : "memory");			\
 	}								\
+	lazy_clear_cpu_interrupt();					\
 }
 
 BUILDIO(b, b, char)

index d356f802945a..cf58bceea042 100644
@@ -14,6 +14,7 @@
 #include <asm/page.h> /* I/O is all done through memory accesses */
 #include <linux/string.h> /* for memset() and memcpy() */
 #include <linux/types.h>
+#include <linux/clearcpu.h>
 
 #ifdef CONFIG_GENERIC_IOMAP
 #include <asm-generic/iomap.h>

@@ -1115,6 +1116,7 @@ static inline void memcpy_fromio(void *buffer,
 				 size_t size)
 {
 	memcpy(buffer, __io_virt(addr), size);
+	lazy_clear_cpu_interrupt();
 }
 #endif
 

@@ -1132,6 +1134,7 @@ static inline void memcpy_toio(volatile void __iomem *addr, const void *buffer,
 			       size_t size)
 {
 	memcpy(__io_virt(addr), buffer, size);
+	lazy_clear_cpu_interrupt();
 }
 #endif
 

index 0d4bdcb84da5..1a0898fa29a9 100644
@@ -2,6 +2,7 @@
 #include <linux/export.h>
 #include <linux/swap.h> /* for totalram_pages */
 #include <linux/memblock.h>
+#include <linux/clearcpu.h>
 
 void *kmap(struct page *page)
 {

@@ -38,6 +39,8 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
 	preempt_disable();
 	pagefault_disable();
 
+	lazy_clear_cpu_interrupt();
+
 	if (!PageHighMem(page))
 		return page_address(page);
 

index ea5cdbd8c2c3..6dd4a719b0c7 100644
@@ -8,6 +8,7 @@
 #include <linux/mm.h>
 #include <linux/uaccess.h>
 #include <linux/hardirq.h>
+#include <linux/clearcpu.h>
 
 #include <asm/cacheflush.h>
 

@@ -92,6 +93,7 @@ static inline void *kmap_atomic(struct page *page)
 {
 	preempt_disable();
 	pagefault_disable();
+	lazy_clear_cpu_interrupt();
 	return page_address(page);
 }
 #define kmap_atomic_prot(page, prot)	kmap_atomic(page)

index ce95b8cbd229..a9e280782d25 100644
@@ -81,8 +81,9 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
 	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 16, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 17, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 18, feature_bit) ||	\
+	   CHECK_BIT_IN_MASK_WORD(REQUIRED_MASK, 19, feature_bit) ||	\
 	   REQUIRED_MASK_CHECK					  ||	\
-	   BUILD_BUG_ON_ZERO(NCAPINTS != 19))
+	   BUILD_BUG_ON_ZERO(NCAPINTS != 20))
 
 #define DISABLED_MASK_BIT_SET(feature_bit)				\
 	 ( CHECK_BIT_IN_MASK_WORD(DISABLED_MASK,  0, feature_bit) ||	\

@@ -104,8 +105,9 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
 	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 16, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 17, feature_bit) ||	\
 	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 18, feature_bit) ||	\
+	   CHECK_BIT_IN_MASK_WORD(DISABLED_MASK, 19, feature_bit) ||	\
 	   DISABLED_MASK_CHECK					  ||	\
-	   BUILD_BUG_ON_ZERO(NCAPINTS != 19))
+	   BUILD_BUG_ON_ZERO(NCAPINTS != 20))
 
 #define cpu_has(c, bit)							\
 	(__builtin_constant_p(bit) && REQUIRED_MASK_BIT_SET(bit) ? 1 :	\

index 27735ae3c3a2..9e934626ea88 100644
@@ -13,7 +13,7 @@
 /*
  * Defines x86 CPU feature bits
  */
-#define NCAPINTS			19	   /* N 32-bit words worth of info */
+#define NCAPINTS			20	   /* N 32-bit words worth of info */
 #define NBUGINTS			1	   /* N 32-bit bug flags */
 
 /*

index a5ea841cc6d2..f0f935f8d917 100644
@@ -84,6 +84,7 @@
 #define DISABLED_MASK16	(DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57|DISABLE_UMIP)
 #define DISABLED_MASK17	0
 #define DISABLED_MASK18	0
-#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
+#define DISABLED_MASK19	0
+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
 
 #endif /* _ASM_X86_DISABLED_FEATURES_H */

index 6847d85400a8..fa5700097f64 100644
@@ -101,6 +101,7 @@
 #define REQUIRED_MASK16	0
 #define REQUIRED_MASK17	0
 #define REQUIRED_MASK18	0
-#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19)
+#define REQUIRED_MASK19	0
+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 20)
 
 #endif /* _ASM_X86_REQUIRED_FEATURES_H */

index f693c2c0bec3..a1e94386f940 100644
@@ -9,6 +9,7 @@
 
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/clearcpu.h>
 
 #include "comedidev.h"
 #include "comedi_internal.h"

@@ -597,6 +598,8 @@ unsigned int comedi_buf_write_samples(struct comedi_subdevice *s,
 	comedi_inc_scan_progress(s, nbytes);
 	s->async->events |= COMEDI_CB_BLOCK;
 
+	lazy_clear_cpu_interrupt();
+
 	return nbytes;
 }
 EXPORT_SYMBOL_GPL(comedi_buf_write_samples);

