123 files changed, 4973 insertions, 917 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-thunderbolt b/Documentation/ABI/testing/sysfs-bus-thunderbolt
index 151584a1f950..b21fba14689b 100644
--- a/Documentation/ABI/testing/sysfs-bus-thunderbolt
+++ b/Documentation/ABI/testing/sysfs-bus-thunderbolt
@@ -21,6 +21,15 @@ Description:	Holds a comma separated list of device unique_ids that
                 If a device is authorized automatically during boot its
                 boot attribute is set to 1.
 
+What: /sys/bus/thunderbolt/devices/.../domainX/iommu_dma_protection
+Date:           Mar 2019
+KernelVersion:  4.21
+Contact:        thunderbolt-software@lists.01.org
+Description:    This attribute tells whether the system uses IOMMU
+                for DMA protection. Value of 1 means IOMMU is used 0 means
+                it is not (DMA protection is solely based on Thunderbolt
+                security levels).
+
 What: /sys/bus/thunderbolt/devices/.../domainX/security
 Date:           Sep 2017
 KernelVersion:  4.13
diff --git a/Documentation/admin-guide/thunderbolt.rst b/Documentation/admin-guide/thunderbolt.rst
index 35fccba6a9a6..898ad78f3cc7 100644
--- a/Documentation/admin-guide/thunderbolt.rst
+++ b/Documentation/admin-guide/thunderbolt.rst
@@ -133,6 +133,26 @@ If the user still wants to connect the device they can either approve
 the device without a key or write a new key and write 1 to the
 ``authorized`` file to get the new key stored on the device NVM.
 
+DMA protection utilizing IOMMU
+------------------------------
+Recent systems from 2018 and forward with Thunderbolt ports may natively
+support IOMMU. This means that Thunderbolt security is handled by an IOMMU
+so connected devices cannot access memory regions outside of what is
+allocated for them by drivers. When Linux is running on such system it
+automatically enables IOMMU if not enabled by the user already. These
+systems can be identified by reading ``1`` from
+``/sys/bus/thunderbolt/devices/domainX/iommu_dma_protection`` attribute.
+
+The driver does not do anything special in this case but because DMA
+protection is handled by the IOMMU, security levels (if set) are
+redundant. For this reason some systems ship with security level set to
+``none``. Other systems have security level set to ``user`` in order to
+support downgrade to older OS, so users who want to automatically
+authorize devices when IOMMU DMA protection is enabled can use the
+following ``udev`` rule::
+
+  ACTION=="add", SUBSYSTEM=="thunderbolt", ATTRS{iommu_dma_protection}=="1", ATTR{authorized}=="0", ATTR{authorized}="1"
+
 Upgrading NVM on Thunderbolt device or host
 -------------------------------------------
 Since most of the functionality is handled in firmware running on a
diff --git a/Documentation/devicetree/bindings/firmware/intel,stratix10-svc.txt b/Documentation/devicetree/bindings/firmware/intel,stratix10-svc.txt
new file mode 100644
index 000000000000..1fa66065acc6
--- /dev/null
+++ b/Documentation/devicetree/bindings/firmware/intel,stratix10-svc.txt
@@ -0,0 +1,57 @@
+Intel Service Layer Driver for Stratix10 SoC
+============================================
+Intel Stratix10 SoC is composed of a 64 bit quad-core ARM Cortex A53 hard
+processor system (HPS) and Secure Device Manager (SDM). When the FPGA is
+configured from HPS, there needs to be a way for HPS to notify SDM the
+location and size of the configuration data. Then SDM will get the
+configuration data from that location and perform the FPGA configuration.
+
+To meet the whole system security needs and support virtual machine requesting
+communication with SDM, only the secure world of software (EL3, Exception
+Layer 3) can interface with SDM. All software entities running on other
+exception layers must channel through the EL3 software whenever it needs
+service from SDM.
+
+Intel Stratix10 service layer driver, running at privileged exception level
+(EL1, Exception Layer 1), interfaces with the service providers and provides
+the services for FPGA configuration, QSPI, Crypto and warm reset. Service layer
+driver also manages secure monitor call (SMC) to communicate with secure monitor
+code running in EL3.
+
+Required properties:
+-------------------
+The svc node has the following mandatory properties, must be located under
+the firmware node.
+
+- compatible: "intel,stratix10-svc"
+- method: smc or hvc
+        smc - Secure Monitor Call
+        hvc - Hypervisor Call
+- memory-region:
+        phandle to the reserved memory node. See
+        Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt
+        for details
+
+Example:
+-------
+
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                service_reserved: svcbuffer@0 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x0 0x0 0x1000000>;
+                        alignment = <0x1000>;
+                        no-map;
+                };
+        };
+
+        firmware {
+                svc {
+                        compatible = "intel,stratix10-svc";
+                        method = "smc";
+                        memory-region = <&service_reserved>;
+                };
+        };
diff --git a/Documentation/devicetree/bindings/fpga/intel-stratix10-soc-fpga-mgr.txt b/Documentation/devicetree/bindings/fpga/intel-stratix10-soc-fpga-mgr.txt
new file mode 100644
index 000000000000..6e03f79287fb
--- /dev/null
+++ b/Documentation/devicetree/bindings/fpga/intel-stratix10-soc-fpga-mgr.txt
@@ -0,0 +1,17 @@
+Intel Stratix10 SoC FPGA Manager
+
+Required properties:
+The fpga_mgr node has the following mandatory property, must be located under
+firmware/svc node.
+
+- compatible : should contain "intel,stratix10-soc-fpga-mgr"
+
+Example:
+
+        firmware {
+                svc {
+                        fpga_mgr: fpga-mgr {
+                                compatible = "intel,stratix10-soc-fpga-mgr";
+                        };
+                };
+        };
diff --git a/Documentation/devicetree/bindings/misc/pvpanic-mmio.txt b/Documentation/devicetree/bindings/misc/pvpanic-mmio.txt
new file mode 100644
index 000000000000..985e90736780
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/pvpanic-mmio.txt
@@ -0,0 +1,29 @@
+* QEMU PVPANIC MMIO Configuration bindings
+
+QEMU's emulation / virtualization targets provide the following PVPANIC
+MMIO Configuration interface on the "virt" machine.
+type:
+
+- a read-write, 16-bit wide data register.
+
+QEMU exposes the data register to guests as memory mapped registers.
+
+Required properties:
+
+- compatible: "qemu,pvpanic-mmio".
+- reg: the MMIO region used by the device.
+  * Bytes 0x0  Write panic event to the reg when guest OS panics.
+  * Bytes 0x1  Reserved.
+
+Example:
+
+/ {
+        #size-cells = <0x2>;
+        #address-cells = <0x2>;
+
+        pvpanic-mmio@9060000 {
+                compatible = "qemu,pvpanic-mmio";
+                reg = <0x0 0x9060000 0x0 0x2>;
+        };
+};
+
diff --git a/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt b/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt
index e3298e18de26..2e0723ab3384 100644
--- a/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt
+++ b/Documentation/devicetree/bindings/nvmem/amlogic-efuse.txt
@@ -2,6 +2,8 @@
 
 Required properties:
 - compatible: should be "amlogic,meson-gxbb-efuse"
+- clocks: phandle to the efuse peripheral clock provided by the
+          clock controller.
 
 = Data cells =
 Are child nodes of eFuse, bindings of which as described in
@@ -11,6 +13,7 @@ Example:
 
         efuse: efuse {
                 compatible = "amlogic,meson-gxbb-efuse";
+                clocks = <&clkc CLKID_EFUSE>;
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/Documentation/driver-api/firmware/other_interfaces.rst b/Documentation/driver-api/firmware/other_interfaces.rst
index 36c47b1e9824..a4ac54b5fd79 100644
--- a/Documentation/driver-api/firmware/other_interfaces.rst
+++ b/Documentation/driver-api/firmware/other_interfaces.rst
@@ -13,3 +13,33 @@ EDD Interfaces
 .. kernel-doc:: drivers/firmware/edd.c
    :internal:
 
+Intel Stratix10 SoC Service Layer
+---------------------------------
+Some features of the Intel Stratix10 SoC require a level of privilege
+higher than the kernel is granted. Such secure features include
+FPGA programming. In terms of the ARMv8 architecture, the kernel runs
+at Exception Level 1 (EL1), access to the features requires
+Exception Level 3 (EL3).
+
+The Intel Stratix10 SoC service layer provides an in kernel API for
+drivers to request access to the secure features. The requests are queued
+and processed one by one. ARM’s SMCCC is used to pass the execution
+of the requests on to a secure monitor (EL3).
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_command_code
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_client_msg
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_command_reconfig_payload
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_cb_data
+
+.. kernel-doc:: include/linux/firmware/intel/stratix10-svc-client.h
+   :functions: stratix10_svc_client
+
+.. kernel-doc:: drivers/firmware/stratix10-svc.c
+   :export:
diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst
index 306997941ba1..6b4107cf4b98 100644
--- a/Documentation/trace/index.rst
+++ b/Documentation/trace/index.rst
@@ -22,3 +22,4 @@ Linux Tracing Technologies
    hwlat_detector
    intel_th
    stm
+   sys-t
diff --git a/MAINTAINERS b/MAINTAINERS
index 87ae13cd288c..7d37f8a4743c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -958,6 +958,7 @@ M:	Arve Hjønnevåg <arve@android.com>
 M:      Todd Kjos <tkjos@android.com>
 M:      Martijn Coenen <maco@android.com>
 M:      Joel Fernandes <joel@joelfernandes.org>
+M:      Christian Brauner <christian@brauner.io>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
 L:      devel@driverdev.osuosl.org
 S:      Supported
@@ -1442,6 +1443,7 @@ F:	arch/arm/mach-ep93xx/micro9.c
 
 ARM/CORESIGHT FRAMEWORK AND DRIVERS
 M:      Mathieu Poirier <mathieu.poirier@linaro.org>
+R:      Suzuki K Poulose <suzuki.poulose@arm.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      drivers/hwtracing/coresight/*
@@ -16242,7 +16244,7 @@ F:	drivers/vme/
 F:      include/linux/vme*
 
 VMWARE BALLOON DRIVER
-M:      Xavier Deguillard <xdeguillard@vmware.com>
+M:      Julien Freche <jfreche@vmware.com>
 M:      Nadav Amit <namit@vmware.com>
 M:      "VMware, Inc." <pv-drivers@vmware.com>
 L:      linux-kernel@vger.kernel.org
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index fef7351e9f67..a20df0d9c96d 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -24,6 +24,19 @@
         #address-cells = <2>;
         #size-cells = <2>;
 
+        reserved-memory {
+                #address-cells = <2>;
+                #size-cells = <2>;
+                ranges;
+
+                service_reserved: svcbuffer@0 {
+                        compatible = "shared-dma-pool";
+                        reg = <0x0 0x0 0x0 0x1000000>;
+                        alignment = <0x1000>;
+                        no-map;
+                };
+        };
+
         cpus {
                 #address-cells = <1>;
                 #size-cells = <0>;
@@ -93,6 +106,14 @@
                 interrupt-parent = <&intc>;
                 ranges = <0 0 0 0xffffffff>;
 
+                base_fpga_region {
+                        #address-cells = <0x1>;
+                        #size-cells = <0x1>;
+
+                        compatible = "fpga-region";
+                        fpga-mgr = <&fpga_mgr>;
+                };
+
                 clkmgr: clock-controller@ffd10000 {
                         compatible = "intel,stratix10-clkmgr";
                         reg = <0xffd10000 0x1000>;
@@ -537,5 +558,17 @@
 
                         status = "disabled";
                 };
+
+                firmware {
+                        svc {
+                                compatible = "intel,stratix10-svc";
+                                method = "smc";
+                                memory-region = <&service_reserved>;
+
+                                fpga_mgr: fpga-mgr {
+                                        compatible = "intel,stratix10-soc-fpga-mgr";
+                                };
+                        };
+                };
         };
 };
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 8c7c4583b52d..77abe0ec4043 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -24,6 +24,14 @@ static int acpi_data_get_property_array(const struct acpi_device_data *data,
                                         acpi_object_type type,
                                         const union acpi_object **obj);
 
+/*
+ * The GUIDs here are made equivalent to each other in order to avoid extra
+ * complexity in the properties handling code, with the caveat that the
+ * kernel will accept certain combinations of GUID and properties that are
+ * not defined without a warning. For instance if any of the properties
+ * from different GUID appear in a property list of another, it will be
+ * accepted by the kernel. Firmware validation tools should catch these.
+ */
 static const guid_t prp_guids[] = {
         /* ACPI _DSD device properties GUID: daffd814-6eba-4d8c-8a91-bc9bbf4aa301 */
         GUID_INIT(0xdaffd814, 0x6eba, 0x4d8c,
@@ -31,6 +39,9 @@ static const guid_t prp_guids[] = {
         /* Hotplug in D3 GUID: 6211e2c0-58a3-4af3-90e1-927a4e0c55a4 */
         GUID_INIT(0x6211e2c0, 0x58a3, 0x4af3,
                   0x90, 0xe1, 0x92, 0x7a, 0x4e, 0x0c, 0x55, 0xa4),
+        /* External facing port GUID: efcc06cc-73ac-4bc3-bff0-76143807c389 */
+        GUID_INIT(0xefcc06cc, 0x73ac, 0x4bc3,
+                  0xbf, 0xf0, 0x76, 0x14, 0x38, 0x07, 0xc3, 0x89),
 };
 
 static const guid_t ads_guid =
diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
index 51e8250d113f..4c190f8d1f4c 100644
--- a/drivers/android/Kconfig
+++ b/drivers/android/Kconfig
@@ -20,6 +20,18 @@ config ANDROID_BINDER_IPC
           Android process, using Binder to identify, invoke and pass arguments
           between said processes.
 
