41 files changed, 1568 insertions, 354 deletions

diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 8aeb60eb6ee3..bb015551c2d9 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -140,17 +140,9 @@ cc-option-yn = $(call try-run,\
 cc-disable-warning = $(call try-run,\
         $(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
 
-# cc-name
-# Expands to either gcc or clang
-cc-name = $(shell $(CC) -v 2>&1 | grep -q "clang version" && echo clang || echo gcc)
-
 # cc-version
 cc-version = $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-version.sh $(CC))
 
-# cc-fullversion
-cc-fullversion = $(shell $(CONFIG_SHELL) \
-        $(srctree)/scripts/gcc-version.sh -p $(CC))
-
 # cc-ifversion
 # Usage:  EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
 cc-ifversion = $(shell [ $(cc-version) $(1) $(2) ] && echo $(3) || echo $(4))
@@ -195,7 +187,7 @@ modbuiltin := -f $(srctree)/scripts/Makefile.modbuiltin obj
 # Shorthand for $(Q)$(MAKE) -f scripts/Makefile.dtbinst obj=
 # Usage:
 # $(Q)$(MAKE) $(dtbinst)=dir
-dtbinst := -f $(if $(KBUILD_SRC),$(srctree)/)scripts/Makefile.dtbinst obj
+dtbinst := -f $(srctree)/scripts/Makefile.dtbinst obj
 
 ###
 # Shorthand for $(Q)$(MAKE) -f scripts/Makefile.clean obj=
diff --git a/scripts/Makefile b/scripts/Makefile
index 61affa300d25..ece52ff20171 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -39,8 +39,7 @@ build_unifdef: $(obj)/unifdef
 subdir-$(CONFIG_MODVERSIONS) += genksyms
 subdir-y                     += mod
 subdir-$(CONFIG_SECURITY_SELINUX) += selinux
-subdir-$(CONFIG_DTC)         += dtc
 subdir-$(CONFIG_GDB_SCRIPTS) += gdb
 
 # Let clean descend into subdirs
-subdir- += basic kconfig package gcc-plugins
+subdir- += basic dtc kconfig package gcc-plugins
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index 54da4b070db3..a8e7ba9f73e8 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -36,21 +36,11 @@ subdir-ccflags-y :=
 
 include scripts/Kbuild.include
 
-# For backward compatibility check that these variables do not change
-save-cflags := $(CFLAGS)
-
 # The filename Kbuild has precedence over Makefile
 kbuild-dir := $(if $(filter /%,$(src)),$(src),$(srctree)/$(src))
 kbuild-file := $(if $(wildcard $(kbuild-dir)/Kbuild),$(kbuild-dir)/Kbuild,$(kbuild-dir)/Makefile)
 include $(kbuild-file)
 
-# If the save-* variables changed error out
-ifeq ($(KBUILD_NOPEDANTIC),)
-        ifneq ("$(save-cflags)","$(CFLAGS)")
-                $(error CFLAGS was changed in "$(kbuild-file)". Fix it to use ccflags-y)
-        endif
-endif
-
 include scripts/Makefile.lib
 
 # Do not include host rules unless needed
@@ -83,14 +73,12 @@ __build: $(if $(KBUILD_BUILTIN),$(builtin-target) $(lib-target) $(extra-y)) \
         @:
 
 # Linus' kernel sanity checking tool
-ifneq ($(KBUILD_CHECKSRC),0)
-  ifeq ($(KBUILD_CHECKSRC),2)
-    quiet_cmd_force_checksrc = CHECK   $<
-          cmd_force_checksrc = $(CHECK) $(CHECKFLAGS) $(c_flags) $< ;
-  else
-      quiet_cmd_checksrc     = CHECK   $<
-            cmd_checksrc     = $(CHECK) $(CHECKFLAGS) $(c_flags) $< ;
-  endif
+ifeq ($(KBUILD_CHECKSRC),1)
+  quiet_cmd_checksrc       = CHECK   $<
+        cmd_checksrc       = $(CHECK) $(CHECKFLAGS) $(c_flags) $< ;
+else ifeq ($(KBUILD_CHECKSRC),2)
+  quiet_cmd_force_checksrc = CHECK   $<
+        cmd_force_checksrc = $(CHECK) $(CHECKFLAGS) $(c_flags) $< ;
 endif
 
 ifneq ($(KBUILD_ENABLE_EXTRA_GCC_CHECKS),)
@@ -495,28 +483,12 @@ targets += $(obj)/lib-ksyms.o
 
 endif
 
-#
-# Rule to link composite objects
-#
-#  Composite objects are specified in kbuild makefile as follows:
-#    <composite-object>-objs := <list of .o files>
-#  or
-#    <composite-object>-y    := <list of .o files>
-#  or
-#    <composite-object>-m    := <list of .o files>
-#  The -m syntax only works if <composite object> is a module
-link_multi_deps =                     \
-$(filter $(addprefix $(obj)/,         \
-$($(subst $(obj)/,,$(@:.o=-objs)))    \
-$($(subst $(obj)/,,$(@:.o=-y)))       \
-$($(subst $(obj)/,,$(@:.o=-m)))), $^)
-
 quiet_cmd_link_multi-m = LD [M]  $@
-cmd_link_multi-m = $(LD) $(ld_flags) -r -o $@ $(link_multi_deps) $(cmd_secanalysis)
+cmd_link_multi-m = $(LD) $(ld_flags) -r -o $@ $(filter %.o,$^) $(cmd_secanalysis)
 
 $(multi-used-m): FORCE
         $(call if_changed,link_multi-m)
-        @{ echo $(@:.o=.ko); echo $(link_multi_deps); \
+        @{ echo $(@:.o=.ko); echo $(filter %.o,$^); \
            $(cmd_undef_syms); } > $(MODVERDIR)/$(@F:.o=.mod)
 $(call multi_depend, $(multi-used-m), .o, -objs -y -m)
 
diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
index 8d5357053f86..768306add591 100644
--- a/scripts/Makefile.extrawarn
+++ b/scripts/Makefile.extrawarn
@@ -29,6 +29,7 @@ warning-1 += $(call cc-option, -Wmissing-include-dirs)
 warning-1 += $(call cc-option, -Wunused-but-set-variable)
 warning-1 += $(call cc-option, -Wunused-const-variable)
 warning-1 += $(call cc-option, -Wpacked-not-aligned)
+warning-1 += $(call cc-option, -Wstringop-truncation)
 warning-1 += $(call cc-disable-warning, missing-field-initializers)
 warning-1 += $(call cc-disable-warning, sign-compare)
 
@@ -52,7 +53,6 @@ warning-3 += -Wpointer-arith
 warning-3 += -Wredundant-decls
 warning-3 += -Wswitch-default
 warning-3 += $(call cc-option, -Wpacked-bitfield-compat)
-warning-3 += $(call cc-option, -Wvla)
 
 warning := $(warning-$(findstring 1, $(KBUILD_ENABLE_EXTRA_GCC_CHECKS)))
 warning += $(warning-$(findstring 2, $(KBUILD_ENABLE_EXTRA_GCC_CHECKS)))
@@ -65,7 +65,7 @@ endif
 KBUILD_CFLAGS += $(warning)
 else
 
-ifeq ($(cc-name),clang)
+ifdef CONFIG_CC_IS_CLANG
 KBUILD_CFLAGS += $(call cc-disable-warning, initializer-overrides)
 KBUILD_CFLAGS += $(call cc-disable-warning, unused-value)
 KBUILD_CFLAGS += $(call cc-disable-warning, format)
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index 0a482f341576..46c5c6809806 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -26,6 +26,16 @@ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_RANDSTRUCT)		\
 gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE)   \
                 += -fplugin-arg-randomize_layout_plugin-performance-mode
 
+gcc-plugin-$(CONFIG_GCC_PLUGIN_STACKLEAK)       += stackleak_plugin.so
+gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STACKLEAK)                \
+                += -DSTACKLEAK_PLUGIN
+gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STACKLEAK)                \
+                += -fplugin-arg-stackleak_plugin-track-min-size=$(CONFIG_STACKLEAK_TRACK_MIN_SIZE)
+ifdef CONFIG_GCC_PLUGIN_STACKLEAK
+    DISABLE_STACKLEAK_PLUGIN += -fplugin-arg-stackleak_plugin-disable
+endif
+export DISABLE_STACKLEAK_PLUGIN
+
 # All the plugin CFLAGS are collected here in case a build target needs to
 # filter them out of the KBUILD_CFLAGS.
 GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y))
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 61e596650ed3..8fe4468f9bda 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -283,7 +283,7 @@ $(obj)/%.dtb.S: $(obj)/%.dtb FORCE
 
 quiet_cmd_dtc = DTC     $@
 cmd_dtc = mkdir -p $(dir ${dtc-tmp}) ; \
-        $(CPP) $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
+        $(HOSTCC) -E $(dtc_cpp_flags) -x assembler-with-cpp -o $(dtc-tmp) $< ; \
         $(DTC) -O dtb -o $@ -b 0 \
                 $(addprefix -i,$(dir $<) $(DTC_INCLUDE)) $(DTC_FLAGS) \
                 -d $(depfile).dtc.tmp $(dtc-tmp) ; \
diff --git a/scripts/asn1_compiler.c b/scripts/asn1_compiler.c
index c146020fc783..1b28787028d3 100644
--- a/scripts/asn1_compiler.c
+++ b/scripts/asn1_compiler.c
@@ -413,7 +413,7 @@ static void tokenise(char *buffer, char *end)
 
                         /* Handle string tokens */
                         if (isalpha(*p)) {
-                                const char **dir, *start = p;
+                                const char **dir;
 
                                 /* Can be a directive, type name or element
                                  * name.  Find the end of the name.
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 161b0224d6ae..c883ec55654f 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -4934,17 +4934,6 @@ sub process {
                 while ($line =~ m{($Constant|$Lval)}g) {
                         my $var = $1;
 
-#gcc binary extension
-                        if ($var =~ /^$Binary$/) {
-                                if (WARN("GCC_BINARY_CONSTANT",
-                                         "Avoid gcc v4.3+ binary constant extension: <$var>\n" . $herecurr) &&
-                                    $fix) {
-                                        my $hexval = sprintf("0x%x", oct($var));
-                                        $fixed[$fixlinenr] =~
-                                            s/\b$var\b/$hexval/;
-                                }
-                        }
-
 #CamelCase
                         if ($var !~ /^$Constant$/ &&
                             $var =~ /[A-Z][a-z]|[a-z][A-Z]/ &&
diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile
index 1c943e03eaf2..056d5da6c477 100644
--- a/scripts/dtc/Makefile
+++ b/scripts/dtc/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 # scripts/dtc makefile
 
-hostprogs-y     := dtc
+hostprogs-$(CONFIG_DTC) := dtc
 always          := $(hostprogs-y)
 
 dtc-objs        := dtc.o flattree.o fstree.o data.o livetree.o treesource.o \
@@ -11,6 +11,13 @@ dtc-objs	+= dtc-lexer.lex.o dtc-parser.tab.o
 # Source files need to get at the userspace version of libfdt_env.h to compile
 HOST_EXTRACFLAGS := -I$(src)/libfdt
 
+ifeq ($(wildcard /usr/include/yaml.h),)
+HOST_EXTRACFLAGS += -DNO_YAML
+else
+dtc-objs        += yamltree.o
+HOSTLDLIBS_dtc  := -lyaml
+endif
+
 # Generated files need one more search path to include headers in source tree
 HOSTCFLAGS_dtc-lexer.lex.o := -I$(src)
 HOSTCFLAGS_dtc-parser.tab.o := -I$(src)
diff --git a/scripts/dtc/Makefile.dtc b/scripts/dtc/Makefile.dtc
index bece49b35535..d4375630a7f7 100644
--- a/scripts/dtc/Makefile.dtc
+++ b/scripts/dtc/Makefile.dtc
@@ -14,5 +14,9 @@ DTC_SRCS = \
         treesource.c \
         util.c
 
+ifneq ($(NO_YAML),1)
+DTC_SRCS += yamltree.c
+endif
+
 DTC_GEN_SRCS = dtc-lexer.lex.c dtc-parser.tab.c
 DTC_OBJS = $(DTC_SRCS:%.c=%.o) $(DTC_GEN_SRCS:%.c=%.o)
diff --git a/scripts/dtc/checks.c b/scripts/dtc/checks.c
index a2cc1036c915..9c9b0c328af6 100644
--- a/scripts/dtc/checks.c
+++ b/scripts/dtc/checks.c
@@ -962,6 +962,143 @@ static void check_simple_bus_reg(struct check *c, struct dt_info *dti, struct no
 }
 WARNING(simple_bus_reg, check_simple_bus_reg, NULL, &reg_format, &simple_bus_bridge);
 