@@ -637,6 +640,8 @@ unsigned int comedi_buf_read_samples(struct comedi_subdevice *s,
 	comedi_inc_scan_progress(s, nbytes);
 	s->async->events |= COMEDI_CB_BLOCK;
 
+	lazy_clear_cpu_interrupt();
+
 	return nbytes;
 }
 EXPORT_SYMBOL_GPL(comedi_buf_read_samples);

index 7bc105f47d21..dfd51d97d683 100644
@@ -29,6 +29,7 @@
 #include <asm/desc.h>
 #include <asm/traps.h>
 #include <asm/vdso.h>
+#include <asm/clearcpu.h>
 #include <linux/uaccess.h>
 #include <asm/cpufeature.h>
 

@@ -211,6 +212,8 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
 	ti->status &= ~(TS_COMPAT|TS_I386_REGS_POKED);
 #endif
 
+	clear_cpu();
+
 	user_enter_irqoff();
 }
 

new file mode 100644
index 000000000000..1da885793805
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _ASM_CLEARCPU_H
+#define _ASM_CLEARCPU_H 1
+
+#include <linux/jump_label.h>
+#include <linux/sched/smt.h>
+#include <asm/alternative.h>
+#include <linux/thread_info.h>
+
+/*
+ * Clear CPU buffers to avoid side channels.
+ * We use microcode as a side effect of the obsolete VERW instruction
+ */
+
+static inline void clear_cpu(void)
+{
+	unsigned kernel_ds = __KERNEL_DS;
+	/* Has to be memory form, don't modify to use an register */
+	alternative_input("", "verw %[kernelds]", X86_BUG_MDS,
+		[kernelds] "m" (kernel_ds));
+}
+
+#endif

index 9ef6c5dc00dc..233ca598826f 100644
@@ -344,6 +344,7 @@
 /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */
 #define X86_FEATURE_AVX512_4VNNIW	(18*32+ 2) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS	(18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */
+#define X86_FEATURE_MD_CLEAR		(18*32+10) /* Flush state on VERW */
 #define X86_FEATURE_PCONFIG		(18*32+18) /* Intel PCONFIG */
 #define X86_FEATURE_SPEC_CTRL		(18*32+26) /* "" Speculation Control (IBRS + IBPB) */
 #define X86_FEATURE_INTEL_STIBP		(18*32+27) /* "" Single Thread Indirect Branch Predictors */

index 18bc9b51ac9b..1c5507400089 100644
@@ -494,7 +494,7 @@ do_nmi(struct pt_regs *regs, long error_code)
 {
 	if (this_cpu_read(nmi_state) != NMI_NOT_RUNNING) {
 		this_cpu_write(nmi_state, NMI_LATCHED);
-		return;
+		goto out;
 	}
 	this_cpu_write(nmi_state, NMI_EXECUTING);
 	this_cpu_write(nmi_cr2, read_cr2());

@@ -533,6 +533,9 @@ do_nmi(struct pt_regs *regs, long error_code)
 		write_cr2(this_cpu_read(nmi_cr2));
 	if (this_cpu_dec_return(nmi_state))
 		goto nmi_restart;
+
+out:
+	clear_cpu();
 }
 NOKPROBE_SYMBOL(do_nmi);
 

index 77070c2d1240..71f6dd698968 100644
@@ -17,6 +17,7 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/ratelimit.h>
+#include <linux/clearcpu.h>
 
 
 #define MIN_TTYB_SIZE	256

@@ -328,6 +329,7 @@ int tty_insert_flip_string_fixed_flag(struct tty_port *port,
 		/* There is a small chance that we need to split the data over
 		   several buffers. If this is the case we must loop */
 	} while (unlikely(size > copied));
+	lazy_clear_cpu_interrupt();
 	return copied;
 }
 EXPORT_SYMBOL(tty_insert_flip_string_fixed_flag);

@@ -363,6 +365,7 @@ int tty_insert_flip_string_flags(struct tty_port *port,
 		/* There is a small chance that we need to split the data over
 		   several buffers. If this is the case we must loop */
 	} while (unlikely(size > copied));
+	lazy_clear_cpu_interrupt();
 	return copied;
 }
 EXPORT_SYMBOL(tty_insert_flip_string_flags);

@@ -388,7 +391,7 @@ int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag)
 	if (~tb->flags & TTYB_NORMAL)
 		*flag_buf_ptr(tb, tb->used) = flag;
 	*char_buf_ptr(tb, tb->used++) = ch;
-
+	lazy_clear_cpu_interrupt();
 	return 1;
 }
 EXPORT_SYMBOL(__tty_insert_flip_char);

index 767f62086bd9..41ae39e339b9 100644
@@ -2,6 +2,8 @@
 #ifndef _LINUX_TTY_FLIP_H
 #define _LINUX_TTY_FLIP_H
 
+#include <linux/clearcpu.h>
+
 extern int tty_buffer_set_limit(struct tty_port *port, int limit);
 extern int tty_buffer_space_avail(struct tty_port *port);
 extern int tty_buffer_request_room(struct tty_port *port, size_t size);

@@ -21,6 +23,8 @@ static inline int tty_insert_flip_char(struct tty_port *port,
 	struct tty_buffer *tb = port->buf.tail;
 	int change;
 
+	lazy_clear_cpu_interrupt();
+
 	change = (tb->flags & TTYB_NORMAL) && (flag != TTY_NORMAL);
 	if (!change && tb->used < tb->size) {
 		if (~tb->flags & TTYB_NORMAL)