+config ANDROID_BINDERFS
+        bool "Android Binderfs filesystem"
+        depends on ANDROID_BINDER_IPC
+        default n
+        ---help---
+          Binderfs is a pseudo-filesystem for the Android Binder IPC driver
+          which can be mounted per-ipc namespace allowing to run multiple
+          instances of Android.
+          Each binderfs mount initially only contains a binder-control device.
+          It can be used to dynamically allocate new binder IPC devices via
+          ioctls.
+
 config ANDROID_BINDER_DEVICES
         string "Android Binder devices"
         depends on ANDROID_BINDER_IPC
diff --git a/drivers/android/Makefile b/drivers/android/Makefile
index a01254c43ee3..c7856e3200da 100644
--- a/drivers/android/Makefile
+++ b/drivers/android/Makefile
@@ -1,4 +1,5 @@
 ccflags-y += -I$(src)                   # needed for trace events
 
+obj-$(CONFIG_ANDROID_BINDERFS)          += binderfs.o
 obj-$(CONFIG_ANDROID_BINDER_IPC)        += binder.o binder_alloc.o
 obj-$(CONFIG_ANDROID_BINDER_IPC_SELFTEST) += binder_alloc_selftest.o
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 9f1000d2a40c..cdfc87629efb 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -72,12 +72,14 @@
 #include <linux/spinlock.h>
 #include <linux/ratelimit.h>
 #include <linux/syscalls.h>
+#include <linux/task_work.h>
 
 #include <uapi/linux/android/binder.h>
 
 #include <asm/cacheflush.h>
 
 #include "binder_alloc.h"
+#include "binder_internal.h"
 #include "binder_trace.h"
 
 static HLIST_HEAD(binder_deferred_list);
@@ -94,22 +96,8 @@ static struct dentry *binder_debugfs_dir_entry_root;
 static struct dentry *binder_debugfs_dir_entry_proc;
 static atomic_t binder_last_id;
 
-#define BINDER_DEBUG_ENTRY(name) \
-static int binder_##name##_open(struct inode *inode, struct file *file) \
-{ \
-        return single_open(file, binder_##name##_show, inode->i_private); \
-} \
-\
-static const struct file_operations binder_##name##_fops = { \
-        .owner = THIS_MODULE, \
-        .open = binder_##name##_open, \
-        .read = seq_read, \
-        .llseek = seq_lseek, \
-        .release = single_release, \
-}
-
-static int binder_proc_show(struct seq_file *m, void *unused);
-BINDER_DEBUG_ENTRY(proc);
+static int proc_show(struct seq_file *m, void *unused);
+DEFINE_SHOW_ATTRIBUTE(proc);
 
 /* This is only defined in include/asm-arm/sizes.h */
 #ifndef SZ_1K
@@ -262,20 +250,6 @@ static struct binder_transaction_log_entry *binder_transaction_log_add(
         return e;
 }
 
-struct binder_context {
-        struct binder_node *binder_context_mgr_node;
-        struct mutex context_mgr_node_lock;
-
-        kuid_t binder_context_mgr_uid;
-        const char *name;
-};
-
-struct binder_device {
-        struct hlist_node hlist;
-        struct miscdevice miscdev;
-        struct binder_context context;
-};
-
 /**
  * struct binder_work - work enqueued on a worklist
  * @entry:             node enqueued on list
@@ -660,6 +634,7 @@ struct binder_transaction {
 #define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
 static void
 _binder_proc_lock(struct binder_proc *proc, int line)
+        __acquires(&proc->outer_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -675,6 +650,7 @@ _binder_proc_lock(struct binder_proc *proc, int line)
 #define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
 static void
 _binder_proc_unlock(struct binder_proc *proc, int line)
+        __releases(&proc->outer_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -690,6 +666,7 @@ _binder_proc_unlock(struct binder_proc *proc, int line)
 #define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
 static void
 _binder_inner_proc_lock(struct binder_proc *proc, int line)
+        __acquires(&proc->inner_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -705,6 +682,7 @@ _binder_inner_proc_lock(struct binder_proc *proc, int line)
 #define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
 static void
 _binder_inner_proc_unlock(struct binder_proc *proc, int line)
+        __releases(&proc->inner_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -720,6 +698,7 @@ _binder_inner_proc_unlock(struct binder_proc *proc, int line)
 #define binder_node_lock(node) _binder_node_lock(node, __LINE__)
 static void
 _binder_node_lock(struct binder_node *node, int line)
+        __acquires(&node->lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -735,6 +714,7 @@ _binder_node_lock(struct binder_node *node, int line)
 #define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
 static void
 _binder_node_unlock(struct binder_node *node, int line)
+        __releases(&node->lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
@@ -751,12 +731,16 @@ _binder_node_unlock(struct binder_node *node, int line)
 #define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
 static void
 _binder_node_inner_lock(struct binder_node *node, int line)
+        __acquires(&node->lock) __acquires(&node->proc->inner_lock)
 {
         binder_debug(BINDER_DEBUG_SPINLOCKS,
                      "%s: line=%d\n", __func__, line);
         spin_lock(&node->lock);
         if (node->proc)
                 binder_inner_proc_lock(node->proc);
+        else
+                /* annotation for sparse */
+                __acquire(&node->proc->inner_lock);
 }
 
 /**
@@ -768,6 +752,7 @@ _binder_node_inner_lock(struct binder_node *node, int line)
 #define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
 static void
 _binder_node_inner_unlock(struct binder_node *node, int line)
+        __releases(&node->lock) __releases(&node->proc->inner_lock)
 {
         struct binder_proc *proc = node->proc;
 
@@ -775,6 +760,9 @@ _binder_node_inner_unlock(struct binder_node *node, int line)
                      "%s: line=%d\n", __func__, line);
         if (proc)
                 binder_inner_proc_unlock(proc);
+        else
+                /* annotation for sparse */
+                __release(&node->proc->inner_lock);
         spin_unlock(&node->lock);
 }
 
@@ -1384,10 +1372,14 @@ static void binder_dec_node_tmpref(struct binder_node *node)
         binder_node_inner_lock(node);
         if (!node->proc)
                 spin_lock(&binder_dead_nodes_lock);
+        else
+                __acquire(&binder_dead_nodes_lock);
         node->tmp_refs--;
         BUG_ON(node->tmp_refs < 0);
         if (!node->proc)
                 spin_unlock(&binder_dead_nodes_lock);
+        else
+                __release(&binder_dead_nodes_lock);
         /*
          * Call binder_dec_node() to check if all refcounts are 0
          * and cleanup is needed. Calling with strong=0 and internal=1
@@ -1890,18 +1882,22 @@ static struct binder_thread *binder_get_txn_from(
  */
 static struct binder_thread *binder_get_txn_from_and_acq_inner(
                 struct binder_transaction *t)
+        __acquires(&t->from->proc->inner_lock)
 {
         struct binder_thread *from;
 
         from = binder_get_txn_from(t);
-        if (!from)
+        if (!from) {
+                __acquire(&from->proc->inner_lock);
                 return NULL;
+        }
         binder_inner_proc_lock(from->proc);
         if (t->from) {
                 BUG_ON(from != t->from);
                 return from;
         }
         binder_inner_proc_unlock(from->proc);
+        __acquire(&from->proc->inner_lock);
         binder_thread_dec_tmpref(from);
         return NULL;
 }
@@ -1973,6 +1969,8 @@ static void binder_send_failed_reply(struct binder_transaction *t,
                         binder_thread_dec_tmpref(target_thread);
                         binder_free_transaction(t);
                         return;
+                } else {
+                        __release(&target_thread->proc->inner_lock);
                 }
                 next = t->from_parent;
 
@@ -2160,6 +2158,64 @@ static bool binder_validate_fixup(struct binder_buffer *b,
         return (fixup_offset >= last_min_offset);
 }
 
+/**
+ * struct binder_task_work_cb - for deferred close
+ *
+ * @twork:                callback_head for task work
+ * @fd:                   fd to close
+ *
+ * Structure to pass task work to be handled after
+ * returning from binder_ioctl() via task_work_add().
+ */
+struct binder_task_work_cb {
+        struct callback_head twork;
+        struct file *file;
+};
+
+/**
+ * binder_do_fd_close() - close list of file descriptors
+ * @twork:      callback head for task work
+ *
+ * It is not safe to call ksys_close() during the binder_ioctl()
+ * function if there is a chance that binder's own file descriptor
+ * might be closed. This is to meet the requirements for using
+ * fdget() (see comments for __fget_light()). Therefore use
+ * task_work_add() to schedule the close operation once we have
+ * returned from binder_ioctl(). This function is a callback
+ * for that mechanism and does the actual ksys_close() on the
+ * given file descriptor.
+ */
+static void binder_do_fd_close(struct callback_head *twork)
+{
+        struct binder_task_work_cb *twcb = container_of(twork,
+                        struct binder_task_work_cb, twork);
+
+        fput(twcb->file);
+        kfree(twcb);
+}
+
+/**
+ * binder_deferred_fd_close() - schedule a close for the given file-descriptor
+ * @fd:         file-descriptor to close
+ *
+ * See comments in binder_do_fd_close(). This function is used to schedule
+ * a file-descriptor to be closed after returning from binder_ioctl().
+ */
+static void binder_deferred_fd_close(int fd)
+{
+        struct binder_task_work_cb *twcb;
+
+        twcb = kzalloc(sizeof(*twcb), GFP_KERNEL);
+        if (!twcb)
+                return;
+        init_task_work(&twcb->twork, binder_do_fd_close);
+        __close_fd_get_file(fd, &twcb->file);
+        if (twcb->file)
+                task_work_add(current, &twcb->twork, true);
+        else
+                kfree(twcb);
+}
+
 static void binder_transaction_buffer_release(struct binder_proc *proc,
                                               struct binder_buffer *buffer,
                                               binder_size_t *failed_at)
@@ -2299,7 +2355,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                         }
                         fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
-                                ksys_close(fd_array[fd_index]);
+                                binder_deferred_fd_close(fd_array[fd_index]);
                 } break;
                 default:
                         pr_err("transaction release %d bad object type %x\n",
@@ -2394,11 +2450,15 @@ static int binder_translate_handle(struct flat_binder_object *fp,
                 fp->cookie = node->cookie;
                 if (node->proc)
                         binder_inner_proc_lock(node->proc);
+                else
+                        __acquire(&node->proc->inner_lock);
                 binder_inc_node_nilocked(node,
                                          fp->hdr.type == BINDER_TYPE_BINDER,
                                          0, NULL);
                 if (node->proc)
                         binder_inner_proc_unlock(node->proc);
+                else
+                        __release(&node->proc->inner_lock);
                 trace_binder_transaction_ref_to_node(t, node, &src_rdata);
                 binder_debug(BINDER_DEBUG_TRANSACTION,
                              "        ref %d desc %d -> node %d u%016llx\n",
@@ -2762,6 +2822,8 @@ static void binder_transaction(struct binder_proc *proc,
                 binder_set_nice(in_reply_to->saved_priority);
                 target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
                 if (target_thread == NULL) {
+                        /* annotation for sparse */
+                        __release(&target_thread->proc->inner_lock);
                         return_error = BR_DEAD_REPLY;
                         return_error_line = __LINE__;
                         goto err_dead_binder;
@@ -3912,7 +3974,7 @@ static int binder_apply_fd_fixups(struct binder_transaction *t)
                 } else if (ret) {
                         u32 *fdp = (u32 *)(t->buffer->data + fixup->offset);
 
-                        ksys_close(*fdp);
+                        binder_deferred_fd_close(*fdp);
                 }
                 list_del(&fixup->fixup_entry);
                 kfree(fixup);
@@ -4164,6 +4226,11 @@ retry:
                         if (cmd == BR_DEAD_BINDER)
                                 goto done; /* DEAD_BINDER notifications can cause transactions */
                 } break;
+                default:
+                        binder_inner_proc_unlock(proc);
+                        pr_err("%d:%d: bad work type %d\n",
+                               proc->pid, thread->pid, w->type);
+                        break;
                 }
 
                 if (!t)
@@ -4467,6 +4534,8 @@ static int binder_thread_release(struct binder_proc *proc,
                 spin_lock(&t->lock);
                 if (t->to_thread == thread)
                         send_reply = t;
+        } else {
+                __acquire(&t->lock);
         }
         thread->is_dead = true;
 