+static const struct bus_type i2c_bus = {
+        .name = "i2c-bus",
+};
+
+static void check_i2c_bus_bridge(struct check *c, struct dt_info *dti, struct node *node)
+{
+        if (strprefixeq(node->name, node->basenamelen, "i2c-bus") ||
+            strprefixeq(node->name, node->basenamelen, "i2c-arb")) {
+                node->bus = &i2c_bus;
+        } else if (strprefixeq(node->name, node->basenamelen, "i2c")) {
+                struct node *child;
+                for_each_child(node, child) {
+                        if (strprefixeq(child->name, node->basenamelen, "i2c-bus"))
+                                return;
+                }
+                node->bus = &i2c_bus;
+        } else
+                return;
+
+        if (!node->children)
+                return;
+
+        if (node_addr_cells(node) != 1)
+                FAIL(c, dti, node, "incorrect #address-cells for I2C bus");
+        if (node_size_cells(node) != 0)
+                FAIL(c, dti, node, "incorrect #size-cells for I2C bus");
+
+}
+WARNING(i2c_bus_bridge, check_i2c_bus_bridge, NULL, &addr_size_cells);
+
+static void check_i2c_bus_reg(struct check *c, struct dt_info *dti, struct node *node)
+{
+        struct property *prop;
+        const char *unitname = get_unitname(node);
+        char unit_addr[17];
+        uint32_t reg = 0;
+        int len;
+        cell_t *cells = NULL;
+
+        if (!node->parent || (node->parent->bus != &i2c_bus))
+                return;
+
+        prop = get_property(node, "reg");
+        if (prop)
+                cells = (cell_t *)prop->val.val;
+
+        if (!cells) {
+                FAIL(c, dti, node, "missing or empty reg property");
+                return;
+        }
+
+        reg = fdt32_to_cpu(*cells);
+        snprintf(unit_addr, sizeof(unit_addr), "%x", reg);
+        if (!streq(unitname, unit_addr))
+                FAIL(c, dti, node, "I2C bus unit address format error, expected \"%s\"",
+                     unit_addr);
+
+        for (len = prop->val.len; len > 0; len -= 4) {
+                reg = fdt32_to_cpu(*(cells++));
+                if (reg > 0x3ff)
+                        FAIL_PROP(c, dti, node, prop, "I2C address must be less than 10-bits, got \"0x%x\"",
+                                  reg);
+
+        }
+}
+WARNING(i2c_bus_reg, check_i2c_bus_reg, NULL, &reg_format, &i2c_bus_bridge);
+
+static const struct bus_type spi_bus = {
+        .name = "spi-bus",
+};
+
+static void check_spi_bus_bridge(struct check *c, struct dt_info *dti, struct node *node)
+{
+
+        if (strprefixeq(node->name, node->basenamelen, "spi")) {
+                node->bus = &spi_bus;
+        } else {
+                /* Try to detect SPI buses which don't have proper node name */
+                struct node *child;
+
+                if (node_addr_cells(node) != 1 || node_size_cells(node) != 0)
+                        return;
+
+                for_each_child(node, child) {
+                        struct property *prop;
+                        for_each_property(child, prop) {
+                                if (strprefixeq(prop->name, 4, "spi-")) {
+                                        node->bus = &spi_bus;
+                                        break;
+                                }
+                        }
+                        if (node->bus == &spi_bus)
+                                break;
+                }
+
+                if (node->bus == &spi_bus && get_property(node, "reg"))
+                        FAIL(c, dti, node, "node name for SPI buses should be 'spi'");
+        }
+        if (node->bus != &spi_bus || !node->children)
+                return;
+
+        if (node_addr_cells(node) != 1)
+                FAIL(c, dti, node, "incorrect #address-cells for SPI bus");
+        if (node_size_cells(node) != 0)
+                FAIL(c, dti, node, "incorrect #size-cells for SPI bus");
+
+}
+WARNING(spi_bus_bridge, check_spi_bus_bridge, NULL, &addr_size_cells);
+
+static void check_spi_bus_reg(struct check *c, struct dt_info *dti, struct node *node)
+{
+        struct property *prop;
+        const char *unitname = get_unitname(node);
+        char unit_addr[9];
+        uint32_t reg = 0;
+        cell_t *cells = NULL;
+
+        if (!node->parent || (node->parent->bus != &spi_bus))
+                return;
+
+        prop = get_property(node, "reg");
+        if (prop)
+                cells = (cell_t *)prop->val.val;
+
+        if (!cells) {
+                FAIL(c, dti, node, "missing or empty reg property");
+                return;
+        }
+
+        reg = fdt32_to_cpu(*cells);
+        snprintf(unit_addr, sizeof(unit_addr), "%x", reg);
+        if (!streq(unitname, unit_addr))
+                FAIL(c, dti, node, "SPI bus unit address format error, expected \"%s\"",
+                     unit_addr);
+}
+WARNING(spi_bus_reg, check_spi_bus_reg, NULL, &reg_format, &spi_bus_bridge);
+
 static void check_unit_address_format(struct check *c, struct dt_info *dti,
                                       struct node *node)
 {
@@ -1582,6 +1719,12 @@ static struct check *check_table[] = {
         &simple_bus_bridge,
         &simple_bus_reg,
 
+        &i2c_bus_bridge,
+        &i2c_bus_reg,
+
+        &spi_bus_bridge,
+        &spi_bus_reg,
+
         &avoid_default_addr_size,
         &avoid_unnecessary_addr_size,
         &unique_unit_address,
diff --git a/scripts/dtc/data.c b/scripts/dtc/data.c
index aa37a16c8891..4a204145cc7b 100644
--- a/scripts/dtc/data.c
+++ b/scripts/dtc/data.c
@@ -74,7 +74,8 @@ struct data data_copy_escape_string(const char *s, int len)
         struct data d;
         char *q;
 
-        d = data_grow_for(empty_data, len + 1);
+        d = data_add_marker(empty_data, TYPE_STRING, NULL);
+        d = data_grow_for(d, len + 1);
 
         q = d.val;
         while (i < len) {
@@ -94,6 +95,7 @@ struct data data_copy_file(FILE *f, size_t maxlen)
 {
         struct data d = empty_data;
 
+        d = data_add_marker(d, TYPE_NONE, NULL);
         while (!feof(f) && (d.len < maxlen)) {
                 size_t chunksize, ret;
 
diff --git a/scripts/dtc/dtc-parser.y b/scripts/dtc/dtc-parser.y
index 011a5b25539a..dd70ebf386f4 100644
--- a/scripts/dtc/dtc-parser.y
+++ b/scripts/dtc/dtc-parser.y
@@ -287,6 +287,7 @@ propdata:
                 }
         | propdataprefix DT_REF
                 {
+                        $1 = data_add_marker($1, TYPE_STRING, $2);
                         $$ = data_add_marker($1, REF_PATH, $2);
                 }
         | propdataprefix DT_INCBIN '(' DT_STRING ',' integer_prim ',' integer_prim ')'
@@ -340,22 +341,27 @@ arrayprefix:
         DT_BITS DT_LITERAL '<'
                 {
                         unsigned long long bits;
+                        enum markertype type = TYPE_UINT32;
 
                         bits = $2;
 
-                        if ((bits !=  8) && (bits != 16) &&
-                            (bits != 32) && (bits != 64)) {
+                        switch (bits) {
+                        case 8: type = TYPE_UINT8; break;
+                        case 16: type = TYPE_UINT16; break;
+                        case 32: type = TYPE_UINT32; break;
+                        case 64: type = TYPE_UINT64; break;
+                        default:
                                 ERROR(&@2, "Array elements must be"
                                       " 8, 16, 32 or 64-bits");
                                 bits = 32;
                         }
 
-                        $$.data = empty_data;
+                        $$.data = data_add_marker(empty_data, type, NULL);
                         $$.bits = bits;
                 }
         | '<'
                 {
-                        $$.data = empty_data;
+                        $$.data = data_add_marker(empty_data, TYPE_UINT32, NULL);
                         $$.bits = 32;
                 }
         | arrayprefix integer_prim
@@ -499,7 +505,7 @@ integer_unary:
 bytestring:
           /* empty */
                 {
-                        $$ = empty_data;
+                        $$ = data_add_marker(empty_data, TYPE_UINT8, NULL);
                 }
         | bytestring DT_BYTE
                 {
diff --git a/scripts/dtc/dtc.c b/scripts/dtc/dtc.c
index c36994e6eac5..64134aadb997 100644
--- a/scripts/dtc/dtc.c
+++ b/scripts/dtc/dtc.c
@@ -95,6 +95,9 @@ static const char * const usage_opts_help[] = {
         "\n\tOutput formats are:\n"
          "\t\tdts - device tree source text\n"
          "\t\tdtb - device tree blob\n"
+#ifndef NO_YAML
+         "\t\tyaml - device tree encoded as YAML\n"
+#endif
          "\t\tasm - assembler source",
         "\n\tBlob version to produce, defaults to "stringify(DEFAULT_FDT_VERSION)" (for dtb and asm output)",
         "\n\tOutput dependency file",
@@ -128,6 +131,8 @@ static const char *guess_type_by_name(const char *fname, const char *fallback)
                 return fallback;
         if (!strcasecmp(s, ".dts"))
                 return "dts";
+        if (!strcasecmp(s, ".yaml"))
+                return "yaml";
         if (!strcasecmp(s, ".dtb"))
                 return "dtb";
         return fallback;
@@ -350,6 +355,12 @@ int main(int argc, char *argv[])
 
         if (streq(outform, "dts")) {
                 dt_to_source(outf, dti);
+#ifndef NO_YAML
+        } else if (streq(outform, "yaml")) {
+                if (!streq(inform, "dts"))
+                        die("YAML output format requires dts input format\n");
+                dt_to_yaml(outf, dti);
+#endif
         } else if (streq(outform, "dtb")) {
                 dt_to_blob(outf, dti, outversion);
         } else if (streq(outform, "asm")) {
diff --git a/scripts/dtc/dtc.h b/scripts/dtc/dtc.h
index 6d667701ab6a..cbe541525c2c 100644
--- a/scripts/dtc/dtc.h
+++ b/scripts/dtc/dtc.h
@@ -74,10 +74,17 @@ typedef uint32_t cell_t;
 
 /* Data blobs */
 enum markertype {
+        TYPE_NONE,
         REF_PHANDLE,
         REF_PATH,
         LABEL,
+        TYPE_UINT8,
+        TYPE_UINT16,
+        TYPE_UINT32,
+        TYPE_UINT64,
+        TYPE_STRING,
 };
+extern const char *markername(enum markertype markertype);
 
 struct  marker {
         enum markertype type;
@@ -101,6 +108,8 @@ struct data {
         for_each_marker(m) \
                 if ((m)->type == (t))
 
+size_t type_marker_length(struct marker *m);
+
 void data_free(struct data d);
 
 struct data data_grow_for(struct data d, int xlen);
@@ -290,6 +299,10 @@ struct dt_info *dt_from_blob(const char *fname);
 void dt_to_source(FILE *f, struct dt_info *dti);
 struct dt_info *dt_from_source(const char *f);
 
+/* YAML source */
+
+void dt_to_yaml(FILE *f, struct dt_info *dti);
+
 /* FS trees */
 
 struct dt_info *dt_from_fs(const char *dirname);
diff --git a/scripts/dtc/flattree.c b/scripts/dtc/flattree.c
index 8d268fb785db..851ea87dbc0f 100644
--- a/scripts/dtc/flattree.c
+++ b/scripts/dtc/flattree.c
@@ -393,7 +393,7 @@ void dt_to_blob(FILE *f, struct dt_info *dti, int version)
                         padlen = 0;
                         if (quiet < 1)
                                 fprintf(stderr,
-                                        "Warning: blob size %d >= minimum size %d\n",
+                                        "Warning: blob size %"PRIu32" >= minimum size %d\n",
                                         fdt32_to_cpu(fdt.totalsize), minsize);
                 }
         }
diff --git a/scripts/dtc/libfdt/fdt.c b/scripts/dtc/libfdt/fdt.c
index 7855a1787763..ae03b1112961 100644
--- a/scripts/dtc/libfdt/fdt.c
+++ b/scripts/dtc/libfdt/fdt.c
@@ -55,7 +55,12 @@
 
 #include "libfdt_internal.h"
 
-int fdt_check_header(const void *fdt)
+/*
+ * Minimal sanity check for a read-only tree. fdt_ro_probe_() checks
+ * that the given buffer contains what appears to be a flattened
+ * device tree with sane information in its header.
+ */
+int fdt_ro_probe_(const void *fdt)
 {
         if (fdt_magic(fdt) == FDT_MAGIC) {
                 /* Complete tree */
@@ -74,6 +79,78 @@ int fdt_check_header(const void *fdt)
         return 0;
 }
 
+static int check_off_(uint32_t hdrsize, uint32_t totalsize, uint32_t off)
+{
+        return (off >= hdrsize) && (off <= totalsize);
+}
+
+static int check_block_(uint32_t hdrsize, uint32_t totalsize,
+                        uint32_t base, uint32_t size)
+{
+        if (!check_off_(hdrsize, totalsize, base))
+                return 0; /* block start out of bounds */
+        if ((base + size) < base)
+                return 0; /* overflow */
+        if (!check_off_(hdrsize, totalsize, base + size))
+                return 0; /* block end out of bounds */
+        return 1;
+}
+
+size_t fdt_header_size_(uint32_t version)
+{
+        if (version <= 1)
+                return FDT_V1_SIZE;
+        else if (version <= 2)
+                return FDT_V2_SIZE;
+        else if (version <= 3)
+                return FDT_V3_SIZE;
+        else if (version <= 16)
+                return FDT_V16_SIZE;
+        else
+                return FDT_V17_SIZE;
+}
+
+int fdt_check_header(const void *fdt)
+{
+        size_t hdrsize;
+
+        if (fdt_magic(fdt) != FDT_MAGIC)
+                return -FDT_ERR_BADMAGIC;
+        hdrsize = fdt_header_size(fdt);
+        if ((fdt_version(fdt) < FDT_FIRST_SUPPORTED_VERSION)
+            || (fdt_last_comp_version(fdt) > FDT_LAST_SUPPORTED_VERSION))
+                return -FDT_ERR_BADVERSION;
+        if (fdt_version(fdt) < fdt_last_comp_version(fdt))
+                return -FDT_ERR_BADVERSION;
+
+        if ((fdt_totalsize(fdt) < hdrsize)
+            || (fdt_totalsize(fdt) > INT_MAX))
+                return -FDT_ERR_TRUNCATED;
+
+        /* Bounds check memrsv block */
+        if (!check_off_(hdrsize, fdt_totalsize(fdt), fdt_off_mem_rsvmap(fdt)))
+                return -FDT_ERR_TRUNCATED;
+
+        /* Bounds check structure block */
+        if (fdt_version(fdt) < 17) {
+                if (!check_off_(hdrsize, fdt_totalsize(fdt),
+                                fdt_off_dt_struct(fdt)))
+                        return -FDT_ERR_TRUNCATED;
+        } else {
+                if (!check_block_(hdrsize, fdt_totalsize(fdt),
+                                  fdt_off_dt_struct(fdt),
+                                  fdt_size_dt_struct(fdt)))
+                        return -FDT_ERR_TRUNCATED;
+        }
+
+        /* Bounds check strings block */
+        if (!check_block_(hdrsize, fdt_totalsize(fdt),
+                          fdt_off_dt_strings(fdt), fdt_size_dt_strings(fdt)))
+                return -FDT_ERR_TRUNCATED;
+
+        return 0;
+}
+
 const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len)
 {
         unsigned absoffset = offset + fdt_off_dt_struct(fdt);
@@ -244,7 +321,7 @@ const char *fdt_find_string_(const char *strtab, int tabsize, const char *s)
 
 int fdt_move(const void *fdt, void *buf, int bufsize)
 {
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         if (fdt_totalsize(fdt) > bufsize)
                 return -FDT_ERR_NOSPACE;
diff --git a/scripts/dtc/libfdt/fdt_addresses.c b/scripts/dtc/libfdt/fdt_addresses.c
index eff4dbcc729d..49537b578d03 100644
--- a/scripts/dtc/libfdt/fdt_addresses.c
+++ b/scripts/dtc/libfdt/fdt_addresses.c
@@ -1,6 +1,7 @@
 /*
  * libfdt - Flat Device Tree manipulation
  * Copyright (C) 2014 David Gibson <david@gibson.dropbear.id.au>
+ * Copyright (C) 2018 embedded brains GmbH
  *
  * libfdt is dual licensed: you can use it either under the terms of
  * the GPL, or the BSD license, at your option.
@@ -55,42 +56,32 @@
 
