Merge tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here is the big set of char and misc driver patches for 4.21-rc1.

  Lots of different types of driver things in here, as this tree seems
  to be the "collection of various driver subsystems not big enough to
  have their own git tree" lately.

  Anyway, some highlights of the changes in here:

   - binderfs: is it a rule that all driver subsystems will eventually
     grow to have their own filesystem? Binder now has one to handle the
     use of it in containerized systems.

     This was discussed at the Plumbers conference a few months ago and
     knocked into mergable shape very fast by Christian Brauner. Who
     also has signed up to be another binder maintainer, showing a
     distinct lack of good judgement :)

   - binder updates and fixes

   - mei driver updates

   - fpga driver updates and additions

   - thunderbolt driver updates

   - soundwire driver updates

   - extcon driver updates

   - nvmem driver updates

   - hyper-v driver updates

   - coresight driver updates

   - pvpanic driver additions and reworking for more device support

   - lp driver updates. Yes really, it's _finally_ moved to the proper
     parallal port driver model, something I never thought I would see
     happen. Good stuff.

   - other tiny driver updates and fixes.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (116 commits)
  MAINTAINERS: add another Android binder maintainer
  intel_th: msu: Fix an off-by-one in attribute store
  stm class: Add a reference to the SyS-T document
  stm class: Fix a module refcount leak in policy creation error path
  char: lp: use new parport device model
  char: lp: properly count the lp devices
  char: lp: use first unused lp number while registering
  char: lp: detach the device when parallel port is removed
  char: lp: introduce list to save port number
  bus: qcom: remove duplicated include from qcom-ebi2.c
  VMCI: Use memdup_user() rather than duplicating its implementation
  char/rtc: Use of_node_name_eq for node name comparisons
  misc: mic: fix a DMA pool free failure
  ptp: fix an IS_ERR() vs NULL check
  genwqe: Fix size check
  binder: implement binderfs
  binder: fix use-after-free due to ksys_close() during fdget()
  bus: fsl-mc: remove duplicated include files
  bus: fsl-mc: explicitly define the fsl_mc_command endianness
  misc: ti-st: make array read_ver_cmd static, shrinks object size
  ...

123 files changed, 4973 insertions, 917 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-thunderbolt b/Documentation/ABI/testing/sysfs-bus-thunderbolt
index 151584a1f950..b21fba14689b 100644
--- a/Documentation/ABI/testing/sysfs-bus-thunderbolt
+++ b/Documentation/ABI/testing/sysfs-bus-thunderbolt
@@ -21,6 +21,15 @@ Description:	Holds a comma separated list of device unique_ids that
                 If a device is authorized automatically during boot its
                 boot attribute is set to 1.
 
+What: /sys/bus/thunderbolt/devices/.../domainX/iommu_dma_protection
+Date:           Mar 2019
+KernelVersion:  4.21
+Contact:        thunderbolt-software@lists.01.org
+Description:    This attribute tells whether the system uses IOMMU
+                for DMA protection. Value of 1 means IOMMU is used 0 means
+                it is not (DMA protection is solely based on Thunderbolt
+                security levels).
+
 What: /sys/bus/thunderbolt/devices/.../domainX/security
 Date:           Sep 2017
 KernelVersion:  4.13
diff --git a/Documentation/admin-guide/thunderbolt.rst b/Documentation/admin-guide/thunderbolt.rst
index 35fccba6a9a6..898ad78f3cc7 100644
--- a/Documentation/admin-guide/thunderbolt.rst
+++ b/Documentation/admin-guide/thunderbolt.rst
@@ -133,6 +133,26 @@ If the user still wants to connect the device they can either approve
 the device without a key or write a new key and write 1 to the
 ``authorized`` file to get the new key stored on the device NVM.
 
+DMA protection utilizing IOMMU
+------------------------------
+Recent systems from 2018 and forward with Thunderbolt ports may natively
+support IOMMU. This means that Thunderbolt security is handled by an IOMMU
+so connected devices cannot access memory regions outside of what is
+allocated for them by drivers. When Linux is running on such system it
+automatically enables IOMMU if not enabled by the user already. These
+systems can be identified by reading ``1`` from
+``/sys/bus/thunderbolt/devices/domainX/iommu_dma_protection`` attribute.
+
+The driver does not do anything special in this case but because DMA
+protection is handled by the IOMMU, security levels (if set) are
+redundant. For this reason some systems ship with security level set to
+``none``. Other systems have security level set to ``user`` in order to
+support downgrade to older OS, so users who want to automatically
+authorize devices when IOMMU DMA protection is enabled can use the
+following ``udev`` rule::
+
+  ACTION=="add", SUBSYSTEM=="thunderbolt", ATTRS{iommu_dma_protection}=="1", ATTR{authorized}=="0", ATTR{authorized}="1"
+
 Upgrading NVM on Thunderbolt device or host
 -------------------------------------------
 Since most of the functionality is handled in firmware running on a
diff --git a/Documentation/devicetree/bindings/firmware/intel,stratix10-svc.txt b/Documentation/devicetree/bindings/firmware/intel,stratix10-svc.txt
new file mode 100644
index 000000000000..1fa66065acc6
--- /dev/null
+++ b/Documentation/devicetree/bindings/firmware/intel,stratix10-svc.txt
@@ -0,0 +1,57 @@
+Intel Service Layer Driver for Stratix10 SoC
+============================================
+Intel Stratix10 SoC is composed of a 64 bit quad-core ARM Cortex A53 hard
+processor system (HPS) and Secure Device Manager (SDM). When the FPGA is
+configured from HPS, there needs to be a way for HPS to notify SDM the
+location and size of the configuration data. Then SDM will get the
+configuration data from that location and perform the FPGA configuration.
+
+To meet the whole system security needs and support virtual machine requesting
+communication with SDM, only the secure world of software (EL3, Exception
+Layer 3) can interface with SDM. All software entities running on other
+exception layers must channel through the EL3 software whenever it needs
+service from SDM.
+
+Intel Stratix10 service layer driver, running at privileged exception level
+(EL1, Exception Layer 1), interfaces with the service providers and provides
+the services for FPGA configuration, QSPI, Crypto and warm reset. Service layer
+driver also manages secure monitor call (SMC) to communicate with secure monitor
+code running in EL3.
+
+Required properties:
+-------------------
+The svc node has the following mandatory properties, must be located under
+the firmware node.
+
+- compatible: "intel,stratix10-svc"
+- method: smc or hvc
+        smc - Secure Monitor Call
+        hvc - Hypervisor Call
+- memory-region:
+        phandle to the reserved memory node. See
+        Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt
+        for details
+
+Example:
+-------
+
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                service_reserved: svcbuffer@0 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x0 0x0 0x1000000>;
+                        alignment = <0x1000>;
+                        no-map;
+                };
+        };
+
+        firmware {
+                svc {
+                        compatible = "intel,stratix10-svc";
+                        method = "smc";
+                        memory-region = <&service_reserved>;
+                };
+        };
diff --git a/Documentation/devicetree/bindings/fpga/intel-stratix10-soc-fpga-mgr.txt b/Documentation/devicetree/bindings/fpga/intel-stratix10-soc-fpga-mgr.txt
new file mode 100644
index 000000000000..6e03f79287fb
--- /dev/null
+++ b/Documentation/devicetree/bindings/fpga/intel-stratix10-soc-fpga-mgr.txt
@@ -0,0 +1,17 @@
+Intel Stratix10 SoC FPGA Manager
+
+Required properties:
+The fpga_mgr node has the following mandatory property, must be located under
+firmware/svc node.
+
+- compatible : should contain "intel,stratix10-soc-fpga-mgr"
+
+Example:
+
+        firmware {
+                svc {
+                        fpga_mgr: fpga-mgr {
+                                compatible = "intel,stratix10-soc-fpga-mgr";
+                        };
+                };
+        };
diff --git a/Documentation/devicetree/bindings/misc/pvpanic-mmio.txt b/Documentation/devicetree/bindings/misc/pvpanic-mmio.txt
new file mode 100644
index 000000000000..985e90736780
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/pvpanic-mmio.txt
@@ -0,0 +1,29 @@
+* QEMU PVPANIC MMIO Configuration bindings
+
+QEMU's emulation / virtualization targets provide the following PVPANIC
+MMIO Configuration interface on the "virt" machine.
+type:
+
+- a read-write, 16-bit wide data register.
+
+QEMU exposes the data register to guests as memory mapped registers.
+
+Required properties:
+
+- compatible: "qemu,pvpanic-mmio".
+- reg: the MMIO region used by the device.
+  * Bytes 0x0  Write panic event to the reg when guest OS panics.
+  * Bytes 0x1  Reserved.
+
+Example:
+
+/ {
+        #size-cells = <0x2>;
+        #address-cells = <0x2>;
+
+        pvpanic-mmio@9060000 {
+                compatible = "qemu,pvpanic-mmio";
+                reg = <0x0 0x9060000 0x0 0x2>;
+        };
+};
+
diff --git a/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt b/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt
index e3298e18de26..2e0723ab3384 100644
--- a/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt
+++ b/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt
@@ -2,6 +2,8 @@
 
 Required properties:
 - compatible: should be "amlogic,meson-gxbb-efuse"
+- clocks: phandle to the efuse peripheral clock provided by the
+          clock controller.
 
 = Data cells =
 Are child nodes of eFuse, bindings of which as described in
@@ -11,6 +13,7 @@ Example:
 
         efuse: efuse {
                 compatible = "amlogic,meson-gxbb-efuse";
+                clocks = <&clkc CLKID_EFUSE>;
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/Documentation/driver-api/firmware/other_interfaces.rst b/Documentation/driver-api/firmware/other_interfaces.rst
index 36c47b1e9824..a4ac54b5fd79 100644
--- a/Documentation/driver-api/firmware/other_interfaces.rst
+++ b/Documentation/driver-api/firmware/other_interfaces.rst
@@ -13,3 +13,33 @@ EDD Interfaces
 .. kernel-doc:: drivers/firmware/edd.c
    :internal:
 
+Intel Stratix10 SoC Service Layer
+---------------------------------
+Some features of the Intel Stratix10 SoC require a level of privilege
+higher than the kernel is granted. Such secure features include
+FPGA programming. In terms of the ARMv8 architecture, the kernel runs
+at Exception Level 1 (EL1), access to the features requires
+Exception Level 3 (EL3).
+
+The Intel Stratix10 SoC service layer provides an in kernel API for
+drivers to request access to the secure features. The requests are queued
+and processed one by one. ARM’s SMCCC is used to pass the execution
+of the requests on to a secure monitor (EL3).
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_command_code
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_client_msg
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_command_reconfig_payload
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_cb_data
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_client
+
+.. kernel-doc:: drivers/firmware/stratix10-svc.c
+   :export:
diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst
index 306997941ba1..6b4107cf4b98 100644
--- a/Documentation/trace/index.rst
+++ b/Documentation/trace/index.rst
@@ -22,3 +22,4 @@ Linux Tracing Technologies
    hwlat_detector
    intel_th
    stm
+   sys-t
diff --git a/MAINTAINERS b/MAINTAINERS
index 87ae13cd288c..7d37f8a4743c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -958,6 +958,7 @@ M:	Arve Hjønnevåg <arve@android.com>
 M:      Todd Kjos <tkjos@android.com>
 M:      Martijn Coenen <maco@android.com>
 M:      Joel Fernandes <joel@joelfernandes.org>
+M:      Christian Brauner <christian@brauner.io>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
 L:      devel@driverdev.osuosl.org
 S:      Supported
@@ -1442,6 +1443,7 @@ F:	arch/arm/mach-ep93xx/micro9.c
 
 ARM/CORESIGHT FRAMEWORK AND DRIVERS
 M:      Mathieu Poirier <mathieu.poirier@linaro.org>
+R:      Suzuki K Poulose <suzuki.poulose@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/hwtracing/coresight/*
@@ -16242,7 +16244,7 @@ F:	drivers/vme/
 F:      include/linux/vme*
 
 VMWARE BALLOON DRIVER
-M:      Xavier Deguillard <xdeguillard@vmware.com>
+M:      Julien Freche <jfreche@vmware.com>
 M:      Nadav Amit <namit@vmware.com>
 M:      "VMware, Inc." <pv-drivers@vmware.com>
 L:      linux-kernel@vger.kernel.org
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index fef7351e9f67..a20df0d9c96d 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -24,6 +24,19 @@
         #address-cells = <2>;
         #size-cells = <2>;
 
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                service_reserved: svcbuffer@0 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x0 0x0 0x1000000>;
+                        alignment = <0x1000>;
+                        no-map;
+                };
+        };
+
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -93,6 +106,14 @@
                 interrupt-parent = <&intc>;
                 ranges = <0 0 0 0xffffffff>;
 
+                base_fpga_region {
+                        #address-cells = <0x1>;
+                        #size-cells = <0x1>;
+
+                        compatible = "fpga-region";
+                        fpga-mgr = <&fpga_mgr>;
+                };
+
                 clkmgr: clock-controller@ffd10000 {
                         compatible = "intel,stratix10-clkmgr";
                         reg = <0xffd10000 0x1000>;
@@ -537,5 +558,17 @@
 
                         status = "disabled";
                 };
+
+                firmware {
+                        svc {
+                                compatible = "intel,stratix10-svc";
+                                method = "smc";
+                                memory-region = <&service_reserved>;
+
+                                fpga_mgr: fpga-mgr {
+                                        compatible = "intel,stratix10-soc-fpga-mgr";
+                                };
+                        };
+                };
         };
 };
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 8c7c4583b52d..77abe0ec4043 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -24,6 +24,14 @@ static int acpi_data_get_property_array(const struct acpi_device_data *data,
                                         acpi_object_type type,
                                         const union acpi_object **obj);
 
+/*
+ * The GUIDs here are made equivalent to each other in order to avoid extra
+ * complexity in the properties handling code, with the caveat that the
+ * kernel will accept certain combinations of GUID and properties that are
+ * not defined without a warning. For instance if any of the properties
+ * from different GUID appear in a property list of another, it will be
+ * accepted by the kernel. Firmware validation tools should catch these.
+ */
 static const guid_t prp_guids[] = {
         /* ACPI _DSD device properties GUID: daffd814-6eba-4d8c-8a91-bc9bbf4aa301 */
         GUID_INIT(0xdaffd814, 0x6eba, 0x4d8c,
@@ -31,6 +39,9 @@ static const guid_t prp_guids[] = {
         /* Hotplug in D3 GUID: 6211e2c0-58a3-4af3-90e1-927a4e0c55a4 */
         GUID_INIT(0x6211e2c0, 0x58a3, 0x4af3,
                   0x90, 0xe1, 0x92, 0x7a, 0x4e, 0x0c, 0x55, 0xa4),
+        /* External facing port GUID: efcc06cc-73ac-4bc3-bff0-76143807c389 */
+        GUID_INIT(0xefcc06cc, 0x73ac, 0x4bc3,
+                  0xbf, 0xf0, 0x76, 0x14, 0x38, 0x07, 0xc3, 0x89),
 };
 
 static const guid_t ads_guid =
diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
index 51e8250d113f..4c190f8d1f4c 100644
--- a/drivers/android/Kconfig
+++ b/drivers/android/Kconfig
@@ -20,6 +20,18 @@ config ANDROID_BINDER_IPC
           Android process, using Binder to identify, invoke and pass arguments
           between said processes.
 
+config ANDROID_BINDERFS
+        bool "Android Binderfs filesystem"
+        depends on ANDROID_BINDER_IPC
+        default n
+        ---help---
+          Binderfs is a pseudo-filesystem for the Android Binder IPC driver
+          which can be mounted per-ipc namespace allowing to run multiple
+          instances of Android.
+          Each binderfs mount initially only contains a binder-control device.
+          It can be used to dynamically allocate new binder IPC devices via
+          ioctls.
+
 config ANDROID_BINDER_DEVICES
         string "Android Binder devices"
         depends on ANDROID_BINDER_IPC
diff --git a/drivers/android/Makefile b/drivers/android/Makefile
index a01254c43ee3..c7856e3200da 100644
--- a/drivers/android/Makefile
+++ b/drivers/android/Makefile
@@ -1,4 +1,5 @@
 ccflags-y += -I$(src)                   # needed for trace events
 
+obj-$(CONFIG_ANDROID_BINDERFS)          += binderfs.o
 obj-$(CONFIG_ANDROID_BINDER_IPC)        += binder.o binder_alloc.o
 obj-$(CONFIG_ANDROID_BINDER_IPC_SELFTEST) += binder_alloc_selftest.o
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 9f1000d2a40c..cdfc87629efb 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -72,12 +72,14 @@
 #include <linux/spinlock.h>
 #include <linux/ratelimit.h>
 #include <linux/syscalls.h>
+#include <linux/task_work.h>
 
 #include <uapi/linux/android/binder.h>
 
 #include <asm/cacheflush.h>
 
 #include "binder_alloc.h"
+#include "binder_internal.h"
 #include "binder_trace.h"
 
 static HLIST_HEAD(binder_deferred_list);
@@ -94,22 +96,8 @@ static struct dentry *binder_debugfs_dir_entry_root;
 static struct dentry *binder_debugfs_dir_entry_proc;
 static atomic_t binder_last_id;
 
-#define BINDER_DEBUG_ENTRY(name) \
-static int binder_##name##_open(struct inode *inode, struct file *file) \
-{ \
-        return single_open(file, binder_##name##_show, inode->i_private); \
-} \
-\
-static const struct file_operations binder_##name##_fops = { \
-        .owner = THIS_MODULE, \
-        .open = binder_##name##_open, \
-        .read = seq_read, \
-        .llseek = seq_lseek, \
-        .release = single_release, \
-}
-
-static int binder_proc_show(struct seq_file *m, void *unused);
-BINDER_DEBUG_ENTRY(proc);
+static int proc_show(struct seq_file *m, void *unused);
+DEFINE_SHOW_ATTRIBUTE(proc);
 
 /* This is only defined in include/asm-arm/sizes.h */
 #ifndef SZ_1K
@@ -262,20 +250,6 @@ static struct binder_transaction_log_entry *binder_transaction_log_add(
         return e;
 }
 
-struct binder_context {
-        struct binder_node *binder_context_mgr_node;
-        struct mutex context_mgr_node_lock;
-
-        kuid_t binder_context_mgr_uid;
-        const char *name;
-};
-
-struct binder_device {
-        struct hlist_node hlist;
-        struct miscdevice miscdev;
-        struct binder_context context;
-};
-
 /**
  * struct binder_work - work enqueued on a worklist
  * @entry:             node enqueued on list
@@ -660,6 +634,7 @@ struct binder_transaction {
 #define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
 static void
 _binder_proc_lock(struct binder_proc *proc, int line)
+        __acquires(&proc->outer_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -675,6 +650,7 @@ _binder_proc_lock(struct binder_proc *proc, int line)
 #define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
 static void
 _binder_proc_unlock(struct binder_proc *proc, int line)
+        __releases(&proc->outer_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -690,6 +666,7 @@ _binder_proc_unlock(struct binder_proc *proc, int line)
 #define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
 static void
 _binder_inner_proc_lock(struct binder_proc *proc, int line)
+        __acquires(&proc->inner_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -705,6 +682,7 @@ _binder_inner_proc_lock(struct binder_proc *proc, int line)
 #define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
 static void
 _binder_inner_proc_unlock(struct binder_proc *proc, int line)
+        __releases(&proc->inner_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -720,6 +698,7 @@ _binder_inner_proc_unlock(struct binder_proc *proc, int line)
 #define binder_node_lock(node) _binder_node_lock(node, __LINE__)
 static void
 _binder_node_lock(struct binder_node *node, int line)
+        __acquires(&node->lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -735,6 +714,7 @@ _binder_node_lock(struct binder_node *node, int line)
 #define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
 static void
 _binder_node_unlock(struct binder_node *node, int line)
+        __releases(&node->lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -751,12 +731,16 @@ _binder_node_unlock(struct binder_node *node, int line)
 #define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
 static void
 _binder_node_inner_lock(struct binder_node *node, int line)
+        __acquires(&node->lock) __acquires(&node->proc->inner_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
         spin_lock(&node->lock);
         if (node->proc)
                 binder_inner_proc_lock(node->proc);
+        else
+                /* annotation for sparse */
+                __acquire(&node->proc->inner_lock);
 }
 
 /**
@@ -768,6 +752,7 @@ _binder_node_inner_lock(struct binder_node *node, int line)
 #define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
 static void
 _binder_node_inner_unlock(struct binder_node *node, int line)
+        __releases(&node->lock) __releases(&node->proc->inner_lock)
 {
         struct binder_proc *proc = node->proc;
 
@@ -775,6 +760,9 @@ _binder_node_inner_unlock(struct binder_node *node, int line)
                      "%s: line=%d\n", __func__, line);
         if (proc)
                 binder_inner_proc_unlock(proc);
+        else
+                /* annotation for sparse */
+                __release(&node->proc->inner_lock);
         spin_unlock(&node->lock);
 }
 
@@ -1384,10 +1372,14 @@ static void binder_dec_node_tmpref(struct binder_node *node)
         binder_node_inner_lock(node);
         if (!node->proc)
                 spin_lock(&binder_dead_nodes_lock);
+        else
+                __acquire(&binder_dead_nodes_lock);
         node->tmp_refs--;
         BUG_ON(node->tmp_refs < 0);
         if (!node->proc)
                 spin_unlock(&binder_dead_nodes_lock);
+        else
+                __release(&binder_dead_nodes_lock);
         /*
          * Call binder_dec_node() to check if all refcounts are 0
          * and cleanup is needed. Calling with strong=0 and internal=1
@@ -1890,18 +1882,22 @@ static struct binder_thread *binder_get_txn_from(
  */
 static struct binder_thread *binder_get_txn_from_and_acq_inner(
                 struct binder_transaction *t)
+        __acquires(&t->from->proc->inner_lock)
 {
         struct binder_thread *from;
 
         from = binder_get_txn_from(t);
-        if (!from)
+        if (!from) {
+                __acquire(&from->proc->inner_lock);
                 return NULL;
+        }
         binder_inner_proc_lock(from->proc);
         if (t->from) {
                 BUG_ON(from != t->from);
                 return from;
         }
         binder_inner_proc_unlock(from->proc);
+        __acquire(&from->proc->inner_lock);
         binder_thread_dec_tmpref(from);
         return NULL;
 }
@@ -1973,6 +1969,8 @@ static void binder_send_failed_reply(struct binder_transaction *t,
                         binder_thread_dec_tmpref(target_thread);
                         binder_free_transaction(t);
                         return;
+                } else {
+                        __release(&target_thread->proc->inner_lock);
                 }
                 next = t->from_parent;
 
@@ -2160,6 +2158,64 @@ static bool binder_validate_fixup(struct binder_buffer *b,
         return (fixup_offset >= last_min_offset);
 }
 
+/**
+ * struct binder_task_work_cb - for deferred close
+ *
+ * @twork:                callback_head for task work
+ * @fd:                   fd to close
+ *
+ * Structure to pass task work to be handled after
+ * returning from binder_ioctl() via task_work_add().
+ */
+struct binder_task_work_cb {
+        struct callback_head twork;
+        struct file *file;
+};
+
+/**
+ * binder_do_fd_close() - close list of file descriptors
+ * @twork:      callback head for task work
+ *
+ * It is not safe to call ksys_close() during the binder_ioctl()
+ * function if there is a chance that binder's own file descriptor
+ * might be closed. This is to meet the requirements for using
+ * fdget() (see comments for __fget_light()). Therefore use
+ * task_work_add() to schedule the close operation once we have
+ * returned from binder_ioctl(). This function is a callback
+ * for that mechanism and does the actual ksys_close() on the
+ * given file descriptor.
+ */
+static void binder_do_fd_close(struct callback_head *twork)
+{
+        struct binder_task_work_cb *twcb = container_of(twork,
+                        struct binder_task_work_cb, twork);
+
+        fput(twcb->file);
+        kfree(twcb);
+}
+
+/**
+ * binder_deferred_fd_close() - schedule a close for the given file-descriptor
+ * @fd:         file-descriptor to close
+ *
+ * See comments in binder_do_fd_close(). This function is used to schedule
+ * a file-descriptor to be closed after returning from binder_ioctl().
+ */
+static void binder_deferred_fd_close(int fd)
+{
+        struct binder_task_work_cb *twcb;
+
+        twcb = kzalloc(sizeof(*twcb), GFP_KERNEL);
+        if (!twcb)
+                return;
+        init_task_work(&twcb->twork, binder_do_fd_close);
+        __close_fd_get_file(fd, &twcb->file);
+        if (twcb->file)
+                task_work_add(current, &twcb->twork, true);
+        else
+                kfree(twcb);
+}
+
 static void binder_transaction_buffer_release(struct binder_proc *proc,
                                               struct binder_buffer *buffer,
                                               binder_size_t *failed_at)
@@ -2299,7 +2355,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                         }
                         fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
-                                ksys_close(fd_array[fd_index]);
+                                binder_deferred_fd_close(fd_array[fd_index]);
                 } break;
                 default:
                         pr_err("transaction release %d bad object type %x\n",
@@ -2394,11 +2450,15 @@ static int binder_translate_handle(struct flat_binder_object *fp,
                 fp->cookie = node->cookie;
                 if (node->proc)
                         binder_inner_proc_lock(node->proc);
+                else
+                        __acquire(&node->proc->inner_lock);
                 binder_inc_node_nilocked(node,
                                          fp->hdr.type == BINDER_TYPE_BINDER,
                                          0, NULL);
                 if (node->proc)
                         binder_inner_proc_unlock(node->proc);
+                else
+                        __release(&node->proc->inner_lock);
                 trace_binder_transaction_ref_to_node(t, node, &src_rdata);
                 binder_debug(BINDER_DEBUG_TRANSACTION,
                              "        ref %d desc %d -> node %d u%016llx\n",
@@ -2762,6 +2822,8 @@ static void binder_transaction(struct binder_proc *proc,
                 binder_set_nice(in_reply_to->saved_priority);
                 target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
                 if (target_thread == NULL) {
+                        /* annotation for sparse */
+                        __release(&target_thread->proc->inner_lock);
                         return_error = BR_DEAD_REPLY;
                         return_error_line = __LINE__;
                         goto err_dead_binder;
@@ -3912,7 +3974,7 @@ static int binder_apply_fd_fixups(struct binder_transaction *t)
                 } else if (ret) {
                         u32 *fdp = (u32 *)(t->buffer->data + fixup->offset);
 
-                        ksys_close(*fdp);
+                        binder_deferred_fd_close(*fdp);
                 }
                 list_del(&fixup->fixup_entry);
                 kfree(fixup);
@@ -4164,6 +4226,11 @@ retry:
                         if (cmd == BR_DEAD_BINDER)
                                 goto done; /* DEAD_BINDER notifications can cause transactions */
                 } break;
+                default:
+                        binder_inner_proc_unlock(proc);
+                        pr_err("%d:%d: bad work type %d\n",
+                               proc->pid, thread->pid, w->type);
+                        break;
                 }
 
                 if (!t)
@@ -4467,6 +4534,8 @@ static int binder_thread_release(struct binder_proc *proc,
                 spin_lock(&t->lock);
                 if (t->to_thread == thread)
                         send_reply = t;
+        } else {
+                __acquire(&t->lock);
         }
         thread->is_dead = true;
 
@@ -4495,7 +4564,11 @@ static int binder_thread_release(struct binder_proc *proc,
                 spin_unlock(&last_t->lock);
                 if (t)
                         spin_lock(&t->lock);
+                else
+                        __acquire(&t->lock);
         }
+        /* annotation for sparse, lock not acquired in last iteration above */
+        __release(&t->lock);
 
         /*
          * If this thread used poll, make sure we remove the waitqueue
@@ -4938,8 +5011,12 @@ static int binder_open(struct inode *nodp, struct file *filp)
         proc->tsk = current->group_leader;
         INIT_LIST_HEAD(&proc->todo);
         proc->default_priority = task_nice(current);
-        binder_dev = container_of(filp->private_data, struct binder_device,
-                                  miscdev);
+        /* binderfs stashes devices in i_private */
+        if (is_binderfs_device(nodp))
+                binder_dev = nodp->i_private;
+        else
+                binder_dev = container_of(filp->private_data,
+                                          struct binder_device, miscdev);
         proc->context = &binder_dev->context;
         binder_alloc_init(&proc->alloc);
 
@@ -4967,7 +5044,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
                 proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
                         binder_debugfs_dir_entry_proc,
                         (void *)(unsigned long)proc->pid,
-                        &binder_proc_fops);
+                        &proc_fops);
         }
 
         return 0;
@@ -5391,6 +5468,9 @@ static void print_binder_proc(struct seq_file *m,
         for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
                 struct binder_node *node = rb_entry(n, struct binder_node,
                                                     rb_node);
+                if (!print_all && !node->has_async_transaction)
+                        continue;
+
                 /*
                  * take a temporary reference on the node so it
                  * survives and isn't removed from the tree
@@ -5595,7 +5675,7 @@ static void print_binder_proc_stats(struct seq_file *m,
 }
 
 
-static int binder_state_show(struct seq_file *m, void *unused)
+static int state_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
         struct binder_node *node;
@@ -5634,7 +5714,7 @@ static int binder_state_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static int binder_stats_show(struct seq_file *m, void *unused)
+static int stats_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
 
@@ -5650,7 +5730,7 @@ static int binder_stats_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static int binder_transactions_show(struct seq_file *m, void *unused)
+static int transactions_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
 
@@ -5663,7 +5743,7 @@ static int binder_transactions_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static int binder_proc_show(struct seq_file *m, void *unused)
+static int proc_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *itr;
         int pid = (unsigned long)m->private;
@@ -5706,7 +5786,7 @@ static void print_binder_transaction_log_entry(struct seq_file *m,
                         "\n" : " (incomplete)\n");
 }
 
-static int binder_transaction_log_show(struct seq_file *m, void *unused)
+static int transaction_log_show(struct seq_file *m, void *unused)
 {
         struct binder_transaction_log *log = m->private;
         unsigned int log_cur = atomic_read(&log->cur);
@@ -5727,7 +5807,7 @@ static int binder_transaction_log_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static const struct file_operations binder_fops = {
+const struct file_operations binder_fops = {
         .owner = THIS_MODULE,
         .poll = binder_poll,
         .unlocked_ioctl = binder_ioctl,
@@ -5738,10 +5818,10 @@ static const struct file_operations binder_fops = {
         .release = binder_release,
 };
 
-BINDER_DEBUG_ENTRY(state);
-BINDER_DEBUG_ENTRY(stats);
-BINDER_DEBUG_ENTRY(transactions);
-BINDER_DEBUG_ENTRY(transaction_log);
+DEFINE_SHOW_ATTRIBUTE(state);
+DEFINE_SHOW_ATTRIBUTE(stats);
+DEFINE_SHOW_ATTRIBUTE(transactions);
+DEFINE_SHOW_ATTRIBUTE(transaction_log);
 
 static int __init init_binder_device(const char *name)
 {
@@ -5795,27 +5875,27 @@ static int __init binder_init(void)
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     NULL,
-                                    &binder_state_fops);
+                                    &state_fops);
                 debugfs_create_file("stats",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     NULL,
-                                    &binder_stats_fops);
+                                    &stats_fops);
                 debugfs_create_file("transactions",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     NULL,
-                                    &binder_transactions_fops);
+                                    &transactions_fops);
                 debugfs_create_file("transaction_log",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     &binder_transaction_log,
-                                    &binder_transaction_log_fops);
+                                    &transaction_log_fops);
                 debugfs_create_file("failed_transaction_log",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     &binder_transaction_log_failed,
-                                    &binder_transaction_log_fops);
+                                    &transaction_log_fops);
         }
 