@@ -4495,7 +4564,11 @@ static int binder_thread_release(struct binder_proc *proc,
                 spin_unlock(&last_t->lock);
                 if (t)
                         spin_lock(&t->lock);
+                else
+                        __acquire(&t->lock);
         }
+        /* annotation for sparse, lock not acquired in last iteration above */
+        __release(&t->lock);
 
         /*
          * If this thread used poll, make sure we remove the waitqueue
@@ -4938,8 +5011,12 @@ static int binder_open(struct inode *nodp, struct file *filp)
         proc->tsk = current->group_leader;
         INIT_LIST_HEAD(&proc->todo);
         proc->default_priority = task_nice(current);
-        binder_dev = container_of(filp->private_data, struct binder_device,
-                                  miscdev);
+        /* binderfs stashes devices in i_private */
+        if (is_binderfs_device(nodp))
+                binder_dev = nodp->i_private;
+        else
+                binder_dev = container_of(filp->private_data,
+                                          struct binder_device, miscdev);
         proc->context = &binder_dev->context;
         binder_alloc_init(&proc->alloc);
 
@@ -4967,7 +5044,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
                 proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
                         binder_debugfs_dir_entry_proc,
                         (void *)(unsigned long)proc->pid,
-                        &binder_proc_fops);
+                        &proc_fops);
         }
 
         return 0;
@@ -5391,6 +5468,9 @@ static void print_binder_proc(struct seq_file *m,
         for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
                 struct binder_node *node = rb_entry(n, struct binder_node,
                                                     rb_node);
+                if (!print_all && !node->has_async_transaction)
+                        continue;
+
                 /*
                  * take a temporary reference on the node so it
                  * survives and isn't removed from the tree
@@ -5595,7 +5675,7 @@ static void print_binder_proc_stats(struct seq_file *m,
 }
 
 
-static int binder_state_show(struct seq_file *m, void *unused)
+static int state_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
         struct binder_node *node;
@@ -5634,7 +5714,7 @@ static int binder_state_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static int binder_stats_show(struct seq_file *m, void *unused)
+static int stats_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
 
@@ -5650,7 +5730,7 @@ static int binder_stats_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static int binder_transactions_show(struct seq_file *m, void *unused)
+static int transactions_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *proc;
 
@@ -5663,7 +5743,7 @@ static int binder_transactions_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static int binder_proc_show(struct seq_file *m, void *unused)
+static int proc_show(struct seq_file *m, void *unused)
 {
         struct binder_proc *itr;
         int pid = (unsigned long)m->private;
@@ -5706,7 +5786,7 @@ static void print_binder_transaction_log_entry(struct seq_file *m,
                         "\n" : " (incomplete)\n");
 }
 
-static int binder_transaction_log_show(struct seq_file *m, void *unused)
+static int transaction_log_show(struct seq_file *m, void *unused)
 {
         struct binder_transaction_log *log = m->private;
         unsigned int log_cur = atomic_read(&log->cur);
@@ -5727,7 +5807,7 @@ static int binder_transaction_log_show(struct seq_file *m, void *unused)
         return 0;
 }
 
-static const struct file_operations binder_fops = {
+const struct file_operations binder_fops = {
         .owner = THIS_MODULE,
         .poll = binder_poll,
         .unlocked_ioctl = binder_ioctl,
@@ -5738,10 +5818,10 @@ static const struct file_operations binder_fops = {
         .release = binder_release,
 };
 
-BINDER_DEBUG_ENTRY(state);
-BINDER_DEBUG_ENTRY(stats);
-BINDER_DEBUG_ENTRY(transactions);
-BINDER_DEBUG_ENTRY(transaction_log);
+DEFINE_SHOW_ATTRIBUTE(state);
+DEFINE_SHOW_ATTRIBUTE(stats);
+DEFINE_SHOW_ATTRIBUTE(transactions);
+DEFINE_SHOW_ATTRIBUTE(transaction_log);
 
 static int __init init_binder_device(const char *name)
 {
@@ -5795,27 +5875,27 @@ static int __init binder_init(void)
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     NULL,
-                                    &binder_state_fops);
+                                    &state_fops);
                 debugfs_create_file("stats",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     NULL,
-                                    &binder_stats_fops);
+                                    &stats_fops);
                 debugfs_create_file("transactions",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     NULL,
-                                    &binder_transactions_fops);
+                                    &transactions_fops);
                 debugfs_create_file("transaction_log",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     &binder_transaction_log,
-                                    &binder_transaction_log_fops);
+                                    &transaction_log_fops);
                 debugfs_create_file("failed_transaction_log",
                                     0444,
                                     binder_debugfs_dir_entry_root,
                                     &binder_transaction_log_failed,
-                                    &binder_transaction_log_fops);
+                                    &transaction_log_fops);
         }
 