 #include "libfdt_internal.h"
 
-int fdt_address_cells(const void *fdt, int nodeoffset)
+static int fdt_cells(const void *fdt, int nodeoffset, const char *name)
 {
-        const fdt32_t *ac;
+        const fdt32_t *c;
         int val;
         int len;
 
-        ac = fdt_getprop(fdt, nodeoffset, "#address-cells", &len);
-        if (!ac)
+        c = fdt_getprop(fdt, nodeoffset, name, &len);
+        if (!c)
                 return 2;
 
-        if (len != sizeof(*ac))
+        if (len != sizeof(*c))
                 return -FDT_ERR_BADNCELLS;
 
-        val = fdt32_to_cpu(*ac);
+        val = fdt32_to_cpu(*c);
         if ((val <= 0) || (val > FDT_MAX_NCELLS))
                 return -FDT_ERR_BADNCELLS;
 
         return val;
 }
 
-int fdt_size_cells(const void *fdt, int nodeoffset)
+int fdt_address_cells(const void *fdt, int nodeoffset)
 {
-        const fdt32_t *sc;
-        int val;
-        int len;
-
-        sc = fdt_getprop(fdt, nodeoffset, "#size-cells", &len);
-        if (!sc)
-                return 2;
-
-        if (len != sizeof(*sc))
-                return -FDT_ERR_BADNCELLS;
-
-        val = fdt32_to_cpu(*sc);
-        if ((val < 0) || (val > FDT_MAX_NCELLS))
-                return -FDT_ERR_BADNCELLS;
+        return fdt_cells(fdt, nodeoffset, "#address-cells");
+}
 
-        return val;
+int fdt_size_cells(const void *fdt, int nodeoffset)
+{
+        return fdt_cells(fdt, nodeoffset, "#size-cells");
 }
diff --git a/scripts/dtc/libfdt/fdt_overlay.c b/scripts/dtc/libfdt/fdt_overlay.c
index bf75388ec9a2..5fdab6c6371d 100644
--- a/scripts/dtc/libfdt/fdt_overlay.c
+++ b/scripts/dtc/libfdt/fdt_overlay.c
@@ -697,7 +697,7 @@ static int get_path_len(const void *fdt, int nodeoffset)
         int len = 0, namelen;
         const char *name;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         for (;;) {
                 name = fdt_get_name(fdt, nodeoffset, &namelen);
@@ -866,8 +866,8 @@ int fdt_overlay_apply(void *fdt, void *fdto)
         uint32_t delta = fdt_get_max_phandle(fdt);
         int ret;
 
-        FDT_CHECK_HEADER(fdt);
-        FDT_CHECK_HEADER(fdto);
+        FDT_RO_PROBE(fdt);
+        FDT_RO_PROBE(fdto);
 
         ret = overlay_adjust_local_phandles(fdto, delta);
         if (ret)
diff --git a/scripts/dtc/libfdt/fdt_ro.c b/scripts/dtc/libfdt/fdt_ro.c
index dfb3236da388..eafc14282892 100644
--- a/scripts/dtc/libfdt/fdt_ro.c
+++ b/scripts/dtc/libfdt/fdt_ro.c
@@ -76,17 +76,72 @@ static int fdt_nodename_eq_(const void *fdt, int offset,
                 return 0;
 }
 
+const char *fdt_get_string(const void *fdt, int stroffset, int *lenp)
+{
+        uint32_t absoffset = stroffset + fdt_off_dt_strings(fdt);
+        size_t len;
+        int err;
+        const char *s, *n;
+
+        err = fdt_ro_probe_(fdt);
+        if (err != 0)
+                goto fail;
+
+        err = -FDT_ERR_BADOFFSET;
+        if (absoffset >= fdt_totalsize(fdt))
+                goto fail;
+        len = fdt_totalsize(fdt) - absoffset;
+
+        if (fdt_magic(fdt) == FDT_MAGIC) {
+                if (stroffset < 0)
+                        goto fail;
+                if (fdt_version(fdt) >= 17) {
+                        if (stroffset >= fdt_size_dt_strings(fdt))
+                                goto fail;
+                        if ((fdt_size_dt_strings(fdt) - stroffset) < len)
+                                len = fdt_size_dt_strings(fdt) - stroffset;
+                }
+        } else if (fdt_magic(fdt) == FDT_SW_MAGIC) {
+                if ((stroffset >= 0)
+                    || (stroffset < -fdt_size_dt_strings(fdt)))
+                        goto fail;
+                if ((-stroffset) < len)
+                        len = -stroffset;
+        } else {
+                err = -FDT_ERR_INTERNAL;
+                goto fail;
+        }
+
+        s = (const char *)fdt + absoffset;
+        n = memchr(s, '\0', len);
+        if (!n) {
+                /* missing terminating NULL */
+                err = -FDT_ERR_TRUNCATED;
+                goto fail;
+        }
+
+        if (lenp)
+                *lenp = n - s;
+        return s;
+
+fail:
+        if (lenp)
+                *lenp = err;
+        return NULL;
+}
+
 const char *fdt_string(const void *fdt, int stroffset)
 {
-        return (const char *)fdt + fdt_off_dt_strings(fdt) + stroffset;
+        return fdt_get_string(fdt, stroffset, NULL);
 }
 
 static int fdt_string_eq_(const void *fdt, int stroffset,
                           const char *s, int len)
 {
-        const char *p = fdt_string(fdt, stroffset);
+        int slen;
+        const char *p = fdt_get_string(fdt, stroffset, &slen);
 
-        return (strlen(p) == len) && (memcmp(p, s, len) == 0);
+        return p && (slen == len) && (memcmp(p, s, len) == 0);
 }
 
 uint32_t fdt_get_max_phandle(const void *fdt)
@@ -115,21 +170,42 @@ uint32_t fdt_get_max_phandle(const void *fdt)
         return 0;
 }
 
+static const struct fdt_reserve_entry *fdt_mem_rsv(const void *fdt, int n)
+{
+        int offset = n * sizeof(struct fdt_reserve_entry);
+        int absoffset = fdt_off_mem_rsvmap(fdt) + offset;
+
+        if (absoffset < fdt_off_mem_rsvmap(fdt))
+                return NULL;
+        if (absoffset > fdt_totalsize(fdt) - sizeof(struct fdt_reserve_entry))
+                return NULL;
+        return fdt_mem_rsv_(fdt, n);
+}
+
 int fdt_get_mem_rsv(const void *fdt, int n, uint64_t *address, uint64_t *size)
 {
-        FDT_CHECK_HEADER(fdt);
-        *address = fdt64_to_cpu(fdt_mem_rsv_(fdt, n)->address);
-        *size = fdt64_to_cpu(fdt_mem_rsv_(fdt, n)->size);
+        const struct fdt_reserve_entry *re;
+
+        FDT_RO_PROBE(fdt);
+        re = fdt_mem_rsv(fdt, n);
+        if (!re)
+                return -FDT_ERR_BADOFFSET;
+
+        *address = fdt64_ld(&re->address);
+        *size = fdt64_ld(&re->size);
         return 0;
 }
 
 int fdt_num_mem_rsv(const void *fdt)
 {
-        int i = 0;
+        int i;
+        const struct fdt_reserve_entry *re;
 
-        while (fdt64_to_cpu(fdt_mem_rsv_(fdt, i)->size) != 0)
-                i++;
-        return i;
+        for (i = 0; (re = fdt_mem_rsv(fdt, i)) != NULL; i++) {
+                if (fdt64_ld(&re->size) == 0)
+                        return i;
+        }
+        return -FDT_ERR_TRUNCATED;
 }
 
 static int nextprop_(const void *fdt, int offset)
@@ -161,7 +237,7 @@ int fdt_subnode_offset_namelen(const void *fdt, int offset,
 {
         int depth;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         for (depth = 0;
              (offset >= 0) && (depth >= 0);
@@ -187,7 +263,7 @@ int fdt_path_offset_namelen(const void *fdt, const char *path, int namelen)
         const char *p = path;
         int offset = 0;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         /* see if we have an alias */
         if (*path != '/') {
@@ -237,7 +313,7 @@ const char *fdt_get_name(const void *fdt, int nodeoffset, int *len)
         const char *nameptr;
         int err;
 
-        if (((err = fdt_check_header(fdt)) != 0)
+        if (((err = fdt_ro_probe_(fdt)) != 0)
             || ((err = fdt_check_node_offset_(fdt, nodeoffset)) < 0))
                         goto fail;
 
@@ -303,7 +379,7 @@ static const struct fdt_property *fdt_get_property_by_offset_(const void *fdt,
         prop = fdt_offset_ptr_(fdt, offset);
 
         if (lenp)
-                *lenp = fdt32_to_cpu(prop->len);
+                *lenp = fdt32_ld(&prop->len);
 
         return prop;
 }
@@ -340,7 +416,7 @@ static const struct fdt_property *fdt_get_property_namelen_(const void *fdt,
                         offset = -FDT_ERR_INTERNAL;
                         break;
                 }
-                if (fdt_string_eq_(fdt, fdt32_to_cpu(prop->nameoff),
+                if (fdt_string_eq_(fdt, fdt32_ld(&prop->nameoff),
                                    name, namelen)) {
                         if (poffset)
                                 *poffset = offset;
@@ -393,7 +469,7 @@ const void *fdt_getprop_namelen(const void *fdt, int nodeoffset,
 
         /* Handle realignment */
         if (fdt_version(fdt) < 0x10 && (poffset + sizeof(*prop)) % 8 &&
-            fdt32_to_cpu(prop->len) >= 8)
+            fdt32_ld(&prop->len) >= 8)
                 return prop->data + 4;
         return prop->data;
 }
@@ -406,12 +482,22 @@ const void *fdt_getprop_by_offset(const void *fdt, int offset,
         prop = fdt_get_property_by_offset_(fdt, offset, lenp);
         if (!prop)
                 return NULL;
-        if (namep)
-                *namep = fdt_string(fdt, fdt32_to_cpu(prop->nameoff));
+        if (namep) {
+                const char *name;
+                int namelen;
+                name = fdt_get_string(fdt, fdt32_ld(&prop->nameoff),
+                                      &namelen);
+                if (!name) {
+                        if (lenp)
+                                *lenp = namelen;
+                        return NULL;
+                }
+                *namep = name;
+        }
 
         /* Handle realignment */
         if (fdt_version(fdt) < 0x10 && (offset + sizeof(*prop)) % 8 &&
-            fdt32_to_cpu(prop->len) >= 8)
+            fdt32_ld(&prop->len) >= 8)
                 return prop->data + 4;
         return prop->data;
 }
@@ -436,7 +522,7 @@ uint32_t fdt_get_phandle(const void *fdt, int nodeoffset)
                         return 0;
         }
 
-        return fdt32_to_cpu(*php);
+        return fdt32_ld(php);
 }
 
 const char *fdt_get_alias_namelen(const void *fdt,
@@ -462,7 +548,7 @@ int fdt_get_path(const void *fdt, int nodeoffset, char *buf, int buflen)
         int offset, depth, namelen;
         const char *name;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         if (buflen < 2)
                 return -FDT_ERR_NOSPACE;
@@ -514,7 +600,7 @@ int fdt_supernode_atdepth_offset(const void *fdt, int nodeoffset,
         int offset, depth;
         int supernodeoffset = -FDT_ERR_INTERNAL;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         if (supernodedepth < 0)
                 return -FDT_ERR_NOTFOUND;
@@ -573,7 +659,7 @@ int fdt_node_offset_by_prop_value(const void *fdt, int startoffset,
         const void *val;
         int len;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         /* FIXME: The algorithm here is pretty horrible: we scan each
          * property of a node in fdt_getprop(), then if that didn't
@@ -599,7 +685,7 @@ int fdt_node_offset_by_phandle(const void *fdt, uint32_t phandle)
         if ((phandle == 0) || (phandle == -1))
                 return -FDT_ERR_BADPHANDLE;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         /* FIXME: The algorithm here is pretty horrible: we
          * potentially scan each property of a node in
@@ -752,7 +838,7 @@ int fdt_node_offset_by_compatible(const void *fdt, int startoffset,
 {
         int offset, err;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         /* FIXME: The algorithm here is pretty horrible: we scan each
          * property of a node in fdt_node_check_compatible(), then if
@@ -771,3 +857,66 @@ int fdt_node_offset_by_compatible(const void *fdt, int startoffset,
 
         return offset; /* error from fdt_next_node() */
 }
+
+int fdt_check_full(const void *fdt, size_t bufsize)
+{
+        int err;
+        int num_memrsv;
+        int offset, nextoffset = 0;
+        uint32_t tag;
+        unsigned depth = 0;
+        const void *prop;
+        const char *propname;
+
+        if (bufsize < FDT_V1_SIZE)
+                return -FDT_ERR_TRUNCATED;
+        err = fdt_check_header(fdt);
+        if (err != 0)
+                return err;
+        if (bufsize < fdt_totalsize(fdt))
+                return -FDT_ERR_TRUNCATED;
+
+        num_memrsv = fdt_num_mem_rsv(fdt);
+        if (num_memrsv < 0)
+                return num_memrsv;
+
+        while (1) {
+                offset = nextoffset;
+                tag = fdt_next_tag(fdt, offset, &nextoffset);
+
+                if (nextoffset < 0)
+                        return nextoffset;
+
+                switch (tag) {
+                case FDT_NOP:
+                        break;
+
+                case FDT_END:
+                        if (depth != 0)
+                                return -FDT_ERR_BADSTRUCTURE;
+                        return 0;
+
+                case FDT_BEGIN_NODE:
+                        depth++;
+                        if (depth > INT_MAX)
+                                return -FDT_ERR_BADSTRUCTURE;
+                        break;
+
+                case FDT_END_NODE:
+                        if (depth == 0)
+                                return -FDT_ERR_BADSTRUCTURE;
+                        depth--;
+                        break;
+
+                case FDT_PROP:
+                        prop = fdt_getprop_by_offset(fdt, offset, &propname,
+                                                     &err);
+                        if (!prop)
+                                return err;
+                        break;
+
+                default:
+                        return -FDT_ERR_INTERNAL;
+                }
+        }
+}
diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c
index 9b829051e444..2e49855d7cf8 100644
--- a/scripts/dtc/libfdt/fdt_rw.c
+++ b/scripts/dtc/libfdt/fdt_rw.c
@@ -67,9 +67,9 @@ static int fdt_blocks_misordered_(const void *fdt,
                     (fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt)));
 }
 