         /*
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 030c98f35cca..022cd80e80cc 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -939,6 +939,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
                                        struct list_lru_one *lru,
                                        spinlock_t *lock,
                                        void *cb_arg)
+        __must_hold(lock)
 {
         struct mm_struct *mm = NULL;
         struct binder_lru_page *page = container_of(item,
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index fb3238c74c8a..c0aadbbf7f19 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -30,16 +30,16 @@ struct binder_transaction;
  * struct binder_buffer - buffer used for binder transactions
  * @entry:              entry alloc->buffers
  * @rb_node:            node for allocated_buffers/free_buffers rb trees
- * @free:               true if buffer is free
- * @allow_user_free:    describe the second member of struct blah,
- * @async_transaction:  describe the second member of struct blah,
- * @debug_id:           describe the second member of struct blah,
- * @transaction:        describe the second member of struct blah,
- * @target_node:        describe the second member of struct blah,
- * @data_size:          describe the second member of struct blah,
- * @offsets_size:       describe the second member of struct blah,
- * @extra_buffers_size: describe the second member of struct blah,
- * @data:i              describe the second member of struct blah,
+ * @free:               %true if buffer is free
+ * @allow_user_free:    %true if user is allowed to free buffer
+ * @async_transaction:  %true if buffer is in use for an async txn
+ * @debug_id:           unique ID for debugging
+ * @transaction:        pointer to associated struct binder_transaction
+ * @target_node:        struct binder_node associated with this buffer
+ * @data_size:          size of @transaction data
+ * @offsets_size:       size of array of offsets
+ * @extra_buffers_size: size of space for other objects (like sg lists)
+ * @data:               pointer to base of buffer space
  *
  * Bookkeeping structure for binder transaction buffers
  */
diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
new file mode 100644
index 000000000000..7fb97f503ef2
--- /dev/null
+++ b/drivers/android/binder_internal.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef _LINUX_BINDER_INTERNAL_H
+#define _LINUX_BINDER_INTERNAL_H
+
+#include <linux/export.h>
+#include <linux/fs.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/mutex.h>
+#include <linux/stddef.h>
+#include <linux/types.h>
+#include <linux/uidgid.h>
+
+struct binder_context {
+        struct binder_node *binder_context_mgr_node;
+        struct mutex context_mgr_node_lock;
+        kuid_t binder_context_mgr_uid;
+        const char *name;
+};
+
+/**
+ * struct binder_device - information about a binder device node
+ * @hlist:          list of binder devices (only used for devices requested via
+ *                  CONFIG_ANDROID_BINDER_DEVICES)
+ * @miscdev:        information about a binder character device node
+ * @context:        binder context information
+ * @binderfs_inode: This is the inode of the root dentry of the super block
+ *                  belonging to a binderfs mount.
+ */
+struct binder_device {
+        struct hlist_node hlist;
+        struct miscdevice miscdev;
+        struct binder_context context;
+        struct inode *binderfs_inode;
+};
+
+extern const struct file_operations binder_fops;
+
+#ifdef CONFIG_ANDROID_BINDERFS
+extern bool is_binderfs_device(const struct inode *inode);
+#else
+static inline bool is_binderfs_device(const struct inode *inode)
+{
+        return false;
+}
+#endif
+
+#endif /* _LINUX_BINDER_INTERNAL_H */
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
new file mode 100644
index 000000000000..7496b10532aa
--- /dev/null
+++ b/drivers/android/binderfs.c
@@ -0,0 +1,544 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <linux/compiler_types.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/fsnotify.h>
+#include <linux/gfp.h>
+#include <linux/idr.h>
+#include <linux/init.h>
+#include <linux/ipc_namespace.h>
+#include <linux/kdev_t.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/magic.h>
+#include <linux/major.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/mount.h>
+#include <linux/parser.h>
+#include <linux/radix-tree.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/spinlock_types.h>
+#include <linux/stddef.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include <linux/user_namespace.h>
+#include <linux/xarray.h>
+#include <uapi/asm-generic/errno-base.h>
+#include <uapi/linux/android/binder.h>
+#include <uapi/linux/android/binder_ctl.h>
+
+#include "binder_internal.h"
+
+#define FIRST_INODE 1
+#define SECOND_INODE 2
+#define INODE_OFFSET 3
+#define INTSTRLEN 21
+#define BINDERFS_MAX_MINOR (1U << MINORBITS)
+
+static struct vfsmount *binderfs_mnt;
+
+static dev_t binderfs_dev;
+static DEFINE_MUTEX(binderfs_minors_mutex);
+static DEFINE_IDA(binderfs_minors);
+
+/**
+ * binderfs_info - information about a binderfs mount
+ * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
+ * @control_dentry: This records the dentry of this binderfs mount
+ *                  binder-control device.
+ * @root_uid:       uid that needs to be used when a new binder device is
+ *                  created.
+ * @root_gid:       gid that needs to be used when a new binder device is
+ *                  created.
+ */
+struct binderfs_info {
+        struct ipc_namespace *ipc_ns;
+        struct dentry *control_dentry;
+        kuid_t root_uid;
+        kgid_t root_gid;
+
+};
+
+static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
+{
+        return inode->i_sb->s_fs_info;
+}
+
+bool is_binderfs_device(const struct inode *inode)
+{
+        if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
+                return true;
+
+        return false;
+}
+
+/**
+ * binderfs_binder_device_create - allocate inode from super block of a
+ *                                 binderfs mount
+ * @ref_inode: inode from wich the super block will be taken
+ * @userp:     buffer to copy information about new device for userspace to
+ * @req:       struct binderfs_device as copied from userspace
+ *
+ * This function allocated a new binder_device and reserves a new minor
+ * number for it.
+ * Minor numbers are limited and tracked globally in binderfs_minors. The
+ * function will stash a struct binder_device for the specific binder
+ * device in i_private of the inode.
+ * It will go on to allocate a new inode from the super block of the
+ * filesystem mount, stash a struct binder_device in its i_private field
+ * and attach a dentry to that inode.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int binderfs_binder_device_create(struct inode *ref_inode,
+                                         struct binderfs_device __user *userp,
+                                         struct binderfs_device *req)
+{
+        int minor, ret;
+        struct dentry *dentry, *dup, *root;
+        struct binder_device *device;
+        size_t name_len = BINDERFS_MAX_NAME + 1;
+        char *name = NULL;
+        struct inode *inode = NULL;
+        struct super_block *sb = ref_inode->i_sb;
+        struct binderfs_info *info = sb->s_fs_info;
+
+        /* Reserve new minor number for the new device. */
+        mutex_lock(&binderfs_minors_mutex);
+        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        mutex_unlock(&binderfs_minors_mutex);
+        if (minor < 0)
+                return minor;
+
+        ret = -ENOMEM;
+        device = kzalloc(sizeof(*device), GFP_KERNEL);
+        if (!device)
+                goto err;
+
+        inode = new_inode(sb);
+        if (!inode)
+                goto err;
+
+        inode->i_ino = minor + INODE_OFFSET;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+        init_special_inode(inode, S_IFCHR | 0600,
+                           MKDEV(MAJOR(binderfs_dev), minor));
+        inode->i_fop = &binder_fops;
+        inode->i_uid = info->root_uid;
+        inode->i_gid = info->root_gid;
+
+        name = kmalloc(name_len, GFP_KERNEL);
+        if (!name)
+                goto err;
+
+        strscpy(name, req->name, name_len);
+
+        device->binderfs_inode = inode;
+        device->context.binder_context_mgr_uid = INVALID_UID;
+        device->context.name = name;
+        device->miscdev.name = name;
+        device->miscdev.minor = minor;
+        mutex_init(&device->context.context_mgr_node_lock);
+
+        req->major = MAJOR(binderfs_dev);
+        req->minor = minor;
+
+        ret = copy_to_user(userp, req, sizeof(*req));
+        if (ret) {
+                ret = -EFAULT;
+                goto err;
+        }
+
+        root = sb->s_root;
+        inode_lock(d_inode(root));
+        dentry = d_alloc_name(root, name);
+        if (!dentry) {
+                inode_unlock(d_inode(root));
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        /* Verify that the name userspace gave us is not already in use. */
+        dup = d_lookup(root, &dentry->d_name);
+        if (dup) {
+                if (d_really_is_positive(dup)) {
+                        dput(dup);
+                        dput(dentry);
+                        inode_unlock(d_inode(root));
+                        ret = -EEXIST;
+                        goto err;
+                }
+                dput(dup);
+        }
+
+        inode->i_private = device;
+        d_add(dentry, inode);
+        fsnotify_create(root->d_inode, dentry);
+        inode_unlock(d_inode(root));
+
+        return 0;
+
+err:
+        kfree(name);
+        kfree(device);
+        mutex_lock(&binderfs_minors_mutex);
+        ida_free(&binderfs_minors, minor);
+        mutex_unlock(&binderfs_minors_mutex);
+        iput(inode);
+
+        return ret;
+}
+
+/**
+ * binderfs_ctl_ioctl - handle binder device node allocation requests
+ *
+ * The request handler for the binder-control device. All requests operate on
+ * the binderfs mount the binder-control device resides in:
+ * - BINDER_CTL_ADD
+ *   Allocate a new binder device.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
+                             unsigned long arg)
+{
+        int ret = -EINVAL;
+        struct inode *inode = file_inode(file);
+        struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
+        struct binderfs_device device_req;
+
+        switch (cmd) {
+        case BINDER_CTL_ADD:
+                ret = copy_from_user(&device_req, device, sizeof(device_req));
+                if (ret) {
+                        ret = -EFAULT;
+                        break;
+                }
+
+                ret = binderfs_binder_device_create(inode, device, &device_req);
+                break;
+        default:
+                break;
+        }
+
+        return ret;
+}
+
+static void binderfs_evict_inode(struct inode *inode)
+{
+        struct binder_device *device = inode->i_private;
+
+        clear_inode(inode);
+
+        if (!device)
+                return;
+
+        mutex_lock(&binderfs_minors_mutex);
+        ida_free(&binderfs_minors, device->miscdev.minor);
+        mutex_unlock(&binderfs_minors_mutex);
+
+        kfree(device->context.name);
+        kfree(device);
+}
+
+static const struct super_operations binderfs_super_ops = {
+        .statfs = simple_statfs,
+        .evict_inode = binderfs_evict_inode,
+};
+
+static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+                           struct inode *new_dir, struct dentry *new_dentry,
+                           unsigned int flags)
+{
+        struct inode *inode = d_inode(old_dentry);
+
+        /* binderfs doesn't support directories. */
+        if (d_is_dir(old_dentry))
+                return -EPERM;
+
+        if (flags & ~RENAME_NOREPLACE)
+                return -EINVAL;
+
+        if (!simple_empty(new_dentry))
+                return -ENOTEMPTY;
+
+        if (d_really_is_positive(new_dentry))
+                simple_unlink(new_dir, new_dentry);
+
+        old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
+                new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
+
+        return 0;
+}
+
+static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
+{
+        /*
+         * The control dentry is only ever touched during mount so checking it
+         * here should not require us to take lock.
+         */
+        if (BINDERFS_I(dir)->control_dentry == dentry)
+                return -EPERM;
+
+        return simple_unlink(dir, dentry);
+}
+
+static const struct file_operations binder_ctl_fops = {
+        .owner          = THIS_MODULE,
+        .open           = nonseekable_open,
+        .unlocked_ioctl = binder_ctl_ioctl,
+        .compat_ioctl   = binder_ctl_ioctl,
+        .llseek         = noop_llseek,
+};
+
+/**
+ * binderfs_binder_ctl_create - create a new binder-control device
+ * @sb: super block of the binderfs mount
+ *
+ * This function creates a new binder-control device node in the binderfs mount
+ * referred to by @sb.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int binderfs_binder_ctl_create(struct super_block *sb)
+{
+        int minor, ret;
+        struct dentry *dentry;
+        struct binder_device *device;
+        struct inode *inode = NULL;
+        struct dentry *root = sb->s_root;
+        struct binderfs_info *info = sb->s_fs_info;
+
+        device = kzalloc(sizeof(*device), GFP_KERNEL);
+        if (!device)
+                return -ENOMEM;
+
+        inode_lock(d_inode(root));
+
+        /* If we have already created a binder-control node, return. */
+        if (info->control_dentry) {
+                ret = 0;
+                goto out;
+        }
+
+        ret = -ENOMEM;
+        inode = new_inode(sb);
+        if (!inode)
+                goto out;
+
+        /* Reserve a new minor number for the new device. */
+        mutex_lock(&binderfs_minors_mutex);
+        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        mutex_unlock(&binderfs_minors_mutex);
+        if (minor < 0) {
+                ret = minor;
+                goto out;
+        }
+
+        inode->i_ino = SECOND_INODE;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+        init_special_inode(inode, S_IFCHR | 0600,
+                           MKDEV(MAJOR(binderfs_dev), minor));
+        inode->i_fop = &binder_ctl_fops;
+        inode->i_uid = info->root_uid;
+        inode->i_gid = info->root_gid;
+
+        device->binderfs_inode = inode;
+        device->miscdev.minor = minor;
+
+        dentry = d_alloc_name(root, "binder-control");
+        if (!dentry)
+                goto out;
+
+        inode->i_private = device;
+        info->control_dentry = dentry;
+        d_add(dentry, inode);
+        inode_unlock(d_inode(root));
+
+        return 0;
+
+out:
+        inode_unlock(d_inode(root));
+        kfree(device);
+        iput(inode);
+
+        return ret;
+}
+
+static const struct inode_operations binderfs_dir_inode_operations = {
+        .lookup = simple_lookup,
+        .rename = binderfs_rename,
+        .unlink = binderfs_unlink,
+};
+
+static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
+{
+        struct binderfs_info *info;
+        int ret = -ENOMEM;
+        struct inode *inode = NULL;
+        struct ipc_namespace *ipc_ns = sb->s_fs_info;
+
+        get_ipc_ns(ipc_ns);
+
+        sb->s_blocksize = PAGE_SIZE;
+        sb->s_blocksize_bits = PAGE_SHIFT;
+
+        /*
+         * The binderfs filesystem can be mounted by userns root in a
+         * non-initial userns. By default such mounts have the SB_I_NODEV flag
+         * set in s_iflags to prevent security issues where userns root can
+         * just create random device nodes via mknod() since it owns the
+         * filesystem mount. But binderfs does not allow to create any files
+         * including devices nodes. The only way to create binder devices nodes
+         * is through the binder-control device which userns root is explicitly
+         * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
+         * necessary and safe.
+         */
+        sb->s_iflags &= ~SB_I_NODEV;
+        sb->s_iflags |= SB_I_NOEXEC;
+        sb->s_magic = BINDERFS_SUPER_MAGIC;
+        sb->s_op = &binderfs_super_ops;
+        sb->s_time_gran = 1;
+
+        info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
+        if (!info)
+                goto err_without_dentry;
+
+        info->ipc_ns = ipc_ns;
+        info->root_gid = make_kgid(sb->s_user_ns, 0);
+        if (!gid_valid(info->root_gid))
+                info->root_gid = GLOBAL_ROOT_GID;
+        info->root_uid = make_kuid(sb->s_user_ns, 0);
+        if (!uid_valid(info->root_uid))
+                info->root_uid = GLOBAL_ROOT_UID;
+
+        sb->s_fs_info = info;
+
+        inode = new_inode(sb);
+        if (!inode)
+                goto err_without_dentry;
+
+        inode->i_ino = FIRST_INODE;
+        inode->i_fop = &simple_dir_operations;
+        inode->i_mode = S_IFDIR | 0755;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+        inode->i_op = &binderfs_dir_inode_operations;
+        set_nlink(inode, 2);
+
+        sb->s_root = d_make_root(inode);
+        if (!sb->s_root)
+                goto err_without_dentry;
+
+        ret = binderfs_binder_ctl_create(sb);
+        if (ret)
+                goto err_with_dentry;
+
+        return 0;
+
+err_with_dentry:
+        dput(sb->s_root);
+        sb->s_root = NULL;
+
+err_without_dentry:
+        put_ipc_ns(ipc_ns);
+        iput(inode);
+        kfree(info);
+
+        return ret;
+}
+
+static int binderfs_test_super(struct super_block *sb, void *data)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+
+        if (info)
+                return info->ipc_ns == data;
+
+        return 0;
+}
+
+static int binderfs_set_super(struct super_block *sb, void *data)
+{
+        sb->s_fs_info = data;
+        return set_anon_super(sb, NULL);
+}
+
+static struct dentry *binderfs_mount(struct file_system_type *fs_type,
+                                     int flags, const char *dev_name,
+                                     void *data)
+{
+        struct super_block *sb;
+        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
+
+        if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN))
+                return ERR_PTR(-EPERM);
+
+        sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super,
+                         flags, ipc_ns->user_ns, ipc_ns);
+        if (IS_ERR(sb))
+                return ERR_CAST(sb);
+
+        if (!sb->s_root) {
+                int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
+                if (ret) {
+                        deactivate_locked_super(sb);
+                        return ERR_PTR(ret);
+                }
+
+                sb->s_flags |= SB_ACTIVE;
+        }
+
+        return dget(sb->s_root);
+}
+
+static void binderfs_kill_super(struct super_block *sb)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+
+        if (info && info->ipc_ns)
+                put_ipc_ns(info->ipc_ns);
+
+        kfree(info);
+        kill_litter_super(sb);
+}
+
+static struct file_system_type binder_fs_type = {
+        .name           = "binder",
+        .mount          = binderfs_mount,
+        .kill_sb        = binderfs_kill_super,
+        .fs_flags       = FS_USERNS_MOUNT,
+};
+
+static int __init init_binderfs(void)
+{
+        int ret;
+
+        /* Allocate new major number for binderfs. */
+        ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
+                                  "binder");
+        if (ret)
+                return ret;
+
+        ret = register_filesystem(&binder_fs_type);
+        if (ret) {
+                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
+                return ret;
+        }
+
+        binderfs_mnt = kern_mount(&binder_fs_type);
+        if (IS_ERR(binderfs_mnt)) {
+                ret = PTR_ERR(binderfs_mnt);
+                binderfs_mnt = NULL;
+                unregister_filesystem(&binder_fs_type);
+                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
+        }
+
+        return ret;
+}
+
+device_initcall(init_binderfs);
diff --git a/drivers/bus/fsl-mc/dpbp.c b/drivers/bus/fsl-mc/dpbp.c
index 17e3c5d2f22e..9003cd3698a5 100644
--- a/drivers/bus/fsl-mc/dpbp.c
+++ b/drivers/bus/fsl-mc/dpbp.c
@@ -5,7 +5,6 @@
  */
 #include <linux/kernel.h>
 #include <linux/fsl/mc.h>
-#include <linux/fsl/mc.h>
 
 #include "fsl-mc-private.h"
 
diff --git a/drivers/bus/fsl-mc/dpcon.c b/drivers/bus/fsl-mc/dpcon.c
index 760555d7946e..97b6fa605e62 100644
--- a/drivers/bus/fsl-mc/dpcon.c
+++ b/drivers/bus/fsl-mc/dpcon.c
@@ -5,7 +5,6 @@
  */
 #include <linux/kernel.h>
 #include <linux/fsl/mc.h>
-#include <linux/fsl/mc.h>
 
 #include "fsl-mc-private.h"
 
diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
index a6444244c411..56b01e4344d3 100644
--- a/drivers/bus/qcom-ebi2.c
+++ b/drivers/bus/qcom-ebi2.c
@@ -21,7 +21,6 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/init.h>
-#include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
 #include <linux/bitops.h>
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 8c4dd1a3bb6a..5c8d780637bd 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -46,8 +46,8 @@
  *      lp=auto                         (assign lp devices to all ports that
  *                                       have printers attached, as determined
  *                                       by the IEEE-1284 autoprobe)
- * 
- *      lp=reset                        (reset the printer during 
+ *
+ *      lp=reset                        (reset the printer during
  *                                       initialisation)
  *
  *      lp=off                          (disable the printer driver entirely)
@@ -141,6 +141,7 @@
 
 static DEFINE_MUTEX(lp_mutex);
 static struct lp_struct lp_table[LP_NO];
+static int port_num[LP_NO];
 
 static unsigned int lp_count = 0;
 static struct class *lp_class;
@@ -166,7 +167,7 @@ static struct parport *console_registered;
 static void lp_claim_parport_or_block(struct lp_struct *this_lp)
 {
         if (!test_and_set_bit(LP_PARPORT_CLAIMED, &this_lp->bits)) {
-                parport_claim_or_block (this_lp->dev);
+                parport_claim_or_block(this_lp->dev);
         }
 }
 
@@ -174,7 +175,7 @@ static void lp_claim_parport_or_block(struct lp_struct *this_lp)
 static void lp_release_parport(struct lp_struct *this_lp)
 {
         if (test_and_clear_bit(LP_PARPORT_CLAIMED, &this_lp->bits)) {
-                parport_release (this_lp->dev);
+                parport_release(this_lp->dev);
         }
 }
 
@@ -184,37 +185,37 @@ static int lp_preempt(void *handle)
 {
         struct lp_struct *this_lp = (struct lp_struct *)handle;
         set_bit(LP_PREEMPT_REQUEST, &this_lp->bits);
-        return (1);
+        return 1;
 }
 
 
-/* 
+/*
  * Try to negotiate to a new mode; if unsuccessful negotiate to
  * compatibility mode.  Return the mode we ended up in.
  */
-static int lp_negotiate(struct parport * port, int mode)
+static int lp_negotiate(struct parport *port, int mode)
 {
-        if (parport_negotiate (port, mode) != 0) {
+        if (parport_negotiate(port, mode) != 0) {
                 mode = IEEE1284_MODE_COMPAT;
-                parport_negotiate (port, mode);
+                parport_negotiate(port, mode);
         }
 
-        return (mode);
+        return mode;
 }
 
 static int lp_reset(int minor)
 {
         int retval;
-        lp_claim_parport_or_block (&lp_table[minor]);
+        lp_claim_parport_or_block(&lp_table[minor]);
         w_ctr(minor, LP_PSELECP);
-        udelay (LP_DELAY);
+        udelay(LP_DELAY);
         w_ctr(minor, LP_PSELECP | LP_PINITP);
         retval = r_str(minor);
-        lp_release_parport (&lp_table[minor]);
+        lp_release_parport(&lp_table[minor]);
         return retval;
 }
 
-static void lp_error (int minor)
+static void lp_error(int minor)
 {
         DEFINE_WAIT(wait);
         int polling;
@@ -223,12 +224,15 @@ static void lp_error (int minor)
                 return;
 
         polling = lp_table[minor].dev->port->irq == PARPORT_IRQ_NONE;
-        if (polling) lp_release_parport (&lp_table[minor]);
+        if (polling)
+                lp_release_parport(&lp_table[minor]);
         prepare_to_wait(&lp_table[minor].waitq, &wait, TASK_INTERRUPTIBLE);
         schedule_timeout(LP_TIMEOUT_POLLED);
         finish_wait(&lp_table[minor].waitq, &wait);
-        if (polling) lp_claim_parport_or_block (&lp_table[minor]);
-        else parport_yield_blocking (lp_table[minor].dev);
+        if (polling)
+                lp_claim_parport_or_block(&lp_table[minor]);
+        else
+                parport_yield_blocking(lp_table[minor].dev);
 }
 
 static int lp_check_status(int minor)
@@ -259,7 +263,7 @@ static int lp_check_status(int minor)
                 error = -EIO;
         } else {
                 last = 0; /* Come here if LP_CAREFUL is set and no
-                             errors are reported. */
+                             errors are reported. */
         }
 
         lp_table[minor].last_error = last;
@@ -276,14 +280,14 @@ static int lp_wait_ready(int minor, int nonblock)
 
         /* If we're not in compatibility mode, we're ready now! */
         if (lp_table[minor].current_mode != IEEE1284_MODE_COMPAT) {
-          return (0);
+                return 0;
         }
 
         do {
-                error = lp_check_status (minor);
+                error = lp_check_status(minor);
                 if (error && (nonblock || (LP_F(minor) & LP_ABORT)))
                         break;
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         error = -EINTR;
                         break;
                 }
@@ -291,8 +295,8 @@ static int lp_wait_ready(int minor, int nonblock)
         return error;
 }
 
-static ssize_t lp_write(struct file * file, const char __user * buf,
-                        size_t count, loff_t *ppos)
+static ssize_t lp_write(struct file *file, const char __user *buf,
+                        size_t count, loff_t *ppos)
 {
         unsigned int minor = iminor(file_inode(file));
         struct parport *port = lp_table[minor].dev->port;
@@ -317,26 +321,26 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
         if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
                 return -EINTR;
 
-        if (copy_from_user (kbuf, buf, copy_size)) {
+        if (copy_from_user(kbuf, buf, copy_size)) {
                 retv = -EFAULT;
                 goto out_unlock;
         }
 
-        /* Claim Parport or sleep until it becomes available
-         */
-        lp_claim_parport_or_block (&lp_table[minor]);
+        /* Claim Parport or sleep until it becomes available
+         */
+        lp_claim_parport_or_block(&lp_table[minor]);
         /* Go to the proper mode. */
-        lp_table[minor].current_mode = lp_negotiate (port, 
-                                                     lp_table[minor].best_mode);
+        lp_table[minor].current_mode = lp_negotiate(port,
+                                                    lp_table[minor].best_mode);
 
-        parport_set_timeout (lp_table[minor].dev,
-                             (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
-                              : lp_table[minor].timeout));
+        parport_set_timeout(lp_table[minor].dev,
+                            (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
+                             : lp_table[minor].timeout));
 
-        if ((retv = lp_wait_ready (minor, nonblock)) == 0)
+        if ((retv = lp_wait_ready(minor, nonblock)) == 0)
         do {
                 /* Write the data. */
-                written = parport_write (port, kbuf, copy_size);
+                written = parport_write(port, kbuf, copy_size);
                 if (written > 0) {
                         copy_size -= written;
                         count -= written;
@@ -344,7 +348,7 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                         retv += written;
                 }
 
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         if (retv == 0)
                                 retv = -EINTR;
 
@@ -355,11 +359,11 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                         /* incomplete write -> check error ! */
                         int error;
 
-                        parport_negotiate (lp_table[minor].dev->port, 
-                                           IEEE1284_MODE_COMPAT);
+                        parport_negotiate(lp_table[minor].dev->port,
+                                          IEEE1284_MODE_COMPAT);
                         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
 
-                        error = lp_wait_ready (minor, nonblock);
+                        error = lp_wait_ready(minor, nonblock);
 
                         if (error) {
                                 if (retv == 0)
@@ -371,13 +375,13 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                                 break;
                         }
 
-                        parport_yield_blocking (lp_table[minor].dev);
-                        lp_table[minor].current_mode 
-                          = lp_negotiate (port, 
-                                          lp_table[minor].best_mode);
+                        parport_yield_blocking(lp_table[minor].dev);
+                        lp_table[minor].current_mode
+                          = lp_negotiate(port,
+                                         lp_table[minor].best_mode);
 
                 } else if (need_resched())
-                        schedule ();
+                        schedule();
 
                 if (count) {
                         copy_size = count;
@@ -389,27 +393,27 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                                         retv = -EFAULT;
                                 break;
                         }
-                }       
+                }
         } while (count > 0);
 
-        if (test_and_clear_bit(LP_PREEMPT_REQUEST, 
+        if (test_and_clear_bit(LP_PREEMPT_REQUEST,
                                &lp_table[minor].bits)) {
                 printk(KERN_INFO "lp%d releasing parport\n", minor);
-                parport_negotiate (lp_table[minor].dev->port, 
-                                   IEEE1284_MODE_COMPAT);
+                parport_negotiate(lp_table[minor].dev->port,
+                                  IEEE1284_MODE_COMPAT);
                 lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
-                lp_release_parport (&lp_table[minor]);
+                lp_release_parport(&lp_table[minor]);
         }
 out_unlock:
         mutex_unlock(&lp_table[minor].port_mutex);
 
-        return retv;
+        return retv;
 }
 
 #ifdef CONFIG_PARPORT_1284
 
 /* Status readback conforming to ieee1284 */
-static ssize_t lp_read(struct file * file, char __user * buf,
+static ssize_t lp_read(struct file *file, char __user *buf,
                        size_t count, loff_t *ppos)
 {
         DEFINE_WAIT(wait);
@@ -426,21 +430,21 @@ static ssize_t lp_read(struct file * file, char __user * buf,
         if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
                 return -EINTR;
 
-        lp_claim_parport_or_block (&lp_table[minor]);
+        lp_claim_parport_or_block(&lp_table[minor]);
 
-        parport_set_timeout (lp_table[minor].dev,
-                             (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
-                              : lp_table[minor].timeout));
+        parport_set_timeout(lp_table[minor].dev,
+                            (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
+                             : lp_table[minor].timeout));
 
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
-        if (parport_negotiate (lp_table[minor].dev->port,
-                               IEEE1284_MODE_NIBBLE)) {
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        if (parport_negotiate(lp_table[minor].dev->port,
+                              IEEE1284_MODE_NIBBLE)) {
                 retval = -EIO;
                 goto out;
         }
 
         while (retval == 0) {
-                retval = parport_read (port, kbuf, count);
+                retval = parport_read(port, kbuf, count);
 
                 if (retval > 0)
                         break;
@@ -453,11 +457,11 @@ static ssize_t lp_read(struct file * file, char __user * buf,
                 /* Wait for data. */
 
                 if (lp_table[minor].dev->port->irq == PARPORT_IRQ_NONE) {
-                        parport_negotiate (lp_table[minor].dev->port,
-                                           IEEE1284_MODE_COMPAT);
-                        lp_error (minor);
-                        if (parport_negotiate (lp_table[minor].dev->port,
-                                               IEEE1284_MODE_NIBBLE)) {
+                        parport_negotiate(lp_table[minor].dev->port,
+                                          IEEE1284_MODE_COMPAT);
+                        lp_error(minor);
+                        if (parport_negotiate(lp_table[minor].dev->port,
+                                              IEEE1284_MODE_NIBBLE)) {
                                 retval = -EIO;
                                 goto out;
                         }
@@ -467,18 +471,18 @@ static ssize_t lp_read(struct file * file, char __user * buf,
                         finish_wait(&lp_table[minor].waitq, &wait);
                 }
 
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         retval = -ERESTARTSYS;
                         break;
                 }
 
-                cond_resched ();
+                cond_resched();
         }
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
  out:
-        lp_release_parport (&lp_table[minor]);
+        lp_release_parport(&lp_table[minor]);
 
-        if (retval > 0 && copy_to_user (buf, kbuf, retval))
+        if (retval > 0 && copy_to_user(buf, kbuf, retval))
                 retval = -EFAULT;
 
         mutex_unlock(&lp_table[minor].port_mutex);
@@ -488,7 +492,7 @@ static ssize_t lp_read(struct file * file, char __user * buf,
 
 #endif /* IEEE 1284 support */
 
-static int lp_open(struct inode * inode, struct file * file)
+static int lp_open(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode);
         int ret = 0;
@@ -513,9 +517,9 @@ static int lp_open(struct inode * inode, struct file * file)
            should most likely only ever be used by the tunelp application. */
         if ((LP_F(minor) & LP_ABORTOPEN) && !(file->f_flags & O_NONBLOCK)) {
                 int status;
-                lp_claim_parport_or_block (&lp_table[minor]);
+                lp_claim_parport_or_block(&lp_table[minor]);
                 status = r_str(minor);
-                lp_release_parport (&lp_table[minor]);
+                lp_release_parport(&lp_table[minor]);
                 if (status & LP_POUTPA) {
                         printk(KERN_INFO "lp%d out of paper\n", minor);
                         LP_F(minor) &= ~LP_BUSY;
@@ -540,32 +544,32 @@ static int lp_open(struct inode * inode, struct file * file)
                 goto out;
         }
         /* Determine if the peripheral supports ECP mode */
-        lp_claim_parport_or_block (&lp_table[minor]);
+        lp_claim_parport_or_block(&lp_table[minor]);
         if ( (lp_table[minor].dev->port->modes & PARPORT_MODE_ECP) &&
-             !parport_negotiate (lp_table[minor].dev->port, 
-                                 IEEE1284_MODE_ECP)) {
-                printk (KERN_INFO "lp%d: ECP mode\n", minor);
+             !parport_negotiate(lp_table[minor].dev->port,
+                                 IEEE1284_MODE_ECP)) {
+                printk(KERN_INFO "lp%d: ECP mode\n", minor);
                 lp_table[minor].best_mode = IEEE1284_MODE_ECP;
         } else {
                 lp_table[minor].best_mode = IEEE1284_MODE_COMPAT;
         }
         /* Leave peripheral in compatibility mode */
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
-        lp_release_parport (&lp_table[minor]);
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        lp_release_parport(&lp_table[minor]);
         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
 out:
         mutex_unlock(&lp_mutex);
         return ret;
 }
 
-static int lp_release(struct inode * inode, struct file * file)
+static int lp_release(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode);
 
-        lp_claim_parport_or_block (&lp_table[minor]);
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        lp_claim_parport_or_block(&lp_table[minor]);
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
-        lp_release_parport (&lp_table[minor]);
+        lp_release_parport(&lp_table[minor]);
         kfree(lp_table[minor].lp_buffer);
         lp_table[minor].lp_buffer = NULL;
         LP_F(minor) &= ~LP_BUSY;
@@ -615,7 +619,7 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                 case LPWAIT:
                         LP_WAIT(minor) = arg;
                         break;
-                case LPSETIRQ: 
+                case LPSETIRQ:
                         return -EINVAL;
                         break;
                 case LPGETIRQ:
@@ -626,9 +630,9 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                 case LPGETSTATUS:
                         if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
                                 return -EINTR;
-                        lp_claim_parport_or_block (&lp_table[minor]);
+                        lp_claim_parport_or_block(&lp_table[minor]);
                         status = r_str(minor);
-                        lp_release_parport (&lp_table[minor]);
+                        lp_release_parport(&lp_table[minor]);
                         mutex_unlock(&lp_table[minor].port_mutex);
 
                         if (copy_to_user(argp, &status, sizeof(int)))
@@ -647,8 +651,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                                                 sizeof(struct lp_stats));
                         break;
 #endif
-                case LPGETFLAGS:
-                        status = LP_F(minor);
+                case LPGETFLAGS:
+                        status = LP_F(minor);
                         if (copy_to_user(argp, &status, sizeof(int)))
                                 return -EFAULT;
                         break;
@@ -801,31 +805,31 @@ static const struct file_operations lp_fops = {
 
 /* The console must be locked when we get here. */
 
-static void lp_console_write (struct console *co, const char *s,
-                              unsigned count)
+static void lp_console_write(struct console *co, const char *s,
+                             unsigned count)
 {
         struct pardevice *dev = lp_table[CONSOLE_LP].dev;
         struct parport *port = dev->port;
         ssize_t written;
 
-        if (parport_claim (dev))
+        if (parport_claim(dev))
                 /* Nothing we can do. */
                 return;
 
-        parport_set_timeout (dev, 0);
+        parport_set_timeout(dev, 0);
 
         /* Go to compatibility mode. */
-        parport_negotiate (port, IEEE1284_MODE_COMPAT);
+        parport_negotiate(port, IEEE1284_MODE_COMPAT);
 
         do {
                 /* Write the data, converting LF->CRLF as we go. */
                 ssize_t canwrite = count;
-                char *lf = memchr (s, '\n', count);
+                char *lf = memchr(s, '\n', count);
                 if (lf)
                         canwrite = lf - s;
 
                 if (canwrite > 0) {
-                        written = parport_write (port, s, canwrite);
+                        written = parport_write(port, s, canwrite);
 
                         if (written <= 0)
                                 continue;
@@ -843,14 +847,14 @@ static void lp_console_write (struct console *co, const char *s,
                         s++;
                         count--;
                         do {
-                                written = parport_write (port, crlf, i);
+                                written = parport_write(port, crlf, i);
                                 if (written > 0)
                                         i -= written, crlf += written;
                         } while (i > 0 && (CONSOLE_LP_STRICT || written > 0));
                 }
         } while (count > 0 && (CONSOLE_LP_STRICT || written > 0));
 
-        parport_release (dev);
+        parport_release(dev);
 }
 
 static struct console lpcons = {
@@ -871,7 +875,7 @@ module_param_array(parport, charp, NULL, 0);
 module_param(reset, bool, 0);
 
 #ifndef MODULE
-static int __init lp_setup (char *str)
+static int __init lp_setup(char *str)
 {
         static int parport_ptr;
         int x;
@@ -908,9 +912,13 @@ static int __init lp_setup (char *str)
 
 static int lp_register(int nr, struct parport *port)
 {
-        lp_table[nr].dev = parport_register_device(port, "lp", 
-                                                   lp_preempt, NULL, NULL, 0,
-                                                   (void *) &lp_table[nr]);
+        struct pardev_cb ppdev_cb;
+
+        memset(&ppdev_cb, 0, sizeof(ppdev_cb));
+        ppdev_cb.preempt = lp_preempt;
+        ppdev_cb.private = &lp_table[nr];
+        lp_table[nr].dev = parport_register_dev_model(port, "lp",
+                                                      &ppdev_cb, nr);
         if (lp_table[nr].dev == NULL)
                 return 1;
         lp_table[nr].flags |= LP_EXIST;
@@ -921,7 +929,7 @@ static int lp_register(int nr, struct parport *port)
         device_create(lp_class, port->dev, MKDEV(LP_MAJOR, nr), NULL,
                       "lp%d", nr);
 
-        printk(KERN_INFO "lp%d: using %s (%s).\n", nr, port->name, 
+        printk(KERN_INFO "lp%d: using %s (%s).\n", nr, port->name,
                (port->irq == PARPORT_IRQ_NONE)?"polling":"interrupt-driven");
 
 #ifdef CONFIG_LP_CONSOLE
@@ -929,17 +937,18 @@ static int lp_register(int nr, struct parport *port)
                 if (port->modes & PARPORT_MODE_SAFEININT) {
                         register_console(&lpcons);
                         console_registered = port;
-                        printk (KERN_INFO "lp%d: console ready\n", CONSOLE_LP);
+                        printk(KERN_INFO "lp%d: console ready\n", CONSOLE_LP);
                 } else
-                        printk (KERN_ERR "lp%d: cannot run console on %s\n",
-                                CONSOLE_LP, port->name);
+                        printk(KERN_ERR "lp%d: cannot run console on %s\n",
+                               CONSOLE_LP, port->name);
         }
 #endif
+        port_num[nr] = port->number;
 
         return 0;
 }
 
-static void lp_attach (struct parport *port)
+static void lp_attach(struct parport *port)
 {
         unsigned int i;
 
@@ -953,7 +962,11 @@ static void lp_attach (struct parport *port)
                         printk(KERN_INFO "lp: ignoring parallel port (max. %d)\n",LP_NO);
                         return;
                 }
-                if (!lp_register(lp_count, port))
+                for (i = 0; i < LP_NO; i++)
+                        if (port_num[i] == -1)
+                                break;
+
+                if (!lp_register(i, port))
                         lp_count++;
                 break;
 
@@ -969,8 +982,10 @@ static void lp_attach (struct parport *port)
         }
 }
 
-static void lp_detach (struct parport *port)
+static void lp_detach(struct parport *port)
 {
+        int n;
+
         /* Write this some day. */
 #ifdef CONFIG_LP_CONSOLE
         if (console_registered == port) {
@@ -978,15 +993,25 @@ static void lp_detach (struct parport *port)
                 console_registered = NULL;
         }
 #endif /* CONFIG_LP_CONSOLE */
+
+        for (n = 0; n < LP_NO; n++) {
+                if (port_num[n] == port->number) {
+                        port_num[n] = -1;
+                        lp_count--;
+                        device_destroy(lp_class, MKDEV(LP_MAJOR, n));
+                        parport_unregister_device(lp_table[n].dev);
+                }
+        }
 }
 
 static struct parport_driver lp_driver = {
         .name = "lp",
-        .attach = lp_attach,
+        .match_port = lp_attach,
         .detach = lp_detach,
+        .devmodel = true,
 };
 
-static int __init lp_init (void)
+static int __init lp_init(void)
 {
         int i, err = 0;
 
@@ -1003,17 +1028,18 @@ static int __init lp_init (void)
 #ifdef LP_STATS
                 lp_table[i].lastcall = 0;
                 lp_table[i].runchars = 0;
-                memset (&lp_table[i].stats, 0, sizeof (struct lp_stats));
+                memset(&lp_table[i].stats, 0, sizeof(struct lp_stats));
 #endif
                 lp_table[i].last_error = 0;
-                init_waitqueue_head (&lp_table[i].waitq);
-                init_waitqueue_head (&lp_table[i].dataq);
+                init_waitqueue_head(&lp_table[i].waitq);
+                init_waitqueue_head(&lp_table[i].dataq);
                 mutex_init(&lp_table[i].port_mutex);
                 lp_table[i].timeout = 10 * HZ;
+                port_num[i] = -1;
         }
 
-        if (register_chrdev (LP_MAJOR, "lp", &lp_fops)) {
-                printk (KERN_ERR "lp: unable to get major %d\n", LP_MAJOR);
+        if (register_chrdev(LP_MAJOR, "lp", &lp_fops)) {
+                printk(KERN_ERR "lp: unable to get major %d\n", LP_MAJOR);
                 return -EIO;
         }
 
@@ -1023,17 +1049,17 @@ static int __init lp_init (void)
                 goto out_reg;
         }
 
-        if (parport_register_driver (&lp_driver)) {
-                printk (KERN_ERR "lp: unable to register with parport\n");
+        if (parport_register_driver(&lp_driver)) {
+                printk(KERN_ERR "lp: unable to register with parport\n");
                 err = -EIO;
                 goto out_class;
         }
 
         if (!lp_count) {
-                printk (KERN_INFO "lp: driver loaded but no devices found\n");
+                printk(KERN_INFO "lp: driver loaded but no devices found\n");
 #ifndef CONFIG_PARPORT_1284
                 if (parport_nr[0] == LP_PARPORT_AUTO)
-                        printk (KERN_INFO "lp: (is IEEE 1284 support enabled?)\n");
+                        printk(KERN_INFO "lp: (is IEEE 1284 support enabled?)\n");
 #endif
         }
 