         /*
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 030c98f35cca..022cd80e80cc 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -939,6 +939,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
                                        struct list_lru_one *lru,
                                        spinlock_t *lock,
                                        void *cb_arg)
+        __must_hold(lock)
 {
         struct mm_struct *mm = NULL;
         struct binder_lru_page *page = container_of(item,
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index fb3238c74c8a..c0aadbbf7f19 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -30,16 +30,16 @@ struct binder_transaction;
  * struct binder_buffer - buffer used for binder transactions
  * @entry:              entry alloc->buffers
  * @rb_node:            node for allocated_buffers/free_buffers rb trees
- * @free:               true if buffer is free
- * @allow_user_free:    describe the second member of struct blah,
- * @async_transaction:  describe the second member of struct blah,
- * @debug_id:           describe the second member of struct blah,
- * @transaction:        describe the second member of struct blah,
- * @target_node:        describe the second member of struct blah,
- * @data_size:          describe the second member of struct blah,
- * @offsets_size:       describe the second member of struct blah,
- * @extra_buffers_size: describe the second member of struct blah,
- * @data:i              describe the second member of struct blah,
+ * @free:               %true if buffer is free
+ * @allow_user_free:    %true if user is allowed to free buffer
+ * @async_transaction:  %true if buffer is in use for an async txn
+ * @debug_id:           unique ID for debugging
+ * @transaction:        pointer to associated struct binder_transaction
+ * @target_node:        struct binder_node associated with this buffer
+ * @data_size:          size of @transaction data
+ * @offsets_size:       size of array of offsets
+ * @extra_buffers_size: size of space for other objects (like sg lists)
+ * @data:               pointer to base of buffer space
  *
  * Bookkeeping structure for binder transaction buffers
  */
diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
new file mode 100644
index 000000000000..7fb97f503ef2
--- /dev/null
+++ b/drivers/android/binder_internal.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef _LINUX_BINDER_INTERNAL_H
+#define _LINUX_BINDER_INTERNAL_H
+
+#include <linux/export.h>
+#include <linux/fs.h>
+#include <linux/list.h>
+#include <linux/miscdevice.h>
+#include <linux/mutex.h>
+#include <linux/stddef.h>
+#include <linux/types.h>
+#include <linux/uidgid.h>
+
+struct binder_context {
+        struct binder_node *binder_context_mgr_node;
+        struct mutex context_mgr_node_lock;
+        kuid_t binder_context_mgr_uid;
+        const char *name;
+};
+
+/**
+ * struct binder_device - information about a binder device node
+ * @hlist:          list of binder devices (only used for devices requested via
+ *                  CONFIG_ANDROID_BINDER_DEVICES)
+ * @miscdev:        information about a binder character device node
+ * @context:        binder context information
+ * @binderfs_inode: This is the inode of the root dentry of the super block
+ *                  belonging to a binderfs mount.
+ */
+struct binder_device {
+        struct hlist_node hlist;
+        struct miscdevice miscdev;
+        struct binder_context context;
+        struct inode *binderfs_inode;
+};
+
+extern const struct file_operations binder_fops;
+
+#ifdef CONFIG_ANDROID_BINDERFS
+extern bool is_binderfs_device(const struct inode *inode);
+#else
+static inline bool is_binderfs_device(const struct inode *inode)
+{
+        return false;
+}
+#endif
+
+#endif /* _LINUX_BINDER_INTERNAL_H */
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
new file mode 100644
index 000000000000..7496b10532aa
--- /dev/null
+++ b/drivers/android/binderfs.c
@@ -0,0 +1,544 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#include <linux/compiler_types.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/fsnotify.h>
+#include <linux/gfp.h>
+#include <linux/idr.h>
+#include <linux/init.h>
+#include <linux/ipc_namespace.h>
+#include <linux/kdev_t.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/magic.h>
+#include <linux/major.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/mount.h>
+#include <linux/parser.h>
+#include <linux/radix-tree.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/spinlock_types.h>
+#include <linux/stddef.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include <linux/user_namespace.h>
+#include <linux/xarray.h>
+#include <uapi/asm-generic/errno-base.h>
+#include <uapi/linux/android/binder.h>
+#include <uapi/linux/android/binder_ctl.h>
+
+#include "binder_internal.h"
+
+#define FIRST_INODE 1
+#define SECOND_INODE 2
+#define INODE_OFFSET 3
+#define INTSTRLEN 21
+#define BINDERFS_MAX_MINOR (1U << MINORBITS)
+
+static struct vfsmount *binderfs_mnt;
+
+static dev_t binderfs_dev;
+static DEFINE_MUTEX(binderfs_minors_mutex);
+static DEFINE_IDA(binderfs_minors);
+
+/**
+ * binderfs_info - information about a binderfs mount
+ * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
+ * @control_dentry: This records the dentry of this binderfs mount
+ *                  binder-control device.
+ * @root_uid:       uid that needs to be used when a new binder device is
+ *                  created.
+ * @root_gid:       gid that needs to be used when a new binder device is
+ *                  created.
+ */
+struct binderfs_info {
+        struct ipc_namespace *ipc_ns;
+        struct dentry *control_dentry;
+        kuid_t root_uid;
+        kgid_t root_gid;
+
+};
+
+static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
+{
+        return inode->i_sb->s_fs_info;
+}
+
+bool is_binderfs_device(const struct inode *inode)
+{
+        if (inode->i_sb->s_magic == BINDERFS_SUPER_MAGIC)
+                return true;
+
+        return false;
+}
+
+/**
+ * binderfs_binder_device_create - allocate inode from super block of a
+ *                                 binderfs mount
+ * @ref_inode: inode from wich the super block will be taken
+ * @userp:     buffer to copy information about new device for userspace to
+ * @req:       struct binderfs_device as copied from userspace
+ *
+ * This function allocated a new binder_device and reserves a new minor
+ * number for it.
+ * Minor numbers are limited and tracked globally in binderfs_minors. The
+ * function will stash a struct binder_device for the specific binder
+ * device in i_private of the inode.
+ * It will go on to allocate a new inode from the super block of the
+ * filesystem mount, stash a struct binder_device in its i_private field
+ * and attach a dentry to that inode.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int binderfs_binder_device_create(struct inode *ref_inode,
+                                         struct binderfs_device __user *userp,
+                                         struct binderfs_device *req)
+{
+        int minor, ret;
+        struct dentry *dentry, *dup, *root;
+        struct binder_device *device;
+        size_t name_len = BINDERFS_MAX_NAME + 1;
+        char *name = NULL;
+        struct inode *inode = NULL;
+        struct super_block *sb = ref_inode->i_sb;
+        struct binderfs_info *info = sb->s_fs_info;
+
+        /* Reserve new minor number for the new device. */
+        mutex_lock(&binderfs_minors_mutex);
+        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        mutex_unlock(&binderfs_minors_mutex);
+        if (minor < 0)
+                return minor;
+
+        ret = -ENOMEM;
+        device = kzalloc(sizeof(*device), GFP_KERNEL);
+        if (!device)
+                goto err;
+
+        inode = new_inode(sb);
+        if (!inode)
+                goto err;
+
+        inode->i_ino = minor + INODE_OFFSET;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+        init_special_inode(inode, S_IFCHR | 0600,
+                           MKDEV(MAJOR(binderfs_dev), minor));
+        inode->i_fop = &binder_fops;
+        inode->i_uid = info->root_uid;
+        inode->i_gid = info->root_gid;
+
+        name = kmalloc(name_len, GFP_KERNEL);
+        if (!name)
+                goto err;
+
+        strscpy(name, req->name, name_len);
+
+        device->binderfs_inode = inode;
+        device->context.binder_context_mgr_uid = INVALID_UID;
+        device->context.name = name;
+        device->miscdev.name = name;
+        device->miscdev.minor = minor;
+        mutex_init(&device->context.context_mgr_node_lock);
+
+        req->major = MAJOR(binderfs_dev);
+        req->minor = minor;
+
+        ret = copy_to_user(userp, req, sizeof(*req));
+        if (ret) {
+                ret = -EFAULT;
+                goto err;
+        }
+
+        root = sb->s_root;
+        inode_lock(d_inode(root));
+        dentry = d_alloc_name(root, name);
+        if (!dentry) {
+                inode_unlock(d_inode(root));
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        /* Verify that the name userspace gave us is not already in use. */
+        dup = d_lookup(root, &dentry->d_name);
+        if (dup) {
+                if (d_really_is_positive(dup)) {
+                        dput(dup);
+                        dput(dentry);
+                        inode_unlock(d_inode(root));
+                        ret = -EEXIST;
+                        goto err;
+                }
+                dput(dup);
+        }
+
+        inode->i_private = device;
+        d_add(dentry, inode);
+        fsnotify_create(root->d_inode, dentry);
+        inode_unlock(d_inode(root));
+
+        return 0;
+
+err:
+        kfree(name);
+        kfree(device);
+        mutex_lock(&binderfs_minors_mutex);
+        ida_free(&binderfs_minors, minor);
+        mutex_unlock(&binderfs_minors_mutex);
+        iput(inode);
+
+        return ret;
+}
+
+/**
+ * binderfs_ctl_ioctl - handle binder device node allocation requests
+ *
+ * The request handler for the binder-control device. All requests operate on
+ * the binderfs mount the binder-control device resides in:
+ * - BINDER_CTL_ADD
+ *   Allocate a new binder device.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static long binder_ctl_ioctl(struct file *file, unsigned int cmd,
+                             unsigned long arg)
+{
+        int ret = -EINVAL;
+        struct inode *inode = file_inode(file);
+        struct binderfs_device __user *device = (struct binderfs_device __user *)arg;
+        struct binderfs_device device_req;
+
+        switch (cmd) {
+        case BINDER_CTL_ADD:
+                ret = copy_from_user(&device_req, device, sizeof(device_req));
+                if (ret) {
+                        ret = -EFAULT;
+                        break;
+                }
+
+                ret = binderfs_binder_device_create(inode, device, &device_req);
+                break;
+        default:
+                break;
+        }
+
+        return ret;
+}
+
+static void binderfs_evict_inode(struct inode *inode)
+{
+        struct binder_device *device = inode->i_private;
+
+        clear_inode(inode);
+
+        if (!device)
+                return;
+
+        mutex_lock(&binderfs_minors_mutex);
+        ida_free(&binderfs_minors, device->miscdev.minor);
+        mutex_unlock(&binderfs_minors_mutex);
+
+        kfree(device->context.name);
+        kfree(device);
+}
+
+static const struct super_operations binderfs_super_ops = {
+        .statfs = simple_statfs,
+        .evict_inode = binderfs_evict_inode,
+};
+
+static int binderfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+                           struct inode *new_dir, struct dentry *new_dentry,
+                           unsigned int flags)
+{
+        struct inode *inode = d_inode(old_dentry);
+
+        /* binderfs doesn't support directories. */
+        if (d_is_dir(old_dentry))
+                return -EPERM;
+
+        if (flags & ~RENAME_NOREPLACE)
+                return -EINVAL;
+
+        if (!simple_empty(new_dentry))
+                return -ENOTEMPTY;
+
+        if (d_really_is_positive(new_dentry))
+                simple_unlink(new_dir, new_dentry);
+
+        old_dir->i_ctime = old_dir->i_mtime = new_dir->i_ctime =
+                new_dir->i_mtime = inode->i_ctime = current_time(old_dir);
+
+        return 0;
+}
+
+static int binderfs_unlink(struct inode *dir, struct dentry *dentry)
+{
+        /*
+         * The control dentry is only ever touched during mount so checking it
+         * here should not require us to take lock.
+         */
+        if (BINDERFS_I(dir)->control_dentry == dentry)
+                return -EPERM;
+
+        return simple_unlink(dir, dentry);
+}
+
+static const struct file_operations binder_ctl_fops = {
+        .owner          = THIS_MODULE,
+        .open           = nonseekable_open,
+        .unlocked_ioctl = binder_ctl_ioctl,
+        .compat_ioctl   = binder_ctl_ioctl,
+        .llseek         = noop_llseek,
+};
+
+/**
+ * binderfs_binder_ctl_create - create a new binder-control device
+ * @sb: super block of the binderfs mount
+ *
+ * This function creates a new binder-control device node in the binderfs mount
+ * referred to by @sb.
+ *
+ * Return: 0 on success, negative errno on failure
+ */
+static int binderfs_binder_ctl_create(struct super_block *sb)
+{
+        int minor, ret;
+        struct dentry *dentry;
+        struct binder_device *device;
+        struct inode *inode = NULL;
+        struct dentry *root = sb->s_root;
+        struct binderfs_info *info = sb->s_fs_info;
+
+        device = kzalloc(sizeof(*device), GFP_KERNEL);
+        if (!device)
+                return -ENOMEM;
+
+        inode_lock(d_inode(root));
+
+        /* If we have already created a binder-control node, return. */
+        if (info->control_dentry) {
+                ret = 0;
+                goto out;
+        }
+
+        ret = -ENOMEM;
+        inode = new_inode(sb);
+        if (!inode)
+                goto out;
+
+        /* Reserve a new minor number for the new device. */
+        mutex_lock(&binderfs_minors_mutex);
+        minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
+        mutex_unlock(&binderfs_minors_mutex);
+        if (minor < 0) {
+                ret = minor;
+                goto out;
+        }
+
+        inode->i_ino = SECOND_INODE;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+        init_special_inode(inode, S_IFCHR | 0600,
+                           MKDEV(MAJOR(binderfs_dev), minor));
+        inode->i_fop = &binder_ctl_fops;
+        inode->i_uid = info->root_uid;
+        inode->i_gid = info->root_gid;
+
+        device->binderfs_inode = inode;
+        device->miscdev.minor = minor;
+
+        dentry = d_alloc_name(root, "binder-control");
+        if (!dentry)
+                goto out;
+
+        inode->i_private = device;
+        info->control_dentry = dentry;
+        d_add(dentry, inode);
+        inode_unlock(d_inode(root));
+
+        return 0;
+
+out:
+        inode_unlock(d_inode(root));
+        kfree(device);
+        iput(inode);
+
+        return ret;
+}
+
+static const struct inode_operations binderfs_dir_inode_operations = {
+        .lookup = simple_lookup,
+        .rename = binderfs_rename,
+        .unlink = binderfs_unlink,
+};
+
+static int binderfs_fill_super(struct super_block *sb, void *data, int silent)
+{
+        struct binderfs_info *info;
+        int ret = -ENOMEM;
+        struct inode *inode = NULL;
+        struct ipc_namespace *ipc_ns = sb->s_fs_info;
+
+        get_ipc_ns(ipc_ns);
+
+        sb->s_blocksize = PAGE_SIZE;
+        sb->s_blocksize_bits = PAGE_SHIFT;
+
+        /*
+         * The binderfs filesystem can be mounted by userns root in a
+         * non-initial userns. By default such mounts have the SB_I_NODEV flag
+         * set in s_iflags to prevent security issues where userns root can
+         * just create random device nodes via mknod() since it owns the
+         * filesystem mount. But binderfs does not allow to create any files
+         * including devices nodes. The only way to create binder devices nodes
+         * is through the binder-control device which userns root is explicitly
+         * allowed to do. So removing the SB_I_NODEV flag from s_iflags is both
+         * necessary and safe.
+         */
+        sb->s_iflags &= ~SB_I_NODEV;
+        sb->s_iflags |= SB_I_NOEXEC;
+        sb->s_magic = BINDERFS_SUPER_MAGIC;
+        sb->s_op = &binderfs_super_ops;
+        sb->s_time_gran = 1;
+
+        info = kzalloc(sizeof(struct binderfs_info), GFP_KERNEL);
+        if (!info)
+                goto err_without_dentry;
+
+        info->ipc_ns = ipc_ns;
+        info->root_gid = make_kgid(sb->s_user_ns, 0);
+        if (!gid_valid(info->root_gid))
+                info->root_gid = GLOBAL_ROOT_GID;
+        info->root_uid = make_kuid(sb->s_user_ns, 0);
+        if (!uid_valid(info->root_uid))
+                info->root_uid = GLOBAL_ROOT_UID;
+
+        sb->s_fs_info = info;
+
+        inode = new_inode(sb);
+        if (!inode)
+                goto err_without_dentry;
+
+        inode->i_ino = FIRST_INODE;
+        inode->i_fop = &simple_dir_operations;
+        inode->i_mode = S_IFDIR | 0755;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
+        inode->i_op = &binderfs_dir_inode_operations;
+        set_nlink(inode, 2);
+
+        sb->s_root = d_make_root(inode);
+        if (!sb->s_root)
+                goto err_without_dentry;
+
+        ret = binderfs_binder_ctl_create(sb);
+        if (ret)
+                goto err_with_dentry;
+
+        return 0;
+
+err_with_dentry:
+        dput(sb->s_root);
+        sb->s_root = NULL;
+
+err_without_dentry:
+        put_ipc_ns(ipc_ns);
+        iput(inode);
+        kfree(info);
+
+        return ret;
+}
+
+static int binderfs_test_super(struct super_block *sb, void *data)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+
+        if (info)
+                return info->ipc_ns == data;
+
+        return 0;
+}
+
+static int binderfs_set_super(struct super_block *sb, void *data)
+{
+        sb->s_fs_info = data;
+        return set_anon_super(sb, NULL);
+}
+
+static struct dentry *binderfs_mount(struct file_system_type *fs_type,
+                                     int flags, const char *dev_name,
+                                     void *data)
+{
+        struct super_block *sb;
+        struct ipc_namespace *ipc_ns = current->nsproxy->ipc_ns;
+
+        if (!ns_capable(ipc_ns->user_ns, CAP_SYS_ADMIN))
+                return ERR_PTR(-EPERM);
+
+        sb = sget_userns(fs_type, binderfs_test_super, binderfs_set_super,
+                         flags, ipc_ns->user_ns, ipc_ns);
+        if (IS_ERR(sb))
+                return ERR_CAST(sb);
+
+        if (!sb->s_root) {
+                int ret = binderfs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
+                if (ret) {
+                        deactivate_locked_super(sb);
+                        return ERR_PTR(ret);
+                }
+
+                sb->s_flags |= SB_ACTIVE;
+        }
+
+        return dget(sb->s_root);
+}
+
+static void binderfs_kill_super(struct super_block *sb)
+{
+        struct binderfs_info *info = sb->s_fs_info;
+
+        if (info && info->ipc_ns)
+                put_ipc_ns(info->ipc_ns);
+
+        kfree(info);
+        kill_litter_super(sb);
+}
+
+static struct file_system_type binder_fs_type = {
+        .name           = "binder",
+        .mount          = binderfs_mount,
+        .kill_sb        = binderfs_kill_super,
+        .fs_flags       = FS_USERNS_MOUNT,
+};
+
+static int __init init_binderfs(void)
+{
+        int ret;
+
+        /* Allocate new major number for binderfs. */
+        ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR,
+                                  "binder");
+        if (ret)
+                return ret;
+
+        ret = register_filesystem(&binder_fs_type);
+        if (ret) {
+                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
+                return ret;
+        }
+
+        binderfs_mnt = kern_mount(&binder_fs_type);
+        if (IS_ERR(binderfs_mnt)) {
+                ret = PTR_ERR(binderfs_mnt);
+                binderfs_mnt = NULL;
+                unregister_filesystem(&binder_fs_type);
+                unregister_chrdev_region(binderfs_dev, BINDERFS_MAX_MINOR);
+        }
+
+        return ret;
+}
+
+device_initcall(init_binderfs);
diff --git a/drivers/bus/fsl-mc/dpbp.c b/drivers/bus/fsl-mc/dpbp.c
index 17e3c5d2f22e..9003cd3698a5 100644
--- a/drivers/bus/fsl-mc/dpbp.c
+++ b/drivers/bus/fsl-mc/dpbp.c
@@ -5,7 +5,6 @@
  */
 #include <linux/kernel.h>
 #include <linux/fsl/mc.h>
-#include <linux/fsl/mc.h>
 
 #include "fsl-mc-private.h"
 
diff --git a/drivers/bus/fsl-mc/dpcon.c b/drivers/bus/fsl-mc/dpcon.c
index 760555d7946e..97b6fa605e62 100644
--- a/drivers/bus/fsl-mc/dpcon.c
+++ b/drivers/bus/fsl-mc/dpcon.c
@@ -5,7 +5,6 @@
  */
 #include <linux/kernel.h>
 #include <linux/fsl/mc.h>
-#include <linux/fsl/mc.h>
 
 #include "fsl-mc-private.h"
 
diff --git a/drivers/bus/qcom-ebi2.c b/drivers/bus/qcom-ebi2.c
index a6444244c411..56b01e4344d3 100644
--- a/drivers/bus/qcom-ebi2.c
+++ b/drivers/bus/qcom-ebi2.c
@@ -21,7 +21,6 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
 #include <linux/init.h>
-#include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/platform_device.h>
 #include <linux/bitops.h>
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 8c4dd1a3bb6a..5c8d780637bd 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -46,8 +46,8 @@
  *      lp=auto                         (assign lp devices to all ports that
  *                                       have printers attached, as determined
  *                                       by the IEEE-1284 autoprobe)
- * 
- *      lp=reset                        (reset the printer during 
+ *
+ *      lp=reset                        (reset the printer during
  *                                       initialisation)
  *
  *      lp=off                          (disable the printer driver entirely)
@@ -141,6 +141,7 @@
 
 static DEFINE_MUTEX(lp_mutex);
 static struct lp_struct lp_table[LP_NO];
+static int port_num[LP_NO];
 
 static unsigned int lp_count = 0;
 static struct class *lp_class;
@@ -166,7 +167,7 @@ static struct parport *console_registered;
 static void lp_claim_parport_or_block(struct lp_struct *this_lp)
 {
         if (!test_and_set_bit(LP_PARPORT_CLAIMED, &this_lp->bits)) {
-                parport_claim_or_block (this_lp->dev);
+                parport_claim_or_block(this_lp->dev);
         }
 }
 