-static int fdt_rw_check_header_(void *fdt)
+static int fdt_rw_probe_(void *fdt)
 {
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         if (fdt_version(fdt) < 17)
                 return -FDT_ERR_BADVERSION;
@@ -82,10 +82,10 @@ static int fdt_rw_check_header_(void *fdt)
         return 0;
 }
 
-#define FDT_RW_CHECK_HEADER(fdt) \
+#define FDT_RW_PROBE(fdt) \
         { \
                 int err_; \
-                if ((err_ = fdt_rw_check_header_(fdt)) != 0) \
+                if ((err_ = fdt_rw_probe_(fdt)) != 0) \
                         return err_; \
         }
 
@@ -176,7 +176,7 @@ int fdt_add_mem_rsv(void *fdt, uint64_t address, uint64_t size)
         struct fdt_reserve_entry *re;
         int err;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         re = fdt_mem_rsv_w_(fdt, fdt_num_mem_rsv(fdt));
         err = fdt_splice_mem_rsv_(fdt, re, 0, 1);
@@ -192,7 +192,7 @@ int fdt_del_mem_rsv(void *fdt, int n)
 {
         struct fdt_reserve_entry *re = fdt_mem_rsv_w_(fdt, n);
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         if (n >= fdt_num_mem_rsv(fdt))
                 return -FDT_ERR_NOTFOUND;
@@ -252,7 +252,7 @@ int fdt_set_name(void *fdt, int nodeoffset, const char *name)
         int oldlen, newlen;
         int err;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         namep = (char *)(uintptr_t)fdt_get_name(fdt, nodeoffset, &oldlen);
         if (!namep)
@@ -275,7 +275,7 @@ int fdt_setprop_placeholder(void *fdt, int nodeoffset, const char *name,
         struct fdt_property *prop;
         int err;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         err = fdt_resize_property_(fdt, nodeoffset, name, len, &prop);
         if (err == -FDT_ERR_NOTFOUND)
@@ -308,7 +308,7 @@ int fdt_appendprop(void *fdt, int nodeoffset, const char *name,
         struct fdt_property *prop;
         int err, oldlen, newlen;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         prop = fdt_get_property_w(fdt, nodeoffset, name, &oldlen);
         if (prop) {
@@ -334,7 +334,7 @@ int fdt_delprop(void *fdt, int nodeoffset, const char *name)
         struct fdt_property *prop;
         int len, proplen;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         prop = fdt_get_property_w(fdt, nodeoffset, name, &len);
         if (!prop)
@@ -354,7 +354,7 @@ int fdt_add_subnode_namelen(void *fdt, int parentoffset,
         uint32_t tag;
         fdt32_t *endtag;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         offset = fdt_subnode_offset_namelen(fdt, parentoffset, name, namelen);
         if (offset >= 0)
@@ -394,7 +394,7 @@ int fdt_del_node(void *fdt, int nodeoffset)
 {
         int endoffset;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         endoffset = fdt_node_end_offset_(fdt, nodeoffset);
         if (endoffset < 0)
@@ -435,7 +435,7 @@ int fdt_open_into(const void *fdt, void *buf, int bufsize)
         const char *fdtend = fdtstart + fdt_totalsize(fdt);
         char *tmp;
 
-        FDT_CHECK_HEADER(fdt);
+        FDT_RO_PROBE(fdt);
 
         mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
                 * sizeof(struct fdt_reserve_entry);
@@ -494,7 +494,7 @@ int fdt_pack(void *fdt)
 {
         int mem_rsv_size;
 
-        FDT_RW_CHECK_HEADER(fdt);
+        FDT_RW_PROBE(fdt);
 
         mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
                 * sizeof(struct fdt_reserve_entry);
diff --git a/scripts/dtc/libfdt/fdt_sw.c b/scripts/dtc/libfdt/fdt_sw.c
index 6d33cc29d022..9fa4a94d83c3 100644
--- a/scripts/dtc/libfdt/fdt_sw.c
+++ b/scripts/dtc/libfdt/fdt_sw.c
@@ -55,21 +55,77 @@
 
 #include "libfdt_internal.h"
 
-static int fdt_sw_check_header_(void *fdt)
+static int fdt_sw_probe_(void *fdt)
 {
-        if (fdt_magic(fdt) != FDT_SW_MAGIC)
+        if (fdt_magic(fdt) == FDT_MAGIC)
+                return -FDT_ERR_BADSTATE;
+        else if (fdt_magic(fdt) != FDT_SW_MAGIC)
                 return -FDT_ERR_BADMAGIC;
-        /* FIXME: should check more details about the header state */
         return 0;
 }
 
-#define FDT_SW_CHECK_HEADER(fdt) \
+#define FDT_SW_PROBE(fdt) \
+        { \
+                int err; \
+                if ((err = fdt_sw_probe_(fdt)) != 0) \
+                        return err; \
+        }
+
+/* 'memrsv' state:      Initial state after fdt_create()
+ *
+ * Allowed functions:
+ *      fdt_add_reservmap_entry()
+ *      fdt_finish_reservemap()         [moves to 'struct' state]
+ */
+static int fdt_sw_probe_memrsv_(void *fdt)
+{
+        int err = fdt_sw_probe_(fdt);
+        if (err)
+                return err;
+
+        if (fdt_off_dt_strings(fdt) != 0)
+                return -FDT_ERR_BADSTATE;
+        return 0;
+}
+
+#define FDT_SW_PROBE_MEMRSV(fdt) \
+        { \
+                int err; \
+                if ((err = fdt_sw_probe_memrsv_(fdt)) != 0) \
+                        return err; \
+        }
+
+/* 'struct' state:      Enter this state after fdt_finish_reservemap()
+ *
+ * Allowed functions:
+ *      fdt_begin_node()
+ *      fdt_end_node()
+ *      fdt_property*()
+ *      fdt_finish()                    [moves to 'complete' state]
+ */
+static int fdt_sw_probe_struct_(void *fdt)
+{
+        int err = fdt_sw_probe_(fdt);
+        if (err)
+                return err;
+
+        if (fdt_off_dt_strings(fdt) != fdt_totalsize(fdt))
+                return -FDT_ERR_BADSTATE;
+        return 0;
+}
+
+#define FDT_SW_PROBE_STRUCT(fdt) \
         { \
                 int err; \
-                if ((err = fdt_sw_check_header_(fdt)) != 0) \
+                if ((err = fdt_sw_probe_struct_(fdt)) != 0) \
                         return err; \
         }
 
+/* 'complete' state:    Enter this state after fdt_finish()
+ *
+ * Allowed functions: none
+ */
+
 static void *fdt_grab_space_(void *fdt, size_t len)
 {
         int offset = fdt_size_dt_struct(fdt);
@@ -87,9 +143,11 @@ static void *fdt_grab_space_(void *fdt, size_t len)
 
 int fdt_create(void *buf, int bufsize)
 {
+        const size_t hdrsize = FDT_ALIGN(sizeof(struct fdt_header),
+                                         sizeof(struct fdt_reserve_entry));
         void *fdt = buf;
 
-        if (bufsize < sizeof(struct fdt_header))
+        if (bufsize < hdrsize)
                 return -FDT_ERR_NOSPACE;
 
         memset(buf, 0, bufsize);
@@ -99,10 +157,9 @@ int fdt_create(void *buf, int bufsize)
         fdt_set_last_comp_version(fdt, FDT_FIRST_SUPPORTED_VERSION);
         fdt_set_totalsize(fdt,  bufsize);
 
-        fdt_set_off_mem_rsvmap(fdt, FDT_ALIGN(sizeof(struct fdt_header),
-                                              sizeof(struct fdt_reserve_entry)));
+        fdt_set_off_mem_rsvmap(fdt, hdrsize);
         fdt_set_off_dt_struct(fdt, fdt_off_mem_rsvmap(fdt));
-        fdt_set_off_dt_strings(fdt, bufsize);
+        fdt_set_off_dt_strings(fdt, 0);
 
         return 0;
 }
@@ -112,11 +169,14 @@ int fdt_resize(void *fdt, void *buf, int bufsize)
         size_t headsize, tailsize;
         char *oldtail, *newtail;
 
-        FDT_SW_CHECK_HEADER(fdt);
+        FDT_SW_PROBE(fdt);
 
-        headsize = fdt_off_dt_struct(fdt);
+        headsize = fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt);
         tailsize = fdt_size_dt_strings(fdt);
 
+        if ((headsize + tailsize) > fdt_totalsize(fdt))
+                return -FDT_ERR_INTERNAL;
+
         if ((headsize + tailsize) > bufsize)
                 return -FDT_ERR_NOSPACE;
 
@@ -133,8 +193,9 @@ int fdt_resize(void *fdt, void *buf, int bufsize)
                 memmove(buf, fdt, headsize);
         }
 
-        fdt_set_off_dt_strings(buf, bufsize);
         fdt_set_totalsize(buf, bufsize);
+        if (fdt_off_dt_strings(buf))
+                fdt_set_off_dt_strings(buf, bufsize);
 
         return 0;
 }
@@ -144,10 +205,7 @@ int fdt_add_reservemap_entry(void *fdt, uint64_t addr, uint64_t size)
         struct fdt_reserve_entry *re;
         int offset;
 
-        FDT_SW_CHECK_HEADER(fdt);
-
-        if (fdt_size_dt_struct(fdt))
-                return -FDT_ERR_BADSTATE;
+        FDT_SW_PROBE_MEMRSV(fdt);
 
         offset = fdt_off_dt_struct(fdt);
         if ((offset + sizeof(*re)) > fdt_totalsize(fdt))
@@ -164,16 +222,23 @@ int fdt_add_reservemap_entry(void *fdt, uint64_t addr, uint64_t size)
 
 int fdt_finish_reservemap(void *fdt)
 {
-        return fdt_add_reservemap_entry(fdt, 0, 0);
+        int err = fdt_add_reservemap_entry(fdt, 0, 0);
+
+        if (err)
+                return err;
+
+        fdt_set_off_dt_strings(fdt, fdt_totalsize(fdt));
+        return 0;
 }
 
 int fdt_begin_node(void *fdt, const char *name)
 {
         struct fdt_node_header *nh;
-        int namelen = strlen(name) + 1;
+        int namelen;
 
-        FDT_SW_CHECK_HEADER(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
+        namelen = strlen(name) + 1;
         nh = fdt_grab_space_(fdt, sizeof(*nh) + FDT_TAGALIGN(namelen));
         if (! nh)
                 return -FDT_ERR_NOSPACE;
@@ -187,7 +252,7 @@ int fdt_end_node(void *fdt)
 {
         fdt32_t *en;
 
-        FDT_SW_CHECK_HEADER(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
         en = fdt_grab_space_(fdt, FDT_TAGSIZE);
         if (! en)
@@ -225,7 +290,7 @@ int fdt_property_placeholder(void *fdt, const char *name, int len, void **valp)
         struct fdt_property *prop;
         int nameoff;
 
-        FDT_SW_CHECK_HEADER(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
         nameoff = fdt_find_add_string_(fdt, name);
         if (nameoff == 0)
@@ -262,7 +327,7 @@ int fdt_finish(void *fdt)
         uint32_t tag;
         int offset, nextoffset;
 
-        FDT_SW_CHECK_HEADER(fdt);
+        FDT_SW_PROBE_STRUCT(fdt);
 
         /* Add terminator */
         end = fdt_grab_space_(fdt, sizeof(*end));
diff --git a/scripts/dtc/libfdt/libfdt.h b/scripts/dtc/libfdt/libfdt.h
index 1e27780e1185..2bd151dd355f 100644
--- a/scripts/dtc/libfdt/libfdt.h
+++ b/scripts/dtc/libfdt/libfdt.h
@@ -90,8 +90,9 @@
 
 /* Error codes: codes for bad device tree blobs */
 #define FDT_ERR_TRUNCATED       8
-        /* FDT_ERR_TRUNCATED: Structure block of the given device tree
-         * ends without an FDT_END tag. */
+        /* FDT_ERR_TRUNCATED: FDT or a sub-block is improperly
+         * terminated (overflows, goes outside allowed bounds, or
+         * isn't properly terminated).  */
 #define FDT_ERR_BADMAGIC        9
         /* FDT_ERR_BADMAGIC: Given "device tree" appears not to be a
          * device tree at all - it is missing the flattened device
@@ -153,6 +154,29 @@ static inline void *fdt_offset_ptr_w(void *fdt, int offset, int checklen)
 
 uint32_t fdt_next_tag(const void *fdt, int offset, int *nextoffset);
 
+/*
+ * Alignment helpers:
+ *     These helpers access words from a device tree blob.  They're
+ *     built to work even with unaligned pointers on platforms (ike
+ *     ARM) that don't like unaligned loads and stores
+ */
+
+static inline uint32_t fdt32_ld(const fdt32_t *p)
+{
+        fdt32_t v;
+
+        memcpy(&v, p, sizeof(v));
+        return fdt32_to_cpu(v);
+}
+
+static inline uint64_t fdt64_ld(const fdt64_t *p)
+{
+        fdt64_t v;
+
+        memcpy(&v, p, sizeof(v));
+        return fdt64_to_cpu(v);
+}
+
 /**********************************************************************/
 /* Traversal functions                                                */
 /**********************************************************************/
@@ -213,7 +237,7 @@ int fdt_next_subnode(const void *fdt, int offset);
 /* General functions                                                  */
 /**********************************************************************/
 #define fdt_get_header(fdt, field) \
-        (fdt32_to_cpu(((const struct fdt_header *)(fdt))->field))
+        (fdt32_ld(&((const struct fdt_header *)(fdt))->field))
 #define fdt_magic(fdt)                  (fdt_get_header(fdt, magic))
 #define fdt_totalsize(fdt)              (fdt_get_header(fdt, totalsize))
 #define fdt_off_dt_struct(fdt)          (fdt_get_header(fdt, off_dt_struct))
@@ -244,18 +268,31 @@ fdt_set_hdr_(size_dt_struct);
 #undef fdt_set_hdr_
 