@@ -1046,7 +1072,7 @@ out_reg:
         return err;
 }
 
-static int __init lp_init_module (void)
+static int __init lp_init_module(void)
 {
         if (parport[0]) {
                 /* The user gave some parameters.  Let's see what they were.  */
@@ -1060,7 +1086,7 @@ static int __init lp_init_module (void)
                                 else {
                                         char *ep;
                                         unsigned long r = simple_strtoul(parport[n], &ep, 0);
-                                        if (ep != parport[n]) 
+                                        if (ep != parport[n])
                                                 parport_nr[n] = r;
                                         else {
                                                 printk(KERN_ERR "lp: bad port specifier `%s'\n", parport[n]);
@@ -1074,23 +1100,15 @@ static int __init lp_init_module (void)
         return lp_init();
 }
 
-static void lp_cleanup_module (void)
+static void lp_cleanup_module(void)
 {
-        unsigned int offset;
-
-        parport_unregister_driver (&lp_driver);
+        parport_unregister_driver(&lp_driver);
 
 #ifdef CONFIG_LP_CONSOLE
-        unregister_console (&lpcons);
+        unregister_console(&lpcons);
 #endif
 
         unregister_chrdev(LP_MAJOR, "lp");
-        for (offset = 0; offset < LP_NO; offset++) {
-                if (lp_table[offset].dev == NULL)
-                        continue;
-                parport_unregister_device(lp_table[offset].dev);
-                device_destroy(lp_class, MKDEV(LP_MAJOR, offset));
-        }
         class_destroy(lp_class);
 }
 
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index 4948c8bda6b1..62b7c721c732 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -866,8 +866,8 @@ static int __init rtc_init(void)
 #ifdef CONFIG_SPARC32
         for_each_node_by_name(ebus_dp, "ebus") {
                 struct device_node *dp;
-                for (dp = ebus_dp; dp; dp = dp->sibling) {
-                        if (!strcmp(dp->name, "rtc")) {
+                for_each_child_of_node(ebus_dp, dp) {
+                        if (of_node_name_eq(dp, "rtc")) {
                                 op = of_find_device_by_node(dp);
                                 if (op) {
                                         rtc_port = op->resource[0].start;
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 8eeb4190207d..6d81bb3bb503 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -506,28 +506,28 @@ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
 
         val = (unsigned char)tmp;
         spin_lock_irqsave(&event_lock, flags);
-                if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x28);
-                        SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
-                } else if (val >= CLK_8_592MHz) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x38);
-                        switch (val) {
-                        case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
-                                break;
-                        case CLK_11_184MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
-                                break;
-                        case CLK_34_368MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
-                                break;
-                        case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
-                                break;
-                        }
-                } else
-                        SET_PORT_BITS(TLCLK_REG3, 0xc7, val << 3);
-
+        if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
+                SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x28);
+                SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
+        } else if (val >= CLK_8_592MHz) {
+                SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x38);
+                switch (val) {
+                case CLK_8_592MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                        break;
+                case CLK_11_184MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
+                        break;
+                case CLK_34_368MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
+                        break;
+                case CLK_44_736MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                        break;
+                }
+        } else {
+                SET_PORT_BITS(TLCLK_REG3, 0xc7, val << 3);
+        }
         spin_unlock_irqrestore(&event_lock, flags);
 
         return strnlen(buf, count);
@@ -548,27 +548,28 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
 
         val = (unsigned char)tmp;
         spin_lock_irqsave(&event_lock, flags);
-                if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x5);
-                        SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
-                } else if (val >= CLK_8_592MHz) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
-                        switch (val) {
-                        case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
-                                break;
-                        case CLK_11_184MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
-                                break;
-                        case CLK_34_368MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
-                                break;
-                        case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
-                                break;
-                        }
-                } else
-                        SET_PORT_BITS(TLCLK_REG3, 0xf8, val);
+        if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
+                SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x5);
+                SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
+        } else if (val >= CLK_8_592MHz) {
+                SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
+                switch (val) {
+                case CLK_8_592MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                        break;
+                case CLK_11_184MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
+                        break;
+                case CLK_34_368MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
+                        break;
+                case CLK_44_736MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                        break;
+                }
+        } else {
+                SET_PORT_BITS(TLCLK_REG3, 0xf8, val);
+        }
         spin_unlock_irqrestore(&event_lock, flags);
 
         return strnlen(buf, count);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 5b5b5d72eab7..fbeb71953526 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1309,7 +1309,7 @@ static const struct attribute_group port_attribute_group = {
         .attrs = port_sysfs_entries,
 };
 
-static int debugfs_show(struct seq_file *s, void *data)
+static int port_debugfs_show(struct seq_file *s, void *data)
 {
         struct port *port = s->private;
 
@@ -1327,18 +1327,7 @@ static int debugfs_show(struct seq_file *s, void *data)
         return 0;
 }
 
-static int debugfs_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, debugfs_show, inode->i_private);
-}
-
-static const struct file_operations port_debugfs_ops = {
-        .owner = THIS_MODULE,
-        .open = debugfs_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(port_debugfs);
 
 static void set_console_size(struct port *port, u16 rows, u16 cols)
 {
@@ -1490,7 +1479,7 @@ static int add_port(struct ports_device *portdev, u32 id)
                 port->debugfs_file = debugfs_create_file(debugfs_name, 0444,
                                                          pdrvdata.debugfs_dir,
                                                          port,
-                                                         &port_debugfs_ops);
+                                                         &port_debugfs_fops);
         }
         return 0;
 
diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c
index 22d2feb1f8bc..32f663436e6e 100644
--- a/drivers/extcon/extcon-max14577.c
+++ b/drivers/extcon/extcon-max14577.c
@@ -657,6 +657,8 @@ static int max14577_muic_probe(struct platform_device *pdev)
         struct max14577 *max14577 = dev_get_drvdata(pdev->dev.parent);
         struct max14577_muic_info *info;
         int delay_jiffies;
+        int cable_type;
+        bool attached;
         int ret;
         int i;
         u8 id;
@@ -725,8 +727,17 @@ static int max14577_muic_probe(struct platform_device *pdev)
         info->path_uart = CTRL1_SW_UART;
         delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
 
-        /* Set initial path for UART */
-        max14577_muic_set_path(info, info->path_uart, true);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = max14577_bulk_read(info->max14577->regmap,
+                        MAX14577_MUIC_REG_STATUS1, info->status, 2);
+        if (ret) {
+                dev_err(info->dev, "Cannot read STATUS registers\n");
+                return ret;
+        }
+        cable_type = max14577_muic_get_cable_type(info, MAX14577_CABLE_GROUP_ADC,
+                                         &attached);
+        if (attached && cable_type == MAX14577_MUIC_ADC_FACTORY_MODE_UART_OFF)
+                max14577_muic_set_path(info, info->path_uart, true);
 
         /* Check revision number of MUIC device*/
         ret = max14577_read_reg(info->max14577->regmap,
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index a79537ebb671..32fc5a66ffa9 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1072,6 +1072,8 @@ static int max77693_muic_probe(struct platform_device *pdev)
         struct max77693_reg_data *init_data;
         int num_init_data;
         int delay_jiffies;
+        int cable_type;
+        bool attached;
         int ret;
         int i;
         unsigned int id;
@@ -1212,8 +1214,18 @@ static int max77693_muic_probe(struct platform_device *pdev)
                 delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         }
 
-        /* Set initial path for UART */
-         max77693_muic_set_path(info, info->path_uart, true);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = regmap_bulk_read(info->max77693->regmap_muic,
+                        MAX77693_MUIC_REG_STATUS1, info->status, 2);
+        if (ret) {
+                dev_err(info->dev, "failed to read MUIC register\n");
+                return ret;
+        }
+        cable_type = max77693_muic_get_cable_type(info,
+                                           MAX77693_CABLE_GROUP_ADC, &attached);
+        if (attached && (cable_type == MAX77693_MUIC_ADC_FACTORY_MODE_UART_ON ||
+                         cable_type == MAX77693_MUIC_ADC_FACTORY_MODE_UART_OFF))
+                max77693_muic_set_path(info, info->path_uart, true);
 
         /* Check revision number of MUIC device*/
         ret = regmap_read(info->max77693->regmap_muic,
diff --git a/drivers/extcon/extcon-max77843.c b/drivers/extcon/extcon-max77843.c
index b98cbd0362f5..a343a6ef3506 100644
--- a/drivers/extcon/extcon-max77843.c
+++ b/drivers/extcon/extcon-max77843.c
@@ -812,6 +812,8 @@ static int max77843_muic_probe(struct platform_device *pdev)
         struct max77693_dev *max77843 = dev_get_drvdata(pdev->dev.parent);
         struct max77843_muic_info *info;
         unsigned int id;
+        int cable_type;
+        bool attached;
         int i, ret;
 
         info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
@@ -856,9 +858,19 @@ static int max77843_muic_probe(struct platform_device *pdev)
         /* Set ADC debounce time */
         max77843_muic_set_debounce_time(info, MAX77843_DEBOUNCE_TIME_25MS);
 
-        /* Set initial path for UART */
-        max77843_muic_set_path(info, MAX77843_MUIC_CONTROL1_SW_UART, true,
-                               false);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = regmap_bulk_read(max77843->regmap_muic,
+                        MAX77843_MUIC_REG_STATUS1, info->status,
+                        MAX77843_MUIC_STATUS_NUM);
+        if (ret) {
+                dev_err(info->dev, "Cannot read STATUS registers\n");
+                goto err_muic_irq;
+        }
+        cable_type = max77843_muic_get_cable_type(info, MAX77843_CABLE_GROUP_ADC,
+                                         &attached);
+        if (attached && cable_type == MAX77843_MUIC_ADC_FACTORY_MODE_UART_OFF)
+                max77843_muic_set_path(info, MAX77843_MUIC_CONTROL1_SW_UART,
+                                       true, false);
 
         /* Check revision number of MUIC device */
         ret = regmap_read(max77843->regmap_muic, MAX77843_MUIC_REG_ID, &id);
diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index bdabb2479e0d..172e116ac1ce 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -311,12 +311,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info,
 {
         int ret = 0;
 
-        if (usb_type == MAX8997_USB_HOST) {
-                ret = max8997_muic_set_path(info, info->path_usb, attached);
-                if (ret < 0) {
-                        dev_err(info->dev, "failed to update muic register\n");
-                        return ret;
-                }
+        ret = max8997_muic_set_path(info, info->path_usb, attached);
+        if (ret < 0) {
+                dev_err(info->dev, "failed to update muic register\n");
+                return ret;
         }
 
         switch (usb_type) {
@@ -632,6 +630,8 @@ static int max8997_muic_probe(struct platform_device *pdev)
         struct max8997_platform_data *pdata = dev_get_platdata(max8997->dev);
         struct max8997_muic_info *info;
         int delay_jiffies;
+        int cable_type;
+        bool attached;
         int ret, i;
 
         info = devm_kzalloc(&pdev->dev, sizeof(struct max8997_muic_info),
@@ -724,8 +724,17 @@ static int max8997_muic_probe(struct platform_device *pdev)
                 delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         }
 
-        /* Set initial path for UART */
-         max8997_muic_set_path(info, info->path_uart, true);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = max8997_bulk_read(info->muic, MAX8997_MUIC_REG_STATUS1,
+                                2, info->status);
+        if (ret) {
+                dev_err(info->dev, "failed to read MUIC register\n");
+                return ret;
+        }
+        cable_type = max8997_muic_get_cable_type(info,
+                                           MAX8997_CABLE_GROUP_ADC, &attached);
+        if (attached && cable_type == MAX8997_MUIC_ADC_FACTORY_MODE_UART_OFF)
+                max8997_muic_set_path(info, info->path_uart, true);
 
         /* Set ADC debounce time */
         max8997_muic_set_debounce_time(info, ADC_DEBOUNCE_TIME_25MS);
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 7273e5082b41..f754578414f0 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -216,6 +216,18 @@ config FW_CFG_SYSFS_CMDLINE
           WARNING: Using incorrect parameters (base address in particular)
           may crash your system.
 
+config INTEL_STRATIX10_SERVICE
+        tristate "Intel Stratix10 Service Layer"
+        depends on HAVE_ARM_SMCCC
+        default n
+        help
+          Intel Stratix10 service layer runs at privileged exception level,
+          interfaces with the service providers (FPGA manager is one of them)
+          and manages secure monitor call to communicate with secure monitor
+          software at secure monitor exception level.
+
+          Say Y here if you want Stratix10 service layer support.
+
 config QCOM_SCM
         bool
         depends on ARM || ARM64
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 3158dffd9914..80feb635120f 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_DMI_SYSFS)		+= dmi-sysfs.o
 obj-$(CONFIG_EDD)               += edd.o
 obj-$(CONFIG_EFI_PCDP)          += pcdp.o
 obj-$(CONFIG_DMIID)             += dmi-id.o
+obj-$(CONFIG_INTEL_STRATIX10_SERVICE) += stratix10-svc.o
 obj-$(CONFIG_ISCSI_IBFT_FIND)   += iscsi_ibft_find.o
 obj-$(CONFIG_ISCSI_IBFT)        += iscsi_ibft.o
 obj-$(CONFIG_FIRMWARE_MEMMAP)   += memmap.o
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
new file mode 100644
index 000000000000..6e6514825ad0
--- /dev/null
+++ b/drivers/firmware/stratix10-svc.c
@@ -0,0 +1,1041 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2017-2018, Intel Corporation
+ */
+
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/genalloc.h>
+#include <linux/io.h>
+#include <linux/kfifo.h>
+#include <linux/kthread.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/firmware/intel/stratix10-smc.h>
+#include <linux/firmware/intel/stratix10-svc-client.h>
+#include <linux/types.h>
+
+/**
+ * SVC_NUM_DATA_IN_FIFO - number of struct stratix10_svc_data in the FIFO
+ *
+ * SVC_NUM_CHANNEL - number of channel supported by service layer driver
+ *
+ * FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS - claim back the submitted buffer(s)
+ * from the secure world for FPGA manager to reuse, or to free the buffer(s)
+ * when all bit-stream data had be send.
+ *
+ * FPGA_CONFIG_STATUS_TIMEOUT_SEC - poll the FPGA configuration status,
+ * service layer will return error to FPGA manager when timeout occurs,
+ * timeout is set to 30 seconds (30 * 1000) at Intel Stratix10 SoC.
+ */
+#define SVC_NUM_DATA_IN_FIFO                    32
+#define SVC_NUM_CHANNEL                         2
+#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS       200
+#define FPGA_CONFIG_STATUS_TIMEOUT_SEC          30
+
+typedef void (svc_invoke_fn)(unsigned long, unsigned long, unsigned long,
+                             unsigned long, unsigned long, unsigned long,
+                             unsigned long, unsigned long,
+                             struct arm_smccc_res *);
+struct stratix10_svc_chan;
+
+/**
+ * struct stratix10_svc_sh_memory - service shared memory structure
+ * @sync_complete: state for a completion
+ * @addr: physical address of shared memory block
+ * @size: size of shared memory block
+ * @invoke_fn: function to issue secure monitor or hypervisor call
+ *
+ * This struct is used to save physical address and size of shared memory
+ * block. The shared memory blocked is allocated by secure monitor software
+ * at secure world.
+ *
+ * Service layer driver uses the physical address and size to create a memory
+ * pool, then allocates data buffer from that memory pool for service client.
+ */
+struct stratix10_svc_sh_memory {
+        struct completion sync_complete;
+        unsigned long addr;
+        unsigned long size;
+        svc_invoke_fn *invoke_fn;
+};
+
+/**
+ * struct stratix10_svc_data_mem - service memory structure
+ * @vaddr: virtual address
+ * @paddr: physical address
+ * @size: size of memory
+ * @node: link list head node
+ *
+ * This struct is used in a list that keeps track of buffers which have
+ * been allocated or freed from the memory pool. Service layer driver also
+ * uses this struct to transfer physical address to virtual address.
+ */
+struct stratix10_svc_data_mem {
+        void *vaddr;
+        phys_addr_t paddr;
+        size_t size;
+        struct list_head node;
+};
+
+/**
+ * struct stratix10_svc_data - service data structure
+ * @chan: service channel
+ * @paddr: playload physical address
+ * @size: playload size
+ * @command: service command requested by client
+ * @flag: configuration type (full or partial)
+ * @arg: args to be passed via registers and not physically mapped buffers
+ *
+ * This struct is used in service FIFO for inter-process communication.
+ */
+struct stratix10_svc_data {
+        struct stratix10_svc_chan *chan;
+        phys_addr_t paddr;
+        size_t size;
+        u32 command;
+        u32 flag;
+        u64 arg[3];
+};
+
+/**
+ * struct stratix10_svc_controller - service controller
+ * @dev: device
+ * @chans: array of service channels
+ * @num_chans: number of channels in 'chans' array
+ * @num_active_client: number of active service client
+ * @node: list management
+ * @genpool: memory pool pointing to the memory region
+ * @task: pointer to the thread task which handles SMC or HVC call
+ * @svc_fifo: a queue for storing service message data
+ * @complete_status: state for completion
+ * @svc_fifo_lock: protect access to service message data queue
+ * @invoke_fn: function to issue secure monitor call or hypervisor call
+ *
+ * This struct is used to create communication channels for service clients, to
+ * handle secure monitor or hypervisor call.
+ */
+struct stratix10_svc_controller {
+        struct device *dev;
+        struct stratix10_svc_chan *chans;
+        int num_chans;
+        int num_active_client;
+        struct list_head node;
+        struct gen_pool *genpool;
+        struct task_struct *task;
+        struct kfifo svc_fifo;
+        struct completion complete_status;
+        spinlock_t svc_fifo_lock;
+        svc_invoke_fn *invoke_fn;
+};
+
+/**
+ * struct stratix10_svc_chan - service communication channel
+ * @ctrl: pointer to service controller which is the provider of this channel
+ * @scl: pointer to service client which owns the channel
+ * @name: service client name associated with the channel
+ * @lock: protect access to the channel
+ *
+ * This struct is used by service client to communicate with service layer, each
+ * service client has its own channel created by service controller.
+ */
+struct stratix10_svc_chan {
+        struct stratix10_svc_controller *ctrl;
+        struct stratix10_svc_client *scl;
+        char *name;
+        spinlock_t lock;
+};
+
+static LIST_HEAD(svc_ctrl);
+static LIST_HEAD(svc_data_mem);
+
+/**
+ * svc_pa_to_va() - translate physical address to virtual address
+ * @addr: to be translated physical address
+ *
+ * Return: valid virtual address or NULL if the provided physical
+ * address doesn't exist.
+ */
+static void *svc_pa_to_va(unsigned long addr)
+{
+        struct stratix10_svc_data_mem *pmem;
+
+        pr_debug("claim back P-addr=0x%016x\n", (unsigned int)addr);
+        list_for_each_entry(pmem, &svc_data_mem, node)
+                if (pmem->paddr == addr)
+                        return pmem->vaddr;
+
+        /* physical address is not found */
+        return NULL;
+}
+
+/**
+ * svc_thread_cmd_data_claim() - claim back buffer from the secure world
+ * @ctrl: pointer to service layer controller
+ * @p_data: pointer to service data structure
+ * @cb_data: pointer to callback data structure to service client
+ *
+ * Claim back the submitted buffers from the secure world and pass buffer
+ * back to service client (FPGA manager, etc) for reuse.
+ */
+static void svc_thread_cmd_data_claim(struct stratix10_svc_controller *ctrl,
+                                      struct stratix10_svc_data *p_data,
+                                      struct stratix10_svc_cb_data *cb_data)
+{
+        struct arm_smccc_res res;
+        unsigned long timeout;
+
+        reinit_completion(&ctrl->complete_status);
+        timeout = msecs_to_jiffies(FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS);
+
+        pr_debug("%s: claim back the submitted buffer\n", __func__);
+        do {
+                ctrl->invoke_fn(INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE,
+                                0, 0, 0, 0, 0, 0, 0, &res);
+
+                if (res.a0 == INTEL_SIP_SMC_STATUS_OK) {
+                        if (!res.a1) {
+                                complete(&ctrl->complete_status);
+                                break;
+                        }
+                        cb_data->status = BIT(SVC_STATUS_RECONFIG_BUFFER_DONE);
+                        cb_data->kaddr1 = svc_pa_to_va(res.a1);
+                        cb_data->kaddr2 = (res.a2) ?
+                                          svc_pa_to_va(res.a2) : NULL;
+                        cb_data->kaddr3 = (res.a3) ?
+                                          svc_pa_to_va(res.a3) : NULL;
+                        p_data->chan->scl->receive_cb(p_data->chan->scl,
+                                                      cb_data);
+                } else {
+                        pr_debug("%s: secure world busy, polling again\n",
+                                 __func__);
+                }
+        } while (res.a0 == INTEL_SIP_SMC_STATUS_OK ||
+                 res.a0 == INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY ||
+                 wait_for_completion_timeout(&ctrl->complete_status, timeout));
+}
+
+/**
+ * svc_thread_cmd_config_status() - check configuration status
+ * @ctrl: pointer to service layer controller
+ * @p_data: pointer to service data structure
+ * @cb_data: pointer to callback data structure to service client
+ *
+ * Check whether the secure firmware at secure world has finished the FPGA
+ * configuration, and then inform FPGA manager the configuration status.
+ */
+static void svc_thread_cmd_config_status(struct stratix10_svc_controller *ctrl,
+                                         struct stratix10_svc_data *p_data,
+                                         struct stratix10_svc_cb_data *cb_data)
+{
+        struct arm_smccc_res res;
+        int count_in_sec;
+
+        cb_data->kaddr1 = NULL;
+        cb_data->kaddr2 = NULL;
+        cb_data->kaddr3 = NULL;
+        cb_data->status = BIT(SVC_STATUS_RECONFIG_ERROR);
+
+        pr_debug("%s: polling config status\n", __func__);
+
+        count_in_sec = FPGA_CONFIG_STATUS_TIMEOUT_SEC;
+        while (count_in_sec) {
+                ctrl->invoke_fn(INTEL_SIP_SMC_FPGA_CONFIG_ISDONE,
+                                0, 0, 0, 0, 0, 0, 0, &res);
+                if ((res.a0 == INTEL_SIP_SMC_STATUS_OK) ||
+                    (res.a0 == INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR))
+                        break;
+
+                /*
+                 * configuration is still in progress, wait one second then
+                 * poll again
+                 */
+                msleep(1000);
+                count_in_sec--;
+        };
+
+        if (res.a0 == INTEL_SIP_SMC_STATUS_OK && count_in_sec)
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_COMPLETED);
+
+        p_data->chan->scl->receive_cb(p_data->chan->scl, cb_data);
+}
+
+/**
+ * svc_thread_recv_status_ok() - handle the successful status
+ * @p_data: pointer to service data structure
+ * @cb_data: pointer to callback data structure to service client
+ * @res: result from SMC or HVC call
+ *
+ * Send back the correspond status to the service clients.
+ */
+static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
+                                      struct stratix10_svc_cb_data *cb_data,
+                                      struct arm_smccc_res res)
+{
+        cb_data->kaddr1 = NULL;
+        cb_data->kaddr2 = NULL;
+        cb_data->kaddr3 = NULL;
+
+        switch (p_data->command) {
+        case COMMAND_RECONFIG:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_REQUEST_OK);
+                break;
+        case COMMAND_RECONFIG_DATA_SUBMIT:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED);
+                break;
+        case COMMAND_NOOP:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED);
+                cb_data->kaddr1 = svc_pa_to_va(res.a1);
+                break;
+        case COMMAND_RECONFIG_STATUS:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_COMPLETED);
+                break;
+        case COMMAND_RSU_UPDATE:
+                cb_data->status = BIT(SVC_STATUS_RSU_OK);
+                break;
+        default:
+                pr_warn("it shouldn't happen\n");
+                break;
+        }
+
+        pr_debug("%s: call receive_cb\n", __func__);
+        p_data->chan->scl->receive_cb(p_data->chan->scl, cb_data);
+}
+
+/**
+ * svc_normal_to_secure_thread() - the function to run in the kthread
+ * @data: data pointer for kthread function
+ *
+ * Service layer driver creates stratix10_svc_smc_hvc_call kthread on CPU
+ * node 0, its function stratix10_svc_secure_call_thread is used to handle
+ * SMC or HVC calls between kernel driver and secure monitor software.
+ *
+ * Return: 0 for success or -ENOMEM on error.
+ */
+static int svc_normal_to_secure_thread(void *data)
+{
+        struct stratix10_svc_controller
+                        *ctrl = (struct stratix10_svc_controller *)data;
+        struct stratix10_svc_data *pdata;
+        struct stratix10_svc_cb_data *cbdata;
+        struct arm_smccc_res res;
+        unsigned long a0, a1, a2;
+        int ret_fifo = 0;
+
+        pdata =  kmalloc(sizeof(*pdata), GFP_KERNEL);
+        if (!pdata)
+                return -ENOMEM;
+
+        cbdata = kmalloc(sizeof(*cbdata), GFP_KERNEL);
+        if (!cbdata) {
+                kfree(pdata);
+                return -ENOMEM;
+        }
+
+        /* default set, to remove build warning */
+        a0 = INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK;
+        a1 = 0;
+        a2 = 0;
+
+        pr_debug("smc_hvc_shm_thread is running\n");
+
+        while (!kthread_should_stop()) {
+                ret_fifo = kfifo_out_spinlocked(&ctrl->svc_fifo,
+                                                pdata, sizeof(*pdata),
+                                                &ctrl->svc_fifo_lock);
+
+                if (!ret_fifo)
+                        continue;
+
+                pr_debug("get from FIFO pa=0x%016x, command=%u, size=%u\n",
+                         (unsigned int)pdata->paddr, pdata->command,
+                         (unsigned int)pdata->size);
+
+                switch (pdata->command) {
+                case COMMAND_RECONFIG_DATA_CLAIM:
+                        svc_thread_cmd_data_claim(ctrl, pdata, cbdata);
+                        continue;
+                case COMMAND_RECONFIG:
+                        a0 = INTEL_SIP_SMC_FPGA_CONFIG_START;
+                        pr_debug("conf_type=%u\n", (unsigned int)pdata->flag);
+                        a1 = pdata->flag;
+                        a2 = 0;
+                        break;
+                case COMMAND_RECONFIG_DATA_SUBMIT:
+                        a0 = INTEL_SIP_SMC_FPGA_CONFIG_WRITE;
+                        a1 = (unsigned long)pdata->paddr;
+                        a2 = (unsigned long)pdata->size;
+                        break;
+                case COMMAND_RECONFIG_STATUS:
+                        a0 = INTEL_SIP_SMC_FPGA_CONFIG_ISDONE;
+                        a1 = 0;
+                        a2 = 0;
+                        break;
+                case COMMAND_RSU_STATUS:
+                        a0 = INTEL_SIP_SMC_RSU_STATUS;
+                        a1 = 0;
+                        a2 = 0;
+                        break;
+                case COMMAND_RSU_UPDATE:
+                        a0 = INTEL_SIP_SMC_RSU_UPDATE;
+                        a1 = pdata->arg[0];
+                        a2 = 0;
+                        break;
+                default:
+                        pr_warn("it shouldn't happen\n");
+                        break;
+                }
+                pr_debug("%s: before SMC call -- a0=0x%016x a1=0x%016x",
+                         __func__, (unsigned int)a0, (unsigned int)a1);
+                pr_debug(" a2=0x%016x\n", (unsigned int)a2);
+
+                ctrl->invoke_fn(a0, a1, a2, 0, 0, 0, 0, 0, &res);
+
+                pr_debug("%s: after SMC call -- res.a0=0x%016x",
+                         __func__, (unsigned int)res.a0);
+                pr_debug(" res.a1=0x%016x, res.a2=0x%016x",
+                         (unsigned int)res.a1, (unsigned int)res.a2);
+                pr_debug(" res.a3=0x%016x\n", (unsigned int)res.a3);
+
+                if (pdata->command == COMMAND_RSU_STATUS) {
+                        if (res.a0 == INTEL_SIP_SMC_RSU_ERROR)
+                                cbdata->status = BIT(SVC_STATUS_RSU_ERROR);
+                        else
+                                cbdata->status = BIT(SVC_STATUS_RSU_OK);
+
+                        cbdata->kaddr1 = &res;
+                        cbdata->kaddr2 = NULL;
+                        cbdata->kaddr3 = NULL;
+                        pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);
+                        continue;
+                }
+
+                switch (res.a0) {
+                case INTEL_SIP_SMC_STATUS_OK:
+                        svc_thread_recv_status_ok(pdata, cbdata, res);
+                        break;
+                case INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY:
+                        switch (pdata->command) {
+                        case COMMAND_RECONFIG_DATA_SUBMIT:
+                                svc_thread_cmd_data_claim(ctrl,
+                                                          pdata, cbdata);
+                                break;
+                        case COMMAND_RECONFIG_STATUS:
+                                svc_thread_cmd_config_status(ctrl,
+                                                             pdata, cbdata);
+                                break;
+                        default:
+                                pr_warn("it shouldn't happen\n");
+                                break;
+                        }
+                        break;
+                case INTEL_SIP_SMC_FPGA_CONFIG_STATUS_REJECTED:
+                        pr_debug("%s: STATUS_REJECTED\n", __func__);
+                        break;
+                case INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR:
+                        pr_err("%s: STATUS_ERROR\n", __func__);
+                        cbdata->status = BIT(SVC_STATUS_RECONFIG_ERROR);
+                        cbdata->kaddr1 = NULL;
+                        cbdata->kaddr2 = NULL;
+                        cbdata->kaddr3 = NULL;
+                        pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);
+                        break;
+                default:
+                        pr_warn("it shouldn't happen\n");
+                        break;
+                }
+        };
+
+        kfree(cbdata);
+        kfree(pdata);
+
+        return 0;
+}
+
+/**
+ * svc_normal_to_secure_shm_thread() - the function to run in the kthread
+ * @data: data pointer for kthread function
+ *
+ * Service layer driver creates stratix10_svc_smc_hvc_shm kthread on CPU
+ * node 0, its function stratix10_svc_secure_shm_thread is used to query the
+ * physical address of memory block reserved by secure monitor software at
+ * secure world.
+ *
+ * svc_normal_to_secure_shm_thread() calls do_exit() directly since it is a
+ * standlone thread for which no one will call kthread_stop() or return when
+ * 'kthread_should_stop()' is true.
+ */
+static int svc_normal_to_secure_shm_thread(void *data)
+{
+        struct stratix10_svc_sh_memory
+                        *sh_mem = (struct stratix10_svc_sh_memory *)data;
+        struct arm_smccc_res res;
+
+        /* SMC or HVC call to get shared memory info from secure world */
+        sh_mem->invoke_fn(INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM,
+                          0, 0, 0, 0, 0, 0, 0, &res);
+        if (res.a0 == INTEL_SIP_SMC_STATUS_OK) {
+                sh_mem->addr = res.a1;
+                sh_mem->size = res.a2;
+        } else {
+                pr_err("%s: after SMC call -- res.a0=0x%016x",  __func__,
+                       (unsigned int)res.a0);
+                sh_mem->addr = 0;
+                sh_mem->size = 0;
+        }
+
+        complete(&sh_mem->sync_complete);
+        do_exit(0);
+}
+
+/**
+ * svc_get_sh_memory() - get memory block reserved by secure monitor SW
+ * @pdev: pointer to service layer device
+ * @sh_memory: pointer to service shared memory structure
+ *
+ * Return: zero for successfully getting the physical address of memory block
+ * reserved by secure monitor software, or negative value on error.
+ */
+static int svc_get_sh_memory(struct platform_device *pdev,
+                                    struct stratix10_svc_sh_memory *sh_memory)
+{
+        struct device *dev = &pdev->dev;
+        struct task_struct *sh_memory_task;
+        unsigned int cpu = 0;
+
+        init_completion(&sh_memory->sync_complete);
+
+        /* smc or hvc call happens on cpu 0 bound kthread */
+        sh_memory_task = kthread_create_on_node(svc_normal_to_secure_shm_thread,
+                                               (void *)sh_memory,
+                                                cpu_to_node(cpu),
+                                                "svc_smc_hvc_shm_thread");
+        if (IS_ERR(sh_memory_task)) {
+                dev_err(dev, "fail to create stratix10_svc_smc_shm_thread\n");
+                return -EINVAL;
+        }
+
+        wake_up_process(sh_memory_task);
+
+        if (!wait_for_completion_timeout(&sh_memory->sync_complete, 10 * HZ)) {
+                dev_err(dev,
+                        "timeout to get sh-memory paras from secure world\n");
+                return -ETIMEDOUT;
+        }
+
+        if (!sh_memory->addr || !sh_memory->size) {
+                dev_err(dev,
+                        "fails to get shared memory info from secure world\n");
+                return -ENOMEM;
+        }
+
+        dev_dbg(dev, "SM software provides paddr: 0x%016x, size: 0x%08x\n",
+                (unsigned int)sh_memory->addr,
+                (unsigned int)sh_memory->size);
+
+        return 0;
+}
+
+/**
+ * svc_create_memory_pool() - create a memory pool from reserved memory block
+ * @pdev: pointer to service layer device
+ * @sh_memory: pointer to service shared memory structure
+ *
+ * Return: pool allocated from reserved memory block or ERR_PTR() on error.
+ */
+static struct gen_pool *
+svc_create_memory_pool(struct platform_device *pdev,
+                       struct stratix10_svc_sh_memory *sh_memory)
+{
+        struct device *dev = &pdev->dev;
+        struct gen_pool *genpool;
+        unsigned long vaddr;
+        phys_addr_t paddr;
+        size_t size;
+        phys_addr_t begin;
+        phys_addr_t end;
+        void *va;
+        size_t page_mask = PAGE_SIZE - 1;
+        int min_alloc_order = 3;
+        int ret;
+
+        begin = roundup(sh_memory->addr, PAGE_SIZE);
+        end = rounddown(sh_memory->addr + sh_memory->size, PAGE_SIZE);
+        paddr = begin;
+        size = end - begin;
+        va = memremap(paddr, size, MEMREMAP_WC);
+        if (!va) {
+                dev_err(dev, "fail to remap shared memory\n");
+                return ERR_PTR(-EINVAL);
+        }
+        vaddr = (unsigned long)va;
+        dev_dbg(dev,
+                "reserved memory vaddr: %p, paddr: 0x%16x size: 0x%8x\n",
+                va, (unsigned int)paddr, (unsigned int)size);
+        if ((vaddr & page_mask) || (paddr & page_mask) ||
+            (size & page_mask)) {
+                dev_err(dev, "page is not aligned\n");
+                return ERR_PTR(-EINVAL);
+        }
+        genpool = gen_pool_create(min_alloc_order, -1);
+        if (!genpool) {
+                dev_err(dev, "fail to create genpool\n");
+                return ERR_PTR(-ENOMEM);
+        }
+        gen_pool_set_algo(genpool, gen_pool_best_fit, NULL);
+        ret = gen_pool_add_virt(genpool, vaddr, paddr, size, -1);
+        if (ret) {
+                dev_err(dev, "fail to add memory chunk to the pool\n");
+                gen_pool_destroy(genpool);
+                return ERR_PTR(ret);
+        }
+
+        return genpool;
+}
+
+/**
+ * svc_smccc_smc() - secure monitor call between normal and secure world
+ * @a0: argument passed in registers 0
+ * @a1: argument passed in registers 1
+ * @a2: argument passed in registers 2
+ * @a3: argument passed in registers 3
+ * @a4: argument passed in registers 4
+ * @a5: argument passed in registers 5
+ * @a6: argument passed in registers 6
+ * @a7: argument passed in registers 7
+ * @res: result values from register 0 to 3
+ */
+static void svc_smccc_smc(unsigned long a0, unsigned long a1,
+                          unsigned long a2, unsigned long a3,
+                          unsigned long a4, unsigned long a5,
+                          unsigned long a6, unsigned long a7,
+                          struct arm_smccc_res *res)
+{
+        arm_smccc_smc(a0, a1, a2, a3, a4, a5, a6, a7, res);
+}
+
+/**
+ * svc_smccc_hvc() - hypervisor call between normal and secure world
+ * @a0: argument passed in registers 0
+ * @a1: argument passed in registers 1
+ * @a2: argument passed in registers 2
+ * @a3: argument passed in registers 3
+ * @a4: argument passed in registers 4
+ * @a5: argument passed in registers 5
+ * @a6: argument passed in registers 6
+ * @a7: argument passed in registers 7
+ * @res: result values from register 0 to 3
+ */
+static void svc_smccc_hvc(unsigned long a0, unsigned long a1,
+                          unsigned long a2, unsigned long a3,
+                          unsigned long a4, unsigned long a5,
+                          unsigned long a6, unsigned long a7,
+                          struct arm_smccc_res *res)
+{
+        arm_smccc_hvc(a0, a1, a2, a3, a4, a5, a6, a7, res);
+}
+
+/**
+ * get_invoke_func() - invoke SMC or HVC call
+ * @dev: pointer to device
+ *
+ * Return: function pointer to svc_smccc_smc or svc_smccc_hvc.
+ */
+static svc_invoke_fn *get_invoke_func(struct device *dev)
+{
+        const char *method;
+
+        if (of_property_read_string(dev->of_node, "method", &method)) {
+                dev_warn(dev, "missing \"method\" property\n");
+                return ERR_PTR(-ENXIO);
+        }
+
+        if (!strcmp(method, "smc"))
+                return svc_smccc_smc;
+        if (!strcmp(method, "hvc"))
+                return svc_smccc_hvc;
+
+        dev_warn(dev, "invalid \"method\" property: %s\n", method);
+
+        return ERR_PTR(-EINVAL);
+}
+
+/**
+ * stratix10_svc_request_channel_byname() - request a service channel
+ * @client: pointer to service client
+ * @name: service client name
+ *
+ * This function is used by service client to request a service channel.
+ *
+ * Return: a pointer to channel assigned to the client on success,
+ * or ERR_PTR() on error.
+ */
+struct stratix10_svc_chan *stratix10_svc_request_channel_byname(
+        struct stratix10_svc_client *client, const char *name)
+{
+        struct device *dev = client->dev;
+        struct stratix10_svc_controller *controller;
+        struct stratix10_svc_chan *chan = NULL;
+        unsigned long flag;
+        int i;
+
+        /* if probe was called after client's, or error on probe */
+        if (list_empty(&svc_ctrl))
+                return ERR_PTR(-EPROBE_DEFER);
+
+        controller = list_first_entry(&svc_ctrl,
+                                      struct stratix10_svc_controller, node);
+        for (i = 0; i < SVC_NUM_CHANNEL; i++) {
+                if (!strcmp(controller->chans[i].name, name)) {
+                        chan = &controller->chans[i];
+                        break;
+                }
+        }
+
+        /* if there was no channel match */
+        if (i == SVC_NUM_CHANNEL) {
+                dev_err(dev, "%s: channel not allocated\n", __func__);
+                return ERR_PTR(-EINVAL);
+        }
+
+        if (chan->scl || !try_module_get(controller->dev->driver->owner)) {
+                dev_dbg(dev, "%s: svc not free\n", __func__);
+                return ERR_PTR(-EBUSY);
+        }
+
+        spin_lock_irqsave(&chan->lock, flag);
+        chan->scl = client;
+        chan->ctrl->num_active_client++;
+        spin_unlock_irqrestore(&chan->lock, flag);
+
+        return chan;
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_request_channel_byname);
+
+/**
+ * stratix10_svc_free_channel() - free service channel
+ * @chan: service channel to be freed
+ *
+ * This function is used by service client to free a service channel.
+ */
+void stratix10_svc_free_channel(struct stratix10_svc_chan *chan)
+{
+        unsigned long flag;
+
+        spin_lock_irqsave(&chan->lock, flag);
+        chan->scl = NULL;
+        chan->ctrl->num_active_client--;
+        module_put(chan->ctrl->dev->driver->owner);
+        spin_unlock_irqrestore(&chan->lock, flag);
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_free_channel);
+
+/**
+ * stratix10_svc_send() - send a message data to the remote
+ * @chan: service channel assigned to the client
+ * @msg: message data to be sent, in the format of
+ * "struct stratix10_svc_client_msg"
+ *
+ * This function is used by service client to add a message to the service
+ * layer driver's queue for being sent to the secure world.
+ *
+ * Return: 0 for success, -ENOMEM or -ENOBUFS on error.
+ */
+int stratix10_svc_send(struct stratix10_svc_chan *chan, void *msg)
+{
+        struct stratix10_svc_client_msg
+                *p_msg = (struct stratix10_svc_client_msg *)msg;
+        struct stratix10_svc_data_mem *p_mem;
+        struct stratix10_svc_data *p_data;
+        int ret = 0;
+        unsigned int cpu = 0;
+
+        p_data = kzalloc(sizeof(*p_data), GFP_KERNEL);
+        if (!p_data)
+                return -ENOMEM;
+
+        /* first client will create kernel thread */
+        if (!chan->ctrl->task) {
+                chan->ctrl->task =
+                        kthread_create_on_node(svc_normal_to_secure_thread,
+                                              (void *)chan->ctrl,
+                                              cpu_to_node(cpu),
+                                              "svc_smc_hvc_thread");
+                        if (IS_ERR(chan->ctrl->task)) {
+                                dev_err(chan->ctrl->dev,
+                                        "fails to create svc_smc_hvc_thread\n");
+                                kfree(p_data);
+                                return -EINVAL;
+                        }
+                kthread_bind(chan->ctrl->task, cpu);
+                wake_up_process(chan->ctrl->task);
+        }
+
+        pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,
+                 p_msg->payload, p_msg->command,
+                 (unsigned int)p_msg->payload_length);
+
+        if (list_empty(&svc_data_mem)) {
+                if (p_msg->command == COMMAND_RECONFIG) {
+                        struct stratix10_svc_command_config_type *ct =
+                                (struct stratix10_svc_command_config_type *)
+                                p_msg->payload;
+                        p_data->flag = ct->flags;
+                }
+        } else {
+                list_for_each_entry(p_mem, &svc_data_mem, node)
+                        if (p_mem->vaddr == p_msg->payload) {
+                                p_data->paddr = p_mem->paddr;
+                                break;
+                        }
+        }
+
+        p_data->command = p_msg->command;
+        p_data->arg[0] = p_msg->arg[0];
+        p_data->arg[1] = p_msg->arg[1];
+        p_data->arg[2] = p_msg->arg[2];
+        p_data->size = p_msg->payload_length;
+        p_data->chan = chan;
+        pr_debug("%s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n", __func__,
+               (unsigned int)p_data->paddr, p_data->command,
+               (unsigned int)p_data->size);
+        ret = kfifo_in_spinlocked(&chan->ctrl->svc_fifo, p_data,
+                                  sizeof(*p_data),
+                                  &chan->ctrl->svc_fifo_lock);
+
+        kfree(p_data);
+
+        if (!ret)
+                return -ENOBUFS;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_send);
+
+/**
+ * stratix10_svc_done() - complete service request transactions
+ * @chan: service channel assigned to the client
+ *
+ * This function should be called when client has finished its request
+ * or there is an error in the request process. It allows the service layer
+ * to stop the running thread to have maximize savings in kernel resources.
+ */
+void stratix10_svc_done(struct stratix10_svc_chan *chan)
+{
+        /* stop thread when thread is running AND only one active client */
+        if (chan->ctrl->task && chan->ctrl->num_active_client <= 1) {
+                pr_debug("svc_smc_hvc_shm_thread is stopped\n");
+                kthread_stop(chan->ctrl->task);
+                chan->ctrl->task = NULL;
+        }
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_done);
+
+/**
+ * stratix10_svc_allocate_memory() - allocate memory
+ * @chan: service channel assigned to the client
+ * @size: memory size requested by a specific service client
+ *
+ * Service layer allocates the requested number of bytes buffer from the
+ * memory pool, service client uses this function to get allocated buffers.
+ *
+ * Return: address of allocated memory on success, or ERR_PTR() on error.
+ */
+void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
+                                    size_t size)
+{
+        struct stratix10_svc_data_mem *pmem;
+        unsigned long va;
+        phys_addr_t pa;
+        struct gen_pool *genpool = chan->ctrl->genpool;
+        size_t s = roundup(size, 1 << genpool->min_alloc_order);
+
+        pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+        if (!pmem)
+                return ERR_PTR(-ENOMEM);
+
+        va = gen_pool_alloc(genpool, s);
+        if (!va)
+                return ERR_PTR(-ENOMEM);
+
+        memset((void *)va, 0, s);
+        pa = gen_pool_virt_to_phys(genpool, va);
+
+        pmem->vaddr = (void *)va;
+        pmem->paddr = pa;
+        pmem->size = s;
+        list_add_tail(&pmem->node, &svc_data_mem);
+        pr_debug("%s: va=%p, pa=0x%016x\n", __func__,
+                 pmem->vaddr, (unsigned int)pmem->paddr);
+
+        return (void *)va;
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
+
+/**
+ * stratix10_svc_free_memory() - free allocated memory
+ * @chan: service channel assigned to the client
+ * @kaddr: memory to be freed
+ *
+ * This function is used by service client to free allocated buffers.
+ */
+void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
+{
+        struct stratix10_svc_data_mem *pmem;
+        size_t size = 0;
+
+        list_for_each_entry(pmem, &svc_data_mem, node)
+                if (pmem->vaddr == kaddr) {
+                        size = pmem->size;
+                        break;
+                }
+
+        gen_pool_free(chan->ctrl->genpool, (unsigned long)kaddr, size);
+        pmem->vaddr = NULL;
+        list_del(&pmem->node);
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
+
+static const struct of_device_id stratix10_svc_drv_match[] = {
+        {.compatible = "intel,stratix10-svc"},
+        {},
+};
+
+static int stratix10_svc_drv_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct stratix10_svc_controller *controller;
+        struct stratix10_svc_chan *chans;
+        struct gen_pool *genpool;
+        struct stratix10_svc_sh_memory *sh_memory;
+        svc_invoke_fn *invoke_fn;
+        size_t fifo_size;
+        int ret;
+
+        /* get SMC or HVC function */
+        invoke_fn = get_invoke_func(dev);
+        if (IS_ERR(invoke_fn))
+                return -EINVAL;
+
+        sh_memory = devm_kzalloc(dev, sizeof(*sh_memory), GFP_KERNEL);
+        if (!sh_memory)
+                return -ENOMEM;
+
+        sh_memory->invoke_fn = invoke_fn;
+        ret = svc_get_sh_memory(pdev, sh_memory);
+        if (ret)
+                return ret;
+
+        genpool = svc_create_memory_pool(pdev, sh_memory);
+        if (!genpool)
+                return -ENOMEM;
+
+        /* allocate service controller and supporting channel */
+        controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
+        if (!controller)
+                return -ENOMEM;
+
+        chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL,
+                                   sizeof(*chans), GFP_KERNEL | __GFP_ZERO);
+        if (!chans)
+                return -ENOMEM;
+
+        controller->dev = dev;
+        controller->num_chans = SVC_NUM_CHANNEL;
+        controller->num_active_client = 0;
+        controller->chans = chans;
+        controller->genpool = genpool;
+        controller->task = NULL;
+        controller->invoke_fn = invoke_fn;
+        init_completion(&controller->complete_status);
+
+        fifo_size = sizeof(struct stratix10_svc_data) * SVC_NUM_DATA_IN_FIFO;
+        ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL);
+        if (ret) {
+                dev_err(dev, "fails to allocate FIFO\n");
+                return ret;
+        }
+        spin_lock_init(&controller->svc_fifo_lock);
+
+        chans[0].scl = NULL;
+        chans[0].ctrl = controller;
+        chans[0].name = SVC_CLIENT_FPGA;
+        spin_lock_init(&chans[0].lock);
+
+        chans[1].scl = NULL;
+        chans[1].ctrl = controller;
+        chans[1].name = SVC_CLIENT_RSU;
+        spin_lock_init(&chans[1].lock);
+
+        list_add_tail(&controller->node, &svc_ctrl);
+        platform_set_drvdata(pdev, controller);
+
+        pr_info("Intel Service Layer Driver Initialized\n");
+
+        return ret;
+}
+
+static int stratix10_svc_drv_remove(struct platform_device *pdev)
+{
+        struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
+
+        kfifo_free(&ctrl->svc_fifo);
+        if (ctrl->task) {
+                kthread_stop(ctrl->task);
+                ctrl->task = NULL;
+        }
+        if (ctrl->genpool)
+                gen_pool_destroy(ctrl->genpool);
+        list_del(&ctrl->node);
+
+        return 0;
+}
+
+static struct platform_driver stratix10_svc_driver = {
+        .probe = stratix10_svc_drv_probe,
+        .remove = stratix10_svc_drv_remove,
+        .driver = {
+                .name = "stratix10-svc",
+                .of_match_table = stratix10_svc_drv_match,
+        },
+};
+
+static int __init stratix10_svc_init(void)
+{
+        struct device_node *fw_np;
+        struct device_node *np;
+        int ret;
+
+        fw_np = of_find_node_by_name(NULL, "firmware");
+        if (!fw_np)
+                return -ENODEV;
+
+        np = of_find_matching_node(fw_np, stratix10_svc_drv_match);
+        if (!np)
+                return -ENODEV;
+
+        of_node_put(np);
+        ret = of_platform_populate(fw_np, stratix10_svc_drv_match, NULL, NULL);
+        if (ret)
+                return ret;
+
+        return platform_driver_register(&stratix10_svc_driver);
+}
+
+static void __exit stratix10_svc_exit(void)
+{
+        return platform_driver_unregister(&stratix10_svc_driver);
+}
+
+subsys_initcall(stratix10_svc_init);
+module_exit(stratix10_svc_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Intel Stratix10 Service Layer Driver");
+MODULE_AUTHOR("Richard Gong <richard.gong@intel.com>");
+MODULE_ALIAS("platform:stratix10-svc");
diff --git a/drivers/fpga/Kconfig b/drivers/fpga/Kconfig
index 1ebcef4bab5b..0bb7b5cd6cdc 100644
--- a/drivers/fpga/Kconfig
+++ b/drivers/fpga/Kconfig
@@ -56,6 +56,12 @@ config FPGA_MGR_ZYNQ_FPGA
         help
           FPGA manager driver support for Xilinx Zynq FPGAs.
 