@@ -174,7 +175,7 @@ static void lp_claim_parport_or_block(struct lp_struct *this_lp)
 static void lp_release_parport(struct lp_struct *this_lp)
 {
         if (test_and_clear_bit(LP_PARPORT_CLAIMED, &this_lp->bits)) {
-                parport_release (this_lp->dev);
+                parport_release(this_lp->dev);
         }
 }
 
@@ -184,37 +185,37 @@ static int lp_preempt(void *handle)
 {
         struct lp_struct *this_lp = (struct lp_struct *)handle;
         set_bit(LP_PREEMPT_REQUEST, &this_lp->bits);
-        return (1);
+        return 1;
 }
 
 
-/* 
+/*
  * Try to negotiate to a new mode; if unsuccessful negotiate to
  * compatibility mode.  Return the mode we ended up in.
  */
-static int lp_negotiate(struct parport * port, int mode)
+static int lp_negotiate(struct parport *port, int mode)
 {
-        if (parport_negotiate (port, mode) != 0) {
+        if (parport_negotiate(port, mode) != 0) {
                 mode = IEEE1284_MODE_COMPAT;
-                parport_negotiate (port, mode);
+                parport_negotiate(port, mode);
         }
 
-        return (mode);
+        return mode;
 }
 
 static int lp_reset(int minor)
 {
         int retval;
-        lp_claim_parport_or_block (&lp_table[minor]);
+        lp_claim_parport_or_block(&lp_table[minor]);
         w_ctr(minor, LP_PSELECP);
-        udelay (LP_DELAY);
+        udelay(LP_DELAY);
         w_ctr(minor, LP_PSELECP | LP_PINITP);
         retval = r_str(minor);
-        lp_release_parport (&lp_table[minor]);
+        lp_release_parport(&lp_table[minor]);
         return retval;
 }
 
-static void lp_error (int minor)
+static void lp_error(int minor)
 {
         DEFINE_WAIT(wait);
         int polling;
@@ -223,12 +224,15 @@ static void lp_error (int minor)
                 return;
 
         polling = lp_table[minor].dev->port->irq == PARPORT_IRQ_NONE;
-        if (polling) lp_release_parport (&lp_table[minor]);
+        if (polling)
+                lp_release_parport(&lp_table[minor]);
         prepare_to_wait(&lp_table[minor].waitq, &wait, TASK_INTERRUPTIBLE);
         schedule_timeout(LP_TIMEOUT_POLLED);
         finish_wait(&lp_table[minor].waitq, &wait);
-        if (polling) lp_claim_parport_or_block (&lp_table[minor]);
-        else parport_yield_blocking (lp_table[minor].dev);
+        if (polling)
+                lp_claim_parport_or_block(&lp_table[minor]);
+        else
+                parport_yield_blocking(lp_table[minor].dev);
 }
 
 static int lp_check_status(int minor)
@@ -259,7 +263,7 @@ static int lp_check_status(int minor)
                 error = -EIO;
         } else {
                 last = 0; /* Come here if LP_CAREFUL is set and no
-                             errors are reported. */
+                             errors are reported. */
         }
 
         lp_table[minor].last_error = last;
@@ -276,14 +280,14 @@ static int lp_wait_ready(int minor, int nonblock)
 
         /* If we're not in compatibility mode, we're ready now! */
         if (lp_table[minor].current_mode != IEEE1284_MODE_COMPAT) {
-          return (0);
+                return 0;
         }
 
         do {
-                error = lp_check_status (minor);
+                error = lp_check_status(minor);
                 if (error && (nonblock || (LP_F(minor) & LP_ABORT)))
                         break;
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         error = -EINTR;
                         break;
                 }
@@ -291,8 +295,8 @@ static int lp_wait_ready(int minor, int nonblock)
         return error;
 }
 
-static ssize_t lp_write(struct file * file, const char __user * buf,
-                        size_t count, loff_t *ppos)
+static ssize_t lp_write(struct file *file, const char __user *buf,
+                        size_t count, loff_t *ppos)
 {
         unsigned int minor = iminor(file_inode(file));
         struct parport *port = lp_table[minor].dev->port;
@@ -317,26 +321,26 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
         if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
                 return -EINTR;
 
-        if (copy_from_user (kbuf, buf, copy_size)) {
+        if (copy_from_user(kbuf, buf, copy_size)) {
                 retv = -EFAULT;
                 goto out_unlock;
         }
 
-        /* Claim Parport or sleep until it becomes available
-         */
-        lp_claim_parport_or_block (&lp_table[minor]);
+        /* Claim Parport or sleep until it becomes available
+         */
+        lp_claim_parport_or_block(&lp_table[minor]);
         /* Go to the proper mode. */
-        lp_table[minor].current_mode = lp_negotiate (port, 
-                                                     lp_table[minor].best_mode);
+        lp_table[minor].current_mode = lp_negotiate(port,
+                                                    lp_table[minor].best_mode);
 
-        parport_set_timeout (lp_table[minor].dev,
-                             (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
-                              : lp_table[minor].timeout));
+        parport_set_timeout(lp_table[minor].dev,
+                            (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
+                             : lp_table[minor].timeout));
 
-        if ((retv = lp_wait_ready (minor, nonblock)) == 0)
+        if ((retv = lp_wait_ready(minor, nonblock)) == 0)
         do {
                 /* Write the data. */
-                written = parport_write (port, kbuf, copy_size);
+                written = parport_write(port, kbuf, copy_size);
                 if (written > 0) {
                         copy_size -= written;
                         count -= written;
@@ -344,7 +348,7 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                         retv += written;
                 }
 
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         if (retv == 0)
                                 retv = -EINTR;
 
@@ -355,11 +359,11 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                         /* incomplete write -> check error ! */
                         int error;
 
-                        parport_negotiate (lp_table[minor].dev->port, 
-                                           IEEE1284_MODE_COMPAT);
+                        parport_negotiate(lp_table[minor].dev->port,
+                                          IEEE1284_MODE_COMPAT);
                         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
 
-                        error = lp_wait_ready (minor, nonblock);
+                        error = lp_wait_ready(minor, nonblock);
 
                         if (error) {
                                 if (retv == 0)
@@ -371,13 +375,13 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                                 break;
                         }
 
-                        parport_yield_blocking (lp_table[minor].dev);
-                        lp_table[minor].current_mode 
-                          = lp_negotiate (port, 
-                                          lp_table[minor].best_mode);
+                        parport_yield_blocking(lp_table[minor].dev);
+                        lp_table[minor].current_mode
+                          = lp_negotiate(port,
+                                         lp_table[minor].best_mode);
 
                 } else if (need_resched())
-                        schedule ();
+                        schedule();
 
                 if (count) {
                         copy_size = count;
@@ -389,27 +393,27 @@ static ssize_t lp_write(struct file * file, const char __user * buf,
                                         retv = -EFAULT;
                                 break;
                         }
-                }       
+                }
         } while (count > 0);
 
-        if (test_and_clear_bit(LP_PREEMPT_REQUEST, 
+        if (test_and_clear_bit(LP_PREEMPT_REQUEST,
                                &lp_table[minor].bits)) {
                 printk(KERN_INFO "lp%d releasing parport\n", minor);
-                parport_negotiate (lp_table[minor].dev->port, 
-                                   IEEE1284_MODE_COMPAT);
+                parport_negotiate(lp_table[minor].dev->port,
+                                  IEEE1284_MODE_COMPAT);
                 lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
-                lp_release_parport (&lp_table[minor]);
+                lp_release_parport(&lp_table[minor]);
         }
 out_unlock:
         mutex_unlock(&lp_table[minor].port_mutex);
 
-        return retv;
+        return retv;
 }
 
 #ifdef CONFIG_PARPORT_1284
 
 /* Status readback conforming to ieee1284 */
-static ssize_t lp_read(struct file * file, char __user * buf,
+static ssize_t lp_read(struct file *file, char __user *buf,
                        size_t count, loff_t *ppos)
 {
         DEFINE_WAIT(wait);
@@ -426,21 +430,21 @@ static ssize_t lp_read(struct file * file, char __user * buf,
         if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
                 return -EINTR;
 
-        lp_claim_parport_or_block (&lp_table[minor]);
+        lp_claim_parport_or_block(&lp_table[minor]);
 
-        parport_set_timeout (lp_table[minor].dev,
-                             (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
-                              : lp_table[minor].timeout));
+        parport_set_timeout(lp_table[minor].dev,
+                            (nonblock ? PARPORT_INACTIVITY_O_NONBLOCK
+                             : lp_table[minor].timeout));
 
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
-        if (parport_negotiate (lp_table[minor].dev->port,
-                               IEEE1284_MODE_NIBBLE)) {
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        if (parport_negotiate(lp_table[minor].dev->port,
+                              IEEE1284_MODE_NIBBLE)) {
                 retval = -EIO;
                 goto out;
         }
 
         while (retval == 0) {
-                retval = parport_read (port, kbuf, count);
+                retval = parport_read(port, kbuf, count);
 
                 if (retval > 0)
                         break;
@@ -453,11 +457,11 @@ static ssize_t lp_read(struct file * file, char __user * buf,
                 /* Wait for data. */
 
                 if (lp_table[minor].dev->port->irq == PARPORT_IRQ_NONE) {
-                        parport_negotiate (lp_table[minor].dev->port,
-                                           IEEE1284_MODE_COMPAT);
-                        lp_error (minor);
-                        if (parport_negotiate (lp_table[minor].dev->port,
-                                               IEEE1284_MODE_NIBBLE)) {
+                        parport_negotiate(lp_table[minor].dev->port,
+                                          IEEE1284_MODE_COMPAT);
+                        lp_error(minor);
+                        if (parport_negotiate(lp_table[minor].dev->port,
+                                              IEEE1284_MODE_NIBBLE)) {
                                 retval = -EIO;
                                 goto out;
                         }
@@ -467,18 +471,18 @@ static ssize_t lp_read(struct file * file, char __user * buf,
                         finish_wait(&lp_table[minor].waitq, &wait);
                 }
 
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         retval = -ERESTARTSYS;
                         break;
                 }
 
-                cond_resched ();
+                cond_resched();
         }
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
  out:
-        lp_release_parport (&lp_table[minor]);
+        lp_release_parport(&lp_table[minor]);
 
-        if (retval > 0 && copy_to_user (buf, kbuf, retval))
+        if (retval > 0 && copy_to_user(buf, kbuf, retval))
                 retval = -EFAULT;
 
         mutex_unlock(&lp_table[minor].port_mutex);
@@ -488,7 +492,7 @@ static ssize_t lp_read(struct file * file, char __user * buf,
 
 #endif /* IEEE 1284 support */
 
-static int lp_open(struct inode * inode, struct file * file)
+static int lp_open(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode);
         int ret = 0;
@@ -513,9 +517,9 @@ static int lp_open(struct inode * inode, struct file * file)
            should most likely only ever be used by the tunelp application. */
         if ((LP_F(minor) & LP_ABORTOPEN) && !(file->f_flags & O_NONBLOCK)) {
                 int status;
-                lp_claim_parport_or_block (&lp_table[minor]);
+                lp_claim_parport_or_block(&lp_table[minor]);
                 status = r_str(minor);
-                lp_release_parport (&lp_table[minor]);
+                lp_release_parport(&lp_table[minor]);
                 if (status & LP_POUTPA) {
                         printk(KERN_INFO "lp%d out of paper\n", minor);
                         LP_F(minor) &= ~LP_BUSY;
@@ -540,32 +544,32 @@ static int lp_open(struct inode * inode, struct file * file)
                 goto out;
         }
         /* Determine if the peripheral supports ECP mode */
-        lp_claim_parport_or_block (&lp_table[minor]);
+        lp_claim_parport_or_block(&lp_table[minor]);
         if ( (lp_table[minor].dev->port->modes & PARPORT_MODE_ECP) &&
-             !parport_negotiate (lp_table[minor].dev->port, 
-                                 IEEE1284_MODE_ECP)) {
-                printk (KERN_INFO "lp%d: ECP mode\n", minor);
+             !parport_negotiate(lp_table[minor].dev->port,
+                                 IEEE1284_MODE_ECP)) {
+                printk(KERN_INFO "lp%d: ECP mode\n", minor);
                 lp_table[minor].best_mode = IEEE1284_MODE_ECP;
         } else {
                 lp_table[minor].best_mode = IEEE1284_MODE_COMPAT;
         }
         /* Leave peripheral in compatibility mode */
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
-        lp_release_parport (&lp_table[minor]);
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        lp_release_parport(&lp_table[minor]);
         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
 out:
         mutex_unlock(&lp_mutex);
         return ret;
 }
 