 /**
- * fdt_check_header - sanity check a device tree or possible device tree
+ * fdt_header_size - return the size of the tree's header
+ * @fdt: pointer to a flattened device tree
+ */
+size_t fdt_header_size_(uint32_t version);
+static inline size_t fdt_header_size(const void *fdt)
+{
+        return fdt_header_size_(fdt_version(fdt));
+}
+
+/**
+ * fdt_check_header - sanity check a device tree header
+
  * @fdt: pointer to data which might be a flattened device tree
  *
  * fdt_check_header() checks that the given buffer contains what
- * appears to be a flattened device tree with sane information in its
- * header.
+ * appears to be a flattened device tree, and that the header contains
+ * valid information (to the extent that can be determined from the
+ * header alone).
  *
  * returns:
  *     0, if the buffer appears to contain a valid device tree
  *     -FDT_ERR_BADMAGIC,
  *     -FDT_ERR_BADVERSION,
- *     -FDT_ERR_BADSTATE, standard meanings, as above
+ *     -FDT_ERR_BADSTATE,
+ *     -FDT_ERR_TRUNCATED, standard meanings, as above
  */
 int fdt_check_header(const void *fdt);
 
@@ -284,6 +321,24 @@ int fdt_move(const void *fdt, void *buf, int bufsize);
 /* Read-only functions                                                */
 /**********************************************************************/
 
+int fdt_check_full(const void *fdt, size_t bufsize);
+
+/**
+ * fdt_get_string - retrieve a string from the strings block of a device tree
+ * @fdt: pointer to the device tree blob
+ * @stroffset: offset of the string within the strings block (native endian)
+ * @lenp: optional pointer to return the string's length
+ *
+ * fdt_get_string() retrieves a pointer to a single string from the
+ * strings block of the device tree blob at fdt, and optionally also
+ * returns the string's length in *lenp.
+ *
+ * returns:
+ *     a pointer to the string, on success
+ *     NULL, if stroffset is out of bounds, or doesn't point to a valid string
+ */
+const char *fdt_get_string(const void *fdt, int stroffset, int *lenp);
+
 /**
  * fdt_string - retrieve a string from the strings block of a device tree
  * @fdt: pointer to the device tree blob
@@ -294,7 +349,7 @@ int fdt_move(const void *fdt, void *buf, int bufsize);
  *
  * returns:
  *     a pointer to the string, on success
- *     NULL, if stroffset is out of bounds
+ *     NULL, if stroffset is out of bounds, or doesn't point to a valid string
  */
 const char *fdt_string(const void *fdt, int stroffset);
 
@@ -1090,7 +1145,7 @@ int fdt_address_cells(const void *fdt, int nodeoffset);
  *
  * returns:
  *      0 <= n < FDT_MAX_NCELLS, on success
- *      2, if the node has no #address-cells property
+ *      2, if the node has no #size-cells property
  *      -FDT_ERR_BADNCELLS, if the node has a badly formatted or invalid
  *              #size-cells property
  *      -FDT_ERR_BADMAGIC,
@@ -1313,10 +1368,13 @@ static inline int fdt_property_u64(void *fdt, const char *name, uint64_t val)
         fdt64_t tmp = cpu_to_fdt64(val);
         return fdt_property(fdt, name, &tmp, sizeof(tmp));
 }
+
+#ifndef SWIG /* Not available in Python */
 static inline int fdt_property_cell(void *fdt, const char *name, uint32_t val)
 {
         return fdt_property_u32(fdt, name, val);
 }
+#endif
 
 /**
  * fdt_property_placeholder - add a new property and return a ptr to its value
diff --git a/scripts/dtc/libfdt/libfdt_env.h b/scripts/dtc/libfdt/libfdt_env.h
index bd2474628775..eb2053845c9c 100644
--- a/scripts/dtc/libfdt/libfdt_env.h
+++ b/scripts/dtc/libfdt/libfdt_env.h
@@ -56,6 +56,7 @@
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 
 #ifdef __CHECKER__
 #define FDT_FORCE __attribute__((force))
diff --git a/scripts/dtc/libfdt/libfdt_internal.h b/scripts/dtc/libfdt/libfdt_internal.h
index 7681e192295b..4109f890ae60 100644
--- a/scripts/dtc/libfdt/libfdt_internal.h
+++ b/scripts/dtc/libfdt/libfdt_internal.h
@@ -55,10 +55,11 @@
 #define FDT_ALIGN(x, a)         (((x) + (a) - 1) & ~((a) - 1))
 #define FDT_TAGALIGN(x)         (FDT_ALIGN((x), FDT_TAGSIZE))
 
-#define FDT_CHECK_HEADER(fdt) \
+int fdt_ro_probe_(const void *fdt);
+#define FDT_RO_PROBE(fdt)                       \
         { \
                 int err_; \
-                if ((err_ = fdt_check_header(fdt)) != 0) \
+                if ((err_ = fdt_ro_probe_(fdt)) != 0)   \
                         return err_; \
         }
 
diff --git a/scripts/dtc/livetree.c b/scripts/dtc/livetree.c
index 6e4c367f54b3..4ff0679e0062 100644
--- a/scripts/dtc/livetree.c
+++ b/scripts/dtc/livetree.c
@@ -594,6 +594,7 @@ struct node *get_node_by_ref(struct node *tree, const char *ref)
 cell_t get_node_phandle(struct node *root, struct node *node)
 {
         static cell_t phandle = 1; /* FIXME: ick, static local */
+        struct data d = empty_data;
 
         if ((node->phandle != 0) && (node->phandle != -1))
                 return node->phandle;
@@ -603,17 +604,16 @@ cell_t get_node_phandle(struct node *root, struct node *node)
 
         node->phandle = phandle;
 
+        d = data_add_marker(d, TYPE_UINT32, NULL);
+        d = data_append_cell(d, phandle);
+
         if (!get_property(node, "linux,phandle")
             && (phandle_format & PHANDLE_LEGACY))
-                add_property(node,
-                             build_property("linux,phandle",
-                                            data_append_cell(empty_data, phandle)));
+                add_property(node, build_property("linux,phandle", d));
 
         if (!get_property(node, "phandle")
             && (phandle_format & PHANDLE_EPAPR))
-                add_property(node,
-                             build_property("phandle",
-                                            data_append_cell(empty_data, phandle)));
+                add_property(node, build_property("phandle", d));
 
         /* If the node *does* have a phandle property, we must
          * be dealing with a self-referencing phandle, which will be
diff --git a/scripts/dtc/treesource.c b/scripts/dtc/treesource.c
index 2461a3d068a0..f2874f1d1465 100644
--- a/scripts/dtc/treesource.c
+++ b/scripts/dtc/treesource.c
@@ -61,24 +61,14 @@ static bool isstring(char c)
                 || strchr("\a\b\t\n\v\f\r", c));
 }
 
-static void write_propval_string(FILE *f, struct data val)
+static void write_propval_string(FILE *f, const char *s, size_t len)
 {
-        const char *str = val.val;
-        int i;
-        struct marker *m = val.markers;
-
-        assert(str[val.len-1] == '\0');
+        const char *end = s + len - 1;
+        assert(*end == '\0');
 
-        while (m && (m->offset == 0)) {
-                if (m->type == LABEL)
-                        fprintf(f, "%s: ", m->ref);
-                m = m->next;
-        }
         fprintf(f, "\"");
-
-        for (i = 0; i < (val.len-1); i++) {
-                char c = str[i];
-
+        while (s < end) {
+                char c = *s++;
                 switch (c) {
                 case '\a':
                         fprintf(f, "\\a");
@@ -108,91 +98,78 @@ static void write_propval_string(FILE *f, struct data val)
                         fprintf(f, "\\\"");
                         break;
                 case '\0':
-                        fprintf(f, "\", ");
-                        while (m && (m->offset <= (i + 1))) {
-                                if (m->type == LABEL) {
-                                        assert(m->offset == (i+1));
-                                        fprintf(f, "%s: ", m->ref);
-                                }
-                                m = m->next;
-                        }
-                        fprintf(f, "\"");
+                        fprintf(f, "\\0");
                         break;
                 default:
                         if (isprint((unsigned char)c))
                                 fprintf(f, "%c", c);
                         else
-                                fprintf(f, "\\x%02hhx", c);
+                                fprintf(f, "\\x%02"PRIx8, c);
                 }
         }
         fprintf(f, "\"");
-
-        /* Wrap up any labels at the end of the value */
-        for_each_marker_of_type(m, LABEL) {
-                assert (m->offset == val.len);
-                fprintf(f, " %s:", m->ref);
-        }
 }
 
-static void write_propval_cells(FILE *f, struct data val)
+static void write_propval_int(FILE *f, const char *p, size_t len, size_t width)
 {
-        void *propend = val.val + val.len;
-        fdt32_t *cp = (fdt32_t *)val.val;
-        struct marker *m = val.markers;
-
-        fprintf(f, "<");
-        for (;;) {
-                while (m && (m->offset <= ((char *)cp - val.val))) {
-                        if (m->type == LABEL) {
-                                assert(m->offset == ((char *)cp - val.val));
-                                fprintf(f, "%s: ", m->ref);
-                        }
-                        m = m->next;
-                }
+        const char *end = p + len;
+        assert(len % width == 0);
 
-                fprintf(f, "0x%x", fdt32_to_cpu(*cp++));
-                if ((void *)cp >= propend)
+        for (; p < end; p += width) {
+                switch (width) {
+                case 1:
+                        fprintf(f, " %02"PRIx8, *(const uint8_t*)p);
+                        break;
+                case 2:
+                        fprintf(f, " 0x%02"PRIx16, fdt16_to_cpu(*(const fdt16_t*)p));
+                        break;
+                case 4:
+                        fprintf(f, " 0x%02"PRIx32, fdt32_to_cpu(*(const fdt32_t*)p));
+                        break;
+                case 8:
+                        fprintf(f, " 0x%02"PRIx64, fdt64_to_cpu(*(const fdt64_t*)p));
                         break;
-                fprintf(f, " ");
+                }
         }
+}
 
-        /* Wrap up any labels at the end of the value */
-        for_each_marker_of_type(m, LABEL) {
-                assert (m->offset == val.len);
-                fprintf(f, " %s:", m->ref);
-        }
-        fprintf(f, ">");
+static bool has_data_type_information(struct marker *m)
+{
+        return m->type >= TYPE_UINT8;
 }
 
-static void write_propval_bytes(FILE *f, struct data val)
+static struct marker *next_type_marker(struct marker *m)
 {
-        void *propend = val.val + val.len;
-        const char *bp = val.val;
-        struct marker *m = val.markers;
-
-        fprintf(f, "[");
-        for (;;) {
-                while (m && (m->offset == (bp-val.val))) {
-                        if (m->type == LABEL)
-                                fprintf(f, "%s: ", m->ref);
-                        m = m->next;
-                }
+        while (m && !has_data_type_information(m))
+                m = m->next;
+        return m;
+}
 
-                fprintf(f, "%02hhx", (unsigned char)(*bp++));
-                if ((const void *)bp >= propend)
-                        break;
-                fprintf(f, " ");
-        }
+size_t type_marker_length(struct marker *m)
+{
+        struct marker *next = next_type_marker(m->next);
 
-        /* Wrap up any labels at the end of the value */
-        for_each_marker_of_type(m, LABEL) {
-                assert (m->offset == val.len);
-                fprintf(f, " %s:", m->ref);
-        }
-        fprintf(f, "]");
+        if (next)
+                return next->offset - m->offset;
+        return 0;
 }
 
-static void write_propval(FILE *f, struct property *prop)
+static const char *delim_start[] = {
+        [TYPE_UINT8] = "[",
+        [TYPE_UINT16] = "/bits/ 16 <",
+        [TYPE_UINT32] = "<",
+        [TYPE_UINT64] = "/bits/ 64 <",
+        [TYPE_STRING] = "",
+};
+static const char *delim_end[] = {
+        [TYPE_UINT8] = " ]",
+        [TYPE_UINT16] = " >",
+        [TYPE_UINT32] = " >",
+        [TYPE_UINT64] = " >",
+        [TYPE_STRING] = "",
+};
+
+static enum markertype guess_value_type(struct property *prop)
 {
         int len = prop->val.len;
         const char *p = prop->val.val;
@@ -201,11 +178,6 @@ static void write_propval(FILE *f, struct property *prop)
         int nnotstringlbl = 0, nnotcelllbl = 0;
         int i;
 
-        if (len == 0) {
-                fprintf(f, ";\n");
-                return;
-        }
-
         for (i = 0; i < len; i++) {
                 if (! isstring(p[i]))
                         nnotstring++;
@@ -220,17 +192,91 @@ static void write_propval(FILE *f, struct property *prop)
                         nnotcelllbl++;
         }
 
-        fprintf(f, " = ");
         if ((p[len-1] == '\0') && (nnotstring == 0) && (nnul < (len-nnul))
             && (nnotstringlbl == 0)) {
-                write_propval_string(f, prop->val);
+                return TYPE_STRING;
         } else if (((len % sizeof(cell_t)) == 0) && (nnotcelllbl == 0)) {
-                write_propval_cells(f, prop->val);
-        } else {
-                write_propval_bytes(f, prop->val);
+                return TYPE_UINT32;
         }
 
-        fprintf(f, ";\n");
+        return TYPE_UINT8;
+}
+
+static void write_propval(FILE *f, struct property *prop)
+{
+        size_t len = prop->val.len;
+        struct marker *m = prop->val.markers;
+        struct marker dummy_marker;
+        enum markertype emit_type = TYPE_NONE;
+
+        if (len == 0) {
+                fprintf(f, ";\n");
+                return;
+        }
+
+        fprintf(f, " = ");
+
+        if (!next_type_marker(m)) {
+                /* data type information missing, need to guess */
+                dummy_marker.type = guess_value_type(prop);
+                dummy_marker.next = prop->val.markers;
+                dummy_marker.offset = 0;
+                dummy_marker.ref = NULL;
+                m = &dummy_marker;
+        }
+
+        struct marker *m_label = prop->val.markers;
+        for_each_marker(m) {
+                size_t chunk_len;
+                const char *p = &prop->val.val[m->offset];
+
+                if (!has_data_type_information(m))
+                        continue;
+
+                chunk_len = type_marker_length(m);
+                if (!chunk_len)
+                        chunk_len = len - m->offset;
+
+                if (emit_type != TYPE_NONE)
+                        fprintf(f, "%s, ", delim_end[emit_type]);
+                emit_type = m->type;
+
+                for_each_marker_of_type(m_label, LABEL) {
+                        if (m_label->offset > m->offset)
+                                break;
+                        fprintf(f, "%s: ", m_label->ref);
+                }
+
+                fprintf(f, "%s", delim_start[emit_type]);
+
+                if (chunk_len <= 0)
+                        continue;
+
+                switch(emit_type) {
+                case TYPE_UINT16:
+                        write_propval_int(f, p, chunk_len, 2);
+                        break;
+                case TYPE_UINT32:
+                        write_propval_int(f, p, chunk_len, 4);
+                        break;
+                case TYPE_UINT64:
+                        write_propval_int(f, p, chunk_len, 8);
+                        break;
+                case TYPE_STRING:
+                        write_propval_string(f, p, chunk_len);
+                        break;
+                default:
+                        write_propval_int(f, p, chunk_len, 1);
+                }
+        }
+
+        /* Wrap up any labels at the end of the value */
+        for_each_marker_of_type(m_label, LABEL) {
+                assert (m_label->offset == len);
+                fprintf(f, " %s:", m_label->ref);
+        }
+
+        fprintf(f, "%s;\n", delim_end[emit_type] ? : "");
 }
 
 static void write_tree_source_node(FILE *f, struct node *tree, int level)
@@ -281,4 +327,3 @@ void dt_to_source(FILE *f, struct dt_info *dti)
 
         write_tree_source_node(f, dti->dt, 0);
 }
-
diff --git a/scripts/dtc/update-dtc-source.sh b/scripts/dtc/update-dtc-source.sh
index 1a009fd195d0..7dd29a0362b8 100755
--- a/scripts/dtc/update-dtc-source.sh
+++ b/scripts/dtc/update-dtc-source.sh
@@ -32,7 +32,7 @@ DTC_UPSTREAM_PATH=`pwd`/../dtc
 DTC_LINUX_PATH=`pwd`/scripts/dtc
 