+config FPGA_MGR_STRATIX10_SOC
+        tristate "Intel Stratix10 SoC FPGA Manager"
+        depends on (ARCH_STRATIX10 && INTEL_STRATIX10_SERVICE)
+        help
+          FPGA manager driver support for the Intel Stratix10 SoC.
+
 config FPGA_MGR_XILINX_SPI
         tristate "Xilinx Configuration over Slave Serial (SPI)"
         depends on SPI
diff --git a/drivers/fpga/Makefile b/drivers/fpga/Makefile
index 7a2d73ba7122..c0dd4c82fbdb 100644
--- a/drivers/fpga/Makefile
+++ b/drivers/fpga/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_FPGA_MGR_ICE40_SPI)	+= ice40-spi.o
 obj-$(CONFIG_FPGA_MGR_MACHXO2_SPI)      += machxo2-spi.o
 obj-$(CONFIG_FPGA_MGR_SOCFPGA)          += socfpga.o
 obj-$(CONFIG_FPGA_MGR_SOCFPGA_A10)      += socfpga-a10.o
+obj-$(CONFIG_FPGA_MGR_STRATIX10_SOC)    += stratix10-soc.o
 obj-$(CONFIG_FPGA_MGR_TS73XX)           += ts73xx-fpga.o
 obj-$(CONFIG_FPGA_MGR_XILINX_SPI)       += xilinx-spi.o
 obj-$(CONFIG_FPGA_MGR_ZYNQ_FPGA)        += zynq-fpga.o
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 610a1558e0ed..35c3aa5792e2 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -403,6 +403,7 @@ static int altera_cvp_probe(struct pci_dev *pdev,
         struct altera_cvp_conf *conf;
         struct fpga_manager *mgr;
         u16 cmd, val;
+        u32 regval;
         int ret;
 
         /*
@@ -416,6 +417,14 @@ static int altera_cvp_probe(struct pci_dev *pdev,
                 return -ENODEV;
         }
 
+        pci_read_config_dword(pdev, VSE_CVP_STATUS, &regval);
+        if (!(regval & VSE_CVP_STATUS_CVP_EN)) {
+                dev_err(&pdev->dev,
+                        "CVP is disabled for this device: CVP_STATUS Reg 0x%x\n",
+                        regval);
+                return -ENODEV;
+        }
+
         conf = devm_kzalloc(&pdev->dev, sizeof(*conf), GFP_KERNEL);
         if (!conf)
                 return -ENOMEM;
@@ -466,18 +475,11 @@ static int altera_cvp_probe(struct pci_dev *pdev,
         if (ret)
                 goto err_unmap;
 
-        ret = driver_create_file(&altera_cvp_driver.driver,
-                                 &driver_attr_chkcfg);
-        if (ret) {
-                dev_err(&pdev->dev, "Can't create sysfs chkcfg file\n");
-                fpga_mgr_unregister(mgr);
-                goto err_unmap;
-        }
-
         return 0;
 
 err_unmap:
-        pci_iounmap(pdev, conf->map);
+        if (conf->map)
+                pci_iounmap(pdev, conf->map);
         pci_release_region(pdev, CVP_BAR);
 err_disable:
         cmd &= ~PCI_COMMAND_MEMORY;
@@ -491,16 +493,39 @@ static void altera_cvp_remove(struct pci_dev *pdev)
         struct altera_cvp_conf *conf = mgr->priv;
         u16 cmd;
 
-        driver_remove_file(&altera_cvp_driver.driver, &driver_attr_chkcfg);
         fpga_mgr_unregister(mgr);
-        pci_iounmap(pdev, conf->map);
+        if (conf->map)
+                pci_iounmap(pdev, conf->map);
         pci_release_region(pdev, CVP_BAR);
         pci_read_config_word(pdev, PCI_COMMAND, &cmd);
         cmd &= ~PCI_COMMAND_MEMORY;
         pci_write_config_word(pdev, PCI_COMMAND, cmd);
 }
 
-module_pci_driver(altera_cvp_driver);
+static int __init altera_cvp_init(void)
+{
+        int ret;
+
+        ret = pci_register_driver(&altera_cvp_driver);
+        if (ret)
+                return ret;
+
+        ret = driver_create_file(&altera_cvp_driver.driver,
+                                 &driver_attr_chkcfg);
+        if (ret)
+                pr_warn("Can't create sysfs chkcfg file\n");
+
+        return 0;
+}
+
+static void __exit altera_cvp_exit(void)
+{
+        driver_remove_file(&altera_cvp_driver.driver, &driver_attr_chkcfg);
+        pci_unregister_driver(&altera_cvp_driver);
+}
+
+module_init(altera_cvp_init);
+module_exit(altera_cvp_exit);
 
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
index 33aafda50af5..8c18beec6b57 100644
--- a/drivers/fpga/altera-ps-spi.c
+++ b/drivers/fpga/altera-ps-spi.c
@@ -75,6 +75,12 @@ static struct altera_ps_data a10_data = {
         .t_st2ck_us = 10, /* min(t_ST2CK) */
 };
 
+/* Array index is enum altera_ps_devtype */
+static const struct altera_ps_data *altera_ps_data_map[] = {
+        &c5_data,
+        &a10_data,
+};
+
 static const struct of_device_id of_ef_match[] = {
         { .compatible = "altr,fpga-passive-serial", .data = &c5_data },
         { .compatible = "altr,fpga-arria10-passive-serial", .data = &a10_data },
@@ -234,6 +240,22 @@ static const struct fpga_manager_ops altera_ps_ops = {
         .write_complete = altera_ps_write_complete,
 };
 
+static const struct altera_ps_data *id_to_data(const struct spi_device_id *id)
+{
+        kernel_ulong_t devtype = id->driver_data;
+        const struct altera_ps_data *data;
+
+        /* someone added a altera_ps_devtype without adding to the map array */
+        if (devtype >= ARRAY_SIZE(altera_ps_data_map))
+                return NULL;
+
+        data = altera_ps_data_map[devtype];
+        if (!data || data->devtype != devtype)
+                return NULL;
+
+        return data;
+}
+
 static int altera_ps_probe(struct spi_device *spi)
 {
         struct altera_ps_conf *conf;
@@ -244,11 +266,17 @@ static int altera_ps_probe(struct spi_device *spi)
         if (!conf)
                 return -ENOMEM;
 
-        of_id = of_match_device(of_ef_match, &spi->dev);
-        if (!of_id)
-                return -ENODEV;
+        if (spi->dev.of_node) {
+                of_id = of_match_device(of_ef_match, &spi->dev);
+                if (!of_id)
+                        return -ENODEV;
+                conf->data = of_id->data;
+        } else {
+                conf->data = id_to_data(spi_get_device_id(spi));
+                if (!conf->data)
+                        return -ENODEV;
+        }
 
-        conf->data = of_id->data;
         conf->spi = spi;
         conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_LOW);
         if (IS_ERR(conf->config)) {
@@ -294,7 +322,9 @@ static int altera_ps_remove(struct spi_device *spi)
 }
 
 static const struct spi_device_id altera_ps_spi_ids[] = {
-        {"cyclone-ps-spi", 0},
+        { "cyclone-ps-spi", CYCLONE5 },
+        { "fpga-passive-serial", CYCLONE5 },
+        { "fpga-arria10-passive-serial", ARRIA10 },
         {}
 };
 MODULE_DEVICE_TABLE(spi, altera_ps_spi_ids);
diff --git a/drivers/fpga/dfl-fme-pr.c b/drivers/fpga/dfl-fme-pr.c
index 0b840531ef33..fe5a5578fbf7 100644
--- a/drivers/fpga/dfl-fme-pr.c
+++ b/drivers/fpga/dfl-fme-pr.c
@@ -444,10 +444,8 @@ static void pr_mgmt_uinit(struct platform_device *pdev,
                           struct dfl_feature *feature)
 {
         struct dfl_feature_platform_data *pdata = dev_get_platdata(&pdev->dev);
-        struct dfl_fme *priv;
 
         mutex_lock(&pdata->lock);
-        priv = dfl_fpga_pdata_get_private(pdata);
 
         dfl_fme_destroy_regions(pdata);
         dfl_fme_destroy_bridges(pdata);
diff --git a/drivers/fpga/dfl-fme-region.c b/drivers/fpga/dfl-fme-region.c
index ec134ec93f08..1eeb42af1012 100644
--- a/drivers/fpga/dfl-fme-region.c
+++ b/drivers/fpga/dfl-fme-region.c
@@ -64,7 +64,7 @@ eprobe_mgr_put:
 
 static int fme_region_remove(struct platform_device *pdev)
 {
-        struct fpga_region *region = dev_get_drvdata(&pdev->dev);
+        struct fpga_region *region = platform_get_drvdata(pdev);
         struct fpga_manager *mgr = region->mgr;
 
         fpga_region_unregister(region);
diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
index 122286fd255a..75f64abf9c81 100644
--- a/drivers/fpga/of-fpga-region.c
+++ b/drivers/fpga/of-fpga-region.c
@@ -421,7 +421,7 @@ static int of_fpga_region_probe(struct platform_device *pdev)
                 goto eprobe_mgr_put;
 
         of_platform_populate(np, fpga_region_of_match, NULL, &region->dev);
-        dev_set_drvdata(dev, region);
+        platform_set_drvdata(pdev, region);
 
         dev_info(dev, "FPGA Region probed\n");
 
diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
new file mode 100644
index 000000000000..a1a09e04fab8
--- /dev/null
+++ b/drivers/fpga/stratix10-soc.c
@@ -0,0 +1,535 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * FPGA Manager Driver for Intel Stratix10 SoC
+ *
+ *  Copyright (C) 2018 Intel Corporation
+ */
+#include <linux/completion.h>
+#include <linux/fpga/fpga-mgr.h>
+#include <linux/firmware/intel/stratix10-svc-client.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+
+/*
+ * FPGA programming requires a higher level of privilege (EL3), per the SoC
+ * design.
+ */
+#define NUM_SVC_BUFS    4
+#define SVC_BUF_SIZE    SZ_512K
+
+/* Indicates buffer is in use if set */
+#define SVC_BUF_LOCK    0
+
+#define S10_BUFFER_TIMEOUT (msecs_to_jiffies(SVC_RECONFIG_BUFFER_TIMEOUT_MS))
+#define S10_RECONFIG_TIMEOUT (msecs_to_jiffies(SVC_RECONFIG_REQUEST_TIMEOUT_MS))
+
+/*
+ * struct s10_svc_buf
+ * buf:  virtual address of buf provided by service layer
+ * lock: locked if buffer is in use
+ */
+struct s10_svc_buf {
+        char *buf;
+        unsigned long lock;
+};
+
+struct s10_priv {
+        struct stratix10_svc_chan *chan;
+        struct stratix10_svc_client client;
+        struct completion status_return_completion;
+        struct s10_svc_buf svc_bufs[NUM_SVC_BUFS];
+        unsigned long status;
+};
+
+static int s10_svc_send_msg(struct s10_priv *priv,
+                            enum stratix10_svc_command_code command,
+                            void *payload, u32 payload_length)
+{
+        struct stratix10_svc_chan *chan = priv->chan;
+        struct device *dev = priv->client.dev;
+        struct stratix10_svc_client_msg msg;
+        int ret;
+
+        dev_dbg(dev, "%s cmd=%d payload=%p length=%d\n",
+                __func__, command, payload, payload_length);
+
+        msg.command = command;
+        msg.payload = payload;
+        msg.payload_length = payload_length;
+
+        ret = stratix10_svc_send(chan, &msg);
+        dev_dbg(dev, "stratix10_svc_send returned status %d\n", ret);
+
+        return ret;
+}
+
+/*
+ * Free buffers allocated from the service layer's pool that are not in use.
+ * Return true when all buffers are freed.
+ */
+static bool s10_free_buffers(struct fpga_manager *mgr)
+{
+        struct s10_priv *priv = mgr->priv;
+        uint num_free = 0;
+        uint i;
+
+        for (i = 0; i < NUM_SVC_BUFS; i++) {
+                if (!priv->svc_bufs[i].buf) {
+                        num_free++;
+                        continue;
+                }
+
+                if (!test_and_set_bit_lock(SVC_BUF_LOCK,
+                                           &priv->svc_bufs[i].lock)) {
+                        stratix10_svc_free_memory(priv->chan,
+                                                  priv->svc_bufs[i].buf);
+                        priv->svc_bufs[i].buf = NULL;
+                        num_free++;
+                }
+        }
+
+        return num_free == NUM_SVC_BUFS;
+}
+
+/*
+ * Returns count of how many buffers are not in use.
+ */
+static uint s10_free_buffer_count(struct fpga_manager *mgr)
+{
+        struct s10_priv *priv = mgr->priv;
+        uint num_free = 0;
+        uint i;
+
+        for (i = 0; i < NUM_SVC_BUFS; i++)
+                if (!priv->svc_bufs[i].buf)
+                        num_free++;
+
+        return num_free;
+}
+
+/*
+ * s10_unlock_bufs
+ * Given the returned buffer address, match that address to our buffer struct
+ * and unlock that buffer.  This marks it as available to be refilled and sent
+ * (or freed).
+ * priv: private data
+ * kaddr: kernel address of buffer that was returned from service layer
+ */
+static void s10_unlock_bufs(struct s10_priv *priv, void *kaddr)
+{
+        uint i;
+
+        if (!kaddr)
+                return;
+
+        for (i = 0; i < NUM_SVC_BUFS; i++)
+                if (priv->svc_bufs[i].buf == kaddr) {
+                        clear_bit_unlock(SVC_BUF_LOCK,
+                                         &priv->svc_bufs[i].lock);
+                        return;
+                }
+
+        WARN(1, "Unknown buffer returned from service layer %p\n", kaddr);
+}
+
+/*
+ * s10_receive_callback - callback for service layer to use to provide client
+ * (this driver) messages received through the mailbox.
+ * client: service layer client struct
+ * data: message from service layer
+ */
+static void s10_receive_callback(struct stratix10_svc_client *client,
+                                 struct stratix10_svc_cb_data *data)
+{
+        struct s10_priv *priv = client->priv;
+        u32 status;
+        int i;
+
+        WARN_ONCE(!data, "%s: stratix10_svc_rc_data = NULL", __func__);
+
+        status = data->status;
+
+        /*
+         * Here we set status bits as we receive them.  Elsewhere, we always use
+         * test_and_clear_bit() to check status in priv->status
+         */
+        for (i = 0; i <= SVC_STATUS_RECONFIG_ERROR; i++)
+                if (status & (1 << i))
+                        set_bit(i, &priv->status);
+
+        if (status & BIT(SVC_STATUS_RECONFIG_BUFFER_DONE)) {
+                s10_unlock_bufs(priv, data->kaddr1);
+                s10_unlock_bufs(priv, data->kaddr2);
+                s10_unlock_bufs(priv, data->kaddr3);
+        }
+
+        complete(&priv->status_return_completion);
+}
+
+/*
+ * s10_ops_write_init - prepare for FPGA reconfiguration by requesting
+ * partial reconfig and allocating buffers from the service layer.
+ */
+static int s10_ops_write_init(struct fpga_manager *mgr,
+                              struct fpga_image_info *info,
+                              const char *buf, size_t count)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        struct stratix10_svc_command_config_type ctype;
+        char *kbuf;
+        uint i;
+        int ret;
+
+        ctype.flags = 0;
+        if (info->flags & FPGA_MGR_PARTIAL_RECONFIG) {
+                dev_dbg(dev, "Requesting partial reconfiguration.\n");
+                ctype.flags |= BIT(COMMAND_RECONFIG_FLAG_PARTIAL);
+        } else {
+                dev_dbg(dev, "Requesting full reconfiguration.\n");
+        }
+
+        reinit_completion(&priv->status_return_completion);
+        ret = s10_svc_send_msg(priv, COMMAND_RECONFIG,
+                               &ctype, sizeof(ctype));
+        if (ret < 0)
+                goto init_done;
+
+        ret = wait_for_completion_interruptible_timeout(
+                &priv->status_return_completion, S10_RECONFIG_TIMEOUT);
+        if (!ret) {
+                dev_err(dev, "timeout waiting for RECONFIG_REQUEST\n");
+                ret = -ETIMEDOUT;
+                goto init_done;
+        }
+        if (ret < 0) {
+                dev_err(dev, "error (%d) waiting for RECONFIG_REQUEST\n", ret);
+                goto init_done;
+        }
+
+        ret = 0;
+        if (!test_and_clear_bit(SVC_STATUS_RECONFIG_REQUEST_OK,
+                                &priv->status)) {
+                ret = -ETIMEDOUT;
+                goto init_done;
+        }
+
+        /* Allocate buffers from the service layer's pool. */
+        for (i = 0; i < NUM_SVC_BUFS; i++) {
+                kbuf = stratix10_svc_allocate_memory(priv->chan, SVC_BUF_SIZE);
+                if (!kbuf) {
+                        s10_free_buffers(mgr);
+                        ret = -ENOMEM;
+                        goto init_done;
+                }
+
+                priv->svc_bufs[i].buf = kbuf;
+                priv->svc_bufs[i].lock = 0;
+        }
+
+init_done:
+        stratix10_svc_done(priv->chan);
+        return ret;
+}
+
+/*
+ * s10_send_buf - send a buffer to the service layer queue
+ * mgr: fpga manager struct
+ * buf: fpga image buffer
+ * count: size of buf in bytes
+ * Returns # of bytes transferred or -ENOBUFS if the all the buffers are in use
+ * or if the service queue is full. Never returns 0.
+ */
+static int s10_send_buf(struct fpga_manager *mgr, const char *buf, size_t count)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        void *svc_buf;
+        size_t xfer_sz;
+        int ret;
+        uint i;
+
+        /* get/lock a buffer that that's not being used */
+        for (i = 0; i < NUM_SVC_BUFS; i++)
+                if (!test_and_set_bit_lock(SVC_BUF_LOCK,
+                                           &priv->svc_bufs[i].lock))
+                        break;
+
+        if (i == NUM_SVC_BUFS)
+                return -ENOBUFS;
+
+        xfer_sz = count < SVC_BUF_SIZE ? count : SVC_BUF_SIZE;
+
+        svc_buf = priv->svc_bufs[i].buf;
+        memcpy(svc_buf, buf, xfer_sz);
+        ret = s10_svc_send_msg(priv, COMMAND_RECONFIG_DATA_SUBMIT,
+                               svc_buf, xfer_sz);
+        if (ret < 0) {
+                dev_err(dev,
+                        "Error while sending data to service layer (%d)", ret);
+                clear_bit_unlock(SVC_BUF_LOCK, &priv->svc_bufs[i].lock);
+                return ret;
+        }
+
+        return xfer_sz;
+}
+
+/*
+ * Send a FPGA image to privileged layers to write to the FPGA.  When done
+ * sending, free all service layer buffers we allocated in write_init.
+ */
+static int s10_ops_write(struct fpga_manager *mgr, const char *buf,
+                         size_t count)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        long wait_status;
+        int sent = 0;
+        int ret = 0;
+
+        /*
+         * Loop waiting for buffers to be returned.  When a buffer is returned,
+         * reuse it to send more data or free if if all data has been sent.
+         */
+        while (count > 0 || s10_free_buffer_count(mgr) != NUM_SVC_BUFS) {
+                reinit_completion(&priv->status_return_completion);
+
+                if (count > 0) {
+                        sent = s10_send_buf(mgr, buf, count);
+                        if (sent < 0)
+                                continue;
+
+                        count -= sent;
+                        buf += sent;
+                } else {
+                        if (s10_free_buffers(mgr))
+                                return 0;
+
+                        ret = s10_svc_send_msg(
+                                priv, COMMAND_RECONFIG_DATA_CLAIM,
+                                NULL, 0);
+                        if (ret < 0)
+                                break;
+                }
+
+                /*
+                 * If callback hasn't already happened, wait for buffers to be
+                 * returned from service layer
+                 */
+                wait_status = 1; /* not timed out */
+                if (!priv->status)
+                        wait_status = wait_for_completion_interruptible_timeout(
+                                &priv->status_return_completion,
+                                S10_BUFFER_TIMEOUT);
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_BUFFER_DONE,
+                                       &priv->status) ||
+                    test_and_clear_bit(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED,
+                                       &priv->status)) {
+                        ret = 0;
+                        continue;
+                }
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_ERROR,
+                                       &priv->status)) {
+                        dev_err(dev, "ERROR - giving up - SVC_STATUS_RECONFIG_ERROR\n");
+                        ret = -EFAULT;
+                        break;
+                }
+
+                if (!wait_status) {
+                        dev_err(dev, "timeout waiting for svc layer buffers\n");
+                        ret = -ETIMEDOUT;
+                        break;
+                }
+                if (wait_status < 0) {
+                        ret = wait_status;
+                        dev_err(dev,
+                                "error (%d) waiting for svc layer buffers\n",
+                                ret);
+                        break;
+                }
+        }
+
+        if (!s10_free_buffers(mgr))
+                dev_err(dev, "%s not all buffers were freed\n", __func__);
+
+        return ret;
+}
+
+static int s10_ops_write_complete(struct fpga_manager *mgr,
+                                  struct fpga_image_info *info)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        unsigned long timeout;
+        int ret;
+
+        timeout = usecs_to_jiffies(info->config_complete_timeout_us);
+
+        do {
+                reinit_completion(&priv->status_return_completion);
+
+                ret = s10_svc_send_msg(priv, COMMAND_RECONFIG_STATUS, NULL, 0);
+                if (ret < 0)
+                        break;
+
+                ret = wait_for_completion_interruptible_timeout(
+                        &priv->status_return_completion, timeout);
+                if (!ret) {
+                        dev_err(dev,
+                                "timeout waiting for RECONFIG_COMPLETED\n");
+                        ret = -ETIMEDOUT;
+                        break;
+                }
+                if (ret < 0) {
+                        dev_err(dev,
+                                "error (%d) waiting for RECONFIG_COMPLETED\n",
+                                ret);
+                        break;
+                }
+                /* Not error or timeout, so ret is # of jiffies until timeout */
+                timeout = ret;
+                ret = 0;
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_COMPLETED,
+                                       &priv->status))
+                        break;
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_ERROR,
+                                       &priv->status)) {
+                        dev_err(dev, "ERROR - giving up - SVC_STATUS_RECONFIG_ERROR\n");
+                        ret = -EFAULT;
+                        break;
+                }
+        } while (1);
+
+        stratix10_svc_done(priv->chan);
+
+        return ret;
+}
+
+static enum fpga_mgr_states s10_ops_state(struct fpga_manager *mgr)
+{
+        return FPGA_MGR_STATE_UNKNOWN;
+}
+
+static const struct fpga_manager_ops s10_ops = {
+        .state = s10_ops_state,
+        .write_init = s10_ops_write_init,
+        .write = s10_ops_write,
+        .write_complete = s10_ops_write_complete,
+};
+
+static int s10_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct s10_priv *priv;
+        struct fpga_manager *mgr;
+        int ret;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->client.dev = dev;
+        priv->client.receive_cb = s10_receive_callback;
+        priv->client.priv = priv;
+
+        priv->chan = stratix10_svc_request_channel_byname(&priv->client,
+                                                          SVC_CLIENT_FPGA);
+        if (IS_ERR(priv->chan)) {
+                dev_err(dev, "couldn't get service channel (%s)\n",
+                        SVC_CLIENT_FPGA);
+                return PTR_ERR(priv->chan);
+        }
+
+        init_completion(&priv->status_return_completion);
+
+        mgr = fpga_mgr_create(dev, "Stratix10 SOC FPGA Manager",
+                              &s10_ops, priv);
+        if (!mgr) {
+                dev_err(dev, "unable to create FPGA manager\n");
+                ret = -ENOMEM;
+                goto probe_err;
+        }
+
+        ret = fpga_mgr_register(mgr);
+        if (ret) {
+                dev_err(dev, "unable to register FPGA manager\n");
+                fpga_mgr_free(mgr);
+                goto probe_err;
+        }
+
+        platform_set_drvdata(pdev, mgr);
+        return ret;
+
+probe_err:
+        stratix10_svc_free_channel(priv->chan);
+        return ret;
+}
+
+static int s10_remove(struct platform_device *pdev)
+{
+        struct fpga_manager *mgr = platform_get_drvdata(pdev);
+        struct s10_priv *priv = mgr->priv;
+
+        fpga_mgr_unregister(mgr);
+        stratix10_svc_free_channel(priv->chan);
+
+        return 0;
+}
+
+static const struct of_device_id s10_of_match[] = {
+        { .compatible = "intel,stratix10-soc-fpga-mgr", },
+        {},
+};
+
+MODULE_DEVICE_TABLE(of, s10_of_match);
+
+static struct platform_driver s10_driver = {
+        .probe = s10_probe,
+        .remove = s10_remove,
+        .driver = {
+                .name   = "Stratix10 SoC FPGA manager",
+                .of_match_table = of_match_ptr(s10_of_match),
+        },
+};
+
+static int __init s10_init(void)
+{
+        struct device_node *fw_np;
+        struct device_node *np;
+        int ret;
+
+        fw_np = of_find_node_by_name(NULL, "svc");
+        if (!fw_np)
+                return -ENODEV;
+
+        np = of_find_matching_node(fw_np, s10_of_match);
+        if (!np) {
+                of_node_put(fw_np);
+                return -ENODEV;
+        }
+
+        of_node_put(np);
+        ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
+        of_node_put(fw_np);
+        if (ret)
+                return ret;
+
+        return platform_driver_register(&s10_driver);
+}
+
+static void __exit s10_exit(void)
+{
+        return platform_driver_unregister(&s10_driver);
+}
+
+module_init(s10_init);
+module_exit(s10_exit);
+
+MODULE_AUTHOR("Alan Tull <atull@kernel.org>");
+MODULE_DESCRIPTION("Intel Stratix 10 SOC FPGA Manager");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/fpga/zynq-fpga.c b/drivers/fpga/zynq-fpga.c
index bb82efeebb9d..57b0e6775958 100644
--- a/drivers/fpga/zynq-fpga.c
+++ b/drivers/fpga/zynq-fpga.c
@@ -501,6 +501,10 @@ static int zynq_fpga_ops_write_complete(struct fpga_manager *mgr,
         if (err)
                 return err;
 