-static int lp_release(struct inode * inode, struct file * file)
+static int lp_release(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode);
 
-        lp_claim_parport_or_block (&lp_table[minor]);
-        parport_negotiate (lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
+        lp_claim_parport_or_block(&lp_table[minor]);
+        parport_negotiate(lp_table[minor].dev->port, IEEE1284_MODE_COMPAT);
         lp_table[minor].current_mode = IEEE1284_MODE_COMPAT;
-        lp_release_parport (&lp_table[minor]);
+        lp_release_parport(&lp_table[minor]);
         kfree(lp_table[minor].lp_buffer);
         lp_table[minor].lp_buffer = NULL;
         LP_F(minor) &= ~LP_BUSY;
@@ -615,7 +619,7 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                 case LPWAIT:
                         LP_WAIT(minor) = arg;
                         break;
-                case LPSETIRQ: 
+                case LPSETIRQ:
                         return -EINVAL;
                         break;
                 case LPGETIRQ:
@@ -626,9 +630,9 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                 case LPGETSTATUS:
                         if (mutex_lock_interruptible(&lp_table[minor].port_mutex))
                                 return -EINTR;
-                        lp_claim_parport_or_block (&lp_table[minor]);
+                        lp_claim_parport_or_block(&lp_table[minor]);
                         status = r_str(minor);
-                        lp_release_parport (&lp_table[minor]);
+                        lp_release_parport(&lp_table[minor]);
                         mutex_unlock(&lp_table[minor].port_mutex);
 
                         if (copy_to_user(argp, &status, sizeof(int)))
@@ -647,8 +651,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                                                 sizeof(struct lp_stats));
                         break;
 #endif
-                case LPGETFLAGS:
-                        status = LP_F(minor);
+                case LPGETFLAGS:
+                        status = LP_F(minor);
                         if (copy_to_user(argp, &status, sizeof(int)))
                                 return -EFAULT;
                         break;
@@ -801,31 +805,31 @@ static const struct file_operations lp_fops = {
 
 /* The console must be locked when we get here. */
 
-static void lp_console_write (struct console *co, const char *s,
-                              unsigned count)
+static void lp_console_write(struct console *co, const char *s,
+                             unsigned count)
 {
         struct pardevice *dev = lp_table[CONSOLE_LP].dev;
         struct parport *port = dev->port;
         ssize_t written;
 
-        if (parport_claim (dev))
+        if (parport_claim(dev))
                 /* Nothing we can do. */
                 return;
 
-        parport_set_timeout (dev, 0);
+        parport_set_timeout(dev, 0);
 
         /* Go to compatibility mode. */
-        parport_negotiate (port, IEEE1284_MODE_COMPAT);
+        parport_negotiate(port, IEEE1284_MODE_COMPAT);
 
         do {
                 /* Write the data, converting LF->CRLF as we go. */
                 ssize_t canwrite = count;
-                char *lf = memchr (s, '\n', count);
+                char *lf = memchr(s, '\n', count);
                 if (lf)
                         canwrite = lf - s;
 
                 if (canwrite > 0) {
-                        written = parport_write (port, s, canwrite);
+                        written = parport_write(port, s, canwrite);
 
                         if (written <= 0)
                                 continue;
@@ -843,14 +847,14 @@ static void lp_console_write (struct console *co, const char *s,
                         s++;
                         count--;
                         do {
-                                written = parport_write (port, crlf, i);
+                                written = parport_write(port, crlf, i);
                                 if (written > 0)
                                         i -= written, crlf += written;
                         } while (i > 0 && (CONSOLE_LP_STRICT || written > 0));
                 }
         } while (count > 0 && (CONSOLE_LP_STRICT || written > 0));
 
-        parport_release (dev);
+        parport_release(dev);
 }
 
 static struct console lpcons = {
@@ -871,7 +875,7 @@ module_param_array(parport, charp, NULL, 0);
 module_param(reset, bool, 0);
 
 #ifndef MODULE
-static int __init lp_setup (char *str)
+static int __init lp_setup(char *str)
 {
         static int parport_ptr;
         int x;
@@ -908,9 +912,13 @@ static int __init lp_setup (char *str)
 
 static int lp_register(int nr, struct parport *port)
 {
-        lp_table[nr].dev = parport_register_device(port, "lp", 
-                                                   lp_preempt, NULL, NULL, 0,
-                                                   (void *) &lp_table[nr]);
+        struct pardev_cb ppdev_cb;
+
+        memset(&ppdev_cb, 0, sizeof(ppdev_cb));
+        ppdev_cb.preempt = lp_preempt;
+        ppdev_cb.private = &lp_table[nr];
+        lp_table[nr].dev = parport_register_dev_model(port, "lp",
+                                                      &ppdev_cb, nr);
         if (lp_table[nr].dev == NULL)
                 return 1;
         lp_table[nr].flags |= LP_EXIST;
@@ -921,7 +929,7 @@ static int lp_register(int nr, struct parport *port)
         device_create(lp_class, port->dev, MKDEV(LP_MAJOR, nr), NULL,
                       "lp%d", nr);
 
-        printk(KERN_INFO "lp%d: using %s (%s).\n", nr, port->name, 
+        printk(KERN_INFO "lp%d: using %s (%s).\n", nr, port->name,
                (port->irq == PARPORT_IRQ_NONE)?"polling":"interrupt-driven");
 
 #ifdef CONFIG_LP_CONSOLE
@@ -929,17 +937,18 @@ static int lp_register(int nr, struct parport *port)
                 if (port->modes & PARPORT_MODE_SAFEININT) {
                         register_console(&lpcons);
                         console_registered = port;
-                        printk (KERN_INFO "lp%d: console ready\n", CONSOLE_LP);
+                        printk(KERN_INFO "lp%d: console ready\n", CONSOLE_LP);
                 } else
-                        printk (KERN_ERR "lp%d: cannot run console on %s\n",
-                                CONSOLE_LP, port->name);
+                        printk(KERN_ERR "lp%d: cannot run console on %s\n",
+                               CONSOLE_LP, port->name);
         }
 #endif
+        port_num[nr] = port->number;
 
         return 0;
 }
 
-static void lp_attach (struct parport *port)
+static void lp_attach(struct parport *port)
 {
         unsigned int i;
 
@@ -953,7 +962,11 @@ static void lp_attach (struct parport *port)
                         printk(KERN_INFO "lp: ignoring parallel port (max. %d)\n",LP_NO);
                         return;
                 }
-                if (!lp_register(lp_count, port))
+                for (i = 0; i < LP_NO; i++)
+                        if (port_num[i] == -1)
+                                break;
+
+                if (!lp_register(i, port))
                         lp_count++;
                 break;
 
@@ -969,8 +982,10 @@ static void lp_attach (struct parport *port)
         }
 }
 
-static void lp_detach (struct parport *port)
+static void lp_detach(struct parport *port)
 {
+        int n;
+
         /* Write this some day. */
 #ifdef CONFIG_LP_CONSOLE
         if (console_registered == port) {
@@ -978,15 +993,25 @@ static void lp_detach (struct parport *port)
                 console_registered = NULL;
         }
 #endif /* CONFIG_LP_CONSOLE */
+
+        for (n = 0; n < LP_NO; n++) {
+                if (port_num[n] == port->number) {
+                        port_num[n] = -1;
+                        lp_count--;
+                        device_destroy(lp_class, MKDEV(LP_MAJOR, n));
+                        parport_unregister_device(lp_table[n].dev);
+                }
+        }
 }
 
 static struct parport_driver lp_driver = {
         .name = "lp",
-        .attach = lp_attach,
+        .match_port = lp_attach,
         .detach = lp_detach,
+        .devmodel = true,
 };
 
-static int __init lp_init (void)
+static int __init lp_init(void)
 {
         int i, err = 0;
 
@@ -1003,17 +1028,18 @@ static int __init lp_init (void)
 #ifdef LP_STATS
                 lp_table[i].lastcall = 0;
                 lp_table[i].runchars = 0;
-                memset (&lp_table[i].stats, 0, sizeof (struct lp_stats));
+                memset(&lp_table[i].stats, 0, sizeof(struct lp_stats));
 #endif
                 lp_table[i].last_error = 0;
-                init_waitqueue_head (&lp_table[i].waitq);
-                init_waitqueue_head (&lp_table[i].dataq);
+                init_waitqueue_head(&lp_table[i].waitq);
+                init_waitqueue_head(&lp_table[i].dataq);
                 mutex_init(&lp_table[i].port_mutex);
                 lp_table[i].timeout = 10 * HZ;
+                port_num[i] = -1;
         }
 
-        if (register_chrdev (LP_MAJOR, "lp", &lp_fops)) {
-                printk (KERN_ERR "lp: unable to get major %d\n", LP_MAJOR);
+        if (register_chrdev(LP_MAJOR, "lp", &lp_fops)) {
+                printk(KERN_ERR "lp: unable to get major %d\n", LP_MAJOR);
                 return -EIO;
         }
 
@@ -1023,17 +1049,17 @@ static int __init lp_init (void)
                 goto out_reg;
         }
 
-        if (parport_register_driver (&lp_driver)) {
-                printk (KERN_ERR "lp: unable to register with parport\n");
+        if (parport_register_driver(&lp_driver)) {
+                printk(KERN_ERR "lp: unable to register with parport\n");
                 err = -EIO;
                 goto out_class;
         }
 
         if (!lp_count) {
-                printk (KERN_INFO "lp: driver loaded but no devices found\n");
+                printk(KERN_INFO "lp: driver loaded but no devices found\n");
 #ifndef CONFIG_PARPORT_1284
                 if (parport_nr[0] == LP_PARPORT_AUTO)
-                        printk (KERN_INFO "lp: (is IEEE 1284 support enabled?)\n");
+                        printk(KERN_INFO "lp: (is IEEE 1284 support enabled?)\n");
 #endif
         }
 
@@ -1046,7 +1072,7 @@ out_reg:
         return err;
 }
 
-static int __init lp_init_module (void)
+static int __init lp_init_module(void)
 {
         if (parport[0]) {
                 /* The user gave some parameters.  Let's see what they were.  */
@@ -1060,7 +1086,7 @@ static int __init lp_init_module (void)
                                 else {
                                         char *ep;
                                         unsigned long r = simple_strtoul(parport[n], &ep, 0);
-                                        if (ep != parport[n]) 
+                                        if (ep != parport[n])
                                                 parport_nr[n] = r;
                                         else {
                                                 printk(KERN_ERR "lp: bad port specifier `%s'\n", parport[n]);
@@ -1074,23 +1100,15 @@ static int __init lp_init_module (void)
         return lp_init();
 }
 
-static void lp_cleanup_module (void)
+static void lp_cleanup_module(void)
 {
-        unsigned int offset;
-
-        parport_unregister_driver (&lp_driver);
+        parport_unregister_driver(&lp_driver);
 
 #ifdef CONFIG_LP_CONSOLE
-        unregister_console (&lpcons);
+        unregister_console(&lpcons);
 #endif
 
         unregister_chrdev(LP_MAJOR, "lp");
-        for (offset = 0; offset < LP_NO; offset++) {
-                if (lp_table[offset].dev == NULL)
-                        continue;
-                parport_unregister_device(lp_table[offset].dev);
-                device_destroy(lp_class, MKDEV(LP_MAJOR, offset));
-        }
         class_destroy(lp_class);
 }
 