 DTC_SOURCE="checks.c data.c dtc.c dtc.h flattree.c fstree.c livetree.c srcpos.c \
-                srcpos.h treesource.c util.c util.h version_gen.h Makefile.dtc \
+                srcpos.h treesource.c util.c util.h version_gen.h yamltree.c Makefile.dtc \
                 dtc-lexer.l dtc-parser.y"
 LIBFDT_SOURCE="Makefile.libfdt fdt.c fdt.h fdt_addresses.c fdt_empty_tree.c \
                 fdt_overlay.c fdt_ro.c fdt_rw.c fdt_strerror.c fdt_sw.c \
diff --git a/scripts/dtc/util.c b/scripts/dtc/util.c
index 9953c32a0244..a69b7a13463d 100644
--- a/scripts/dtc/util.c
+++ b/scripts/dtc/util.c
@@ -227,11 +227,11 @@ char get_escape_char(const char *s, int *i)
         return val;
 }
 
-int utilfdt_read_err_len(const char *filename, char **buffp, off_t *len)
+int utilfdt_read_err(const char *filename, char **buffp, size_t *len)
 {
         int fd = 0;     /* assume stdin */
         char *buf = NULL;
-        off_t bufsize = 1024, offset = 0;
+        size_t bufsize = 1024, offset = 0;
         int ret = 0;
 
         *buffp = NULL;
@@ -264,20 +264,15 @@ int utilfdt_read_err_len(const char *filename, char **buffp, off_t *len)
                 free(buf);
         else
                 *buffp = buf;
-        *len = bufsize;
+        if (len)
+                *len = bufsize;
         return ret;
 }
 
-int utilfdt_read_err(const char *filename, char **buffp)
-{
-        off_t len;
-        return utilfdt_read_err_len(filename, buffp, &len);
-}
-
-char *utilfdt_read_len(const char *filename, off_t *len)
+char *utilfdt_read(const char *filename, size_t *len)
 {
         char *buff;
-        int ret = utilfdt_read_err_len(filename, &buff, len);
+        int ret = utilfdt_read_err(filename, &buff, len);
 
         if (ret) {
                 fprintf(stderr, "Couldn't open blob from '%s': %s\n", filename,
@@ -288,12 +283,6 @@ char *utilfdt_read_len(const char *filename, off_t *len)
         return buff;
 }
 
-char *utilfdt_read(const char *filename)
-{
-        off_t len;
-        return utilfdt_read_len(filename, &len);
-}
-
 int utilfdt_write_err(const char *filename, const void *blob)
 {
         int fd = 1;     /* assume stdout */
diff --git a/scripts/dtc/util.h b/scripts/dtc/util.h
index 66fba8ea709b..f6cea8274174 100644
--- a/scripts/dtc/util.h
+++ b/scripts/dtc/util.h
@@ -98,16 +98,10 @@ char get_escape_char(const char *s, int *i);
  * stderr.
  *
  * @param filename      The filename to read, or - for stdin
- * @return Pointer to allocated buffer containing fdt, or NULL on error
- */
-char *utilfdt_read(const char *filename);
-
-/**
- * Like utilfdt_read(), but also passes back the size of the file read.
- *
  * @param len           If non-NULL, the amount of data we managed to read
+ * @return Pointer to allocated buffer containing fdt, or NULL on error
  */
-char *utilfdt_read_len(const char *filename, off_t *len);
+char *utilfdt_read(const char *filename, size_t *len);
 
 /**
  * Read a device tree file into a buffer. Does not report errors, but only
@@ -116,16 +110,10 @@ char *utilfdt_read_len(const char *filename, off_t *len);
  *
  * @param filename      The filename to read, or - for stdin
  * @param buffp         Returns pointer to buffer containing fdt
- * @return 0 if ok, else an errno value representing the error
- */
-int utilfdt_read_err(const char *filename, char **buffp);
-
-/**
- * Like utilfdt_read_err(), but also passes back the size of the file read.
- *
  * @param len           If non-NULL, the amount of data we managed to read
+ * @return 0 if ok, else an errno value representing the error
  */
-int utilfdt_read_err_len(const char *filename, char **buffp, off_t *len);
+int utilfdt_read_err(const char *filename, char **buffp, size_t *len);
 
 /**
  * Write a device tree buffer to a file. This will report any errors on
diff --git a/scripts/dtc/version_gen.h b/scripts/dtc/version_gen.h
index b00f14ff7a17..6d23fd095f16 100644
--- a/scripts/dtc/version_gen.h
+++ b/scripts/dtc/version_gen.h
@@ -1 +1 @@
-#define DTC_VERSION "DTC 1.4.6-g84e414b0"
+#define DTC_VERSION "DTC 1.4.7-gc86da84d"
diff --git a/scripts/dtc/yamltree.c b/scripts/dtc/yamltree.c
new file mode 100644
index 000000000000..a00285a5a9ec
--- /dev/null
+++ b/scripts/dtc/yamltree.c
@@ -0,0 +1,247 @@
+/*
+ * (C) Copyright Linaro, Ltd. 2018
+ * (C) Copyright Arm Holdings.  2017
+ * (C) Copyright David Gibson <dwg@au1.ibm.com>, IBM Corporation.  2005.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of the
+ * License, or (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
+ *                                                                   USA
+ */
+
+#include <stdlib.h>
+#include <yaml.h>
+#include "dtc.h"
+#include "srcpos.h"
+
+char *yaml_error_name[] = {
+        [YAML_NO_ERROR] = "no error",
+        [YAML_MEMORY_ERROR] = "memory error",
+        [YAML_READER_ERROR] = "reader error",
+        [YAML_SCANNER_ERROR] = "scanner error",
+        [YAML_PARSER_ERROR] = "parser error",
+        [YAML_COMPOSER_ERROR] = "composer error",
+        [YAML_WRITER_ERROR] = "writer error",
+        [YAML_EMITTER_ERROR] = "emitter error",
+};
+
+#define yaml_emitter_emit_or_die(emitter, event) (                      \
+{                                                                       \
+        if (!yaml_emitter_emit(emitter, event))                         \
+                die("yaml '%s': %s in %s, line %i\n",                   \
+                    yaml_error_name[(emitter)->error],                  \
+                    (emitter)->problem, __func__, __LINE__);            \
+})
+
+static void yaml_propval_int(yaml_emitter_t *emitter, struct marker *markers, char *data, int len, int width)
+{
+        yaml_event_t event;
+        void *tag;
+        int off, start_offset = markers->offset;
+
+        switch(width) {
+                case 1: tag = "!u8"; break;
+                case 2: tag = "!u16"; break;
+                case 4: tag = "!u32"; break;
+                case 8: tag = "!u64"; break;
+                default:
+                        die("Invalid width %i", width);
+        }
+        assert(len % width == 0);
+
+        yaml_sequence_start_event_initialize(&event, NULL,
+                (yaml_char_t *)tag, width == 4, YAML_FLOW_SEQUENCE_STYLE);
+        yaml_emitter_emit_or_die(emitter, &event);
+
+        for (off = 0; off < len; off += width) {
+                char buf[32];
+                struct marker *m;
+                bool is_phandle = false;
+
+                switch(width) {
+                case 1:
+                        sprintf(buf, "0x%"PRIx8, *(uint8_t*)(data + off));
+                        break;
+                case 2:
+                        sprintf(buf, "0x%"PRIx16, fdt16_to_cpu(*(fdt16_t*)(data + off)));
+                        break;
+                case 4:
+                        sprintf(buf, "0x%"PRIx32, fdt32_to_cpu(*(fdt32_t*)(data + off)));
+                        m = markers;
+                        is_phandle = false;
+                        for_each_marker_of_type(m, REF_PHANDLE) {
+                                if (m->offset == (start_offset + off)) {
+                                        is_phandle = true;
+                                        break;
+                                }
+                        }
+                        break;
+                case 8:
+                        sprintf(buf, "0x%"PRIx64, fdt64_to_cpu(*(fdt64_t*)(data + off)));
+                        break;
+                }
+
+                if (is_phandle)
+                        yaml_scalar_event_initialize(&event, NULL,
+                                (yaml_char_t*)"!phandle", (yaml_char_t *)buf,
+                                strlen(buf), 0, 0, YAML_PLAIN_SCALAR_STYLE);
+                else
+                        yaml_scalar_event_initialize(&event, NULL,
+                                (yaml_char_t*)YAML_INT_TAG, (yaml_char_t *)buf,
+                                strlen(buf), 1, 1, YAML_PLAIN_SCALAR_STYLE);
+                yaml_emitter_emit_or_die(emitter, &event);
+        }
+
+        yaml_sequence_end_event_initialize(&event);
+        yaml_emitter_emit_or_die(emitter, &event);
+}
+
+static void yaml_propval_string(yaml_emitter_t *emitter, char *str, int len)
+{
+        yaml_event_t event;
+        int i;
+
+        assert(str[len-1] == '\0');
+
+        /* Make sure the entire string is in the lower 7-bit ascii range */
+        for (i = 0; i < len; i++)
+                assert(isascii(str[i]));
+
+        yaml_scalar_event_initialize(&event, NULL,
+                (yaml_char_t *)YAML_STR_TAG, (yaml_char_t*)str,
+                len-1, 0, 1, YAML_DOUBLE_QUOTED_SCALAR_STYLE);
+        yaml_emitter_emit_or_die(emitter, &event);
+}
+
+static void yaml_propval(yaml_emitter_t *emitter, struct property *prop)
+{
+        yaml_event_t event;
+        int len = prop->val.len;
+        struct marker *m = prop->val.markers;
+
+        /* Emit the property name */
+        yaml_scalar_event_initialize(&event, NULL,
+                (yaml_char_t *)YAML_STR_TAG, (yaml_char_t*)prop->name,
+                strlen(prop->name), 1, 1, YAML_PLAIN_SCALAR_STYLE);
+        yaml_emitter_emit_or_die(emitter, &event);
+
+        /* Boolean properties are easiest to deal with. Length is zero, so just emit 'true' */
+        if (len == 0) {
+                yaml_scalar_event_initialize(&event, NULL,
+                        (yaml_char_t *)YAML_BOOL_TAG,
+                        (yaml_char_t*)"true",
+                        strlen("true"), 1, 0, YAML_PLAIN_SCALAR_STYLE);
+                yaml_emitter_emit_or_die(emitter, &event);
+                return;
+        }
+
+        if (!m)
+                die("No markers present in property '%s' value\n", prop->name);
+
+        yaml_sequence_start_event_initialize(&event, NULL,
+                (yaml_char_t *)YAML_SEQ_TAG, 1, YAML_FLOW_SEQUENCE_STYLE);
+        yaml_emitter_emit_or_die(emitter, &event);
+
+        for_each_marker(m) {
+                int chunk_len;
+                char *data = &prop->val.val[m->offset];
+
+                if (m->type < TYPE_UINT8)
+                        continue;
+
+                chunk_len = type_marker_length(m) ? : len;
+                assert(chunk_len > 0);
+                len -= chunk_len;
+
+                switch(m->type) {
+                case TYPE_UINT16:
+                        yaml_propval_int(emitter, m, data, chunk_len, 2);
+                        break;
+                case TYPE_UINT32:
+                        yaml_propval_int(emitter, m, data, chunk_len, 4);
+                        break;
+                case TYPE_UINT64:
+                        yaml_propval_int(emitter, m, data, chunk_len, 8);
+                        break;
+                case TYPE_STRING:
+                        yaml_propval_string(emitter, data, chunk_len);
+                        break;
+                default:
+                        yaml_propval_int(emitter, m, data, chunk_len, 1);
+                        break;
+                }
+        }
+
+        yaml_sequence_end_event_initialize(&event);
+        yaml_emitter_emit_or_die(emitter, &event);
+}
+
+
+static void yaml_tree(struct node *tree, yaml_emitter_t *emitter)
+{
+        struct property *prop;
+        struct node *child;
+        yaml_event_t event;
+
+        if (tree->deleted)
+                return;
+
+        yaml_mapping_start_event_initialize(&event, NULL,
+                (yaml_char_t *)YAML_MAP_TAG, 1, YAML_ANY_MAPPING_STYLE);
+        yaml_emitter_emit_or_die(emitter, &event);
+
+        for_each_property(tree, prop)
+                yaml_propval(emitter, prop);
+
+        /* Loop over all the children, emitting them into the map */
+        for_each_child(tree, child) {
+                yaml_scalar_event_initialize(&event, NULL,
+                        (yaml_char_t *)YAML_STR_TAG, (yaml_char_t*)child->name,
+                        strlen(child->name), 1, 0, YAML_PLAIN_SCALAR_STYLE);
+                yaml_emitter_emit_or_die(emitter, &event);
+                yaml_tree(child, emitter);
+        }
+
+        yaml_mapping_end_event_initialize(&event);
+        yaml_emitter_emit_or_die(emitter, &event);
+}
+
+void dt_to_yaml(FILE *f, struct dt_info *dti)
+{
+        yaml_emitter_t emitter;
+        yaml_event_t event;
+
+        yaml_emitter_initialize(&emitter);
+        yaml_emitter_set_output_file(&emitter, f);
+        yaml_stream_start_event_initialize(&event, YAML_UTF8_ENCODING);
+        yaml_emitter_emit_or_die(&emitter, &event);
+
+        yaml_document_start_event_initialize(&event, NULL, NULL, NULL, 0);
+        yaml_emitter_emit_or_die(&emitter, &event);
+
+        yaml_sequence_start_event_initialize(&event, NULL, (yaml_char_t *)YAML_SEQ_TAG, 1, YAML_ANY_SEQUENCE_STYLE);
+        yaml_emitter_emit_or_die(&emitter, &event);
+
+        yaml_tree(dti->dt, &emitter);
+
+        yaml_sequence_end_event_initialize(&event);
+        yaml_emitter_emit_or_die(&emitter, &event);
+
+        yaml_document_end_event_initialize(&event, 0);
+        yaml_emitter_emit_or_die(&emitter, &event);
+
+        yaml_stream_end_event_initialize(&event);
+        yaml_emitter_emit_or_die(&emitter, &event);
+
+        yaml_emitter_delete(&emitter);
+}
diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
index cb0c889e13aa..0d5c799688f0 100644
--- a/scripts/gcc-plugins/Kconfig
+++ b/scripts/gcc-plugins/Kconfig
@@ -139,4 +139,55 @@ config GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
           in structures.  This reduces the performance hit of RANDSTRUCT
           at the cost of weakened randomization.
 