+        /* Release 'PR' control back to the ICAP */
+        zynq_fpga_write(priv, CTRL_OFFSET,
+                zynq_fpga_read(priv, CTRL_OFFSET) & ~CTRL_PCAP_PR_MASK);
+
         err = zynq_fpga_poll_timeout(priv, INT_STS_OFFSET, intr_status,
                                      intr_status & IXR_PCFG_DONE_MASK,
                                      INIT_POLL_DELAY,
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index fe00b12e4417..ce0ba2062723 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -711,7 +711,6 @@ int vmbus_disconnect_ring(struct vmbus_channel *channel)
         /* Snapshot the list of subchannels */
         spin_lock_irqsave(&channel->lock, flags);
         list_splice_init(&channel->sc_list, &list);
-        channel->num_sc = 0;
         spin_unlock_irqrestore(&channel->lock, flags);
 
         list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index edd34c167a9b..d01689079e9b 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -405,7 +405,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel)
                 primary_channel = channel->primary_channel;
                 spin_lock_irqsave(&primary_channel->lock, flags);
                 list_del(&channel->sc_list);
-                primary_channel->num_sc--;
                 spin_unlock_irqrestore(&primary_channel->lock, flags);
         }
 
@@ -1302,49 +1301,6 @@ cleanup:
         return ret;
 }
 
-/*
- * Retrieve the (sub) channel on which to send an outgoing request.
- * When a primary channel has multiple sub-channels, we try to
- * distribute the load equally amongst all available channels.
- */
-struct vmbus_channel *vmbus_get_outgoing_channel(struct vmbus_channel *primary)
-{
-        struct list_head *cur, *tmp;
-        int cur_cpu;
-        struct vmbus_channel *cur_channel;
-        struct vmbus_channel *outgoing_channel = primary;
-        int next_channel;
-        int i = 1;
-
-        if (list_empty(&primary->sc_list))
-                return outgoing_channel;
-
-        next_channel = primary->next_oc++;
-
-        if (next_channel > (primary->num_sc)) {
-                primary->next_oc = 0;
-                return outgoing_channel;
-        }
-
-        cur_cpu = hv_cpu_number_to_vp_number(smp_processor_id());
-        list_for_each_safe(cur, tmp, &primary->sc_list) {
-                cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
-                if (cur_channel->state != CHANNEL_OPENED_STATE)
-                        continue;
-
-                if (cur_channel->target_vp == cur_cpu)
-                        return cur_channel;
-
-                if (i == next_channel)
-                        return cur_channel;
-
-                i++;
-        }
-
-        return outgoing_channel;
-}
-EXPORT_SYMBOL_GPL(vmbus_get_outgoing_channel);
-
 static void invoke_sc_cb(struct vmbus_channel *primary_channel)
 {
         struct list_head *cur, *tmp;
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 11273cd384d6..632d25674e7f 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -33,9 +33,7 @@
 #include "hyperv_vmbus.h"
 
 /* The one and only */
-struct hv_context hv_context = {
-        .synic_initialized      = false,
-};
+struct hv_context hv_context;
 
 /*
  * If false, we're using the old mechanism for stimer0 interrupts
@@ -326,8 +324,6 @@ int hv_synic_init(unsigned int cpu)
 
         hv_set_synic_state(sctrl.as_uint64);
 
-        hv_context.synic_initialized = true;
-
         /*
          * Register the per-cpu clockevent source.
          */
@@ -373,7 +369,8 @@ int hv_synic_cleanup(unsigned int cpu)
         bool channel_found = false;
         unsigned long flags;
 
-        if (!hv_context.synic_initialized)
+        hv_get_synic_state(sctrl.as_uint64);
+        if (sctrl.enable != 1)
                 return -EFAULT;
 
         /*
@@ -435,7 +432,6 @@ int hv_synic_cleanup(unsigned int cpu)
         hv_set_siefp(siefp.as_uint64);
 
         /* Disable the global synic bit */
-        hv_get_synic_state(sctrl.as_uint64);
         sctrl.enable = 0;
         hv_set_synic_state(sctrl.as_uint64);
 
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index d6106e1a0d4a..5054d1105236 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -437,7 +437,7 @@ kvp_send_key(struct work_struct *dummy)
                         val32 = in_msg->body.kvp_set.data.value_u32;
                         message->body.kvp_set.data.value_size =
                                 sprintf(message->body.kvp_set.data.value,
-                                        "%d", val32) + 1;
+                                        "%u", val32) + 1;
                         break;
 
                 case REG_U64:
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 423205077bf6..f10eeb120c8b 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -483,7 +483,7 @@ MODULE_DEVICE_TABLE(vmbus, id_table);
 
 /* The one and only one */
 static  struct hv_driver util_drv = {
-        .name = "hv_util",
+        .name = "hv_utils",
         .id_table = id_table,
         .probe =  util_probe,
         .remove =  util_remove,
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index ea201034b248..a1f6ce6e5974 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -162,8 +162,6 @@ struct hv_context {
 
         void *tsc_page;
 
-        bool synic_initialized;
-
         struct hv_per_cpu_context __percpu *cpu_context;
 
         /*
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index 824be0c5f592..105782ea64c7 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -136,6 +136,11 @@ static void __etb_enable_hw(struct etb_drvdata *drvdata)
 
 static int etb_enable_hw(struct etb_drvdata *drvdata)
 {
+        int rc = coresight_claim_device(drvdata->base);
+
+        if (rc)
+                return rc;
+
         __etb_enable_hw(drvdata);
         return 0;
 }
@@ -223,7 +228,7 @@ static int etb_enable(struct coresight_device *csdev, u32 mode, void *data)
         return 0;
 }
 
-static void etb_disable_hw(struct etb_drvdata *drvdata)
+static void __etb_disable_hw(struct etb_drvdata *drvdata)
 {
         u32 ffcr;
 
@@ -313,6 +318,13 @@ static void etb_dump_hw(struct etb_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
+static void etb_disable_hw(struct etb_drvdata *drvdata)
+{
+        __etb_disable_hw(drvdata);
+        etb_dump_hw(drvdata);
+        coresight_disclaim_device(drvdata->base);
+}
+
 static void etb_disable(struct coresight_device *csdev)
 {
         struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
@@ -323,7 +335,6 @@ static void etb_disable(struct coresight_device *csdev)
         /* Disable the ETB only if it needs to */
         if (drvdata->mode != CS_MODE_DISABLED) {
                 etb_disable_hw(drvdata);
-                etb_dump_hw(drvdata);
                 drvdata->mode = CS_MODE_DISABLED;
         }
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
@@ -402,7 +413,7 @@ static unsigned long etb_update_buffer(struct coresight_device *csdev,
 
         capacity = drvdata->buffer_depth * ETB_FRAME_SIZE_WORDS;
 
-        etb_disable_hw(drvdata);
+        __etb_disable_hw(drvdata);
         CS_UNLOCK(drvdata->base);
 
         /* unit is in words, not bytes */
@@ -510,7 +521,7 @@ static unsigned long etb_update_buffer(struct coresight_device *csdev,
                 handle->head = (cur * PAGE_SIZE) + offset;
                 to_read = buf->nr_pages << PAGE_SHIFT;
         }
-        etb_enable_hw(drvdata);
+        __etb_enable_hw(drvdata);
         CS_LOCK(drvdata->base);
 
         return to_read;
@@ -534,9 +545,9 @@ static void etb_dump(struct etb_drvdata *drvdata)
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
         if (drvdata->mode == CS_MODE_SYSFS) {
-                etb_disable_hw(drvdata);
+                __etb_disable_hw(drvdata);
                 etb_dump_hw(drvdata);
-                etb_enable_hw(drvdata);
+                __etb_enable_hw(drvdata);
         }
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
diff --git a/drivers/hwtracing/coresight/coresight-etm3x.c b/drivers/hwtracing/coresight/coresight-etm3x.c
index fd5c4cca7db5..9a63e87ea5f3 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x.c
@@ -363,15 +363,16 @@ static int etm_enable_hw(struct etm_drvdata *drvdata)
 
         CS_UNLOCK(drvdata->base);
 
+        rc = coresight_claim_device_unlocked(drvdata->base);
+        if (rc)
+                goto done;
+
         /* Turn engine on */
         etm_clr_pwrdwn(drvdata);
         /* Apply power to trace registers */
         etm_set_pwrup(drvdata);
         /* Make sure all registers are accessible */
         etm_os_unlock(drvdata);
-        rc = coresight_claim_device_unlocked(drvdata->base);
-        if (rc)
-                goto done;
 
         etm_set_prog(drvdata);
 
@@ -422,8 +423,6 @@ static int etm_enable_hw(struct etm_drvdata *drvdata)
         etm_clr_prog(drvdata);
 
 done:
-        if (rc)
-                etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
 
         dev_dbg(drvdata->dev, "cpu: %d enable smp call done: %d\n",
@@ -577,9 +576,9 @@ static void etm_disable_hw(void *info)
         for (i = 0; i < drvdata->nr_cntr; i++)
                 config->cntr_val[i] = etm_readl(drvdata, ETMCNTVRn(i));
 
+        etm_set_pwrdwn(drvdata);
         coresight_disclaim_device_unlocked(drvdata->base);
 
-        etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
 
         dev_dbg(drvdata->dev, "cpu: %d disable smp call done\n", drvdata->cpu);
@@ -602,6 +601,7 @@ static void etm_disable_perf(struct coresight_device *csdev)
          * power down the tracer.
          */
         etm_set_pwrdwn(drvdata);
+        coresight_disclaim_device_unlocked(drvdata->base);
 
         CS_LOCK(drvdata->base);
 }
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index 35d6f9709274..ef339ff22090 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -856,7 +856,7 @@ static int stm_probe(struct amba_device *adev, const struct amba_id *id)
 
         if (stm_register_device(dev, &drvdata->stm, THIS_MODULE)) {
                 dev_info(dev,
-                         "stm_register_device failed, probing deffered\n");
+                         "stm_register_device failed, probing deferred\n");
                 return -EPROBE_DEFER;
         }
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
index 53fc83b72a49..a5f053f2db2c 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -86,8 +86,8 @@ static void __tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
 
 static void tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
 {
-        coresight_disclaim_device(drvdata);
         __tmc_etb_disable_hw(drvdata);
+        coresight_disclaim_device(drvdata->base);
 }
 
 static void __tmc_etf_enable_hw(struct tmc_drvdata *drvdata)
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index d293e55553bd..ba7aaf421f36 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -1423,7 +1423,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr,
                 if (!end)
                         break;
 
-                len -= end - p;
+                /* consume the number and the following comma, hence +1 */
+                len -= end - p + 1;
                 p = end + 1;
         } while (len);
 
diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index 0910ec807187..4b9e44b227d8 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -440,10 +440,8 @@ stp_policy_make(struct config_group *group, const char *name)
 
         stm->policy = kzalloc(sizeof(*stm->policy), GFP_KERNEL);
         if (!stm->policy) {
-                mutex_unlock(&stm->policy_mutex);
-                stm_put_protocol(pdrv);
-                stm_put_device(stm);
-                return ERR_PTR(-ENOMEM);
+                ret = ERR_PTR(-ENOMEM);
+                goto unlock_policy;
         }
 
         config_group_init_type_name(&stm->policy->group, name,
@@ -458,7 +456,11 @@ unlock_policy:
         mutex_unlock(&stm->policy_mutex);
 
         if (IS_ERR(ret)) {
-                stm_put_protocol(stm->pdrv);
+                /*
+                 * pdrv and stm->pdrv at this point can be quite different,
+                 * and only one of them needs to be 'put'
+                 */
+                stm_put_protocol(pdrv);
                 stm_put_device(stm);
         }
 
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index d9c748b6f9e4..1edf2a251336 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -2042,3 +2042,28 @@ int dmar_device_remove(acpi_handle handle)
 {
         return dmar_device_hotplug(handle, false);
 }
+
+/*
+ * dmar_platform_optin - Is %DMA_CTRL_PLATFORM_OPT_IN_FLAG set in DMAR table
+ *
+ * Returns true if the platform has %DMA_CTRL_PLATFORM_OPT_IN_FLAG set in
+ * the ACPI DMAR table. This means that the platform boot firmware has made
+ * sure no device can issue DMA outside of RMRR regions.
+ */
+bool dmar_platform_optin(void)
+{
+        struct acpi_table_dmar *dmar;
+        acpi_status status;
+        bool ret;
+
+        status = acpi_get_table(ACPI_SIG_DMAR, 0,
+                                (struct acpi_table_header **)&dmar);
+        if (ACPI_FAILURE(status))
+                return false;
+
+        ret = !!(dmar->flags & DMAR_PLATFORM_OPT_IN);
+        acpi_put_table((struct acpi_table_header *)dmar);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dmar_platform_optin);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 0ad67d65bbce..63b6ce78492a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -184,6 +184,7 @@ static int rwbf_quirk;
  */
 static int force_on = 0;
 int intel_iommu_tboot_noforce;
+static int no_platform_optin;
 
 #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
 
@@ -503,6 +504,7 @@ static int __init intel_iommu_setup(char *str)
                         pr_info("IOMMU enabled\n");
                 } else if (!strncmp(str, "off", 3)) {
                         dmar_disabled = 1;
+                        no_platform_optin = 1;
                         pr_info("IOMMU disabled\n");
                 } else if (!strncmp(str, "igfx_off", 8)) {
                         dmar_map_gfx = 0;
@@ -1471,7 +1473,8 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info)
         if (info->pri_supported && !pci_reset_pri(pdev) && !pci_enable_pri(pdev, 32))
                 info->pri_enabled = 1;
 #endif
-        if (info->ats_supported && !pci_enable_ats(pdev, VTD_PAGE_SHIFT)) {
+        if (!pdev->untrusted && info->ats_supported &&
+            !pci_enable_ats(pdev, VTD_PAGE_SHIFT)) {
                 info->ats_enabled = 1;
                 domain_update_iotlb(info->domain);
                 info->ats_qdep = pci_ats_queue_depth(pdev);
@@ -2895,6 +2898,13 @@ static int iommu_should_identity_map(struct device *dev, int startup)
                 if (device_is_rmrr_locked(dev))
                         return 0;
 
+                /*
+                 * Prevent any device marked as untrusted from getting
+                 * placed into the statically identity mapping domain.
+                 */
+                if (pdev->untrusted)
+                        return 0;
+
                 if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
                         return 1;
 
@@ -4722,14 +4732,54 @@ const struct attribute_group *intel_iommu_groups[] = {
         NULL,
 };
 
+static int __init platform_optin_force_iommu(void)
+{
+        struct pci_dev *pdev = NULL;
+        bool has_untrusted_dev = false;
+
+        if (!dmar_platform_optin() || no_platform_optin)
+                return 0;
+
+        for_each_pci_dev(pdev) {
+                if (pdev->untrusted) {
+                        has_untrusted_dev = true;
+                        break;
+                }
+        }
+
+        if (!has_untrusted_dev)
+                return 0;
+
+        if (no_iommu || dmar_disabled)
+                pr_info("Intel-IOMMU force enabled due to platform opt in\n");
+
+        /*
+         * If Intel-IOMMU is disabled by default, we will apply identity
+         * map for all devices except those marked as being untrusted.
+         */
+        if (dmar_disabled)
+                iommu_identity_mapping |= IDENTMAP_ALL;
+
+        dmar_disabled = 0;
+#if defined(CONFIG_X86) && defined(CONFIG_SWIOTLB)
+        swiotlb = 0;
+#endif
+        no_iommu = 0;
+
+        return 1;
+}
+
 int __init intel_iommu_init(void)
 {
         int ret = -ENODEV;
         struct dmar_drhd_unit *drhd;
         struct intel_iommu *iommu;
 
-        /* VT-d is required for a TXT/tboot launch, so enforce that */
-        force_on = tboot_force_iommu();
+        /*
+         * Intel IOMMU is required for a TXT/tboot launch or platform
+         * opt in, so enforce that.
+         */
+        force_on = tboot_force_iommu() || platform_optin_force_iommu();
 
         if (iommu_init_mempool()) {
                 if (force_on)
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3726eacdf65d..f417b06e11c5 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -513,6 +513,14 @@ config MISC_RTSX
         tristate
         default MISC_RTSX_PCI || MISC_RTSX_USB
 
+config PVPANIC
+        tristate "pvpanic device support"
+        depends on HAS_IOMEM && (ACPI || OF)
+        help
+          This driver provides support for the pvpanic device.  pvpanic is
+          a paravirtualized device provided by QEMU; it lets a virtual machine
+          (guest) communicate panic events to the host.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index fe3134cf3008..e39ccbbc1b3a 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -57,4 +57,5 @@ obj-$(CONFIG_ASPEED_LPC_CTRL)	+= aspeed-lpc-ctrl.o
 obj-$(CONFIG_ASPEED_LPC_SNOOP)  += aspeed-lpc-snoop.o
 obj-$(CONFIG_PCI_ENDPOINT_TEST) += pci_endpoint_test.o
 obj-$(CONFIG_OCXL)              += ocxl/
-obj-y           += cardreader/
+obj-y                           += cardreader/
+obj-$(CONFIG_PVPANIC)           += pvpanic.o
diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
index ef83a9078646..d2ed3b9728b7 100644
--- a/drivers/misc/altera-stapl/altera.c
+++ b/drivers/misc/altera-stapl/altera.c
@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size,
                         key_ptr = &p[note_strings +
                                         get_unaligned_be32(
                                         &p[note_table + (8 * i)])];
-                        if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) &&
-                                                (key != NULL)) {
+                        if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
                                 status = 0;
 
                                 value_ptr = &p[note_strings +
diff --git a/drivers/misc/genwqe/card_debugfs.c b/drivers/misc/genwqe/card_debugfs.c
index c6b82f09b3ba..7c713e01d198 100644
--- a/drivers/misc/genwqe/card_debugfs.c
+++ b/drivers/misc/genwqe/card_debugfs.c
@@ -33,19 +33,6 @@
 #include "card_base.h"
 #include "card_ddcb.h"
 
-#define GENWQE_DEBUGFS_RO(_name, _showfn)                               \
-        static int genwqe_debugfs_##_name##_open(struct inode *inode,   \
-                                                 struct file *file)     \
-        {                                                               \
-                return single_open(file, _showfn, inode->i_private);    \
-        }                                                               \
-        static const struct file_operations genwqe_##_name##_fops = {   \
-                .open = genwqe_debugfs_##_name##_open,                  \
-                .read = seq_read,                                       \
-                .llseek = seq_lseek,                                    \
-                .release = single_release,                              \
-        }
-
 static void dbg_uidn_show(struct seq_file *s, struct genwqe_reg *regs,
                           int entries)
 {
@@ -87,26 +74,26 @@ static int curr_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
         return 0;
 }
 
-static int genwqe_curr_dbg_uid0_show(struct seq_file *s, void *unused)
+static int curr_dbg_uid0_show(struct seq_file *s, void *unused)
 {
         return curr_dbg_uidn_show(s, unused, 0);
 }
 
-GENWQE_DEBUGFS_RO(curr_dbg_uid0, genwqe_curr_dbg_uid0_show);
+DEFINE_SHOW_ATTRIBUTE(curr_dbg_uid0);
 
-static int genwqe_curr_dbg_uid1_show(struct seq_file *s, void *unused)
+static int curr_dbg_uid1_show(struct seq_file *s, void *unused)
 {
         return curr_dbg_uidn_show(s, unused, 1);
 }
 
-GENWQE_DEBUGFS_RO(curr_dbg_uid1, genwqe_curr_dbg_uid1_show);
+DEFINE_SHOW_ATTRIBUTE(curr_dbg_uid1);
 
-static int genwqe_curr_dbg_uid2_show(struct seq_file *s, void *unused)
+static int curr_dbg_uid2_show(struct seq_file *s, void *unused)
 {
         return curr_dbg_uidn_show(s, unused, 2);
 }
 
-GENWQE_DEBUGFS_RO(curr_dbg_uid2, genwqe_curr_dbg_uid2_show);
+DEFINE_SHOW_ATTRIBUTE(curr_dbg_uid2);
 
 static int prev_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
 {
@@ -116,28 +103,28 @@ static int prev_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
         return 0;
 }
 
-static int genwqe_prev_dbg_uid0_show(struct seq_file *s, void *unused)
+static int prev_dbg_uid0_show(struct seq_file *s, void *unused)
 {
         return prev_dbg_uidn_show(s, unused, 0);
 }
 
-GENWQE_DEBUGFS_RO(prev_dbg_uid0, genwqe_prev_dbg_uid0_show);
+DEFINE_SHOW_ATTRIBUTE(prev_dbg_uid0);
 
-static int genwqe_prev_dbg_uid1_show(struct seq_file *s, void *unused)
+static int prev_dbg_uid1_show(struct seq_file *s, void *unused)
 {
         return prev_dbg_uidn_show(s, unused, 1);
 }
 
-GENWQE_DEBUGFS_RO(prev_dbg_uid1, genwqe_prev_dbg_uid1_show);
+DEFINE_SHOW_ATTRIBUTE(prev_dbg_uid1);
 
-static int genwqe_prev_dbg_uid2_show(struct seq_file *s, void *unused)
+static int prev_dbg_uid2_show(struct seq_file *s, void *unused)
 {
         return prev_dbg_uidn_show(s, unused, 2);
 }
 
-GENWQE_DEBUGFS_RO(prev_dbg_uid2, genwqe_prev_dbg_uid2_show);
+DEFINE_SHOW_ATTRIBUTE(prev_dbg_uid2);
 
-static int genwqe_curr_regs_show(struct seq_file *s, void *unused)
+static int curr_regs_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int i;
@@ -164,9 +151,9 @@ static int genwqe_curr_regs_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(curr_regs, genwqe_curr_regs_show);
+DEFINE_SHOW_ATTRIBUTE(curr_regs);
 
-static int genwqe_prev_regs_show(struct seq_file *s, void *unused)
+static int prev_regs_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int i;
@@ -188,9 +175,9 @@ static int genwqe_prev_regs_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(prev_regs, genwqe_prev_regs_show);
+DEFINE_SHOW_ATTRIBUTE(prev_regs);
 
-static int genwqe_jtimer_show(struct seq_file *s, void *unused)
+static int jtimer_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int vf_num;
@@ -209,9 +196,9 @@ static int genwqe_jtimer_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(jtimer, genwqe_jtimer_show);
+DEFINE_SHOW_ATTRIBUTE(jtimer);
 
-static int genwqe_queue_working_time_show(struct seq_file *s, void *unused)
+static int queue_working_time_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int vf_num;
@@ -227,9 +214,9 @@ static int genwqe_queue_working_time_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(queue_working_time, genwqe_queue_working_time_show);
+DEFINE_SHOW_ATTRIBUTE(queue_working_time);
 
-static int genwqe_ddcb_info_show(struct seq_file *s, void *unused)
+static int ddcb_info_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int i;
@@ -300,9 +287,9 @@ static int genwqe_ddcb_info_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(ddcb_info, genwqe_ddcb_info_show);
+DEFINE_SHOW_ATTRIBUTE(ddcb_info);
 
-static int genwqe_info_show(struct seq_file *s, void *unused)
+static int info_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         u64 app_id, slu_id, bitstream = -1;
@@ -335,7 +322,7 @@ static int genwqe_info_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(info, genwqe_info_show);
+DEFINE_SHOW_ATTRIBUTE(info);
 
 int genwqe_init_debugfs(struct genwqe_dev *cd)
 {
@@ -356,14 +343,14 @@ int genwqe_init_debugfs(struct genwqe_dev *cd)
 
         /* non privileged interfaces are done here */
         file = debugfs_create_file("ddcb_info", S_IRUGO, root, cd,
-                                   &genwqe_ddcb_info_fops);
+                                   &ddcb_info_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("info", S_IRUGO, root, cd,
-                                   &genwqe_info_fops);
+                                   &info_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
@@ -396,56 +383,56 @@ int genwqe_init_debugfs(struct genwqe_dev *cd)
         }
 
         file = debugfs_create_file("curr_regs", S_IRUGO, root, cd,
-                                   &genwqe_curr_regs_fops);
+                                   &curr_regs_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("curr_dbg_uid0", S_IRUGO, root, cd,
-                                   &genwqe_curr_dbg_uid0_fops);
+                                   &curr_dbg_uid0_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("curr_dbg_uid1", S_IRUGO, root, cd,
-                                   &genwqe_curr_dbg_uid1_fops);
+                                   &curr_dbg_uid1_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("curr_dbg_uid2", S_IRUGO, root, cd,
-                                   &genwqe_curr_dbg_uid2_fops);
+                                   &curr_dbg_uid2_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_regs", S_IRUGO, root, cd,
-                                   &genwqe_prev_regs_fops);
+                                   &prev_regs_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_dbg_uid0", S_IRUGO, root, cd,
-                                   &genwqe_prev_dbg_uid0_fops);
+                                   &prev_dbg_uid0_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_dbg_uid1", S_IRUGO, root, cd,
-                                   &genwqe_prev_dbg_uid1_fops);
+                                   &prev_dbg_uid1_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_dbg_uid2", S_IRUGO, root, cd,
-                                   &genwqe_prev_dbg_uid2_fops);
+                                   &prev_dbg_uid2_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
@@ -463,14 +450,14 @@ int genwqe_init_debugfs(struct genwqe_dev *cd)
         }
 
         file = debugfs_create_file("jobtimer", S_IRUGO, root, cd,
-                                   &genwqe_jtimer_fops);
+                                   &jtimer_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("queue_working_time", S_IRUGO, root, cd,
-                                   &genwqe_queue_working_time_fops);
+                                   &queue_working_time_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
index 3fcb9a2fe1c9..efe2fb72d54b 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -215,7 +215,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u32 init)
 void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
                                dma_addr_t *dma_handle)
 {
-        if (get_order(size) > MAX_ORDER)
+        if (get_order(size) >= MAX_ORDER)
                 return NULL;
 
         return dma_zalloc_coherent(&cd->pci_dev->dev, size, dma_handle,
diff --git a/drivers/misc/mei/Makefile b/drivers/misc/mei/Makefile
index cd6825afa8e1..d9215fc4e499 100644
--- a/drivers/misc/mei/Makefile
+++ b/drivers/misc/mei/Makefile
@@ -9,6 +9,7 @@ mei-objs += hbm.o
 mei-objs += interrupt.o
 mei-objs += client.o
 mei-objs += main.o
+mei-objs += dma-ring.o
 mei-objs += bus.o
 mei-objs += bus-fixup.o
 mei-$(CONFIG_DEBUG_FS) += debugfs.o
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index ebdcf0b450e2..1fc8ea0f519b 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -318,23 +318,6 @@ void mei_me_cl_rm_all(struct mei_device *dev)
 }
 
 /**
- * mei_cl_cmp_id - tells if the clients are the same
- *
- * @cl1: host client 1
- * @cl2: host client 2
- *
- * Return: true  - if the clients has same host and me ids
- *         false - otherwise
- */
-static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
-                                const struct mei_cl *cl2)
-{
-        return cl1 && cl2 &&
-                (cl1->host_client_id == cl2->host_client_id) &&
-                (mei_cl_me_id(cl1) == mei_cl_me_id(cl2));
-}
-
-/**
  * mei_io_cb_free - free mei_cb_private related memory
  *
  * @cb: mei callback struct
@@ -418,7 +401,7 @@ static void mei_io_list_flush_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (mei_cl_cmp_id(cl, cb->cl))
+                if (cl == cb->cl)
                         list_del_init(&cb->list);
         }
 }
@@ -435,7 +418,7 @@ static void mei_io_tx_list_free_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (mei_cl_cmp_id(cl, cb->cl))
+                if (cl == cb->cl)
                         mei_tx_cb_dequeue(cb);
         }
 }
@@ -478,7 +461,7 @@ struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
         if (length == 0)
                 return cb;
 
-        cb->buf.data = kmalloc(length, GFP_KERNEL);
+        cb->buf.data = kmalloc(roundup(length, MEI_SLOT_SIZE), GFP_KERNEL);
         if (!cb->buf.data) {
                 mei_io_cb_free(cb);
                 return NULL;
@@ -1374,7 +1357,9 @@ int mei_cl_notify_request(struct mei_cl *cl,
 
         mutex_unlock(&dev->device_lock);
         wait_event_timeout(cl->wait,
-                           cl->notify_en == request || !mei_cl_is_connected(cl),
+                           cl->notify_en == request ||
+                           cl->status ||
+                           !mei_cl_is_connected(cl),
                            mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT));
         mutex_lock(&dev->device_lock);
 
@@ -1573,10 +1558,13 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         struct mei_msg_hdr mei_hdr;
         size_t hdr_len = sizeof(mei_hdr);
         size_t len;
-        size_t hbuf_len;
+        size_t hbuf_len, dr_len;
         int hbuf_slots;
+        u32 dr_slots;
+        u32 dma_len;
         int rets;
         bool first_chunk;
+        const void *data;
 
         if (WARN_ON(!cl || !cl->dev))
                 return -ENODEV;
@@ -1597,6 +1585,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         }
 
         len = buf->size - cb->buf_idx;
+        data = buf->data + cb->buf_idx;
         hbuf_slots = mei_hbuf_empty_slots(dev);
         if (hbuf_slots < 0) {
                 rets = -EOVERFLOW;
@@ -1604,6 +1593,8 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         }
 
         hbuf_len = mei_slots2data(hbuf_slots);
+        dr_slots = mei_dma_ring_empty_slots(dev);
+        dr_len = mei_slots2data(dr_slots);
 
         mei_msg_hdr_init(&mei_hdr, cb);
 
@@ -1614,23 +1605,33 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         if (len + hdr_len <= hbuf_len) {
                 mei_hdr.length = len;
                 mei_hdr.msg_complete = 1;
+        } else if (dr_slots && hbuf_len >= hdr_len + sizeof(dma_len)) {
+                mei_hdr.dma_ring = 1;
+                if (len > dr_len)
+                        len = dr_len;
+                else
+                        mei_hdr.msg_complete = 1;
+
+                mei_hdr.length = sizeof(dma_len);
+                dma_len = len;
+                data = &dma_len;
         } else if ((u32)hbuf_slots == mei_hbuf_depth(dev)) {
-                mei_hdr.length = hbuf_len - hdr_len;
+                len = hbuf_len - hdr_len;
+                mei_hdr.length = len;
         } else {
                 return 0;
         }
 
-        cl_dbg(dev, cl, "buf: size = %zu idx = %zu\n",
-                        cb->buf.size, cb->buf_idx);
+        if (mei_hdr.dma_ring)
+                mei_dma_ring_write(dev, buf->data + cb->buf_idx, len);
 
-        rets = mei_write_message(dev, &mei_hdr, hdr_len,
-                                 buf->data + cb->buf_idx, mei_hdr.length);
+        rets = mei_write_message(dev, &mei_hdr, hdr_len, data, mei_hdr.length);
         if (rets)
                 goto err;
 
         cl->status = 0;
         cl->writing_state = MEI_WRITING;
-        cb->buf_idx += mei_hdr.length;
+        cb->buf_idx += len;
 
         if (first_chunk) {
                 if (mei_cl_tx_flow_ctrl_creds_reduce(cl)) {
@@ -1665,11 +1666,13 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
         struct mei_msg_data *buf;
         struct mei_msg_hdr mei_hdr;
         size_t hdr_len = sizeof(mei_hdr);
-        size_t len;
-        size_t hbuf_len;
+        size_t len, hbuf_len, dr_len;
         int hbuf_slots;
+        u32 dr_slots;
+        u32 dma_len;
         ssize_t rets;
         bool blocking;
+        const void *data;
 
         if (WARN_ON(!cl || !cl->dev))
                 return -ENODEV;
@@ -1681,10 +1684,12 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
 
         buf = &cb->buf;
         len = buf->size;
-        blocking = cb->blocking;
 
         cl_dbg(dev, cl, "len=%zd\n", len);
 
+        blocking = cb->blocking;
+        data = buf->data;
+
         rets = pm_runtime_get(dev->dev);
         if (rets < 0 && rets != -EINPROGRESS) {
                 pm_runtime_put_noidle(dev->dev);
@@ -1721,16 +1726,32 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
         }
 
         hbuf_len = mei_slots2data(hbuf_slots);
+        dr_slots = mei_dma_ring_empty_slots(dev);
+        dr_len =  mei_slots2data(dr_slots);
 
         if (len + hdr_len <= hbuf_len) {
                 mei_hdr.length = len;
                 mei_hdr.msg_complete = 1;
+        } else if (dr_slots && hbuf_len >= hdr_len + sizeof(dma_len)) {
+                mei_hdr.dma_ring = 1;
+                if (len > dr_len)
+                        len = dr_len;
+                else
+                        mei_hdr.msg_complete = 1;
+
+                mei_hdr.length = sizeof(dma_len);
+                dma_len = len;
+                data = &dma_len;
         } else {
-                mei_hdr.length = hbuf_len - hdr_len;
+                len = hbuf_len - hdr_len;
+                mei_hdr.length = len;
         }
 
+        if (mei_hdr.dma_ring)
+                mei_dma_ring_write(dev, buf->data, len);
+
         rets = mei_write_message(dev, &mei_hdr, hdr_len,
-                                 buf->data, mei_hdr.length);
+                                 data, mei_hdr.length);
         if (rets)
                 goto err;
 