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index 4948c8bda6b1..62b7c721c732 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -866,8 +866,8 @@ static int __init rtc_init(void)
 #ifdef CONFIG_SPARC32
         for_each_node_by_name(ebus_dp, "ebus") {
                 struct device_node *dp;
-                for (dp = ebus_dp; dp; dp = dp->sibling) {
-                        if (!strcmp(dp->name, "rtc")) {
+                for_each_child_of_node(ebus_dp, dp) {
+                        if (of_node_name_eq(dp, "rtc")) {
                                 op = of_find_device_by_node(dp);
                                 if (op) {
                                         rtc_port = op->resource[0].start;
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 8eeb4190207d..6d81bb3bb503 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -506,28 +506,28 @@ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
 
         val = (unsigned char)tmp;
         spin_lock_irqsave(&event_lock, flags);
-                if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x28);
-                        SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
-                } else if (val >= CLK_8_592MHz) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x38);
-                        switch (val) {
-                        case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
-                                break;
-                        case CLK_11_184MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
-                                break;
-                        case CLK_34_368MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
-                                break;
-                        case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
-                                break;
-                        }
-                } else
-                        SET_PORT_BITS(TLCLK_REG3, 0xc7, val << 3);
-
+        if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
+                SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x28);
+                SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
+        } else if (val >= CLK_8_592MHz) {
+                SET_PORT_BITS(TLCLK_REG3, 0xc7, 0x38);
+                switch (val) {
+                case CLK_8_592MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                        break;
+                case CLK_11_184MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
+                        break;
+                case CLK_34_368MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
+                        break;
+                case CLK_44_736MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                        break;
+                }
+        } else {
+                SET_PORT_BITS(TLCLK_REG3, 0xc7, val << 3);
+        }
         spin_unlock_irqrestore(&event_lock, flags);
 
         return strnlen(buf, count);
@@ -548,27 +548,28 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
 
         val = (unsigned char)tmp;
         spin_lock_irqsave(&event_lock, flags);
-                if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x5);
-                        SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
-                } else if (val >= CLK_8_592MHz) {
-                        SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
-                        switch (val) {
-                        case CLK_8_592MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
-                                break;
-                        case CLK_11_184MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
-                                break;
-                        case CLK_34_368MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
-                                break;
-                        case CLK_44_736MHz:
-                                SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
-                                break;
-                        }
-                } else
-                        SET_PORT_BITS(TLCLK_REG3, 0xf8, val);
+        if ((val == CLK_8kHz) || (val == CLK_16_384MHz)) {
+                SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x5);
+                SET_PORT_BITS(TLCLK_REG1, 0xfb, ~val);
+        } else if (val >= CLK_8_592MHz) {
+                SET_PORT_BITS(TLCLK_REG3, 0xf8, 0x7);
+                switch (val) {
+                case CLK_8_592MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 2);
+                        break;
+                case CLK_11_184MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 0);
+                        break;
+                case CLK_34_368MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 3);
+                        break;
+                case CLK_44_736MHz:
+                        SET_PORT_BITS(TLCLK_REG0, 0xfc, 1);
+                        break;
+                }
+        } else {
+                SET_PORT_BITS(TLCLK_REG3, 0xf8, val);
+        }
         spin_unlock_irqrestore(&event_lock, flags);
 
         return strnlen(buf, count);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 5b5b5d72eab7..fbeb71953526 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1309,7 +1309,7 @@ static const struct attribute_group port_attribute_group = {
         .attrs = port_sysfs_entries,
 };
 
-static int debugfs_show(struct seq_file *s, void *data)
+static int port_debugfs_show(struct seq_file *s, void *data)
 {
         struct port *port = s->private;
 
@@ -1327,18 +1327,7 @@ static int debugfs_show(struct seq_file *s, void *data)
         return 0;
 }
 
-static int debugfs_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, debugfs_show, inode->i_private);
-}
-
-static const struct file_operations port_debugfs_ops = {
-        .owner = THIS_MODULE,
-        .open = debugfs_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(port_debugfs);
 
 static void set_console_size(struct port *port, u16 rows, u16 cols)
 {
@@ -1490,7 +1479,7 @@ static int add_port(struct ports_device *portdev, u32 id)
                 port->debugfs_file = debugfs_create_file(debugfs_name, 0444,
                                                          pdrvdata.debugfs_dir,
                                                          port,
-                                                         &port_debugfs_ops);
+                                                         &port_debugfs_fops);
         }
         return 0;
 
diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c
index 22d2feb1f8bc..32f663436e6e 100644
--- a/drivers/extcon/extcon-max14577.c
+++ b/drivers/extcon/extcon-max14577.c
@@ -657,6 +657,8 @@ static int max14577_muic_probe(struct platform_device *pdev)
         struct max14577 *max14577 = dev_get_drvdata(pdev->dev.parent);
         struct max14577_muic_info *info;
         int delay_jiffies;
+        int cable_type;
+        bool attached;
         int ret;
         int i;
         u8 id;
@@ -725,8 +727,17 @@ static int max14577_muic_probe(struct platform_device *pdev)
         info->path_uart = CTRL1_SW_UART;
         delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
 
-        /* Set initial path for UART */
-        max14577_muic_set_path(info, info->path_uart, true);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = max14577_bulk_read(info->max14577->regmap,
+                        MAX14577_MUIC_REG_STATUS1, info->status, 2);
+        if (ret) {
+                dev_err(info->dev, "Cannot read STATUS registers\n");
+                return ret;
+        }
+        cable_type = max14577_muic_get_cable_type(info, MAX14577_CABLE_GROUP_ADC,
+                                         &attached);
+        if (attached && cable_type == MAX14577_MUIC_ADC_FACTORY_MODE_UART_OFF)
+                max14577_muic_set_path(info, info->path_uart, true);
 
         /* Check revision number of MUIC device*/
         ret = max14577_read_reg(info->max14577->regmap,
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index a79537ebb671..32fc5a66ffa9 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1072,6 +1072,8 @@ static int max77693_muic_probe(struct platform_device *pdev)
         struct max77693_reg_data *init_data;
         int num_init_data;
         int delay_jiffies;
+        int cable_type;
+        bool attached;
         int ret;
         int i;
         unsigned int id;
@@ -1212,8 +1214,18 @@ static int max77693_muic_probe(struct platform_device *pdev)
                 delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         }
 
-        /* Set initial path for UART */
-         max77693_muic_set_path(info, info->path_uart, true);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = regmap_bulk_read(info->max77693->regmap_muic,
+                        MAX77693_MUIC_REG_STATUS1, info->status, 2);
+        if (ret) {
+                dev_err(info->dev, "failed to read MUIC register\n");
+                return ret;
+        }
+        cable_type = max77693_muic_get_cable_type(info,
+                                           MAX77693_CABLE_GROUP_ADC, &attached);
+        if (attached && (cable_type == MAX77693_MUIC_ADC_FACTORY_MODE_UART_ON ||
+                         cable_type == MAX77693_MUIC_ADC_FACTORY_MODE_UART_OFF))
+                max77693_muic_set_path(info, info->path_uart, true);
 
         /* Check revision number of MUIC device*/
         ret = regmap_read(info->max77693->regmap_muic,
diff --git a/drivers/extcon/extcon-max77843.c b/drivers/extcon/extcon-max77843.c
index b98cbd0362f5..a343a6ef3506 100644
--- a/drivers/extcon/extcon-max77843.c
+++ b/drivers/extcon/extcon-max77843.c
@@ -812,6 +812,8 @@ static int max77843_muic_probe(struct platform_device *pdev)
         struct max77693_dev *max77843 = dev_get_drvdata(pdev->dev.parent);
         struct max77843_muic_info *info;
         unsigned int id;
+        int cable_type;
+        bool attached;
         int i, ret;
 
         info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
@@ -856,9 +858,19 @@ static int max77843_muic_probe(struct platform_device *pdev)
         /* Set ADC debounce time */
         max77843_muic_set_debounce_time(info, MAX77843_DEBOUNCE_TIME_25MS);
 
-        /* Set initial path for UART */
-        max77843_muic_set_path(info, MAX77843_MUIC_CONTROL1_SW_UART, true,
-                               false);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = regmap_bulk_read(max77843->regmap_muic,
+                        MAX77843_MUIC_REG_STATUS1, info->status,
+                        MAX77843_MUIC_STATUS_NUM);
+        if (ret) {
+                dev_err(info->dev, "Cannot read STATUS registers\n");
+                goto err_muic_irq;
+        }
+        cable_type = max77843_muic_get_cable_type(info, MAX77843_CABLE_GROUP_ADC,
+                                         &attached);
+        if (attached && cable_type == MAX77843_MUIC_ADC_FACTORY_MODE_UART_OFF)
+                max77843_muic_set_path(info, MAX77843_MUIC_CONTROL1_SW_UART,
+                                       true, false);
 
         /* Check revision number of MUIC device */
         ret = regmap_read(max77843->regmap_muic, MAX77843_MUIC_REG_ID, &id);
diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index bdabb2479e0d..172e116ac1ce 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -311,12 +311,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info,
 {
         int ret = 0;
 
-        if (usb_type == MAX8997_USB_HOST) {
-                ret = max8997_muic_set_path(info, info->path_usb, attached);
-                if (ret < 0) {
-                        dev_err(info->dev, "failed to update muic register\n");
-                        return ret;
-                }
+        ret = max8997_muic_set_path(info, info->path_usb, attached);
+        if (ret < 0) {
+                dev_err(info->dev, "failed to update muic register\n");
+                return ret;
         }
 
         switch (usb_type) {
@@ -632,6 +630,8 @@ static int max8997_muic_probe(struct platform_device *pdev)
         struct max8997_platform_data *pdata = dev_get_platdata(max8997->dev);
         struct max8997_muic_info *info;
         int delay_jiffies;
+        int cable_type;
+        bool attached;
         int ret, i;
 
         info = devm_kzalloc(&pdev->dev, sizeof(struct max8997_muic_info),
@@ -724,8 +724,17 @@ static int max8997_muic_probe(struct platform_device *pdev)
                 delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
         }
 
-        /* Set initial path for UART */
-         max8997_muic_set_path(info, info->path_uart, true);
+        /* Set initial path for UART when JIG is connected to get serial logs */
+        ret = max8997_bulk_read(info->muic, MAX8997_MUIC_REG_STATUS1,
+                                2, info->status);
+        if (ret) {
+                dev_err(info->dev, "failed to read MUIC register\n");
+                return ret;
+        }
+        cable_type = max8997_muic_get_cable_type(info,
+                                           MAX8997_CABLE_GROUP_ADC, &attached);
+        if (attached && cable_type == MAX8997_MUIC_ADC_FACTORY_MODE_UART_OFF)
+                max8997_muic_set_path(info, info->path_uart, true);
 
         /* Set ADC debounce time */
         max8997_muic_set_debounce_time(info, ADC_DEBOUNCE_TIME_25MS);
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 7273e5082b41..f754578414f0 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -216,6 +216,18 @@ config FW_CFG_SYSFS_CMDLINE
           WARNING: Using incorrect parameters (base address in particular)
           may crash your system.
 