+config GCC_PLUGIN_STACKLEAK
+        bool "Erase the kernel stack before returning from syscalls"
+        depends on GCC_PLUGINS
+        depends on HAVE_ARCH_STACKLEAK
+        help
+          This option makes the kernel erase the kernel stack before
+          returning from system calls. That reduces the information which
+          kernel stack leak bugs can reveal and blocks some uninitialized
+          stack variable attacks.
+
+          The tradeoff is the performance impact: on a single CPU system kernel
+          compilation sees a 1% slowdown, other systems and workloads may vary
+          and you are advised to test this feature on your expected workload
+          before deploying it.
+
+          This plugin was ported from grsecurity/PaX. More information at:
+           * https://grsecurity.net/
+           * https://pax.grsecurity.net/
+
+config STACKLEAK_TRACK_MIN_SIZE
+        int "Minimum stack frame size of functions tracked by STACKLEAK"
+        default 100
+        range 0 4096
+        depends on GCC_PLUGIN_STACKLEAK
+        help
+          The STACKLEAK gcc plugin instruments the kernel code for tracking
+          the lowest border of the kernel stack (and for some other purposes).
+          It inserts the stackleak_track_stack() call for the functions with
+          a stack frame size greater than or equal to this parameter.
+          If unsure, leave the default value 100.
+
+config STACKLEAK_METRICS
+        bool "Show STACKLEAK metrics in the /proc file system"
+        depends on GCC_PLUGIN_STACKLEAK
+        depends on PROC_FS
+        help
+          If this is set, STACKLEAK metrics for every task are available in
+          the /proc file system. In particular, /proc/<pid>/stack_depth
+          shows the maximum kernel stack consumption for the current and
+          previous syscalls. Although this information is not precise, it
+          can be useful for estimating the STACKLEAK performance impact for
+          your workloads.
+
+config STACKLEAK_RUNTIME_DISABLE
+        bool "Allow runtime disabling of kernel stack erasing"
+        depends on GCC_PLUGIN_STACKLEAK
+        help
+          This option provides 'stack_erasing' sysctl, which can be used in
+          runtime to control kernel stack erasing for kernels built with
+          CONFIG_GCC_PLUGIN_STACKLEAK.
+
 endif
diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c
new file mode 100644
index 000000000000..2f48da98b5d4
--- /dev/null
+++ b/scripts/gcc-plugins/stackleak_plugin.c
@@ -0,0 +1,427 @@
+/*
+ * Copyright 2011-2017 by the PaX Team <pageexec@freemail.hu>
+ * Modified by Alexander Popov <alex.popov@linux.com>
+ * Licensed under the GPL v2
+ *
+ * Note: the choice of the license means that the compilation process is
+ * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
+ * but for the kernel it doesn't matter since it doesn't link against
+ * any of the gcc libraries
+ *
+ * This gcc plugin is needed for tracking the lowest border of the kernel stack.
+ * It instruments the kernel code inserting stackleak_track_stack() calls:
+ *  - after alloca();
+ *  - for the functions with a stack frame size greater than or equal
+ *     to the "track-min-size" plugin parameter.
+ *
+ * This plugin is ported from grsecurity/PaX. For more information see:
+ *   https://grsecurity.net/
+ *   https://pax.grsecurity.net/
+ *
+ * Debugging:
+ *  - use fprintf() to stderr, debug_generic_expr(), debug_gimple_stmt(),
+ *     print_rtl() and print_simple_rtl();
+ *  - add "-fdump-tree-all -fdump-rtl-all" to the plugin CFLAGS in
+ *     Makefile.gcc-plugins to see the verbose dumps of the gcc passes;
+ *  - use gcc -E to understand the preprocessing shenanigans;
+ *  - use gcc with enabled CFG/GIMPLE/SSA verification (--enable-checking).
+ */
+
+#include "gcc-common.h"
+
+__visible int plugin_is_GPL_compatible;
+
+static int track_frame_size = -1;
+static const char track_function[] = "stackleak_track_stack";
+
+/*
+ * Mark these global variables (roots) for gcc garbage collector since
+ * they point to the garbage-collected memory.
+ */
+static GTY(()) tree track_function_decl;
+
+static struct plugin_info stackleak_plugin_info = {
+        .version = "201707101337",
+        .help = "track-min-size=nn\ttrack stack for functions with a stack frame size >= nn bytes\n"
+                "disable\t\tdo not activate the plugin\n"
+};
+
+static void stackleak_add_track_stack(gimple_stmt_iterator *gsi, bool after)
+{
+        gimple stmt;
+        gcall *stackleak_track_stack;
+        cgraph_node_ptr node;
+        int frequency;
+        basic_block bb;
+
+        /* Insert call to void stackleak_track_stack(void) */
+        stmt = gimple_build_call(track_function_decl, 0);
+        stackleak_track_stack = as_a_gcall(stmt);
+        if (after) {
+                gsi_insert_after(gsi, stackleak_track_stack,
+                                                GSI_CONTINUE_LINKING);
+        } else {
+                gsi_insert_before(gsi, stackleak_track_stack, GSI_SAME_STMT);
+        }
+
+        /* Update the cgraph */
+        bb = gimple_bb(stackleak_track_stack);
+        node = cgraph_get_create_node(track_function_decl);
+        gcc_assert(node);
+        frequency = compute_call_stmt_bb_frequency(current_function_decl, bb);
+        cgraph_create_edge(cgraph_get_node(current_function_decl), node,
+                        stackleak_track_stack, bb->count, frequency);
+}
+
+static bool is_alloca(gimple stmt)
+{
+        if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
+                return true;
+
+#if BUILDING_GCC_VERSION >= 4007
+        if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
+                return true;
+#endif
+
+        return false;
+}
+
+/*
+ * Work with the GIMPLE representation of the code. Insert the
+ * stackleak_track_stack() call after alloca() and into the beginning
+ * of the function if it is not instrumented.
+ */
+static unsigned int stackleak_instrument_execute(void)
+{
+        basic_block bb, entry_bb;
+        bool prologue_instrumented = false, is_leaf = true;
+        gimple_stmt_iterator gsi;
+
+        /*
+         * ENTRY_BLOCK_PTR is a basic block which represents possible entry
+         * point of a function. This block does not contain any code and
+         * has a CFG edge to its successor.
+         */
+        gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
+        entry_bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
+
+        /*
+         * Loop through the GIMPLE statements in each of cfun basic blocks.
+         * cfun is a global variable which represents the function that is
+         * currently processed.
+         */
+        FOR_EACH_BB_FN(bb, cfun) {
+                for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
+                        gimple stmt;
+
+                        stmt = gsi_stmt(gsi);
+
+                        /* Leaf function is a function which makes no calls */
+                        if (is_gimple_call(stmt))
+                                is_leaf = false;
+
+                        if (!is_alloca(stmt))
+                                continue;
+
+                        /* Insert stackleak_track_stack() call after alloca() */
+                        stackleak_add_track_stack(&gsi, true);
+                        if (bb == entry_bb)
+                                prologue_instrumented = true;
+                }
+        }
+
+        if (prologue_instrumented)
+                return 0;
+
+        /*
+         * Special cases to skip the instrumentation.
+         *
+         * Taking the address of static inline functions materializes them,
+         * but we mustn't instrument some of them as the resulting stack
+         * alignment required by the function call ABI will break other
+         * assumptions regarding the expected (but not otherwise enforced)
+         * register clobbering ABI.
+         *
+         * Case in point: native_save_fl on amd64 when optimized for size
+         * clobbers rdx if it were instrumented here.
+         *
+         * TODO: any more special cases?
+         */
+        if (is_leaf &&
+            !TREE_PUBLIC(current_function_decl) &&
+            DECL_DECLARED_INLINE_P(current_function_decl)) {
+                return 0;
+        }
+
+        if (is_leaf &&
+            !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)),
+                     "_paravirt_", 10)) {
+                return 0;
+        }
+
+        /* Insert stackleak_track_stack() call at the function beginning */
+        bb = entry_bb;
+        if (!single_pred_p(bb)) {
+                /* gcc_assert(bb_loop_depth(bb) ||
+                                (bb->flags & BB_IRREDUCIBLE_LOOP)); */
+                split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
+                gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
+                bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
+        }
+        gsi = gsi_after_labels(bb);
+        stackleak_add_track_stack(&gsi, false);
+
+        return 0;
+}
+
+static bool large_stack_frame(void)
+{
+#if BUILDING_GCC_VERSION >= 8000
+        return maybe_ge(get_frame_size(), track_frame_size);
+#else
+        return (get_frame_size() >= track_frame_size);
+#endif
+}
+
+/*
+ * Work with the RTL representation of the code.
+ * Remove the unneeded stackleak_track_stack() calls from the functions
+ * which don't call alloca() and don't have a large enough stack frame size.
+ */
+static unsigned int stackleak_cleanup_execute(void)
+{
+        rtx_insn *insn, *next;
+
+        if (cfun->calls_alloca)
+                return 0;
+
+        if (large_stack_frame())
+                return 0;
+
+        /*
+         * Find stackleak_track_stack() calls. Loop through the chain of insns,
+         * which is an RTL representation of the code for a function.
+         *
+         * The example of a matching insn:
+         *  (call_insn 8 4 10 2 (call (mem (symbol_ref ("stackleak_track_stack")
+         *  [flags 0x41] <function_decl 0x7f7cd3302a80 stackleak_track_stack>)
+         *  [0 stackleak_track_stack S1 A8]) (0)) 675 {*call} (expr_list
+         *  (symbol_ref ("stackleak_track_stack") [flags 0x41] <function_decl
+         *  0x7f7cd3302a80 stackleak_track_stack>) (expr_list (0) (nil))) (nil))
+         */
+        for (insn = get_insns(); insn; insn = next) {
+                rtx body;
+
+                next = NEXT_INSN(insn);
+
+                /* Check the expression code of the insn */
+                if (!CALL_P(insn))
+                        continue;
+
+                /*
+                 * Check the expression code of the insn body, which is an RTL
+                 * Expression (RTX) describing the side effect performed by
+                 * that insn.
+                 */
+                body = PATTERN(insn);
+
+                if (GET_CODE(body) == PARALLEL)
+                        body = XVECEXP(body, 0, 0);
+
+                if (GET_CODE(body) != CALL)
+                        continue;
+
+                /*
+                 * Check the first operand of the call expression. It should
+                 * be a mem RTX describing the needed subroutine with a
+                 * symbol_ref RTX.
+                 */
+                body = XEXP(body, 0);
+                if (GET_CODE(body) != MEM)
+                        continue;
+
+                body = XEXP(body, 0);
+                if (GET_CODE(body) != SYMBOL_REF)
+                        continue;
+
+                if (SYMBOL_REF_DECL(body) != track_function_decl)
+                        continue;
+
+                /* Delete the stackleak_track_stack() call */
+                delete_insn_and_edges(insn);
+#if BUILDING_GCC_VERSION >= 4007 && BUILDING_GCC_VERSION < 8000
+                if (GET_CODE(next) == NOTE &&
+                    NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
+                        insn = next;
+                        next = NEXT_INSN(insn);
+                        delete_insn_and_edges(insn);
+                }
+#endif
+        }
+
+        return 0;
+}
+
+static bool stackleak_gate(void)
+{
+        tree section;
+
+        section = lookup_attribute("section",
+                                   DECL_ATTRIBUTES(current_function_decl));
+        if (section && TREE_VALUE(section)) {
+                section = TREE_VALUE(TREE_VALUE(section));
+
+                if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10))
+                        return false;
+                if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13))
+                        return false;
+                if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13))
+                        return false;
+                if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13))
+                        return false;
+        }
+
+        return track_frame_size >= 0;
+}
+
+/* Build the function declaration for stackleak_track_stack() */
+static void stackleak_start_unit(void *gcc_data __unused,
+                                 void *user_data __unused)
+{
+        tree fntype;
+
+        /* void stackleak_track_stack(void) */
+        fntype = build_function_type_list(void_type_node, NULL_TREE);
+        track_function_decl = build_fn_decl(track_function, fntype);
+        DECL_ASSEMBLER_NAME(track_function_decl); /* for LTO */
+        TREE_PUBLIC(track_function_decl) = 1;
+        TREE_USED(track_function_decl) = 1;
+        DECL_EXTERNAL(track_function_decl) = 1;
+        DECL_ARTIFICIAL(track_function_decl) = 1;
+        DECL_PRESERVE_P(track_function_decl) = 1;
+}
+
+/*
+ * Pass gate function is a predicate function that gets executed before the
+ * corresponding pass. If the return value is 'true' the pass gets executed,
+ * otherwise, it is skipped.
+ */
+static bool stackleak_instrument_gate(void)
+{
+        return stackleak_gate();
+}
+
+#define PASS_NAME stackleak_instrument
+#define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
+#define TODO_FLAGS_START TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts
+#define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
+                        | TODO_update_ssa | TODO_rebuild_cgraph_edges
+#include "gcc-generate-gimple-pass.h"
+
+static bool stackleak_cleanup_gate(void)
+{
+        return stackleak_gate();
+}
+
+#define PASS_NAME stackleak_cleanup
+#define TODO_FLAGS_FINISH TODO_dump_func
+#include "gcc-generate-rtl-pass.h"
+
+/*
+ * Every gcc plugin exports a plugin_init() function that is called right
+ * after the plugin is loaded. This function is responsible for registering
+ * the plugin callbacks and doing other required initialization.
+ */
+__visible int plugin_init(struct plugin_name_args *plugin_info,
+                          struct plugin_gcc_version *version)
+{
+        const char * const plugin_name = plugin_info->base_name;
+        const int argc = plugin_info->argc;
+        const struct plugin_argument * const argv = plugin_info->argv;
+        int i = 0;
+
+        /* Extra GGC root tables describing our GTY-ed data */
+        static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
+                {
+                        .base = &track_function_decl,
+                        .nelt = 1,
+                        .stride = sizeof(track_function_decl),
+                        .cb = &gt_ggc_mx_tree_node,
+                        .pchw = &gt_pch_nx_tree_node
+                },
+                LAST_GGC_ROOT_TAB
+        };
+
+        /*
+         * The stackleak_instrument pass should be executed before the
+         * "optimized" pass, which is the control flow graph cleanup that is
+         * performed just before expanding gcc trees to the RTL. In former
+         * versions of the plugin this new pass was inserted before the
+         * "tree_profile" pass, which is currently called "profile".
+         */
+        PASS_INFO(stackleak_instrument, "optimized", 1,
+                                                PASS_POS_INSERT_BEFORE);
+
+        /*
+         * The stackleak_cleanup pass should be executed after the
+         * "reload" pass, when the stack frame size is final.
+         */
+        PASS_INFO(stackleak_cleanup, "reload", 1, PASS_POS_INSERT_AFTER);
+
+        if (!plugin_default_version_check(version, &gcc_version)) {
+                error(G_("incompatible gcc/plugin versions"));
+                return 1;
+        }
+
+        /* Parse the plugin arguments */
+        for (i = 0; i < argc; i++) {
+                if (!strcmp(argv[i].key, "disable"))
+                        return 0;
+
+                if (!strcmp(argv[i].key, "track-min-size")) {
+                        if (!argv[i].value) {
+                                error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
+                                        plugin_name, argv[i].key);
+                                return 1;
+                        }
+
+                        track_frame_size = atoi(argv[i].value);
+                        if (track_frame_size < 0) {
+                                error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"),
+                                        plugin_name, argv[i].key, argv[i].value);
+                                return 1;
+                        }
+                } else {
+                        error(G_("unknown option '-fplugin-arg-%s-%s'"),
+                                        plugin_name, argv[i].key);
+                        return 1;
+                }
+        }
+
+        /* Give the information about the plugin */
+        register_callback(plugin_name, PLUGIN_INFO, NULL,
+                                                &stackleak_plugin_info);
+
+        /* Register to be called before processing a translation unit */
+        register_callback(plugin_name, PLUGIN_START_UNIT,
+                                        &stackleak_start_unit, NULL);
+
+        /* Register an extra GCC garbage collector (GGC) root table */
+        register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL,
+                                        (void *)&gt_ggc_r_gt_stackleak);
+
+        /*
+         * Hook into the Pass Manager to register new gcc passes.
+         *
+         * The stack frame size info is available only at the last RTL pass,
+         * when it's too late to insert complex code like a function call.
+         * So we register two gcc passes to instrument every function at first
+         * and remove the unneeded instrumentation later.
+         */
+        register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
+                                        &stackleak_instrument_pass_info);
+        register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
+                                        &stackleak_cleanup_pass_info);
+
+        return 0;
+}
diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index a9186a98a37d..109a1af7e444 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -48,8 +48,6 @@ static unsigned long long relative_base;
 static struct addr_range text_ranges[] = {
         { "_stext",     "_etext"     },
         { "_sinittext", "_einittext" },
-        { "_stext_l1",  "_etext_l1"  }, /* Blackfin on-chip L1 inst SRAM */
-        { "_stext_l2",  "_etext_l2"  }, /* Blackfin on-chip L2 SRAM */
 };
 #define text_range_text     (&text_ranges[0])
 #define text_range_inittext (&text_ranges[1])
@@ -405,7 +403,7 @@ static void write_src(void)
         }
 