@@ -1739,7 +1760,9 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
                 goto err;
 
         cl->writing_state = MEI_WRITING;
-        cb->buf_idx = mei_hdr.length;
+        cb->buf_idx = len;
+        /* restore return value */
+        len = buf->size;
 
 out:
         if (mei_hdr.msg_complete)
diff --git a/drivers/misc/mei/dma-ring.c b/drivers/misc/mei/dma-ring.c
new file mode 100644
index 000000000000..795641b82181
--- /dev/null
+++ b/drivers/misc/mei/dma-ring.c
@@ -0,0 +1,269 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved.
+ */
+#include <linux/dma-mapping.h>
+#include <linux/mei.h>
+
+#include "mei_dev.h"
+
+/**
+ * mei_dmam_dscr_alloc() - allocate a managed coherent buffer
+ *     for the dma descriptor
+ * @dev: mei_device
+ * @dscr: dma descriptor
+ *
+ * Return:
+ * * 0       - on success or zero allocation request
+ * * -EINVAL - if size is not power of 2
+ * * -ENOMEM - of allocation has failed
+ */
+static int mei_dmam_dscr_alloc(struct mei_device *dev,
+                               struct mei_dma_dscr *dscr)
+{
+        if (!dscr->size)
+                return 0;
+
+        if (WARN_ON(!is_power_of_2(dscr->size)))
+                return -EINVAL;
+
+        if (dscr->vaddr)
+                return 0;
+
+        dscr->vaddr = dmam_alloc_coherent(dev->dev, dscr->size, &dscr->daddr,
+                                          GFP_KERNEL);
+        if (!dscr->vaddr)
+                return -ENOMEM;
+
+        return 0;
+}
+
+/**
+ * mei_dmam_dscr_free() - free a managed coherent buffer
+ *     from the dma descriptor
+ * @dev: mei_device
+ * @dscr: dma descriptor
+ */
+static void mei_dmam_dscr_free(struct mei_device *dev,
+                               struct mei_dma_dscr *dscr)
+{
+        if (!dscr->vaddr)
+                return;
+
+        dmam_free_coherent(dev->dev, dscr->size, dscr->vaddr, dscr->daddr);
+        dscr->vaddr = NULL;
+}
+
+/**
+ * mei_dmam_ring_free() - free dma ring buffers
+ * @dev: mei device
+ */
+void mei_dmam_ring_free(struct mei_device *dev)
+{
+        int i;
+
+        for (i = 0; i < DMA_DSCR_NUM; i++)
+                mei_dmam_dscr_free(dev, &dev->dr_dscr[i]);
+}
+
+/**
+ * mei_dmam_ring_alloc() - allocate dma ring buffers
+ * @dev: mei device
+ *
+ * Return: -ENOMEM on allocation failure 0 otherwise
+ */
+int mei_dmam_ring_alloc(struct mei_device *dev)
+{
+        int i;
+
+        for (i = 0; i < DMA_DSCR_NUM; i++)
+                if (mei_dmam_dscr_alloc(dev, &dev->dr_dscr[i]))
+                        goto err;
+
+        return 0;
+
+err:
+        mei_dmam_ring_free(dev);
+        return -ENOMEM;
+}
+
+/**
+ * mei_dma_ring_is_allocated() - check if dma ring is allocated
+ * @dev: mei device
+ *
+ * Return: true if dma ring is allocated
+ */
+bool mei_dma_ring_is_allocated(struct mei_device *dev)
+{
+        return !!dev->dr_dscr[DMA_DSCR_HOST].vaddr;
+}
+
+static inline
+struct hbm_dma_ring_ctrl *mei_dma_ring_ctrl(struct mei_device *dev)
+{
+        return (struct hbm_dma_ring_ctrl *)dev->dr_dscr[DMA_DSCR_CTRL].vaddr;
+}
+
+/**
+ * mei_dma_ring_reset() - reset the dma control block
+ * @dev: mei device
+ */
+void mei_dma_ring_reset(struct mei_device *dev)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+
+        if (!ctrl)
+                return;
+
+        memset(ctrl, 0, sizeof(*ctrl));
+}
+
+/**
+ * mei_dma_copy_from() - copy from dma ring into buffer
+ * @dev: mei device
+ * @buf: data buffer
+ * @offset: offset in slots.
+ * @n: number of slots to copy.
+ */
+static size_t mei_dma_copy_from(struct mei_device *dev, unsigned char *buf,
+                                u32 offset, u32 n)
+{
+        unsigned char *dbuf = dev->dr_dscr[DMA_DSCR_DEVICE].vaddr;
+
+        size_t b_offset = offset << 2;
+        size_t b_n = n << 2;
+
+        memcpy(buf, dbuf + b_offset, b_n);
+
+        return b_n;
+}
+
+/**
+ * mei_dma_copy_to() - copy to a buffer to the dma ring
+ * @dev: mei device
+ * @buf: data buffer
+ * @offset: offset in slots.
+ * @n: number of slots to copy.
+ */
+static size_t mei_dma_copy_to(struct mei_device *dev, unsigned char *buf,
+                              u32 offset, u32 n)
+{
+        unsigned char *hbuf = dev->dr_dscr[DMA_DSCR_HOST].vaddr;
+
+        size_t b_offset = offset << 2;
+        size_t b_n = n << 2;
+
+        memcpy(hbuf + b_offset, buf, b_n);
+
+        return b_n;
+}
+
+/**
+ * mei_dma_ring_read() - read data from the ring
+ * @dev: mei device
+ * @buf: buffer to read into: may be NULL in case of droping the data.
+ * @len: length to read.
+ */
+void mei_dma_ring_read(struct mei_device *dev, unsigned char *buf, u32 len)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+        u32 dbuf_depth;
+        u32 rd_idx, rem, slots;
+
+        if (WARN_ON(!ctrl))
+                return;
+
+        dev_dbg(dev->dev, "reading from dma %u bytes\n", len);
+
+        if (!len)
+                return;
+
+        dbuf_depth = dev->dr_dscr[DMA_DSCR_DEVICE].size >> 2;
+        rd_idx = READ_ONCE(ctrl->dbuf_rd_idx) & (dbuf_depth - 1);
+        slots = mei_data2slots(len);
+
+        /* if buf is NULL we drop the packet by advancing the pointer.*/
+        if (!buf)
+                goto out;
+
+        if (rd_idx + slots > dbuf_depth) {
+                buf += mei_dma_copy_from(dev, buf, rd_idx, dbuf_depth - rd_idx);
+                rem = slots - (dbuf_depth - rd_idx);
+                rd_idx = 0;
+        } else {
+                rem = slots;
+        }
+
+        mei_dma_copy_from(dev, buf, rd_idx, rem);
+out:
+        WRITE_ONCE(ctrl->dbuf_rd_idx, ctrl->dbuf_rd_idx + slots);
+}
+
+static inline u32 mei_dma_ring_hbuf_depth(struct mei_device *dev)
+{
+        return dev->dr_dscr[DMA_DSCR_HOST].size >> 2;
+}
+
+/**
+ * mei_dma_ring_empty_slots() - calaculate number of empty slots in dma ring
+ * @dev: mei_device
+ *
+ * Return: number of empty slots
+ */
+u32 mei_dma_ring_empty_slots(struct mei_device *dev)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+        u32 wr_idx, rd_idx, hbuf_depth, empty;
+
+        if (!mei_dma_ring_is_allocated(dev))
+                return 0;
+
+        if (WARN_ON(!ctrl))
+                return 0;
+
+        /* easier to work in slots */
+        hbuf_depth = mei_dma_ring_hbuf_depth(dev);
+        rd_idx = READ_ONCE(ctrl->hbuf_rd_idx);
+        wr_idx = READ_ONCE(ctrl->hbuf_wr_idx);
+
+        if (rd_idx > wr_idx)
+                empty = rd_idx - wr_idx;
+        else
+                empty = hbuf_depth - (wr_idx - rd_idx);
+
+        return empty;
+}
+
+/**
+ * mei_dma_ring_write - write data to dma ring host buffer
+ *
+ * @dev: mei_device
+ * @buf: data will be written
+ * @len: data length
+ */
+void mei_dma_ring_write(struct mei_device *dev, unsigned char *buf, u32 len)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+        u32 hbuf_depth;
+        u32 wr_idx, rem, slots;
+
+        if (WARN_ON(!ctrl))
+                return;
+
+        dev_dbg(dev->dev, "writing to dma %u bytes\n", len);
+        hbuf_depth = mei_dma_ring_hbuf_depth(dev);
+        wr_idx = READ_ONCE(ctrl->hbuf_wr_idx) & (hbuf_depth - 1);
+        slots = mei_data2slots(len);
+
+        if (wr_idx + slots > hbuf_depth) {
+                buf += mei_dma_copy_to(dev, buf, wr_idx, hbuf_depth - wr_idx);
+                rem = slots - (hbuf_depth - wr_idx);
+                wr_idx = 0;
+        } else {
+                rem = slots;
+        }
+
+        mei_dma_copy_to(dev, buf, wr_idx, rem);
+
+        WRITE_ONCE(ctrl->hbuf_wr_idx, ctrl->hbuf_wr_idx + slots);
+}
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index e56f3e72d57a..78c26cebf5d4 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -65,6 +65,7 @@ const char *mei_hbm_state_str(enum mei_hbm_state state)
         MEI_HBM_STATE(IDLE);
         MEI_HBM_STATE(STARTING);
         MEI_HBM_STATE(STARTED);
+        MEI_HBM_STATE(DR_SETUP);
         MEI_HBM_STATE(ENUM_CLIENTS);
         MEI_HBM_STATE(CLIENT_PROPERTIES);
         MEI_HBM_STATE(STOPPED);
@@ -296,6 +297,48 @@ int mei_hbm_start_req(struct mei_device *dev)
 }
 
 /**
+ * mei_hbm_dma_setup_req() - setup DMA request
+ * @dev: the device structure
+ *
+ * Return: 0 on success and < 0 on failure
+ */
+static int mei_hbm_dma_setup_req(struct mei_device *dev)
+{
+        struct mei_msg_hdr mei_hdr;
+        struct hbm_dma_setup_request req;
+        const size_t len = sizeof(struct hbm_dma_setup_request);
+        unsigned int i;
+        int ret;
+
+        mei_hbm_hdr(&mei_hdr, len);
+
+        memset(&req, 0, len);
+        req.hbm_cmd = MEI_HBM_DMA_SETUP_REQ_CMD;
+        for (i = 0; i < DMA_DSCR_NUM; i++) {
+                phys_addr_t paddr;
+
+                paddr = dev->dr_dscr[i].daddr;
+                req.dma_dscr[i].addr_hi = upper_32_bits(paddr);
+                req.dma_dscr[i].addr_lo = lower_32_bits(paddr);
+                req.dma_dscr[i].size = dev->dr_dscr[i].size;
+        }
+
+        mei_dma_ring_reset(dev);
+
+        ret = mei_hbm_write_message(dev, &mei_hdr, &req);
+        if (ret) {
+                dev_err(dev->dev, "dma setup request write failed: ret = %d.\n",
+                        ret);
+                return ret;
+        }
+
+        dev->hbm_state = MEI_HBM_DR_SETUP;
+        dev->init_clients_timer = MEI_CLIENTS_INIT_TIMEOUT;
+        mei_schedule_stall_timer(dev);
+        return 0;
+}
+
+/**
  * mei_hbm_enum_clients_req - sends enumeration client request message.
  *
  * @dev: the device structure
@@ -1044,6 +1087,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
         struct hbm_host_version_response *version_res;
         struct hbm_props_response *props_res;
         struct hbm_host_enum_response *enum_res;
+        struct hbm_dma_setup_response *dma_setup_res;
         struct hbm_add_client_request *add_cl_req;
         int ret;
 
@@ -1108,14 +1152,52 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                         return -EPROTO;
                 }
 
-                if (mei_hbm_enum_clients_req(dev)) {
-                        dev_err(dev->dev, "hbm: start: failed to send enumeration request\n");
-                        return -EIO;
+                if (dev->hbm_f_dr_supported) {
+                        if (mei_dmam_ring_alloc(dev))
+                                dev_info(dev->dev, "running w/o dma ring\n");
+                        if (mei_dma_ring_is_allocated(dev)) {
+                                if (mei_hbm_dma_setup_req(dev))
+                                        return -EIO;
+
+                                wake_up(&dev->wait_hbm_start);
+                                break;
+                        }
                 }
 
+                dev->hbm_f_dr_supported = 0;
+                mei_dmam_ring_free(dev);
+
+                if (mei_hbm_enum_clients_req(dev))
+                        return -EIO;
+
                 wake_up(&dev->wait_hbm_start);
                 break;
 
+        case MEI_HBM_DMA_SETUP_RES_CMD:
+                dev_dbg(dev->dev, "hbm: dma setup response: message received.\n");
+
+                dev->init_clients_timer = 0;
+
+                if (dev->hbm_state != MEI_HBM_DR_SETUP) {
+                        dev_err(dev->dev, "hbm: dma setup response: state mismatch, [%d, %d]\n",
+                                dev->dev_state, dev->hbm_state);
+                        return -EPROTO;
+                }
+
+                dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
+
+                if (dma_setup_res->status) {
+                        dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                                 dma_setup_res->status,
+                                 mei_hbm_status_str(dma_setup_res->status));
+                        dev->hbm_f_dr_supported = 0;
+                        mei_dmam_ring_free(dev);
+                }
+
+                if (mei_hbm_enum_clients_req(dev))
+                        return -EIO;
+                break;
+
         case CLIENT_CONNECT_RES_CMD:
                 dev_dbg(dev->dev, "hbm: client connect response: message received.\n");
                 mei_hbm_cl_res(dev, cl_cmd, MEI_FOP_CONNECT);
@@ -1271,8 +1353,8 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                 break;
 
         default:
-                BUG();
-                break;
+                WARN(1, "hbm: wrong command %d\n", mei_msg->hbm_cmd);
+                return -EPROTO;
 
         }
         return 0;
diff --git a/drivers/misc/mei/hbm.h b/drivers/misc/mei/hbm.h
index a2025a5083a3..0171a7e79bab 100644
--- a/drivers/misc/mei/hbm.h
+++ b/drivers/misc/mei/hbm.h
@@ -26,6 +26,7 @@ struct mei_cl;
  *
  * @MEI_HBM_IDLE : protocol not started
  * @MEI_HBM_STARTING : start request message was sent
+ * @MEI_HBM_DR_SETUP : dma ring setup request message was sent
  * @MEI_HBM_ENUM_CLIENTS : enumeration request was sent
  * @MEI_HBM_CLIENT_PROPERTIES : acquiring clients properties
  * @MEI_HBM_STARTED : enumeration was completed
@@ -34,6 +35,7 @@ struct mei_cl;
 enum mei_hbm_state {
         MEI_HBM_IDLE = 0,
         MEI_HBM_STARTING,
+        MEI_HBM_DR_SETUP,
         MEI_HBM_ENUM_CLIENTS,
         MEI_HBM_CLIENT_PROPERTIES,
         MEI_HBM_STARTED,
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 0759c3a668de..3fbbadfa2ae1 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -1471,15 +1471,21 @@ struct mei_device *mei_me_dev_init(struct pci_dev *pdev,
 {
         struct mei_device *dev;
         struct mei_me_hw *hw;
+        int i;
 
         dev = devm_kzalloc(&pdev->dev, sizeof(struct mei_device) +
                            sizeof(struct mei_me_hw), GFP_KERNEL);
         if (!dev)
                 return NULL;
+
         hw = to_me_hw(dev);
 
+        for (i = 0; i < DMA_DSCR_NUM; i++)
+                dev->dr_dscr[i].size = cfg->dma_size[i];
+
         mei_device_init(dev, &pdev->dev, &mei_me_hw_ops);
         hw->cfg = cfg;
+
         return dev;
 }
 
diff --git a/drivers/misc/mei/hw.h b/drivers/misc/mei/hw.h
index 65655925791a..2b7f7677f8cc 100644
--- a/drivers/misc/mei/hw.h
+++ b/drivers/misc/mei/hw.h
@@ -35,7 +35,7 @@
 /*
  * MEI Version
  */
-#define HBM_MINOR_VERSION                   0
+#define HBM_MINOR_VERSION                   1
 #define HBM_MAJOR_VERSION                   2
 
 /*
@@ -206,6 +206,7 @@ enum  mei_cl_disconnect_status {
  * @dma_ring: message is on dma ring
  * @internal: message is internal
  * @msg_complete: last packet of the message
+ * @extension: extension of the header
  */
 struct mei_msg_hdr {
         u32 me_addr:8;
@@ -215,8 +216,11 @@ struct mei_msg_hdr {
         u32 dma_ring:1;
         u32 internal:1;
         u32 msg_complete:1;
+        u32 extension[0];
 } __packed;
 
+#define MEI_MSG_HDR_MAX 2
+
 struct mei_bus_message {
         u8 hbm_cmd;
         u8 data[0];
@@ -512,4 +516,27 @@ struct hbm_dma_setup_response {
         u8 reserved[2];
 } __packed;
 
+/**
+ * struct mei_dma_ring_ctrl - dma ring control block
+ *
+ * @hbuf_wr_idx: host circular buffer write index in slots
+ * @reserved1: reserved for alignment
+ * @hbuf_rd_idx: host circular buffer read index in slots
+ * @reserved2: reserved for alignment
+ * @dbuf_wr_idx: device circular buffer write index in slots
+ * @reserved3: reserved for alignment
+ * @dbuf_rd_idx: device circular buffer read index in slots
+ * @reserved4: reserved for alignment
+ */
+struct hbm_dma_ring_ctrl {
+        u32 hbuf_wr_idx;
+        u32 reserved1;
+        u32 hbuf_rd_idx;
+        u32 reserved2;
+        u32 dbuf_wr_idx;
+        u32 reserved3;
+        u32 dbuf_rd_idx;
+        u32 reserved4;
+} __packed;
+
 #endif
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 4888ebc076b7..eb026e2a0537 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -151,7 +151,7 @@ int mei_reset(struct mei_device *dev)
 
         mei_hbm_reset(dev);
 
-        dev->rd_msg_hdr = 0;
+        memset(dev->rd_msg_hdr, 0, sizeof(dev->rd_msg_hdr));
 
         if (ret) {
                 dev_err(dev->dev, "hw_reset failed ret = %d\n", ret);
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 5a661cbdf2ae..055c2d89b310 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -75,6 +75,8 @@ static inline int mei_cl_hbm_equal(struct mei_cl *cl,
  */
 static void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr)
 {
+        if (hdr->dma_ring)
+                mei_dma_ring_read(dev, NULL, hdr->extension[0]);
         /*
          * no need to check for size as it is guarantied
          * that length fits into rd_msg_buf
@@ -100,6 +102,7 @@ static int mei_cl_irq_read_msg(struct mei_cl *cl,
         struct mei_device *dev = cl->dev;
         struct mei_cl_cb *cb;
         size_t buf_sz;
+        u32 length;
 
         cb = list_first_entry_or_null(&cl->rd_pending, struct mei_cl_cb, list);
         if (!cb) {
@@ -119,25 +122,31 @@ static int mei_cl_irq_read_msg(struct mei_cl *cl,
                 goto discard;
         }
 
-        buf_sz = mei_hdr->length + cb->buf_idx;
+        length = mei_hdr->dma_ring ? mei_hdr->extension[0] : mei_hdr->length;
+
+        buf_sz = length + cb->buf_idx;
         /* catch for integer overflow */
         if (buf_sz < cb->buf_idx) {
                 cl_err(dev, cl, "message is too big len %d idx %zu\n",
-                       mei_hdr->length, cb->buf_idx);
+                       length, cb->buf_idx);
                 cb->status = -EMSGSIZE;
                 goto discard;
         }
 
         if (cb->buf.size < buf_sz) {
                 cl_dbg(dev, cl, "message overflow. size %zu len %d idx %zu\n",
-                        cb->buf.size, mei_hdr->length, cb->buf_idx);
+                        cb->buf.size, length, cb->buf_idx);
                 cb->status = -EMSGSIZE;
                 goto discard;
         }
 
+        if (mei_hdr->dma_ring)
+                mei_dma_ring_read(dev, cb->buf.data + cb->buf_idx, length);
+
+        /*  for DMA read 0 length to generate an interrupt to the device */
         mei_read_slots(dev, cb->buf.data + cb->buf_idx, mei_hdr->length);
 
-        cb->buf_idx += mei_hdr->length;
+        cb->buf_idx += length;
 
         if (mei_hdr->msg_complete) {
                 cl_dbg(dev, cl, "completed read length = %zu\n", cb->buf_idx);
@@ -247,6 +256,9 @@ static inline int hdr_is_valid(u32 msg_hdr)
         if (!msg_hdr || mei_hdr->reserved)
                 return -EBADMSG;
 
+        if (mei_hdr->dma_ring && mei_hdr->length != MEI_SLOT_SIZE)
+                return -EBADMSG;
+
         return 0;
 }
 
@@ -267,20 +279,20 @@ int mei_irq_read_handler(struct mei_device *dev,
         struct mei_cl *cl;
         int ret;
 
-        if (!dev->rd_msg_hdr) {
-                dev->rd_msg_hdr = mei_read_hdr(dev);
+        if (!dev->rd_msg_hdr[0]) {
+                dev->rd_msg_hdr[0] = mei_read_hdr(dev);
                 (*slots)--;
                 dev_dbg(dev->dev, "slots =%08x.\n", *slots);
 
-                ret = hdr_is_valid(dev->rd_msg_hdr);
+                ret = hdr_is_valid(dev->rd_msg_hdr[0]);
                 if (ret) {
                         dev_err(dev->dev, "corrupted message header 0x%08X\n",
-                                dev->rd_msg_hdr);
+                                dev->rd_msg_hdr[0]);
                         goto end;
                 }
         }
 
-        mei_hdr = (struct mei_msg_hdr *)&dev->rd_msg_hdr;
+        mei_hdr = (struct mei_msg_hdr *)dev->rd_msg_hdr;
         dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
 
         if (mei_slots2data(*slots) < mei_hdr->length) {
@@ -291,6 +303,12 @@ int mei_irq_read_handler(struct mei_device *dev,
                 goto end;
         }
 
+        if (mei_hdr->dma_ring) {
+                dev->rd_msg_hdr[1] = mei_read_hdr(dev);
+                (*slots)--;
+                mei_hdr->length = 0;
+        }
+
         /*  HBM message */
         if (hdr_is_hbm(mei_hdr)) {
                 ret = mei_hbm_dispatch(dev, mei_hdr);
@@ -324,7 +342,7 @@ int mei_irq_read_handler(struct mei_device *dev,
                         goto reset_slots;
                 }
                 dev_err(dev->dev, "no destination client found 0x%08X\n",
-                                dev->rd_msg_hdr);
+                                dev->rd_msg_hdr[0]);
                 ret = -EBADMSG;
                 goto end;
         }
@@ -334,9 +352,8 @@ int mei_irq_read_handler(struct mei_device *dev,
 
 reset_slots:
         /* reset the number of slots and header */
+        memset(dev->rd_msg_hdr, 0, sizeof(dev->rd_msg_hdr));
         *slots = mei_count_full_read_slots(dev);
-        dev->rd_msg_hdr = 0;
-
         if (*slots == -EOVERFLOW) {
                 /* overflow - reset */
                 dev_err(dev->dev, "resetting due to slots overflow.\n");
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 377397e1b5a5..685b78ce30a5 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -122,6 +122,19 @@ struct mei_msg_data {
         unsigned char *data;
 };
 
+/**
+ * struct mei_dma_dscr - dma address descriptor
+ *
+ * @vaddr: dma buffer virtual address
+ * @daddr: dma buffer physical address
+ * @size : dma buffer size
+ */
+struct mei_dma_dscr {
+        void *vaddr;
+        dma_addr_t daddr;
+        size_t size;
+};
+
 /* Maximum number of processed FW status registers */
 #define MEI_FW_STATUS_MAX 6
 /* Minimal  buffer for FW status string (8 bytes in dw + space or '\0') */
@@ -409,6 +422,7 @@ struct mei_fw_version {
  * @rd_msg_hdr  : read message header storage
  *
  * @hbuf_is_ready : query if the host host/write buffer is ready
+ * @dr_dscr: DMA ring descriptors: TX, RX, and CTRL
  *
  * @version     : HBM protocol version in use
  * @hbm_f_pg_supported  : hbm feature pgi protocol
@@ -483,11 +497,13 @@ struct mei_device {
 #endif /* CONFIG_PM */
 
         unsigned char rd_msg_buf[MEI_RD_MSG_BUF_SIZE];
-        u32 rd_msg_hdr;
+        u32 rd_msg_hdr[MEI_MSG_HDR_MAX];
 
         /* write buffer */
         bool hbuf_is_ready;
 
+        struct mei_dma_dscr dr_dscr[DMA_DSCR_NUM];
+
         struct hbm_version version;
         unsigned int hbm_f_pg_supported:1;
         unsigned int hbm_f_dc_supported:1;
@@ -578,6 +594,14 @@ int mei_restart(struct mei_device *dev);
 void mei_stop(struct mei_device *dev);
 void mei_cancel_work(struct mei_device *dev);
 
+int mei_dmam_ring_alloc(struct mei_device *dev);
+void mei_dmam_ring_free(struct mei_device *dev);
+bool mei_dma_ring_is_allocated(struct mei_device *dev);
+void mei_dma_ring_reset(struct mei_device *dev);
+void mei_dma_ring_read(struct mei_device *dev, unsigned char *buf, u32 len);
+void mei_dma_ring_write(struct mei_device *dev, unsigned char *buf, u32 len);
+u32 mei_dma_ring_empty_slots(struct mei_device *dev);
+
 /*
  *  MEI interrupt functions prototype
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index ea4e152270a3..73ace2d59dea 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -98,9 +98,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
 
-        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
 
         /* required last entry */
diff --git a/drivers/misc/mic/card/mic_debugfs.c b/drivers/misc/mic/card/mic_debugfs.c
index 421b3d7911df..7a4140874888 100644
--- a/drivers/misc/mic/card/mic_debugfs.c
+++ b/drivers/misc/mic/card/mic_debugfs.c
@@ -37,9 +37,9 @@
 static struct dentry *mic_dbg;
 
 /**
- * mic_intr_test - Send interrupts to host.
+ * mic_intr_show - Send interrupts to host.
  */
-static int mic_intr_test(struct seq_file *s, void *unused)
+static int mic_intr_show(struct seq_file *s, void *unused)
 {
         struct mic_driver *mdrv = s->private;
         struct mic_device *mdev = &mdrv->mdev;
@@ -56,23 +56,7 @@ static int mic_intr_test(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int mic_intr_test_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_intr_test, inode->i_private);
-}
-
-static int mic_intr_test_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations intr_test_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_intr_test_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_intr_test_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_intr);
 
 /**
  * mic_create_card_debug_dir - Initialize MIC debugfs entries.
@@ -91,7 +75,7 @@ void __init mic_create_card_debug_dir(struct mic_driver *mdrv)
         }
 
         d = debugfs_create_file("intr_test", 0444, mdrv->dbg_dir,
-                mdrv, &intr_test_ops);
+                mdrv, &mic_intr_fops);
 
         if (!d) {
                 dev_err(mdrv->dev,
diff --git a/drivers/misc/mic/cosm/cosm_debugfs.c b/drivers/misc/mic/cosm/cosm_debugfs.c
index 216cb3cd2fe3..71c216d0504d 100644
--- a/drivers/misc/mic/cosm/cosm_debugfs.c
+++ b/drivers/misc/mic/cosm/cosm_debugfs.c
@@ -28,12 +28,12 @@
 static struct dentry *cosm_dbg;
 
 /**
- * cosm_log_buf_show - Display MIC kernel log buffer
+ * log_buf_show - Display MIC kernel log buffer
  *
  * log_buf addr/len is read from System.map by user space
  * and populated in sysfs entries.
  */
-static int cosm_log_buf_show(struct seq_file *s, void *unused)
+static int log_buf_show(struct seq_file *s, void *unused)
 {
         void __iomem *log_buf_va;
         int __iomem *log_buf_len_va;
@@ -78,26 +78,15 @@ done:
         return 0;
 }
 
-static int cosm_log_buf_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cosm_log_buf_show, inode->i_private);
-}
-
-static const struct file_operations log_buf_ops = {
-        .owner   = THIS_MODULE,
-        .open    = cosm_log_buf_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = single_release
-};
+DEFINE_SHOW_ATTRIBUTE(log_buf);
 
 /**
- * cosm_force_reset_show - Force MIC reset
+ * force_reset_show - Force MIC reset
  *
  * Invokes the force_reset COSM bus op instead of the standard reset
  * op in case a force reset of the MIC device is required
  */
-static int cosm_force_reset_show(struct seq_file *s, void *pos)
+static int force_reset_show(struct seq_file *s, void *pos)
 {
         struct cosm_device *cdev = s->private;
 
@@ -105,18 +94,7 @@ static int cosm_force_reset_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int cosm_force_reset_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cosm_force_reset_show, inode->i_private);
-}
-
-static const struct file_operations force_reset_ops = {
-        .owner   = THIS_MODULE,
-        .open    = cosm_force_reset_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = single_release
-};
+DEFINE_SHOW_ATTRIBUTE(force_reset);
 
 void cosm_create_debug_dir(struct cosm_device *cdev)
 {
@@ -130,9 +108,10 @@ void cosm_create_debug_dir(struct cosm_device *cdev)
         if (!cdev->dbg_dir)
                 return;
 
-        debugfs_create_file("log_buf", 0444, cdev->dbg_dir, cdev, &log_buf_ops);
+        debugfs_create_file("log_buf", 0444, cdev->dbg_dir, cdev,
+                            &log_buf_fops);
         debugfs_create_file("force_reset", 0444, cdev->dbg_dir, cdev,
-                            &force_reset_ops);
+                            &force_reset_fops);
 }
 
 void cosm_delete_debug_dir(struct cosm_device *cdev)
diff --git a/drivers/misc/mic/host/mic_debugfs.c b/drivers/misc/mic/host/mic_debugfs.c
index 0a9daba8bb5d..c6e3c764699f 100644
--- a/drivers/misc/mic/host/mic_debugfs.c
+++ b/drivers/misc/mic/host/mic_debugfs.c
@@ -54,23 +54,7 @@ static int mic_smpt_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int mic_smpt_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_smpt_show, inode->i_private);
-}
-
-static int mic_smpt_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations smpt_file_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_smpt_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_smpt_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_smpt);
 
 static int mic_post_code_show(struct seq_file *s, void *pos)
 {
@@ -81,23 +65,7 @@ static int mic_post_code_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int mic_post_code_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_post_code_show, inode->i_private);
-}
-
-static int mic_post_code_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations post_code_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_post_code_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_post_code_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_post_code);
 
 static int mic_msi_irq_info_show(struct seq_file *s, void *pos)
 {
@@ -143,24 +111,7 @@ static int mic_msi_irq_info_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int mic_msi_irq_info_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_msi_irq_info_show, inode->i_private);
-}
-
-static int
-mic_msi_irq_info_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations msi_irq_info_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_msi_irq_info_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_msi_irq_info_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_msi_irq_info);
 
 /**
  * mic_create_debug_dir - Initialize MIC debugfs entries.
@@ -177,13 +128,14 @@ void mic_create_debug_dir(struct mic_device *mdev)
         if (!mdev->dbg_dir)
                 return;
 
-        debugfs_create_file("smpt", 0444, mdev->dbg_dir, mdev, &smpt_file_ops);
+        debugfs_create_file("smpt", 0444, mdev->dbg_dir, mdev,
+                            &mic_smpt_fops);
 
         debugfs_create_file("post_code", 0444, mdev->dbg_dir, mdev,
-                            &post_code_ops);
+                            &mic_post_code_fops);
 
         debugfs_create_file("msi_irq_info", 0444, mdev->dbg_dir, mdev,
-                            &msi_irq_info_ops);
+                            &mic_msi_irq_info_fops);
 }
 
 /**
diff --git a/drivers/misc/mic/scif/scif_debugfs.c b/drivers/misc/mic/scif/scif_debugfs.c
index 6884dad97e17..cca5e980c710 100644
--- a/drivers/misc/mic/scif/scif_debugfs.c
+++ b/drivers/misc/mic/scif/scif_debugfs.c
@@ -24,7 +24,7 @@
 /* Debugfs parent dir */
 static struct dentry *scif_dbg;
 
-static int scif_dev_test(struct seq_file *s, void *unused)
+static int scif_dev_show(struct seq_file *s, void *unused)
 {
         int node;
 
@@ -44,23 +44,7 @@ static int scif_dev_test(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int scif_dev_test_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, scif_dev_test, inode->i_private);
-}
-
-static int scif_dev_test_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations scif_dev_ops = {
-        .owner   = THIS_MODULE,
-        .open    = scif_dev_test_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = scif_dev_test_release
-};
+DEFINE_SHOW_ATTRIBUTE(scif_dev);
 
 static void scif_display_window(struct scif_window *window, struct seq_file *s)
 {
@@ -104,7 +88,7 @@ static void scif_display_all_windows(struct list_head *head, struct seq_file *s)
         }
 }
 
-static int scif_rma_test(struct seq_file *s, void *unused)
+static int scif_rma_show(struct seq_file *s, void *unused)
 {
         struct scif_endpt *ep;
         struct list_head *pos;
@@ -123,23 +107,7 @@ static int scif_rma_test(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int scif_rma_test_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, scif_rma_test, inode->i_private);
-}
-
-static int scif_rma_test_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations scif_rma_ops = {
-        .owner   = THIS_MODULE,
-        .open    = scif_rma_test_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = scif_rma_test_release
-};
+DEFINE_SHOW_ATTRIBUTE(scif_rma);
 
 void __init scif_init_debugfs(void)
 {
@@ -150,8 +118,8 @@ void __init scif_init_debugfs(void)
                 return;
         }
 
-        debugfs_create_file("scif_dev", 0444, scif_dbg, NULL, &scif_dev_ops);
-        debugfs_create_file("scif_rma", 0444, scif_dbg, NULL, &scif_rma_ops);
+        debugfs_create_file("scif_dev", 0444, scif_dbg, NULL, &scif_dev_fops);
+        debugfs_create_file("scif_rma", 0444, scif_dbg, NULL, &scif_rma_fops);
         debugfs_create_u8("en_msg_log", 0666, scif_dbg, &scif_info.en_msg_log);
         debugfs_create_u8("p2p_enable", 0666, scif_dbg, &scif_info.p2p_enable);
 }
diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c
index 7bb929f05d85..2e7ce6ae9dd2 100644
--- a/drivers/misc/mic/scif/scif_fence.c
+++ b/drivers/misc/mic/scif/scif_fence.c
@@ -195,10 +195,11 @@ static inline void *scif_get_local_va(off_t off, struct scif_window *window)
 
 static void scif_prog_signal_cb(void *arg)
 {
-        struct scif_status *status = arg;
+        struct scif_cb_arg *cb_arg = arg;
 
-        dma_pool_free(status->ep->remote_dev->signal_pool, status,
-                      status->src_dma_addr);
+        dma_pool_free(cb_arg->ep->remote_dev->signal_pool, cb_arg->status,
+                      cb_arg->src_dma_addr);
+        kfree(cb_arg);
 }
 
 static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
@@ -209,6 +210,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
         bool x100 = !is_dma_copy_aligned(chan->device, 1, 1, 1);
         struct dma_async_tx_descriptor *tx;
         struct scif_status *status = NULL;
+        struct scif_cb_arg *cb_arg = NULL;
         dma_addr_t src;
         dma_cookie_t cookie;
         int err;
@@ -257,8 +259,16 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
                 goto dma_fail;
         }
         if (!x100) {
+                cb_arg = kmalloc(sizeof(*cb_arg), GFP_KERNEL);
+                if (!cb_arg) {
+                        err = -ENOMEM;
+                        goto dma_fail;
+                }
+                cb_arg->src_dma_addr = src;
+                cb_arg->status = status;
+                cb_arg->ep = ep;
                 tx->callback = scif_prog_signal_cb;
-                tx->callback_param = status;
+                tx->callback_param = cb_arg;
         }
         cookie = tx->tx_submit(tx);
         if (dma_submit_error(cookie)) {
@@ -270,9 +280,11 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
         dma_async_issue_pending(chan);
         return 0;
 dma_fail:
-        if (!x100)
+        if (!x100) {
                 dma_pool_free(ep->remote_dev->signal_pool, status,
                               src - offsetof(struct scif_status, val));
+                kfree(cb_arg);
+        }
 alloc_fail:
         return err;
 }
diff --git a/drivers/misc/mic/scif/scif_rma.h b/drivers/misc/mic/scif/scif_rma.h
index fa6722279196..84af3033a473 100644
--- a/drivers/misc/mic/scif/scif_rma.h
+++ b/drivers/misc/mic/scif/scif_rma.h
@@ -206,6 +206,19 @@ struct scif_status {
 };
 