         output_label("kallsyms_num_syms");
-        printf("\tPTR\t%u\n", table_cnt);
+        printf("\t.long\t%u\n", table_cnt);
         printf("\n");
 
         /* table of offset markers, that give the offset in the compressed stream
@@ -434,7 +432,7 @@ static void write_src(void)
 
         output_label("kallsyms_markers");
         for (i = 0; i < ((table_cnt + 255) >> 8); i++)
-                printf("\tPTR\t%d\n", markers[i]);
+                printf("\t.long\t%u\n", markers[i]);
         printf("\n");
 
         free(markers);
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 67ed9f6ccdf8..63b609243d03 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -68,21 +68,7 @@ PHONY += $(simple-targets)
 $(simple-targets): $(obj)/conf
         $< $(silent) --$@ $(Kconfig)
 
-PHONY += oldnoconfig silentoldconfig savedefconfig defconfig
-
-# oldnoconfig is an alias of olddefconfig, because people already are dependent
-# on its behavior (sets new symbols to their default value but not 'n') with the
-# counter-intuitive name.
-oldnoconfig: olddefconfig
-        @echo "  WARNING: \"oldnoconfig\" target will be removed after Linux 4.19"
-        @echo "            Please use \"olddefconfig\" instead, which is an alias."
-
-# We do not expect manual invokcation of "silentoldcofig" (or "syncconfig").
-silentoldconfig: syncconfig
-        @echo "  WARNING: \"silentoldconfig\" has been renamed to \"syncconfig\""
-        @echo "            and is now an internal implementation detail."
-        @echo "            What you want is probably \"oldconfig\"."
-        @echo "            \"silentoldconfig\" will be removed after Linux 4.19"
+PHONY += savedefconfig defconfig
 
 savedefconfig: $(obj)/conf
         $< $(silent) --$@=defconfig $(Kconfig)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 7b2b37260669..98e0c7a34699 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -460,12 +460,6 @@ static struct option long_opts[] = {
         {"randconfig",      no_argument,       NULL, randconfig},
         {"listnewconfig",   no_argument,       NULL, listnewconfig},
         {"olddefconfig",    no_argument,       NULL, olddefconfig},
-        /*
-         * oldnoconfig is an alias of olddefconfig, because people already
-         * are dependent on its behavior(sets new symbols to their default
-         * value but not 'n') with the counter-intuitive name.
-         */
-        {"oldnoconfig",     no_argument,       NULL, olddefconfig},
         {NULL, 0, NULL, 0}
 };
 
@@ -480,7 +474,6 @@ static void conf_usage(const char *progname)
         printf("  --syncconfig            Similar to oldconfig but generates configuration in\n"
                "                          include/{generated/,config/}\n");
         printf("  --olddefconfig          Same as oldconfig but sets new symbols to their default value\n");
-        printf("  --oldnoconfig           An alias of olddefconfig\n");
         printf("  --defconfig <file>      New config with default defined in <file>\n");
         printf("  --savedefconfig <file>  Save the minimal current configuration to <file>\n");
         printf("  --allnoconfig           New config where all options are answered with no\n");
diff --git a/scripts/kconfig/merge_config.sh b/scripts/kconfig/merge_config.sh
index 67d131447631..da66e7742282 100755
--- a/scripts/kconfig/merge_config.sh
+++ b/scripts/kconfig/merge_config.sh
@@ -33,12 +33,15 @@ usage() {
         echo "  -n    use allnoconfig instead of alldefconfig"
         echo "  -r    list redundant entries when merging fragments"
         echo "  -O    dir to put generated output files.  Consider setting \$KCONFIG_CONFIG instead."
+        echo
+        echo "Used prefix: '$CONFIG_PREFIX'. You can redefine it with \$CONFIG_ environment variable."
 }
 
 RUNMAKE=true
 ALLTARGET=alldefconfig
 WARNREDUN=false
 OUTPUT=.
+CONFIG_PREFIX=${CONFIG_-CONFIG_}
 
 while true; do
         case $1 in
@@ -99,7 +102,8 @@ if [ ! -r "$INITFILE" ]; then
 fi
 
 MERGE_LIST=$*
-SED_CONFIG_EXP="s/^\(# \)\{0,1\}\(CONFIG_[a-zA-Z0-9_]*\)[= ].*/\2/p"
+SED_CONFIG_EXP="s/^\(# \)\{0,1\}\(${CONFIG_PREFIX}[a-zA-Z0-9_]*\)[= ].*/\2/p"
+
 TMP_FILE=$(mktemp ./.tmp.config.XXXXXXXXXX)
 
 echo "Using $INITFILE as base"
diff --git a/scripts/mkmakefile b/scripts/mkmakefile
index e19d6565f245..412f13fdff52 100755
--- a/scripts/mkmakefile
+++ b/scripts/mkmakefile
@@ -6,31 +6,20 @@
 
 # Usage
 # $1 - Kernel src directory
-# $2 - Output directory
-# $3 - version
-# $4 - patchlevel
 
-
-test ! -r $2/Makefile -o -O $2/Makefile || exit 0
 # Only overwrite automatically generated Makefiles
 # (so we do not overwrite kernel Makefile)
-if test -e $2/Makefile && ! grep -q Automatically $2/Makefile
+if test -e Makefile && ! grep -q Automatically Makefile
 then
         exit 0
 fi
 if [ "${quiet}" != "silent_" ]; then
-        echo "  GEN     $2/Makefile"
+        echo "  GEN     Makefile"
 fi
 
-cat << EOF > $2/Makefile
+cat << EOF > Makefile
 # Automatically generated by $0: don't edit
 
-VERSION = $3
-PATCHLEVEL = $4
-
-lastword = \$(word \$(words \$(1)),\$(1))
-makedir := \$(dir \$(call lastword,\$(MAKEFILE_LIST)))
-
 ifeq ("\$(origin V)", "command line")
 VERBOSE := \$(V)
 endif
@@ -38,15 +27,12 @@ ifneq (\$(VERBOSE),1)
 Q := @
 endif
 
-MAKEARGS := -C $1
-MAKEARGS += O=\$(if \$(patsubst /%,,\$(makedir)),\$(CURDIR)/)\$(patsubst %/,%,\$(makedir))
-
 MAKEFLAGS += --no-print-directory
 
 .PHONY: __sub-make \$(MAKECMDGOALS)
 
 __sub-make:
-        \$(Q)\$(MAKE) \$(MAKEARGS) \$(MAKECMDGOALS)
+        \$(Q)\$(MAKE) -C $1 O=\$(CURDIR) \$(MAKECMDGOALS)
 
 \$(filter-out __sub-make, \$(MAKECMDGOALS)): __sub-make
         @:
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 7be43697ff84..28a61665bb9c 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -95,12 +95,20 @@ extern struct devtable *__start___devtable[], *__stop___devtable[];
  */
 #define DEF_FIELD(m, devid, f) \
         typeof(((struct devid *)0)->f) f = TO_NATIVE(*(typeof(f) *)((m) + OFF_##devid##_##f))
+
+/* Define a variable v that holds the address of field f of struct devid
+ * based at address m.  Due to the way typeof works, for a field of type
+ * T[N] the variable has type T(*)[N], _not_ T*.
+ */
+#define DEF_FIELD_ADDR_VAR(m, devid, f, v) \
+        typeof(((struct devid *)0)->f) *v = ((m) + OFF_##devid##_##f)
+
 /* Define a variable f that holds the address of field f of struct devid
  * based at address m.  Due to the way typeof works, for a field of type
  * T[N] the variable has type T(*)[N], _not_ T*.
  */
 #define DEF_FIELD_ADDR(m, devid, f) \
-        typeof(((struct devid *)0)->f) *f = ((m) + OFF_##devid##_##f)
+        DEF_FIELD_ADDR_VAR(m, devid, f, f)
 
 /* Add a table entry.  We test function type matches while we're here. */
 #define ADD_TO_DEVTABLE(device_id, type, function) \
@@ -644,7 +652,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
 
         for (i = 0; i < count; i++) {
                 unsigned int j;
-                DEF_FIELD_ADDR(symval + i*id_size, pnp_card_device_id, devs);
+                DEF_FIELD_ADDR(symval + i * id_size, pnp_card_device_id, devs);
 
                 for (j = 0; j < PNP_MAX_DEVICES; j++) {
                         const char *id = (char *)(*devs)[j].id;
@@ -656,10 +664,13 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
 
                         /* find duplicate, already added value */
                         for (i2 = 0; i2 < i && !dup; i2++) {
-                                DEF_FIELD_ADDR(symval + i2*id_size, pnp_card_device_id, devs);
+                                DEF_FIELD_ADDR_VAR(symval + i2 * id_size,
+                                                   pnp_card_device_id,
+                                                   devs, devs_dup);
 
                                 for (j2 = 0; j2 < PNP_MAX_DEVICES; j2++) {
-                                        const char *id2 = (char *)(*devs)[j2].id;
+                                        const char *id2 =
+                                                (char *)(*devs_dup)[j2].id;
 
                                         if (!id2[0])
                                                 break;
@@ -1415,11 +1426,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
         if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT)
                 return;
 
-        /* All our symbols are of form <prefix>__mod_<name>__<identifier>_device_table. */
-        name = strstr(symname, "__mod_");
-        if (!name)
+        /* All our symbols are of form __mod_<name>__<identifier>_device_table. */
+        if (strncmp(symname, "__mod_", strlen("__mod_")))
                 return;
-        name += strlen("__mod_");
+        name = symname + strlen("__mod_");
         namelen = strlen(name);
         if (namelen < strlen("_device_table"))
                 return;
diff --git a/scripts/tags.sh b/scripts/tags.sh
index 26de7d5aa5c8..4fa070f9231a 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -203,7 +203,7 @@ regex_c=(
         '/\<DECLARE_\(TASKLET\|WORK\|DELAYED_WORK\)(\([[:alnum:]_]*\)/\2/v/'
         '/\(^\s\)OFFSET(\([[:alnum:]_]*\)/\2/v/'
         '/\(^\s\)DEFINE(\([[:alnum:]_]*\)/\2/v/'
-        '/\<DEFINE_HASHTABLE(\([[:alnum:]_]*\)/\1/v/'
+        '/\<\(DEFINE\|DECLARE\)_HASHTABLE(\([[:alnum:]_]*\)/\2/v/'
 )
 regex_kconfig=(
         '/^[[:blank:]]*\(menu\|\)config[[:blank:]]\+\([[:alnum:]_]\+\)/\2/'