 /*
+ * struct scif_cb_arg - Stores the argument of the callback func
+ *
+ * @src_dma_addr: Source buffer DMA address
+ * @status: DMA status
+ * @ep: SCIF endpoint
+ */
+struct scif_cb_arg {
+        dma_addr_t src_dma_addr;
+        struct scif_status *status;
+        struct scif_endpt *ep;
+};
+
+/*
  * struct scif_window - Registration Window for Self and Remote
  *
  * @nr_pages: Number of pages which is defined as a s64 instead of an int
diff --git a/drivers/misc/mic/vop/vop_debugfs.c b/drivers/misc/mic/vop/vop_debugfs.c
index ab43884e5cd7..2ccef52aca23 100644
--- a/drivers/misc/mic/vop/vop_debugfs.c
+++ b/drivers/misc/mic/vop/vop_debugfs.c
@@ -101,23 +101,7 @@ static int vop_dp_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int vop_dp_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, vop_dp_show, inode->i_private);
-}
-
-static int vop_dp_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations dp_ops = {
-        .owner   = THIS_MODULE,
-        .open    = vop_dp_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = vop_dp_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(vop_dp);
 
 static int vop_vdev_info_show(struct seq_file *s, void *unused)
 {
@@ -194,23 +178,7 @@ static int vop_vdev_info_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int vop_vdev_info_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, vop_vdev_info_show, inode->i_private);
-}
-
-static int vop_vdev_info_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations vdev_info_ops = {
-        .owner   = THIS_MODULE,
-        .open    = vop_vdev_info_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = vop_vdev_info_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(vop_vdev_info);
 
 void vop_init_debugfs(struct vop_info *vi)
 {
@@ -222,8 +190,8 @@ void vop_init_debugfs(struct vop_info *vi)
                 pr_err("can't create debugfs dir vop\n");
                 return;
         }
-        debugfs_create_file("dp", 0444, vi->dbg, vi, &dp_ops);
-        debugfs_create_file("vdev_info", 0444, vi->dbg, vi, &vdev_info_ops);
+        debugfs_create_file("dp", 0444, vi->dbg, vi, &vop_dp_fops);
+        debugfs_create_file("vdev_info", 0444, vi->dbg, vi, &vop_vdev_info_fops);
 }
 
 void vop_exit_debugfs(struct vop_info *vi)
diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c
new file mode 100644
index 000000000000..595ac065b401
--- /dev/null
+++ b/drivers/misc/pvpanic.c
@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ *  Pvpanic Device Support
+ *
+ *  Copyright (C) 2013 Fujitsu.
+ *  Copyright (C) 2018 ZTE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/acpi.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include <linux/types.h>
+
+static void __iomem *base;
+
+#define PVPANIC_PANICKED        (1 << 0)
+
+MODULE_AUTHOR("Hu Tao <hutao@cn.fujitsu.com>");
+MODULE_DESCRIPTION("pvpanic device driver");
+MODULE_LICENSE("GPL");
+
+static void
+pvpanic_send_event(unsigned int event)
+{
+        iowrite8(event, base);
+}
+
+static int
+pvpanic_panic_notify(struct notifier_block *nb, unsigned long code,
+                     void *unused)
+{
+        pvpanic_send_event(PVPANIC_PANICKED);
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block pvpanic_panic_nb = {
+        .notifier_call = pvpanic_panic_notify,
+        .priority = 1, /* let this called before broken drm_fb_helper */
+};
+
+#ifdef CONFIG_ACPI
+static int pvpanic_add(struct acpi_device *device);
+static int pvpanic_remove(struct acpi_device *device);
+
+static const struct acpi_device_id pvpanic_device_ids[] = {
+        { "QEMU0001", 0 },
+        { "", 0 }
+};
+MODULE_DEVICE_TABLE(acpi, pvpanic_device_ids);
+
+static struct acpi_driver pvpanic_driver = {
+        .name =         "pvpanic",
+        .class =        "QEMU",
+        .ids =          pvpanic_device_ids,
+        .ops =          {
+                                .add =          pvpanic_add,
+                                .remove =       pvpanic_remove,
+                        },
+        .owner =        THIS_MODULE,
+};
+
+static acpi_status
+pvpanic_walk_resources(struct acpi_resource *res, void *context)
+{
+        struct resource r;
+
+        if (acpi_dev_resource_io(res, &r)) {
+                base = ioport_map(r.start, resource_size(&r));
+                return AE_OK;
+        } else if (acpi_dev_resource_memory(res, &r)) {
+                base = ioremap(r.start, resource_size(&r));
+                return AE_OK;
+        }
+
+        return AE_ERROR;
+}
+
+static int pvpanic_add(struct acpi_device *device)
+{
+        int ret;
+
+        ret = acpi_bus_get_status(device);
+        if (ret < 0)
+                return ret;
+
+        if (!device->status.enabled || !device->status.functional)
+                return -ENODEV;
+
+        acpi_walk_resources(device->handle, METHOD_NAME__CRS,
+                            pvpanic_walk_resources, NULL);
+
+        if (!base)
+                return -ENODEV;
+
+        atomic_notifier_chain_register(&panic_notifier_list,
+                                       &pvpanic_panic_nb);
+
+        return 0;
+}
+
+static int pvpanic_remove(struct acpi_device *device)
+{
+
+        atomic_notifier_chain_unregister(&panic_notifier_list,
+                                         &pvpanic_panic_nb);
+        iounmap(base);
+
+        return 0;
+}
+
+static int pvpanic_register_acpi_driver(void)
+{
+        return acpi_bus_register_driver(&pvpanic_driver);
+}
+
+static void pvpanic_unregister_acpi_driver(void)
+{
+        acpi_bus_unregister_driver(&pvpanic_driver);
+}
+#else
+static int pvpanic_register_acpi_driver(void)
+{
+        return -ENODEV;
+}
+
+static void pvpanic_unregister_acpi_driver(void) {}
+#endif
+
+static int pvpanic_mmio_probe(struct platform_device *pdev)
+{
+        struct resource *mem;
+
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!mem)
+                return -EINVAL;
+
+        base = devm_ioremap_resource(&pdev->dev, mem);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        atomic_notifier_chain_register(&panic_notifier_list,
+                                       &pvpanic_panic_nb);
+
+        return 0;
+}
+
+static int pvpanic_mmio_remove(struct platform_device *pdev)
+{
+
+        atomic_notifier_chain_unregister(&panic_notifier_list,
+                                         &pvpanic_panic_nb);
+
+        return 0;
+}
+
+static const struct of_device_id pvpanic_mmio_match[] = {
+        { .compatible = "qemu,pvpanic-mmio", },
+        {}
+};
+
+static struct platform_driver pvpanic_mmio_driver = {
+        .driver = {
+                .name = "pvpanic-mmio",
+                .of_match_table = pvpanic_mmio_match,
+        },
+        .probe = pvpanic_mmio_probe,
+        .remove = pvpanic_mmio_remove,
+};
+
+static int __init pvpanic_mmio_init(void)
+{
+        if (acpi_disabled)
+                return platform_driver_register(&pvpanic_mmio_driver);
+        else
+                return pvpanic_register_acpi_driver();
+}
+
+static void __exit pvpanic_mmio_exit(void)
+{
+        if (acpi_disabled)
+                platform_driver_unregister(&pvpanic_mmio_driver);
+        else
+                pvpanic_unregister_acpi_driver();
+}
+
+module_init(pvpanic_mmio_init);
+module_exit(pvpanic_mmio_exit);
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 1874ac922166..e7cfdbd1f66d 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -211,7 +211,7 @@ static void kim_int_recv(struct kim_data_s *kim_gdata,
 static long read_local_version(struct kim_data_s *kim_gdata, char *bts_scr_name)
 {
         unsigned short version = 0, chip = 0, min_ver = 0, maj_ver = 0;
-        const char read_ver_cmd[] = { 0x01, 0x01, 0x10, 0x00 };
+        static const char read_ver_cmd[] = { 0x01, 0x01, 0x10, 0x00 };
         long timeout;
 
         pr_debug("%s", __func__);
@@ -564,7 +564,7 @@ long st_kim_stop(void *kim_data)
 /* functions called from subsystems */
 /* called when debugfs entry is read from */
 
-static int show_version(struct seq_file *s, void *unused)
+static int version_show(struct seq_file *s, void *unused)
 {
         struct kim_data_s *kim_gdata = (struct kim_data_s *)s->private;
         seq_printf(s, "%04X %d.%d.%d\n", kim_gdata->version.full,
@@ -573,7 +573,7 @@ static int show_version(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int show_list(struct seq_file *s, void *unused)
+static int list_show(struct seq_file *s, void *unused)
 {
         struct kim_data_s *kim_gdata = (struct kim_data_s *)s->private;
         kim_st_list_protocols(kim_gdata->core_data, s);
@@ -688,30 +688,8 @@ err:
         *core_data = NULL;
 }
 
-static int kim_version_open(struct inode *i, struct file *f)
-{
-        return single_open(f, show_version, i->i_private);
-}
-
-static int kim_list_open(struct inode *i, struct file *f)
-{
-        return single_open(f, show_list, i->i_private);
-}
-
-static const struct file_operations version_debugfs_fops = {
-        /* version info */
-        .open = kim_version_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-static const struct file_operations list_debugfs_fops = {
-        /* protocols info */
-        .open = kim_list_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(version);
+DEFINE_SHOW_ATTRIBUTE(list);
 
 /**********************************************************************/
 /* functions called from platform device driver subsystem
@@ -789,9 +767,9 @@ static int kim_probe(struct platform_device *pdev)
         }
 
         debugfs_create_file("version", S_IRUGO, kim_debugfs_dir,
-                                kim_gdata, &version_debugfs_fops);
+                                kim_gdata, &version_fops);
         debugfs_create_file("protocols", S_IRUGO, kim_debugfs_dir,
-                                kim_gdata, &list_debugfs_fops);
+                                kim_gdata, &list_fops);
         return 0;
 
 err_sysfs_group:
diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c
index 6c3591cdf855..a3c6c773d9dc 100644
--- a/drivers/misc/vexpress-syscfg.c
+++ b/drivers/misc/vexpress-syscfg.c
@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func,
         int tries;
         long timeout;
 
-        if (WARN_ON(index > func->num_templates))
+        if (WARN_ON(index >= func->num_templates))
                 return -EINVAL;
 
         command = readl(syscfg->base + SYS_CFGCTRL);
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
index e6126a4b95d3..f8240b87df22 100644
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -1470,18 +1470,7 @@ static int vmballoon_debug_show(struct seq_file *f, void *offset)
         return 0;
 }
 
-static int vmballoon_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, vmballoon_debug_show, inode->i_private);
-}
-
-static const struct file_operations vmballoon_debug_fops = {
-        .owner          = THIS_MODULE,
-        .open           = vmballoon_debug_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(vmballoon_debug);
 
 static int __init vmballoon_debugfs_init(struct vmballoon *b)
 {
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index edfffc9699ba..5da1f3e3f997 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -750,19 +750,10 @@ static int vmci_host_do_ctx_set_cpt_state(struct vmci_host_dev *vmci_host_dev,
         if (copy_from_user(&set_info, uptr, sizeof(set_info)))
                 return -EFAULT;
 
-        cpt_buf = kmalloc(set_info.buf_size, GFP_KERNEL);
-        if (!cpt_buf) {
-                vmci_ioctl_err(
-                        "cannot allocate memory to set cpt state (type=%d)\n",
-                        set_info.cpt_type);
-                return -ENOMEM;
-        }
-
-        if (copy_from_user(cpt_buf, (void __user *)(uintptr_t)set_info.cpt_buf,
-                           set_info.buf_size)) {
-                retval = -EFAULT;
-                goto out;
-        }
+        cpt_buf = memdup_user((void __user *)(uintptr_t)set_info.cpt_buf,
+                                set_info.buf_size);
+        if (IS_ERR(cpt_buf))
+                return PTR_ERR(cpt_buf);
 
         cid = vmci_ctx_get_id(vmci_host_dev->context);
         set_info.result = vmci_ctx_set_chkpt_state(cid, set_info.cpt_type,
@@ -770,7 +761,6 @@ static int vmci_host_do_ctx_set_cpt_state(struct vmci_host_dev *vmci_host_dev,
 
         retval = copy_to_user(uptr, &set_info, sizeof(set_info)) ? -EFAULT : 0;
 
-out:
         kfree(cpt_buf);
         return retval;
 }
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index 1e18c9639c3e..79a8ff542883 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -1,5 +1,6 @@
 menuconfig MTD
         tristate "Memory Technology Device (MTD) support"
+        imply NVMEM
         help
           Memory Technology Devices are flash, RAM and similar chips, often
           used for solid state file systems on embedded devices. This option
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index b6b93291aba9..21e3cdc04036 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -41,6 +41,7 @@
 #include <linux/reboot.h>
 #include <linux/leds.h>
 #include <linux/debugfs.h>
+#include <linux/nvmem-provider.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
@@ -488,6 +489,50 @@ int mtd_pairing_groups(struct mtd_info *mtd)
 }
 EXPORT_SYMBOL_GPL(mtd_pairing_groups);
 
+static int mtd_nvmem_reg_read(void *priv, unsigned int offset,
+                              void *val, size_t bytes)
+{
+        struct mtd_info *mtd = priv;
+        size_t retlen;
+        int err;
+
+        err = mtd_read(mtd, offset, bytes, &retlen, val);
+        if (err && err != -EUCLEAN)
+                return err;
+
+        return retlen == bytes ? 0 : -EIO;
+}
+
+static int mtd_nvmem_add(struct mtd_info *mtd)
+{
+        struct nvmem_config config = {};
+
+        config.dev = &mtd->dev;
+        config.name = mtd->name;
+        config.owner = THIS_MODULE;
+        config.reg_read = mtd_nvmem_reg_read;
+        config.size = mtd->size;
+        config.word_size = 1;
+        config.stride = 1;
+        config.read_only = true;
+        config.root_only = true;
+        config.no_of_node = true;
+        config.priv = mtd;
+
+        mtd->nvmem = nvmem_register(&config);
+        if (IS_ERR(mtd->nvmem)) {
+                /* Just ignore if there is no NVMEM support in the kernel */
+                if (PTR_ERR(mtd->nvmem) == -ENOSYS) {
+                        mtd->nvmem = NULL;
+                } else {
+                        dev_err(&mtd->dev, "Failed to register NVMEM device\n");
+                        return PTR_ERR(mtd->nvmem);
+                }
+        }
+
+        return 0;
+}
+
 static struct dentry *dfs_dir_mtd;
 
 /**
@@ -570,6 +615,11 @@ int add_mtd_device(struct mtd_info *mtd)
         if (error)
                 goto fail_added;
 
+        /* Add the nvmem provider */
+        error = mtd_nvmem_add(mtd);
+        if (error)
+                goto fail_nvmem_add;
+
         if (!IS_ERR_OR_NULL(dfs_dir_mtd)) {
                 mtd->dbg.dfs_dir = debugfs_create_dir(dev_name(&mtd->dev), dfs_dir_mtd);
                 if (IS_ERR_OR_NULL(mtd->dbg.dfs_dir)) {
@@ -595,6 +645,8 @@ int add_mtd_device(struct mtd_info *mtd)
         __module_get(THIS_MODULE);
         return 0;
 
+fail_nvmem_add:
+        device_unregister(&mtd->dev);
 fail_added:
         of_node_put(mtd_get_of_node(mtd));
         idr_remove(&mtd_idr, i);
@@ -637,6 +689,10 @@ int del_mtd_device(struct mtd_info *mtd)
                        mtd->index, mtd->name, mtd->usecount);
                 ret = -EBUSY;
         } else {
+                /* Try to remove the NVMEM provider */
+                if (mtd->nvmem)
+                        nvmem_unregister(mtd->nvmem);
+
                 device_unregister(&mtd->dev);
 
                 idr_remove(&mtd_idr, mtd->index);
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 27f67dfa649d..f7301bb4ef3b 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -28,6 +28,7 @@ struct nvmem_device {
         size_t                  size;
         bool                    read_only;
         int                     flags;
+        enum nvmem_type         type;
         struct bin_attribute    eeprom;
         struct device           *base_dev;
         struct list_head        cells;
@@ -60,6 +61,13 @@ static LIST_HEAD(nvmem_lookup_list);
 
 static BLOCKING_NOTIFIER_HEAD(nvmem_notifier);
 
+static const char * const nvmem_type_str[] = {
+        [NVMEM_TYPE_UNKNOWN] = "Unknown",
+        [NVMEM_TYPE_EEPROM] = "EEPROM",
+        [NVMEM_TYPE_OTP] = "OTP",
+        [NVMEM_TYPE_BATTERY_BACKED] = "Battery backed",
+};
+
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key eeprom_lock_key;
 #endif
@@ -83,6 +91,21 @@ static int nvmem_reg_write(struct nvmem_device *nvmem, unsigned int offset,
         return -EINVAL;
 }
 
+static ssize_t type_show(struct device *dev,
+                         struct device_attribute *attr, char *buf)
+{
+        struct nvmem_device *nvmem = to_nvmem_device(dev);
+
+        return sprintf(buf, "%s\n", nvmem_type_str[nvmem->type]);
+}
+
+static DEVICE_ATTR_RO(type);
+
+static struct attribute *nvmem_attrs[] = {
+        &dev_attr_type.attr,
+        NULL,
+};
+
 static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
                                     struct bin_attribute *attr,
                                     char *buf, loff_t pos, size_t count)
@@ -168,6 +191,7 @@ static struct bin_attribute *nvmem_bin_rw_attributes[] = {
 
 static const struct attribute_group nvmem_bin_rw_group = {
         .bin_attrs      = nvmem_bin_rw_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_rw_dev_groups[] = {
@@ -191,6 +215,7 @@ static struct bin_attribute *nvmem_bin_ro_attributes[] = {
 
 static const struct attribute_group nvmem_bin_ro_group = {
         .bin_attrs      = nvmem_bin_ro_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_ro_dev_groups[] = {
@@ -215,6 +240,7 @@ static struct bin_attribute *nvmem_bin_rw_root_attributes[] = {
 
 static const struct attribute_group nvmem_bin_rw_root_group = {
         .bin_attrs      = nvmem_bin_rw_root_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_rw_root_dev_groups[] = {
@@ -238,6 +264,7 @@ static struct bin_attribute *nvmem_bin_ro_root_attributes[] = {
 
 static const struct attribute_group nvmem_bin_ro_root_group = {
         .bin_attrs      = nvmem_bin_ro_root_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_ro_root_dev_groups[] = {
@@ -605,9 +632,11 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
         nvmem->dev.bus = &nvmem_bus_type;
         nvmem->dev.parent = config->dev;
         nvmem->priv = config->priv;
+        nvmem->type = config->type;
         nvmem->reg_read = config->reg_read;
         nvmem->reg_write = config->reg_write;
-        nvmem->dev.of_node = config->dev->of_node;
+        if (!config->no_of_node)
+                nvmem->dev.of_node = config->dev->of_node;
 
         if (config->id == -1 && config->name) {
                 dev_set_name(&nvmem->dev, "%s", config->name);
diff --git a/drivers/nvmem/meson-efuse.c b/drivers/nvmem/meson-efuse.c
index d769840d1e18..99372768446b 100644
--- a/drivers/nvmem/meson-efuse.c
+++ b/drivers/nvmem/meson-efuse.c
@@ -14,6 +14,7 @@
  * more details.
  */
 
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/nvmem-provider.h>
 #include <linux/of.h>
@@ -46,10 +47,36 @@ static int meson_efuse_probe(struct platform_device *pdev)
         struct device *dev = &pdev->dev;
         struct nvmem_device *nvmem;
         struct nvmem_config *econfig;
+        struct clk *clk;
         unsigned int size;
+        int ret;
 
-        if (meson_sm_call(SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0)
+        clk = devm_clk_get(dev, NULL);
+        if (IS_ERR(clk)) {
+                ret = PTR_ERR(clk);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "failed to get efuse gate");
+                return ret;
+        }
+
+        ret = clk_prepare_enable(clk);
+        if (ret) {
+                dev_err(dev, "failed to enable gate");
+                return ret;
+        }
+
+        ret = devm_add_action_or_reset(dev,
+                                       (void(*)(void *))clk_disable_unprepare,
+                                       clk);
+        if (ret) {
+                dev_err(dev, "failed to add disable callback");
+                return ret;
+        }
+
+        if (meson_sm_call(SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0) {
+                dev_err(dev, "failed to get max user");
                 return -EINVAL;
+        }
 
         econfig = devm_kzalloc(dev, sizeof(*econfig), GFP_KERNEL);
         if (!econfig)
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index 380916bff9e0..9c8249f74479 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -1667,7 +1667,7 @@ static int parport_ECP_supported(struct parport *pb)
         default:
                 printk(KERN_WARNING "0x%lx: Unknown implementation ID\n",
                         pb->base);
-                /* Assume 1 */
+                /* Fall through - Assume 1 */
         case 1:
                 pword = 1;
         }
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 921db6f80340..e1949f7efd9c 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -789,6 +789,24 @@ static void pci_acpi_optimize_delay(struct pci_dev *pdev,
         ACPI_FREE(obj);
 }
 
+static void pci_acpi_set_untrusted(struct pci_dev *dev)
+{
+        u8 val;
+
+        if (pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT)
+                return;
+        if (device_property_read_u8(&dev->dev, "ExternalFacingPort", &val))
+                return;
+
+        /*
+         * These root ports expose PCIe (including DMA) outside of the
+         * system so make sure we treat them and everything behind as
+         * untrusted.
+         */
+        if (val)
+                dev->untrusted = 1;
+}
+
 static void pci_acpi_setup(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
@@ -798,6 +816,7 @@ static void pci_acpi_setup(struct device *dev)
                 return;
 
         pci_acpi_optimize_delay(pci_dev, adev->handle);
+        pci_acpi_set_untrusted(pci_dev);
 
         pci_acpi_add_pm_notifier(adev, pci_dev);
         if (!adev->wakeup.flags.valid)
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index b1c05b5054a0..257b9f6f2ebb 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1378,6 +1378,19 @@ static void set_pcie_thunderbolt(struct pci_dev *dev)
         }
 }
 
+static void set_pcie_untrusted(struct pci_dev *dev)
+{
+        struct pci_dev *parent;
+
+        /*
+         * If the upstream bridge is untrusted we treat this device
+         * untrusted as well.
+         */
+        parent = pci_upstream_bridge(dev);
+        if (parent && parent->untrusted)
+                dev->untrusted = true;
+}
+
 /**
  * pci_ext_cfg_is_aliased - Is ext config space just an alias of std config?
  * @dev: PCI device
@@ -1638,6 +1651,8 @@ int pci_setup_device(struct pci_dev *dev)
         /* Need to have dev->cfg_size ready */
         set_pcie_thunderbolt(dev);
 
+        set_pcie_untrusted(dev);
+
         /* "Unknown power state" */
         dev->current_state = PCI_UNKNOWN;
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 45ef4d22f14c..e3b62c2ee8d1 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -1172,14 +1172,6 @@ config INTEL_SMARTCONNECT
           This driver checks to determine whether the device has Intel Smart
           Connect enabled, and if so disables it.
 
-config PVPANIC
-        tristate "pvpanic device support"
-        depends on ACPI
-        ---help---
-          This driver provides support for the pvpanic device.  pvpanic is
-          a paravirtualized device provided by QEMU; it lets a virtual machine
-          (guest) communicate panic events to the host.
-
 config INTEL_PMC_IPC
         tristate "Intel PMC IPC Driver"
         depends on ACPI
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index d841c550e3cc..ce8da260c223 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -79,7 +79,6 @@ obj-$(CONFIG_APPLE_GMUX)	+= apple-gmux.o
 obj-$(CONFIG_INTEL_RST)         += intel-rst.o
 obj-$(CONFIG_INTEL_SMARTCONNECT)        += intel-smartconnect.o
 
-obj-$(CONFIG_PVPANIC)           += pvpanic.o
 obj-$(CONFIG_ALIENWARE_WMI)     += alienware-wmi.o
 obj-$(CONFIG_INTEL_PMC_IPC)     += intel_pmc_ipc.o
 obj-$(CONFIG_TOUCHSCREEN_DMI)   += touchscreen_dmi.o
diff --git a/drivers/platform/x86/pvpanic.c b/drivers/platform/x86/pvpanic.c
deleted file mode 100644
index fd86daba7ffd..000000000000
--- a/drivers/platform/x86/pvpanic.c
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- *  pvpanic.c - pvpanic Device Support
- *
- *  Copyright (C) 2013 Fujitsu.
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/acpi.h>
-
-MODULE_AUTHOR("Hu Tao <hutao@cn.fujitsu.com>");
-MODULE_DESCRIPTION("pvpanic device driver");
-MODULE_LICENSE("GPL");
-
-static int pvpanic_add(struct acpi_device *device);
-static int pvpanic_remove(struct acpi_device *device);
-
-static const struct acpi_device_id pvpanic_device_ids[] = {
-        { "QEMU0001", 0 },
-        { "", 0 },
-};
-MODULE_DEVICE_TABLE(acpi, pvpanic_device_ids);
-
-#define PVPANIC_PANICKED        (1 << 0)
-
-static u16 port;
-
-static struct acpi_driver pvpanic_driver = {
-        .name =         "pvpanic",
-        .class =        "QEMU",
-        .ids =          pvpanic_device_ids,
-        .ops =          {
-                                .add =          pvpanic_add,
-                                .remove =       pvpanic_remove,
-                        },
-        .owner =        THIS_MODULE,
-};
-
-static void
-pvpanic_send_event(unsigned int event)
-{
-        outb(event, port);
-}
-
-static int
-pvpanic_panic_notify(struct notifier_block *nb, unsigned long code,
-                     void *unused)
-{
-        pvpanic_send_event(PVPANIC_PANICKED);
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block pvpanic_panic_nb = {
-        .notifier_call = pvpanic_panic_notify,
-        .priority = 1, /* let this called before broken drm_fb_helper */
-};
-
-
-static acpi_status
-pvpanic_walk_resources(struct acpi_resource *res, void *context)
-{
-        switch (res->type) {
-        case ACPI_RESOURCE_TYPE_END_TAG:
-                return AE_OK;
-
-        case ACPI_RESOURCE_TYPE_IO:
-                port = res->data.io.minimum;
-                return AE_OK;
-
-        default:
-                return AE_ERROR;
-        }
-}
-
-static int pvpanic_add(struct acpi_device *device)
-{
-        int ret;
-
-        ret = acpi_bus_get_status(device);
-        if (ret < 0)
-                return ret;
-
-        if (!device->status.enabled || !device->status.functional)
-                return -ENODEV;
-
-        acpi_walk_resources(device->handle, METHOD_NAME__CRS,
-                            pvpanic_walk_resources, NULL);
-
-        if (!port)
-                return -ENODEV;
-
-        atomic_notifier_chain_register(&panic_notifier_list,
-                                       &pvpanic_panic_nb);
-
-        return 0;
-}
-
-static int pvpanic_remove(struct acpi_device *device)
-{
-
-        atomic_notifier_chain_unregister(&panic_notifier_list,
-                                         &pvpanic_panic_nb);
-        return 0;
-}
-
-module_acpi_driver(pvpanic_driver);
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 333ad7d5b45b..dd5d1103e02b 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -158,10 +158,10 @@ static int pps_gpio_probe(struct platform_device *pdev)
         if (data->capture_clear)
                 pps_default_params |= PPS_CAPTURECLEAR | PPS_OFFSETCLEAR;
         data->pps = pps_register_source(&data->info, pps_default_params);
-        if (data->pps == NULL) {
+        if (IS_ERR(data->pps)) {
                 dev_err(&pdev->dev, "failed to register IRQ %d as PPS source\n",
                         data->irq);
-                return -EINVAL;
+                return PTR_ERR(data->pps);
         }
 
         /* register IRQ interrupt handler */
diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c
index 04735649052a..728818b87af3 100644
--- a/drivers/pps/clients/pps-ktimer.c
+++ b/drivers/pps/clients/pps-ktimer.c
@@ -80,9 +80,9 @@ static int __init pps_ktimer_init(void)
 {
         pps = pps_register_source(&pps_ktimer_info,
                                 PPS_CAPTUREASSERT | PPS_OFFSETASSERT);
-        if (pps == NULL) {
+        if (IS_ERR(pps)) {
                 pr_err("cannot register PPS source\n");
-                return -ENOMEM;
+                return PTR_ERR(pps);
         }
 
         timer_setup(&ktimer, pps_ktimer_event, 0);
diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
index 73bd3bb4d93b..00f6c460e493 100644
--- a/drivers/pps/clients/pps-ldisc.c
+++ b/drivers/pps/clients/pps-ldisc.c
@@ -72,9 +72,9 @@ static int pps_tty_open(struct tty_struct *tty)
 
         pps = pps_register_source(&info, PPS_CAPTUREBOTH | \
                                 PPS_OFFSETASSERT | PPS_OFFSETCLEAR);
-        if (pps == NULL) {
+        if (IS_ERR(pps)) {
                 pr_err("cannot register PPS source \"%s\"\n", info.path);
-                return -ENOMEM;
+                return PTR_ERR(pps);
         }
         pps->lookup_cookie = tty;
 
diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
index 4db824f88d00..7226e39aae83 100644
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -179,7 +179,7 @@ static void parport_attach(struct parport *port)
 
         device->pps = pps_register_source(&info,
                         PPS_CAPTUREBOTH | PPS_OFFSETASSERT | PPS_OFFSETCLEAR);
-        if (device->pps == NULL) {
+        if (IS_ERR(device->pps)) {
                 pr_err("couldn't register PPS source\n");
                 goto err_release_dev;
         }
diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 805c749ac1ad..a1c3cd38754f 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -72,7 +72,8 @@ static void pps_echo_client_default(struct pps_device *pps, int event,
  * source is described by info's fields and it will have, as default PPS
  * parameters, the ones specified into default_params.
  *
- * The function returns, in case of success, the PPS device. Otherwise NULL.
+ * The function returns, in case of success, the PPS device. Otherwise
+ * ERR_PTR(errno).
  */
 
 struct pps_device *pps_register_source(struct pps_source_info *info,
@@ -135,7 +136,7 @@ kfree_pps:
 pps_register_source_exit:
         pr_err("%s: unable to register source\n", info->name);
 
-        return NULL;
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(pps_register_source);
 
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index 8a81eecc0ecd..48f3594a7458 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -265,8 +265,8 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
                 pps.mode = PTP_PPS_MODE;
                 pps.owner = info->owner;
                 ptp->pps_source = pps_register_source(&pps, PTP_PPS_DEFAULTS);
-                if (!ptp->pps_source) {
-                        err = -EINVAL;
+                if (IS_ERR(ptp->pps_source)) {
+                        err = PTR_ERR(ptp->pps_source);
                         pr_err("failed to register pps source\n");
                         goto no_pps;
                 }
diff --git a/drivers/slimbus/Kconfig b/drivers/slimbus/Kconfig
index 9d73ad806698..8cd595148d17 100644
--- a/drivers/slimbus/Kconfig
+++ b/drivers/slimbus/Kconfig
@@ -22,8 +22,9 @@ config SLIM_QCOM_CTRL
 
 config SLIM_QCOM_NGD_CTRL
         tristate "Qualcomm SLIMbus Satellite Non-Generic Device Component"
-        depends on QCOM_QMI_HELPERS
-        depends on HAS_IOMEM && DMA_ENGINE
+        depends on HAS_IOMEM && DMA_ENGINE && NET
+        depends on ARCH_QCOM || COMPILE_TEST
+        select QCOM_QMI_HELPERS
         help
           Select driver if Qualcomm's SLIMbus Satellite Non-Generic Device
           Component is programmed using Linux kernel.
diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
index db1f5135846a..ad3e2e23f56e 100644
--- a/drivers/slimbus/qcom-ctrl.c
+++ b/drivers/slimbus/qcom-ctrl.c
@@ -654,8 +654,7 @@ static int qcom_slim_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int qcom_slim_runtime_suspend(struct device *device)
 {
-        struct platform_device *pdev = to_platform_device(device);
-        struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+        struct qcom_slim_ctrl *ctrl = dev_get_drvdata(device);
         int ret;
 
         dev_dbg(device, "pm_runtime: suspending...\n");
@@ -672,8 +671,7 @@ static int qcom_slim_runtime_suspend(struct device *device)
 
 static int qcom_slim_runtime_resume(struct device *device)
 {
-        struct platform_device *pdev = to_platform_device(device);
-        struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+        struct qcom_slim_ctrl *ctrl = dev_get_drvdata(device);
         int ret = 0;
 
         dev_dbg(device, "pm_runtime: resuming...\n");
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 1382a8df6c75..71f094c9ec68 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -787,7 +787,7 @@ static int qcom_slim_ngd_xfer_msg(struct slim_controller *sctrl,
 
         if (txn->msg->num_bytes > SLIM_MSGQ_BUF_LEN ||
                         txn->rl > SLIM_MSGQ_BUF_LEN) {
-                dev_err(ctrl->dev, "msg exeeds HW limit\n");
+                dev_err(ctrl->dev, "msg exceeds HW limit\n");
                 return -EINVAL;
         }
 
@@ -1327,11 +1327,12 @@ static int of_qcom_slim_ngd_register(struct device *parent,
 {
         const struct ngd_reg_offset_data *data;
         struct qcom_slim_ngd *ngd;
+        const struct of_device_id *match;
         struct device_node *node;
         u32 id;
 
-        data = of_match_node(qcom_slim_ngd_dt_match, parent->of_node)->data;
-
+        match = of_match_node(qcom_slim_ngd_dt_match, parent->of_node);
+        data = match->data;
         for_each_available_child_of_node(parent->of_node, node) {
                 if (of_property_read_u32(node, "reg", &id))
                         continue;
diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index c5ee97ee7886..fd8d034cfec1 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -654,14 +654,14 @@ static int intel_pdm_set_sdw_stream(struct snd_soc_dai *dai,
         return cdns_set_sdw_stream(dai, stream, false, direction);
 }
 
-static struct snd_soc_dai_ops intel_pcm_dai_ops = {
+static const struct snd_soc_dai_ops intel_pcm_dai_ops = {
         .hw_params = intel_hw_params,
         .hw_free = intel_hw_free,
         .shutdown = sdw_cdns_shutdown,
         .set_sdw_stream = intel_pcm_set_sdw_stream,
 };
 
-static struct snd_soc_dai_ops intel_pdm_dai_ops = {
+static const struct snd_soc_dai_ops intel_pdm_dai_ops = {
         .hw_params = intel_hw_params,
         .hw_free = intel_hw_free,
         .shutdown = sdw_cdns_shutdown,
diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c
index 93e562f18d40..7416bdbd8576 100644
--- a/drivers/thunderbolt/domain.c
+++ b/drivers/thunderbolt/domain.c
@@ -7,7 +7,9 @@
  */
 
 #include <linux/device.h>
+#include <linux/dmar.h>
 #include <linux/idr.h>
+#include <linux/iommu.h>
 #include <linux/module.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
@@ -236,6 +238,20 @@ err_free_str:
 }
 static DEVICE_ATTR_RW(boot_acl);
 
+static ssize_t iommu_dma_protection_show(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *buf)
+{
+        /*
+         * Kernel DMA protection is a feature where Thunderbolt security is
+         * handled natively using IOMMU. It is enabled when IOMMU is
+         * enabled and ACPI DMAR table has DMAR_PLATFORM_OPT_IN set.
+         */
+        return sprintf(buf, "%d\n",
+                       iommu_present(&pci_bus_type) && dmar_platform_optin());
+}
+static DEVICE_ATTR_RO(iommu_dma_protection);
+
 static ssize_t security_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
 {
@@ -251,6 +267,7 @@ static DEVICE_ATTR_RO(security);
 
 static struct attribute *domain_attrs[] = {
         &dev_attr_boot_acl.attr,
+        &dev_attr_iommu_dma_protection.attr,
         &dev_attr_security.attr,
         NULL,
 };
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 0a357db4b31b..131342280b46 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -569,20 +569,20 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
         ssize_t retval = 0;
         s32 event_count;
 
-        mutex_lock(&idev->info_lock);
-        if (!idev->info || !idev->info->irq)
-                retval = -EIO;
-        mutex_unlock(&idev->info_lock);
-
-        if (retval)
-                return retval;
-
         if (count != sizeof(s32))
                 return -EINVAL;
 
         add_wait_queue(&idev->wait, &wait);
 
         do {
+                mutex_lock(&idev->info_lock);
+                if (!idev->info || !idev->info->irq) {
+                        retval = -EIO;
+                        mutex_unlock(&idev->info_lock);
+                        break;
+                }
+                mutex_unlock(&idev->info_lock);
+
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 event_count = atomic_read(&idev->event);
@@ -1017,6 +1017,9 @@ void uio_unregister_device(struct uio_info *info)
         idev->info = NULL;
         mutex_unlock(&idev->info_lock);
 
+        wake_up_interruptible(&idev->wait);
+        kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);
+
         device_unregister(&idev->dev);
 
         return;
diff --git a/drivers/uio/uio_fsl_elbc_gpcm.c b/drivers/uio/uio_fsl_elbc_gpcm.c
index 9cc37fe07d35..0ee3cd3c25ee 100644
--- a/drivers/uio/uio_fsl_elbc_gpcm.c
+++ b/drivers/uio/uio_fsl_elbc_gpcm.c
@@ -74,8 +74,7 @@ DEVICE_ATTR(reg_or, S_IRUGO|S_IWUSR|S_IWGRP, reg_show, reg_store);
 static ssize_t reg_show(struct device *dev, struct device_attribute *attr,
                         char *buf)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct uio_info *info = platform_get_drvdata(pdev);
+        struct uio_info *info = dev_get_drvdata(dev);
         struct fsl_elbc_gpcm *priv = info->priv;
         struct fsl_lbc_bank *bank = &priv->lbc->bank[priv->bank];
 
@@ -94,8 +93,7 @@ static ssize_t reg_show(struct device *dev, struct device_attribute *attr,
 static ssize_t reg_store(struct device *dev, struct device_attribute *attr,
                          const char *buf, size_t count)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct uio_info *info = platform_get_drvdata(pdev);
+        struct uio_info *info = dev_get_drvdata(dev);
         struct fsl_elbc_gpcm *priv = info->priv;
         struct fsl_lbc_bank *bank = &priv->lbc->bank[priv->bank];
         unsigned long val;
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 3093655c7b92..1475ed5ffcde 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -1312,7 +1312,7 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
                 return -EINVAL;
         }
 
-        if (f32bit)
+        if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
                 ret = vbg_hgcm_call32(gdev, client_id,
                                       call->function, call->timeout_ms,
                                       VBG_IOCTL_HGCM_CALL_PARMS32(call),
diff --git a/fs/file.c b/fs/file.c
index 50304c7525ea..3209ee271c41 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -640,6 +640,35 @@ out_unlock:
 }
 EXPORT_SYMBOL(__close_fd); /* for ksys_close() */
 
+/*
+ * variant of __close_fd that gets a ref on the file for later fput
+ */
+int __close_fd_get_file(unsigned int fd, struct file **res)
+{
+        struct files_struct *files = current->files;
+        struct file *file;
+        struct fdtable *fdt;
+
+        spin_lock(&files->file_lock);
+        fdt = files_fdtable(files);
+        if (fd >= fdt->max_fds)
+                goto out_unlock;
+        file = fdt->fd[fd];
+        if (!file)
+                goto out_unlock;
+        rcu_assign_pointer(fdt->fd[fd], NULL);
+        __put_unused_fd(files, fd);
+        spin_unlock(&files->file_lock);
+        get_file(file);
+        *res = file;
+        return filp_close(file, files);
+
+out_unlock:
+        spin_unlock(&files->file_lock);
+        *res = NULL;
+        return -ENOENT;
+}
+
 void do_close_on_exec(struct files_struct *files)
 {
         unsigned i;
diff --git a/include/linux/dmar.h b/include/linux/dmar.h
index 843a41ba7e28..f8af1d770520 100644
--- a/include/linux/dmar.h
+++ b/include/linux/dmar.h
@@ -39,6 +39,7 @@ struct acpi_dmar_header;
 /* DMAR Flags */
 #define DMAR_INTR_REMAP         0x1
 #define DMAR_X2APIC_OPT_OUT     0x2
+#define DMAR_PLATFORM_OPT_IN    0x4
 
 struct intel_iommu;
 
@@ -170,6 +171,8 @@ static inline int dmar_ir_hotplug(struct dmar_drhd_unit *dmaru, bool insert)
 { return 0; }
 #endif /* CONFIG_IRQ_REMAP */
 
+extern bool dmar_platform_optin(void);
+
 #else /* CONFIG_DMAR_TABLE */
 
 static inline int dmar_device_add(void *handle)
@@ -182,6 +185,11 @@ static inline int dmar_device_remove(void *handle)
         return 0;
 }
 
+static inline bool dmar_platform_optin(void)
+{
+        return false;
+}
+
 #endif /* CONFIG_DMAR_TABLE */
 
 struct irte {
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index 41615f38bcff..f07c55ea0c22 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -121,6 +121,7 @@ extern void __fd_install(struct files_struct *files,
                       unsigned int fd, struct file *file);
 extern int __close_fd(struct files_struct *files,
                       unsigned int fd);
+extern int __close_fd_get_file(unsigned int fd, struct file **res);
 
 extern struct kmem_cache *files_cachep;
 
diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h
new file mode 100644
index 000000000000..5be5dab50b13
--- /dev/null
+++ b/include/linux/firmware/intel/stratix10-smc.h
@@ -0,0 +1,312 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2017-2018, Intel Corporation
+ */
+
+#ifndef __STRATIX10_SMC_H
+#define __STRATIX10_SMC_H
+
+#include <linux/arm-smccc.h>
+#include <linux/bitops.h>
+
+/**
+ * This file defines the Secure Monitor Call (SMC) message protocol used for
+ * service layer driver in normal world (EL1) to communicate with secure
+ * monitor software in Secure Monitor Exception Level 3 (EL3).
+ *
+ * This file is shared with secure firmware (FW) which is out of kernel tree.
+ *
+ * An ARM SMC instruction takes a function identifier and up to 6 64-bit
+ * register values as arguments, and can return up to 4 64-bit register
+ * value. The operation of the secure monitor is determined by the parameter
+ * values passed in through registers.
+ *
+ * EL1 and EL3 communicates pointer as physical address rather than the
+ * virtual address.
+ *
+ * Functions specified by ARM SMC Calling convention:
+ *
+ * FAST call executes atomic operations, returns when the requested operation
+ * has completed.
+ * STD call starts a operation which can be preempted by a non-secure
+ * interrupt. The call can return before the requested operation has
+ * completed.
+ *
+ * a0..a7 is used as register names in the descriptions below, on arm32
+ * that translates to r0..r7 and on arm64 to w0..w7.
+ */
+
+/**
+ * @func_num: function ID
+ */
+#define INTEL_SIP_SMC_STD_CALL_VAL(func_num) \
+        ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL, ARM_SMCCC_SMC_64, \
+        ARM_SMCCC_OWNER_SIP, (func_num))
+
+#define INTEL_SIP_SMC_FAST_CALL_VAL(func_num) \
+        ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_64, \
+        ARM_SMCCC_OWNER_SIP, (func_num))
+
+/**
+ * Return values in INTEL_SIP_SMC_* call
+ *
+ * INTEL_SIP_SMC_RETURN_UNKNOWN_FUNCTION:
+ * Secure monitor software doesn't recognize the request.
+ *
+ * INTEL_SIP_SMC_STATUS_OK:
+ * FPGA configuration completed successfully,
+ * In case of FPGA configuration write operation, it means secure monitor
+ * software can accept the next chunk of FPGA configuration data.
+ *
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY:
+ * In case of FPGA configuration write operation, it means secure monitor
+ * software is still processing previous data & can't accept the next chunk
+ * of data. Service driver needs to issue
+ * INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE call to query the
+ * completed block(s).
+ *
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR:
+ * There is error during the FPGA configuration process.
+ *
+ * INTEL_SIP_SMC_REG_ERROR:
+ * There is error during a read or write operation of the protected registers.
+ *
+ * INTEL_SIP_SMC_RSU_ERROR:
+ * There is error during a remote status update.
+ */
+#define INTEL_SIP_SMC_RETURN_UNKNOWN_FUNCTION           0xFFFFFFFF
+#define INTEL_SIP_SMC_STATUS_OK                         0x0
+#define INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY           0x1
+#define INTEL_SIP_SMC_FPGA_CONFIG_STATUS_REJECTED       0x2
+#define INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR          0x4
+#define INTEL_SIP_SMC_REG_ERROR                         0x5
+#define INTEL_SIP_SMC_RSU_ERROR                         0x7
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_START
+ *
+ * Sync call used by service driver at EL1 to request the FPGA in EL3 to
+ * be prepare to receive a new configuration.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_START.
+ * a1: flag for full or partial configuration. 0 for full and 1 for partial
+ * configuration.
+ * a2-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, or INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_START 1
+#define INTEL_SIP_SMC_FPGA_CONFIG_START \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_START)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_WRITE
+ *
+ * Async call used by service driver at EL1 to provide FPGA configuration data
+ * to secure world.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_WRITE.
+ * a1: 64bit physical address of the configuration data memory block
+ * a2: Size of configuration data block.
+ * a3-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY or
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1: 64bit physical address of 1st completed memory block if any completed
+ * block, otherwise zero value.
+ * a2: 64bit physical address of 2nd completed memory block if any completed
+ * block, otherwise zero value.
+ * a3: 64bit physical address of 3rd completed memory block if any completed
+ * block, otherwise zero value.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_WRITE 2
+#define INTEL_SIP_SMC_FPGA_CONFIG_WRITE \
+        INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_WRITE)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE
+ *
+ * Sync call used by service driver at EL1 to track the completed write
+ * transactions. This request is called after INTEL_SIP_SMC_FPGA_CONFIG_WRITE
+ * call returns INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY or
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1: 64bit physical address of 1st completed memory block.
+ * a2: 64bit physical address of 2nd completed memory block if
+ * any completed block, otherwise zero value.
+ * a3: 64bit physical address of 3rd completed memory block if
+ * any completed block, otherwise zero value.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE 3
+#define INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE \
+INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_ISDONE
+ *
+ * Sync call used by service driver at EL1 to inform secure world that all
+ * data are sent, to check whether or not the secure world had completed
+ * the FPGA configuration process.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_ISDONE.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY or
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_ISDONE 4
+#define INTEL_SIP_SMC_FPGA_CONFIG_ISDONE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_ISDONE)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM
+ *
+ * Sync call used by service driver at EL1 to query the physical address of
+ * memory block reserved by secure monitor software.
+ *
+ * Call register usage:
+ * a0:INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1: start of physical address of reserved memory block.
+ * a2: size of reserved memory block.
+ * a3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_GET_MEM 5
+#define INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_GET_MEM)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK
+ *
+ * For SMC loop-back mode only, used for internal integration, debugging
+ * or troubleshooting.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_LOOPBACK 6
+#define INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_LOOPBACK)
+
+/*
+ * Request INTEL_SIP_SMC_REG_READ
+ *
+ * Read a protected register at EL3
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_REG_READ.
+ * a1: register address.
+ * a2-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_REG_ERROR.
+ * a1: value in the register
+ * a2-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_REG_READ 7
+#define INTEL_SIP_SMC_REG_READ \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_REG_READ)
+
+/*
+ * Request INTEL_SIP_SMC_REG_WRITE
+ *
+ * Write a protected register at EL3
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_REG_WRITE.
+ * a1: register address
+ * a2: value to program into register.
+ * a3-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_REG_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_REG_WRITE 8
+#define INTEL_SIP_SMC_REG_WRITE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_REG_WRITE)
+
+/*
+ * Request INTEL_SIP_SMC_FUNCID_REG_UPDATE
+ *
+ * Update one or more bits in a protected register at EL3 using a
+ * read-modify-write operation.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_REG_UPDATE.
+ * a1: register address
+ * a2: write Mask.
+ * a3: value to write.
+ * a4-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_REG_ERROR.
+ * a1-3: Not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_REG_UPDATE 9
+#define INTEL_SIP_SMC_REG_UPDATE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_REG_UPDATE)
+
+/*
+ * Request INTEL_SIP_SMC_RSU_STATUS
+ *
+ * Request remote status update boot log, call is synchronous.
+ *
+ * Call register usage:
+ * a0 INTEL_SIP_SMC_RSU_STATUS
+ * a1-7 not used
+ *
+ * Return status
+ * a0: Current Image
+ * a1: Last Failing Image
+ * a2: Version | State
+ * a3: Error details | Error location
+ *
+ * Or
+ *
+ * a0: INTEL_SIP_SMC_RSU_ERROR
+ */
+#define INTEL_SIP_SMC_FUNCID_RSU_STATUS 11
+#define INTEL_SIP_SMC_RSU_STATUS \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_RSU_STATUS)
+
+/*
+ * Request INTEL_SIP_SMC_RSU_UPDATE
+ *
+ * Request to set the offset of the bitstream to boot after reboot, call
+ * is synchronous.
+ *
+ * Call register usage:
+ * a0 INTEL_SIP_SMC_RSU_UPDATE
+ * a1 64bit physical address of the configuration data memory in flash
+ * a2-7 not used
+ *
+ * Return status
+ * a0 INTEL_SIP_SMC_STATUS_OK
+ */
+#define INTEL_SIP_SMC_FUNCID_RSU_UPDATE 12
+#define INTEL_SIP_SMC_RSU_UPDATE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_RSU_UPDATE)
+#endif
diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h
new file mode 100644
index 000000000000..e521f172a47a
--- /dev/null
+++ b/include/linux/firmware/intel/stratix10-svc-client.h
@@ -0,0 +1,217 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2017-2018, Intel Corporation
+ */
+
+#ifndef __STRATIX10_SVC_CLIENT_H
+#define __STRATIX10_SVC_CLIENT_H
+
+/**
+ * Service layer driver supports client names
+ *
+ * fpga: for FPGA configuration
+ * rsu: for remote status update
+ */
+#define SVC_CLIENT_FPGA                 "fpga"
+#define SVC_CLIENT_RSU                  "rsu"
+
+/**
+ * Status of the sent command, in bit number
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_REQUEST_OK:
+ * Secure firmware accepts the request of FPGA reconfiguration.
+ *
+ * SVC_STATUS_RECONFIG_BUFFER_SUBMITTED:
+ * Service client successfully submits FPGA configuration
+ * data buffer to secure firmware.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_BUFFER_DONE:
+ * Secure firmware completes data process, ready to accept the
+ * next WRITE transaction.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_COMPLETED:
+ * Secure firmware completes FPGA configuration successfully, FPGA should
+ * be in user mode.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_BUSY:
+ * FPGA configuration is still in process.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_ERROR:
+ * Error encountered during FPGA configuration.
+ *
+ * SVC_STATUS_RSU_OK:
+ * Secure firmware accepts the request of remote status update (RSU).
+ */
+#define SVC_STATUS_RECONFIG_REQUEST_OK          0
+#define SVC_STATUS_RECONFIG_BUFFER_SUBMITTED    1
+#define SVC_STATUS_RECONFIG_BUFFER_DONE         2
+#define SVC_STATUS_RECONFIG_COMPLETED           3
+#define SVC_STATUS_RECONFIG_BUSY                4
+#define SVC_STATUS_RECONFIG_ERROR               5
+#define SVC_STATUS_RSU_OK                       6
+#define SVC_STATUS_RSU_ERROR                    7
+/**
+ * Flag bit for COMMAND_RECONFIG
+ *
+ * COMMAND_RECONFIG_FLAG_PARTIAL:
+ * Set to FPGA configuration type (full or partial), the default
+ * is full reconfig.
+ */
+#define COMMAND_RECONFIG_FLAG_PARTIAL   0
+
+/**
+ * Timeout settings for service clients:
+ * timeout value used in Stratix10 FPGA manager driver.
+ * timeout value used in RSU driver
+ */
+#define SVC_RECONFIG_REQUEST_TIMEOUT_MS         100
+#define SVC_RECONFIG_BUFFER_TIMEOUT_MS          240
+#define SVC_RSU_REQUEST_TIMEOUT_MS              300
+
+struct stratix10_svc_chan;
+
+/**
+ * enum stratix10_svc_command_code - supported service commands
+ *
+ * @COMMAND_NOOP: do 'dummy' request for integration/debug/trouble-shooting
+ *
+ * @COMMAND_RECONFIG: ask for FPGA configuration preparation, return status
+ * is SVC_STATUS_RECONFIG_REQUEST_OK
+ *
+ * @COMMAND_RECONFIG_DATA_SUBMIT: submit buffer(s) of bit-stream data for the
+ * FPGA configuration, return status is SVC_STATUS_RECONFIG_BUFFER_SUBMITTED,
+ * or SVC_STATUS_RECONFIG_ERROR
+ *
+ * @COMMAND_RECONFIG_DATA_CLAIM: check the status of the configuration, return
+ * status is SVC_STATUS_RECONFIG_COMPLETED, or SVC_STATUS_RECONFIG_BUSY, or
+ * SVC_STATUS_RECONFIG_ERROR
+ *
+ * @COMMAND_RECONFIG_STATUS: check the status of the configuration, return
+ * status is SVC_STATUS_RECONFIG_COMPLETED, or  SVC_STATUS_RECONFIG_BUSY, or
+ * SVC_STATUS_RECONFIG_ERROR
+ *
+ * @COMMAND_RSU_STATUS: request remote system update boot log, return status
+ * is log data or SVC_STATUS_RSU_ERROR
+ *
+ * @COMMAND_RSU_UPDATE: set the offset of the bitstream to boot after reboot,
+ * return status is SVC_STATUS_RSU_OK or SVC_STATUS_RSU_ERROR
+ */
+enum stratix10_svc_command_code {
+        COMMAND_NOOP = 0,
+        COMMAND_RECONFIG,
+        COMMAND_RECONFIG_DATA_SUBMIT,
+        COMMAND_RECONFIG_DATA_CLAIM,
+        COMMAND_RECONFIG_STATUS,
+        COMMAND_RSU_STATUS,
+        COMMAND_RSU_UPDATE
+};
+
+/**
+ * struct stratix10_svc_client_msg - message sent by client to service
+ * @payload: starting address of data need be processed
+ * @payload_length: data size in bytes
+ * @command: service command
+ * @arg: args to be passed via registers and not physically mapped buffers
+ */
+struct stratix10_svc_client_msg {
+        void *payload;
+        size_t payload_length;
+        enum stratix10_svc_command_code command;
+        u64 arg[3];
+};
+
+/**
+ * struct stratix10_svc_command_config_type - config type
+ * @flags: flag bit for the type of FPGA configuration
+ */
+struct stratix10_svc_command_config_type {
+        u32 flags;
+};
+
+/**
+ * struct stratix10_svc_cb_data - callback data structure from service layer
+ * @status: the status of sent command
+ * @kaddr1: address of 1st completed data block
+ * @kaddr2: address of 2nd completed data block
+ * @kaddr3: address of 3rd completed data block
+ */
+struct stratix10_svc_cb_data {
+        u32 status;
+        void *kaddr1;
+        void *kaddr2;
+        void *kaddr3;
+};
+
+/**
+ * struct stratix10_svc_client - service client structure
+ * @dev: the client device
+ * @receive_cb: callback to provide service client the received data
+ * @priv: client private data
+ */
+struct stratix10_svc_client {
+        struct device *dev;
+        void (*receive_cb)(struct stratix10_svc_client *client,
+                           struct stratix10_svc_cb_data *cb_data);
+        void *priv;
+};
+
+/**
+ * stratix10_svc_request_channel_byname() - request service channel
+ * @client: identity of the client requesting the channel
+ * @name: supporting client name defined above
+ *
+ * Return: a pointer to channel assigned to the client on success,
+ * or ERR_PTR() on error.
+ */
+struct stratix10_svc_chan
+*stratix10_svc_request_channel_byname(struct stratix10_svc_client *client,
+        const char *name);
+
+/**
+ * stratix10_svc_free_channel() - free service channel.
+ * @chan: service channel to be freed
+ */
+void stratix10_svc_free_channel(struct stratix10_svc_chan *chan);
+
+/**
+ * stratix10_svc_allocate_memory() - allocate the momory
+ * @chan: service channel assigned to the client
+ * @size: number of bytes client requests
+ *
+ * Service layer allocates the requested number of bytes from the memory
+ * pool for the client.
+ *
+ * Return: the starting address of allocated memory on success, or
+ * ERR_PTR() on error.
+ */
+void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
+                                    size_t size);
+
+/**
+ * stratix10_svc_free_memory() - free allocated memory
+ * @chan: service channel assigned to the client
+ * @kaddr: starting address of memory to be free back to pool
+ */
+void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr);
+
+/**
+ * stratix10_svc_send() - send a message to the remote
+ * @chan: service channel assigned to the client
+ * @msg: message data to be sent, in the format of
+ * struct stratix10_svc_client_msg
+ *
+ * Return: 0 for success, -ENOMEM or -ENOBUFS on error.
+ */
+int stratix10_svc_send(struct stratix10_svc_chan *chan, void *msg);
+
+/**
+ * intel_svc_done() - complete service request
+ * @chan: service channel assigned to the client
+ *
+ * This function is used by service client to inform service layer that
+ * client's service requests are completed, or there is an error in the
+ * request process.
+ */
+void stratix10_svc_done(struct stratix10_svc_chan *chan);
+#endif
+
diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h
index 9d3f668df7df..741f567253ef 100644
--- a/include/linux/fsl/mc.h
+++ b/include/linux/fsl/mc.h
@@ -210,8 +210,8 @@ struct mc_cmd_header {
 };
 
 struct fsl_mc_command {
-        u64 header;
-        u64 params[MC_CMD_NUM_OF_PARAMS];
+        __le64 header;
+        __le64 params[MC_CMD_NUM_OF_PARAMS];
 };
 
 enum mc_cmd_status {
@@ -238,11 +238,11 @@ enum mc_cmd_status {
 /* Command completion flag */
 #define MC_CMD_FLAG_INTR_DIS    0x01
 
-static inline u64 mc_encode_cmd_header(u16 cmd_id,
-                                       u32 cmd_flags,
-                                       u16 token)
+static inline __le64 mc_encode_cmd_header(u16 cmd_id,
+                                          u32 cmd_flags,
+                                          u16 token)
 {
-        u64 header = 0;
+        __le64 header = 0;
         struct mc_cmd_header *hdr = (struct mc_cmd_header *)&header;
 
         hdr->cmd_id = cpu_to_le16(cmd_id);
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 14131b6fae68..f0885cc01db6 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -831,15 +831,6 @@ struct vmbus_channel {
          */
         struct list_head sc_list;
         /*
-         * Current number of sub-channels.
-         */
-        int num_sc;
-        /*
-         * Number of a sub-channel (position within sc_list) which is supposed
-         * to be used as the next outgoing channel.
-         */
-        int next_oc;
-        /*
          * The primary channel this sub-channel belongs to.
          * This will be NULL for the primary channel.
          */
@@ -973,14 +964,6 @@ void vmbus_set_chn_rescind_callback(struct vmbus_channel *channel,
                 void (*chn_rescind_cb)(struct vmbus_channel *));
 
 /*
- * Retrieve the (sub) channel on which to send an outgoing request.
- * When a primary channel has multiple sub-channels, we choose a
- * channel whose VCPU binding is closest to the VCPU on which
- * this call is being made.
- */
-struct vmbus_channel *vmbus_get_outgoing_channel(struct vmbus_channel *primary);
-
-/*
  * Check if sub-channels have already been offerred. This API will be useful
  * when the driver is unloaded after establishing sub-channels. In this case,
  * when the driver is re-loaded, the driver would have to check if the
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index ba8fa9072aca..677768b21a1d 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -25,6 +25,7 @@
 #include <linux/notifier.h>
 #include <linux/device.h>
 #include <linux/of.h>
+#include <linux/nvmem-provider.h>
 
 #include <mtd/mtd-abi.h>
 
@@ -342,6 +343,7 @@ struct mtd_info {
         struct device dev;
         int usecount;
         struct mtd_debug_info dbg;
+        struct nvmem_device *nvmem;
 };
 
 int mtd_ooblayout_ecc(struct mtd_info *mtd, int section,
diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h
index 1e3283c2af77..fe051323be0a 100644
--- a/include/linux/nvmem-provider.h
+++ b/include/linux/nvmem-provider.h
@@ -19,6 +19,13 @@ typedef int (*nvmem_reg_read_t)(void *priv, unsigned int offset,
 typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
                                  void *val, size_t bytes);
 
+enum nvmem_type {
+        NVMEM_TYPE_UNKNOWN = 0,
+        NVMEM_TYPE_EEPROM,
+        NVMEM_TYPE_OTP,
+        NVMEM_TYPE_BATTERY_BACKED,
+};
+
 /**
  * struct nvmem_config - NVMEM device configuration
  *
@@ -28,8 +35,10 @@ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
  * @owner:      Pointer to exporter module. Used for refcounting.
  * @cells:      Optional array of pre-defined NVMEM cells.
  * @ncells:     Number of elements in cells.
+ * @type:       Type of the nvmem storage
  * @read_only:  Device is read-only.
  * @root_only:  Device is accessibly to root only.
+ * @no_of_node: Device should not use the parent's of_node even if it's !NULL.
  * @reg_read:   Callback to read data.
  * @reg_write:  Callback to write data.
  * @size:       Device size.
@@ -51,8 +60,10 @@ struct nvmem_config {
         struct module           *owner;
         const struct nvmem_cell_info    *cells;
         int                     ncells;
+        enum nvmem_type         type;
         bool                    read_only;
         bool                    root_only;
+        bool                    no_of_node;
         nvmem_reg_read_t        reg_read;
         nvmem_reg_write_t       reg_write;
         int     size;
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 51a5a5217667..1ab78a23ae08 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -396,6 +396,14 @@ struct pci_dev {
         unsigned int    is_hotplug_bridge:1;
         unsigned int    shpc_managed:1;         /* SHPC owned by shpchp */
         unsigned int    is_thunderbolt:1;       /* Thunderbolt controller */
+        /*
+         * Devices marked being untrusted are the ones that can potentially
+         * execute DMA attacks and similar. They are typically connected
+         * through external ports such as Thunderbolt but not limited to
+         * that. When an IOMMU is enabled they should be getting full
+         * mappings to make sure they cannot access arbitrary memory.
+         */
+        unsigned int    untrusted:1;
         unsigned int    __aer_firmware_first_valid:1;
         unsigned int    __aer_firmware_first:1;
         unsigned int    broken_intx_masking:1;  /* INTx masking can't be used */
diff --git a/include/uapi/linux/android/binder_ctl.h b/include/uapi/linux/android/binder_ctl.h
new file mode 100644
index 000000000000..65b2efd1a0a5
--- /dev/null
+++ b/include/uapi/linux/android/binder_ctl.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2018 Canonical Ltd.
+ *
+ */
+
+#ifndef _UAPI_LINUX_BINDER_CTL_H
+#define _UAPI_LINUX_BINDER_CTL_H
+
+#include <linux/android/binder.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define BINDERFS_MAX_NAME 255
+
+/**
+ * struct binderfs_device - retrieve information about a new binder device
+ * @name:   the name to use for the new binderfs binder device
+ * @major:  major number allocated for binderfs binder devices
+ * @minor:  minor number allocated for the new binderfs binder device
+ *
+ */
+struct binderfs_device {
+        char name[BINDERFS_MAX_NAME + 1];
+        __u8 major;
+        __u8 minor;
+};
+
+/**
+ * Allocate a new binder device.
+ */
+#define BINDER_CTL_ADD _IOWR('b', 1, struct binderfs_device)
+
+#endif /* _UAPI_LINUX_BINDER_CTL_H */
+
diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h
index 96c24478d8ce..f8c00045d537 100644
--- a/include/uapi/linux/magic.h
+++ b/include/uapi/linux/magic.h
@@ -73,6 +73,7 @@
 #define DAXFS_MAGIC             0x64646178
 #define BINFMTFS_MAGIC          0x42494e4d
 #define DEVPTS_SUPER_MAGIC      0x1cd1
+#define BINDERFS_SUPER_MAGIC    0x6c6f6f70
 #define FUTEXFS_SUPER_MAGIC     0xBAD1DEA
 #define PIPEFS_MAGIC            0x50495045
 #define PROC_SUPER_MAGIC        0x9fa0
diff --git a/tools/Makefile b/tools/Makefile
index abb358a70ad0..77f1aee8ea01 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -13,6 +13,7 @@ help:
         @echo '  cgroup                 - cgroup tools'
         @echo '  cpupower               - a tool for all things x86 CPU power'
         @echo '  firewire               - the userspace part of nosy, an IEEE-1394 traffic sniffer'
+        @echo '  firmware               - Firmware tools'
         @echo '  freefall               - laptop accelerometer program for disk protection'
         @echo '  gpio                   - GPIO tools'
         @echo '  hv                     - tools used when in Hyper-V clients'
@@ -60,7 +61,7 @@ acpi: FORCE
 cpupower: FORCE
         $(call descend,power/$@)
 
-cgroup firewire hv guest spi usb virtio vm bpf iio gpio objtool leds wmi pci: FORCE
+cgroup firewire hv guest spi usb virtio vm bpf iio gpio objtool leds wmi pci firmware: FORCE
         $(call descend,$@)
 
 liblockdep: FORCE
@@ -137,7 +138,7 @@ acpi_clean:
 cpupower_clean:
         $(call descend,power/cpupower,clean)
 
-cgroup_clean hv_clean firewire_clean spi_clean usb_clean virtio_clean vm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean pci_clean:
+cgroup_clean hv_clean firewire_clean spi_clean usb_clean virtio_clean vm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean pci_clean firmware_clean:
         $(call descend,$(@:_clean=),clean)
 
 liblockdep_clean:
@@ -175,6 +176,6 @@ clean: acpi_clean cgroup_clean cpupower_clean hv_clean firewire_clean \
                 perf_clean selftests_clean turbostat_clean spi_clean usb_clean virtio_clean \
                 vm_clean bpf_clean iio_clean x86_energy_perf_policy_clean tmon_clean \
                 freefall_clean build_clean libbpf_clean libsubcmd_clean liblockdep_clean \
-                gpio_clean objtool_clean leds_clean wmi_clean pci_clean
+                gpio_clean objtool_clean leds_clean wmi_clean pci_clean firmware_clean
 
 .PHONY: FORCE
diff --git a/tools/firmware/Makefile b/tools/firmware/Makefile
new file mode 100644
index 000000000000..d329825aa31b
--- /dev/null
+++ b/tools/firmware/Makefile
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0
+# Makefile for firmware tools
+
+CFLAGS = -Wall -Wextra -g
+
+all: ihex2fw
+%: %.c
+        $(CC) $(CFLAGS) -o $@ $^
+
+clean:
+        $(RM) ihex2fw
+
+.PHONY: all clean
\ No newline at end of file
diff --git a/tools/firmware/ihex2fw.c b/tools/firmware/ihex2fw.c
new file mode 100644
index 000000000000..b58dd061e978
--- /dev/null
+++ b/tools/firmware/ihex2fw.c
@@ -0,0 +1,281 @@
+/*
+ * Parser/loader for IHEX formatted data.
+ *
+ * Copyright © 2008 David Woodhouse <dwmw2@infradead.org>
+ * Copyright © 2005 Jan Harkes <jaharkes@cs.cmu.edu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#define _GNU_SOURCE
+#include <getopt.h>
+
+
+struct ihex_binrec {
+        struct ihex_binrec *next; /* not part of the real data structure */
+        uint32_t addr;
+        uint16_t len;
+        uint8_t data[];
+};
+
+/**
+ * nybble/hex are little helpers to parse hexadecimal numbers to a byte value
+ **/
+static uint8_t nybble(const uint8_t n)
+{
+        if      (n >= '0' && n <= '9') return n - '0';
+        else if (n >= 'A' && n <= 'F') return n - ('A' - 10);
+        else if (n >= 'a' && n <= 'f') return n - ('a' - 10);
+        return 0;
+}
+
+static uint8_t hex(const uint8_t *data, uint8_t *crc)
+{
+        uint8_t val = (nybble(data[0]) << 4) | nybble(data[1]);
+        *crc += val;
+        return val;
+}
+
+static int process_ihex(uint8_t *data, ssize_t size);
+static void file_record(struct ihex_binrec *record);
+static int output_records(int outfd);
+
+static int sort_records = 0;
+static int wide_records = 0;
+static int include_jump = 0;
+
+static int usage(void)
+{
+        fprintf(stderr, "ihex2fw: Convert ihex files into binary "
+                "representation for use by Linux kernel\n");
+        fprintf(stderr, "usage: ihex2fw [<options>] <src.HEX> <dst.fw>\n");
+        fprintf(stderr, "       -w: wide records (16-bit length)\n");
+        fprintf(stderr, "       -s: sort records by address\n");
+        fprintf(stderr, "       -j: include records for CS:IP/EIP address\n");
+        return 1;
+}
+
+int main(int argc, char **argv)
+{
+        int infd, outfd;
+        struct stat st;
+        uint8_t *data;
+        int opt;
+
+        while ((opt = getopt(argc, argv, "wsj")) != -1) {
+                switch (opt) {
+                case 'w':
+                        wide_records = 1;
+                        break;
+                case 's':
+                        sort_records = 1;
+                        break;
+                case 'j':
+                        include_jump = 1;
+                        break;
+                default:
+                        return usage();
+                }
+        }
+
+        if (optind + 2 != argc)
+                return usage();
+
+        if (!strcmp(argv[optind], "-"))
+                infd = 0;
+        else
+                infd = open(argv[optind], O_RDONLY);
+        if (infd == -1) {
+                fprintf(stderr, "Failed to open source file: %s",
+                        strerror(errno));
+                return usage();
+        }
+        if (fstat(infd, &st)) {
+                perror("stat");
+                return 1;
+        }
+        data = mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, infd, 0);
+        if (data == MAP_FAILED) {
+                perror("mmap");
+                return 1;
+        }
+
+        if (!strcmp(argv[optind+1], "-"))
+                outfd = 1;
+        else
+                outfd = open(argv[optind+1], O_TRUNC|O_CREAT|O_WRONLY, 0644);
+        if (outfd == -1) {
+                fprintf(stderr, "Failed to open destination file: %s",
+                        strerror(errno));
+                return usage();
+        }
+        if (process_ihex(data, st.st_size))
+                return 1;
+
+        return output_records(outfd);
+}
+
+static int process_ihex(uint8_t *data, ssize_t size)
+{
+        struct ihex_binrec *record;
+        uint32_t offset = 0;
+        uint32_t data32;
+        uint8_t type, crc = 0, crcbyte = 0;
+        int i, j;
+        int line = 1;
+        int len;
+
+        i = 0;
+next_record:
+        /* search for the start of record character */
+        while (i < size) {
+                if (data[i] == '\n') line++;
+                if (data[i++] == ':') break;
+        }
+
+        /* Minimum record length would be about 10 characters */
+        if (i + 10 > size) {
+                fprintf(stderr, "Can't find valid record at line %d\n", line);
+                return -EINVAL;
+        }
+
+        len = hex(data + i, &crc); i += 2;
+        if (wide_records) {
+                len <<= 8;
+                len += hex(data + i, &crc); i += 2;
+        }
+        record = malloc((sizeof (*record) + len + 3) & ~3);
+        if (!record) {
+                fprintf(stderr, "out of memory for records\n");
+                return -ENOMEM;
+        }
+        memset(record, 0, (sizeof(*record) + len + 3) & ~3);
+        record->len = len;
+
+        /* now check if we have enough data to read everything */
+        if (i + 8 + (record->len * 2) > size) {
+                fprintf(stderr, "Not enough data to read complete record at line %d\n",
+                        line);
+                return -EINVAL;
+        }
+
+        record->addr  = hex(data + i, &crc) << 8; i += 2;
+        record->addr |= hex(data + i, &crc); i += 2;
+        type = hex(data + i, &crc); i += 2;
+
+        for (j = 0; j < record->len; j++, i += 2)
+                record->data[j] = hex(data + i, &crc);
+
+        /* check CRC */
+        crcbyte = hex(data + i, &crc); i += 2;
+        if (crc != 0) {
+                fprintf(stderr, "CRC failure at line %d: got 0x%X, expected 0x%X\n",
+                        line, crcbyte, (unsigned char)(crcbyte-crc));
+                return -EINVAL;
+        }
+
+        /* Done reading the record */
+        switch (type) {
+        case 0:
+                /* old style EOF record? */
+                if (!record->len)
+                        break;
+
+                record->addr += offset;
+                file_record(record);
+                goto next_record;
+
+        case 1: /* End-Of-File Record */
+                if (record->addr || record->len) {
+                        fprintf(stderr, "Bad EOF record (type 01) format at line %d",
+                                line);
+                        return -EINVAL;
+                }
+                break;
+
+        case 2: /* Extended Segment Address Record (HEX86) */
+        case 4: /* Extended Linear Address Record (HEX386) */
+                if (record->addr || record->len != 2) {
+                        fprintf(stderr, "Bad HEX86/HEX386 record (type %02X) at line %d\n",
+                                type, line);
+                        return -EINVAL;
+                }
+
+                /* We shouldn't really be using the offset for HEX86 because
+                 * the wraparound case is specified quite differently. */
+                offset = record->data[0] << 8 | record->data[1];
+                offset <<= (type == 2 ? 4 : 16);
+                goto next_record;
+
+        case 3: /* Start Segment Address Record */
+        case 5: /* Start Linear Address Record */
+                if (record->addr || record->len != 4) {
+                        fprintf(stderr, "Bad Start Address record (type %02X) at line %d\n",
+                                type, line);
+                        return -EINVAL;
+                }
+
+                memcpy(&data32, &record->data[0], sizeof(data32));
+                data32 = htonl(data32);
+                memcpy(&record->data[0], &data32, sizeof(data32));
+
+                /* These records contain the CS/IP or EIP where execution
+                 * starts. If requested output this as a record. */
+                if (include_jump)
+                        file_record(record);
+                goto next_record;
+
+        default:
+                fprintf(stderr, "Unknown record (type %02X)\n", type);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct ihex_binrec *records;
+
+static void file_record(struct ihex_binrec *record)
+{
+        struct ihex_binrec **p = &records;
+
+        while ((*p) && (!sort_records || (*p)->addr < record->addr))
+                p = &((*p)->next);
+
+        record->next = *p;
+        *p = record;
+}
+
+static int output_records(int outfd)
+{
+        unsigned char zeroes[6] = {0, 0, 0, 0, 0, 0};
+        struct ihex_binrec *p = records;
+
+        while (p) {
+                uint16_t writelen = (p->len + 9) & ~3;
+
+                p->addr = htonl(p->addr);
+                p->len = htons(p->len);
+                if (write(outfd, &p->addr, writelen) != writelen)
+                        return 1;
+                p = p->next;
+        }
+        /* EOF record is zero length, since we don't bother to represent
+           the type field in the binary version */
+        if (write(outfd, zeroes, 6) != 6)
+                return 1;
+        return 0;
+}
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index bbb2a8ef367c..d7e06fe0270e 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
         FILE *file;
         char cmd[PATH_MAX];
         char *mac_addr;
+        int str_len;
 
         /*
          * Set the configuration for the specified interface with
@@ -1301,8 +1302,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
          * invoke the external script to do its magic.
          */
 
-        snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
-                 "hv_set_ifconfig", if_file);
+        str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
+                           "hv_set_ifconfig", if_file);
+        /*
+         * This is a little overcautious, but it's necessary to suppress some
+         * false warnings from gcc 8.0.1.
+         */
+        if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) {
+                syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long",
+                       cmd, str_len);
+                return HV_E_FAIL;
+        }
+
         if (system(cmd)) {
                 syslog(LOG_ERR, "Failed to execute cmd '%s'; error: %d %s",
                                 cmd, errno, strerror(errno));