+config INTEL_STRATIX10_SERVICE
+        tristate "Intel Stratix10 Service Layer"
+        depends on HAVE_ARM_SMCCC
+        default n
+        help
+          Intel Stratix10 service layer runs at privileged exception level,
+          interfaces with the service providers (FPGA manager is one of them)
+          and manages secure monitor call to communicate with secure monitor
+          software at secure monitor exception level.
+
+          Say Y here if you want Stratix10 service layer support.
+
 config QCOM_SCM
         bool
         depends on ARM || ARM64
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 3158dffd9914..80feb635120f 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_DMI_SYSFS)		+= dmi-sysfs.o
 obj-$(CONFIG_EDD)               += edd.o
 obj-$(CONFIG_EFI_PCDP)          += pcdp.o
 obj-$(CONFIG_DMIID)             += dmi-id.o
+obj-$(CONFIG_INTEL_STRATIX10_SERVICE) += stratix10-svc.o
 obj-$(CONFIG_ISCSI_IBFT_FIND)   += iscsi_ibft_find.o
 obj-$(CONFIG_ISCSI_IBFT)        += iscsi_ibft.o
 obj-$(CONFIG_FIRMWARE_MEMMAP)   += memmap.o
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
new file mode 100644
index 000000000000..6e6514825ad0
--- /dev/null
+++ b/drivers/firmware/stratix10-svc.c
@@ -0,0 +1,1041 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2017-2018, Intel Corporation
+ */
+
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/genalloc.h>
+#include <linux/io.h>
+#include <linux/kfifo.h>
+#include <linux/kthread.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/firmware/intel/stratix10-smc.h>
+#include <linux/firmware/intel/stratix10-svc-client.h>
+#include <linux/types.h>
+
+/**
+ * SVC_NUM_DATA_IN_FIFO - number of struct stratix10_svc_data in the FIFO
+ *
+ * SVC_NUM_CHANNEL - number of channel supported by service layer driver
+ *
+ * FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS - claim back the submitted buffer(s)
+ * from the secure world for FPGA manager to reuse, or to free the buffer(s)
+ * when all bit-stream data had be send.
+ *
+ * FPGA_CONFIG_STATUS_TIMEOUT_SEC - poll the FPGA configuration status,
+ * service layer will return error to FPGA manager when timeout occurs,
+ * timeout is set to 30 seconds (30 * 1000) at Intel Stratix10 SoC.
+ */
+#define SVC_NUM_DATA_IN_FIFO                    32
+#define SVC_NUM_CHANNEL                         2
+#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS       200
+#define FPGA_CONFIG_STATUS_TIMEOUT_SEC          30
+
+typedef void (svc_invoke_fn)(unsigned long, unsigned long, unsigned long,
+                             unsigned long, unsigned long, unsigned long,
+                             unsigned long, unsigned long,
+                             struct arm_smccc_res *);
+struct stratix10_svc_chan;
+
+/**
+ * struct stratix10_svc_sh_memory - service shared memory structure
+ * @sync_complete: state for a completion
+ * @addr: physical address of shared memory block
+ * @size: size of shared memory block
+ * @invoke_fn: function to issue secure monitor or hypervisor call
+ *
+ * This struct is used to save physical address and size of shared memory
+ * block. The shared memory blocked is allocated by secure monitor software
+ * at secure world.
+ *
+ * Service layer driver uses the physical address and size to create a memory
+ * pool, then allocates data buffer from that memory pool for service client.
+ */
+struct stratix10_svc_sh_memory {
+        struct completion sync_complete;
+        unsigned long addr;
+        unsigned long size;
+        svc_invoke_fn *invoke_fn;
+};
+
+/**
+ * struct stratix10_svc_data_mem - service memory structure
+ * @vaddr: virtual address
+ * @paddr: physical address
+ * @size: size of memory
+ * @node: link list head node
+ *
+ * This struct is used in a list that keeps track of buffers which have
+ * been allocated or freed from the memory pool. Service layer driver also
+ * uses this struct to transfer physical address to virtual address.
+ */
+struct stratix10_svc_data_mem {
+        void *vaddr;
+        phys_addr_t paddr;
+        size_t size;
+        struct list_head node;
+};
+
+/**
+ * struct stratix10_svc_data - service data structure
+ * @chan: service channel
+ * @paddr: playload physical address
+ * @size: playload size
+ * @command: service command requested by client
+ * @flag: configuration type (full or partial)
+ * @arg: args to be passed via registers and not physically mapped buffers
+ *
+ * This struct is used in service FIFO for inter-process communication.
+ */
+struct stratix10_svc_data {
+        struct stratix10_svc_chan *chan;
+        phys_addr_t paddr;
+        size_t size;
+        u32 command;
+        u32 flag;
+        u64 arg[3];
+};
+
+/**
+ * struct stratix10_svc_controller - service controller
+ * @dev: device
+ * @chans: array of service channels
+ * @num_chans: number of channels in 'chans' array
+ * @num_active_client: number of active service client
+ * @node: list management
+ * @genpool: memory pool pointing to the memory region
+ * @task: pointer to the thread task which handles SMC or HVC call
+ * @svc_fifo: a queue for storing service message data
+ * @complete_status: state for completion
+ * @svc_fifo_lock: protect access to service message data queue
+ * @invoke_fn: function to issue secure monitor call or hypervisor call
+ *
+ * This struct is used to create communication channels for service clients, to
+ * handle secure monitor or hypervisor call.
+ */
+struct stratix10_svc_controller {
+        struct device *dev;
+        struct stratix10_svc_chan *chans;
+        int num_chans;
+        int num_active_client;
+        struct list_head node;
+        struct gen_pool *genpool;
+        struct task_struct *task;
+        struct kfifo svc_fifo;
+        struct completion complete_status;
+        spinlock_t svc_fifo_lock;
+        svc_invoke_fn *invoke_fn;
+};
+
+/**
+ * struct stratix10_svc_chan - service communication channel
+ * @ctrl: pointer to service controller which is the provider of this channel
+ * @scl: pointer to service client which owns the channel
+ * @name: service client name associated with the channel
+ * @lock: protect access to the channel
+ *
+ * This struct is used by service client to communicate with service layer, each
+ * service client has its own channel created by service controller.
+ */
+struct stratix10_svc_chan {
+        struct stratix10_svc_controller *ctrl;
+        struct stratix10_svc_client *scl;
+        char *name;
+        spinlock_t lock;
+};
+
+static LIST_HEAD(svc_ctrl);
+static LIST_HEAD(svc_data_mem);
+
+/**
+ * svc_pa_to_va() - translate physical address to virtual address
+ * @addr: to be translated physical address
+ *
+ * Return: valid virtual address or NULL if the provided physical
+ * address doesn't exist.
+ */
+static void *svc_pa_to_va(unsigned long addr)
+{
+        struct stratix10_svc_data_mem *pmem;
+
+        pr_debug("claim back P-addr=0x%016x\n", (unsigned int)addr);
+        list_for_each_entry(pmem, &svc_data_mem, node)
+                if (pmem->paddr == addr)
+                        return pmem->vaddr;
+
+        /* physical address is not found */
+        return NULL;
+}
+
+/**
+ * svc_thread_cmd_data_claim() - claim back buffer from the secure world
+ * @ctrl: pointer to service layer controller
+ * @p_data: pointer to service data structure
+ * @cb_data: pointer to callback data structure to service client
+ *
+ * Claim back the submitted buffers from the secure world and pass buffer
+ * back to service client (FPGA manager, etc) for reuse.
+ */
+static void svc_thread_cmd_data_claim(struct stratix10_svc_controller *ctrl,
+                                      struct stratix10_svc_data *p_data,
+                                      struct stratix10_svc_cb_data *cb_data)
+{
+        struct arm_smccc_res res;
+        unsigned long timeout;
+
+        reinit_completion(&ctrl->complete_status);
+        timeout = msecs_to_jiffies(FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS);
+
+        pr_debug("%s: claim back the submitted buffer\n", __func__);
+        do {
+                ctrl->invoke_fn(INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE,
+                                0, 0, 0, 0, 0, 0, 0, &res);
+
+                if (res.a0 == INTEL_SIP_SMC_STATUS_OK) {
+                        if (!res.a1) {
+                                complete(&ctrl->complete_status);
+                                break;
+                        }
+                        cb_data->status = BIT(SVC_STATUS_RECONFIG_BUFFER_DONE);
+                        cb_data->kaddr1 = svc_pa_to_va(res.a1);
+                        cb_data->kaddr2 = (res.a2) ?
+                                          svc_pa_to_va(res.a2) : NULL;
+                        cb_data->kaddr3 = (res.a3) ?
+                                          svc_pa_to_va(res.a3) : NULL;
+                        p_data->chan->scl->receive_cb(p_data->chan->scl,
+                                                      cb_data);
+                } else {
+                        pr_debug("%s: secure world busy, polling again\n",
+                                 __func__);
+                }
+        } while (res.a0 == INTEL_SIP_SMC_STATUS_OK ||
+                 res.a0 == INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY ||
+                 wait_for_completion_timeout(&ctrl->complete_status, timeout));
+}
+
+/**
+ * svc_thread_cmd_config_status() - check configuration status
+ * @ctrl: pointer to service layer controller
+ * @p_data: pointer to service data structure
+ * @cb_data: pointer to callback data structure to service client
+ *
+ * Check whether the secure firmware at secure world has finished the FPGA
+ * configuration, and then inform FPGA manager the configuration status.
+ */
+static void svc_thread_cmd_config_status(struct stratix10_svc_controller *ctrl,
+                                         struct stratix10_svc_data *p_data,
+                                         struct stratix10_svc_cb_data *cb_data)
+{
+        struct arm_smccc_res res;
+        int count_in_sec;
+
+        cb_data->kaddr1 = NULL;
+        cb_data->kaddr2 = NULL;
+        cb_data->kaddr3 = NULL;
+        cb_data->status = BIT(SVC_STATUS_RECONFIG_ERROR);
+
+        pr_debug("%s: polling config status\n", __func__);
+
+        count_in_sec = FPGA_CONFIG_STATUS_TIMEOUT_SEC;
+        while (count_in_sec) {
+                ctrl->invoke_fn(INTEL_SIP_SMC_FPGA_CONFIG_ISDONE,
+                                0, 0, 0, 0, 0, 0, 0, &res);
+                if ((res.a0 == INTEL_SIP_SMC_STATUS_OK) ||
+                    (res.a0 == INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR))
+                        break;
+
+                /*
+                 * configuration is still in progress, wait one second then
+                 * poll again
+                 */
+                msleep(1000);
+                count_in_sec--;
+        };
+
+        if (res.a0 == INTEL_SIP_SMC_STATUS_OK && count_in_sec)
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_COMPLETED);
+
+        p_data->chan->scl->receive_cb(p_data->chan->scl, cb_data);
+}
+
+/**
+ * svc_thread_recv_status_ok() - handle the successful status
+ * @p_data: pointer to service data structure
+ * @cb_data: pointer to callback data structure to service client
+ * @res: result from SMC or HVC call
+ *
+ * Send back the correspond status to the service clients.
+ */
+static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
+                                      struct stratix10_svc_cb_data *cb_data,
+                                      struct arm_smccc_res res)
+{
+        cb_data->kaddr1 = NULL;
+        cb_data->kaddr2 = NULL;
+        cb_data->kaddr3 = NULL;
+
+        switch (p_data->command) {
+        case COMMAND_RECONFIG:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_REQUEST_OK);
+                break;
+        case COMMAND_RECONFIG_DATA_SUBMIT:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED);
+                break;
+        case COMMAND_NOOP:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED);
+                cb_data->kaddr1 = svc_pa_to_va(res.a1);
+                break;
+        case COMMAND_RECONFIG_STATUS:
+                cb_data->status = BIT(SVC_STATUS_RECONFIG_COMPLETED);
+                break;
+        case COMMAND_RSU_UPDATE:
+                cb_data->status = BIT(SVC_STATUS_RSU_OK);
+                break;
+        default:
+                pr_warn("it shouldn't happen\n");
+                break;
+        }
+
+        pr_debug("%s: call receive_cb\n", __func__);
+        p_data->chan->scl->receive_cb(p_data->chan->scl, cb_data);
+}
+
+/**
+ * svc_normal_to_secure_thread() - the function to run in the kthread
+ * @data: data pointer for kthread function
+ *
+ * Service layer driver creates stratix10_svc_smc_hvc_call kthread on CPU
+ * node 0, its function stratix10_svc_secure_call_thread is used to handle
+ * SMC or HVC calls between kernel driver and secure monitor software.
+ *
+ * Return: 0 for success or -ENOMEM on error.
+ */
+static int svc_normal_to_secure_thread(void *data)
+{
+        struct stratix10_svc_controller
+                        *ctrl = (struct stratix10_svc_controller *)data;
+        struct stratix10_svc_data *pdata;
+        struct stratix10_svc_cb_data *cbdata;
+        struct arm_smccc_res res;
+        unsigned long a0, a1, a2;
+        int ret_fifo = 0;
+
+        pdata =  kmalloc(sizeof(*pdata), GFP_KERNEL);
+        if (!pdata)
+                return -ENOMEM;
+
+        cbdata = kmalloc(sizeof(*cbdata), GFP_KERNEL);
+        if (!cbdata) {
+                kfree(pdata);
+                return -ENOMEM;
+        }
+
+        /* default set, to remove build warning */
+        a0 = INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK;
+        a1 = 0;
+        a2 = 0;
+
+        pr_debug("smc_hvc_shm_thread is running\n");
+
+        while (!kthread_should_stop()) {
+                ret_fifo = kfifo_out_spinlocked(&ctrl->svc_fifo,
+                                                pdata, sizeof(*pdata),
+                                                &ctrl->svc_fifo_lock);
+
+                if (!ret_fifo)
+                        continue;
+
+                pr_debug("get from FIFO pa=0x%016x, command=%u, size=%u\n",
+                         (unsigned int)pdata->paddr, pdata->command,
+                         (unsigned int)pdata->size);
+
+                switch (pdata->command) {
+                case COMMAND_RECONFIG_DATA_CLAIM:
+                        svc_thread_cmd_data_claim(ctrl, pdata, cbdata);
+                        continue;
+                case COMMAND_RECONFIG:
+                        a0 = INTEL_SIP_SMC_FPGA_CONFIG_START;
+                        pr_debug("conf_type=%u\n", (unsigned int)pdata->flag);
+                        a1 = pdata->flag;
+                        a2 = 0;
+                        break;
+                case COMMAND_RECONFIG_DATA_SUBMIT:
+                        a0 = INTEL_SIP_SMC_FPGA_CONFIG_WRITE;
+                        a1 = (unsigned long)pdata->paddr;
+                        a2 = (unsigned long)pdata->size;
+                        break;
+                case COMMAND_RECONFIG_STATUS:
+                        a0 = INTEL_SIP_SMC_FPGA_CONFIG_ISDONE;
+                        a1 = 0;
+                        a2 = 0;
+                        break;
+                case COMMAND_RSU_STATUS:
+                        a0 = INTEL_SIP_SMC_RSU_STATUS;
+                        a1 = 0;
+                        a2 = 0;
+                        break;
+                case COMMAND_RSU_UPDATE:
+                        a0 = INTEL_SIP_SMC_RSU_UPDATE;
+                        a1 = pdata->arg[0];
+                        a2 = 0;
+                        break;
+                default:
+                        pr_warn("it shouldn't happen\n");
+                        break;
+                }
+                pr_debug("%s: before SMC call -- a0=0x%016x a1=0x%016x",
+                         __func__, (unsigned int)a0, (unsigned int)a1);
+                pr_debug(" a2=0x%016x\n", (unsigned int)a2);
+
+                ctrl->invoke_fn(a0, a1, a2, 0, 0, 0, 0, 0, &res);
+
+                pr_debug("%s: after SMC call -- res.a0=0x%016x",
+                         __func__, (unsigned int)res.a0);
+                pr_debug(" res.a1=0x%016x, res.a2=0x%016x",
+                         (unsigned int)res.a1, (unsigned int)res.a2);
+                pr_debug(" res.a3=0x%016x\n", (unsigned int)res.a3);
+
+                if (pdata->command == COMMAND_RSU_STATUS) {
+                        if (res.a0 == INTEL_SIP_SMC_RSU_ERROR)
+                                cbdata->status = BIT(SVC_STATUS_RSU_ERROR);
+                        else
+                                cbdata->status = BIT(SVC_STATUS_RSU_OK);
+
+                        cbdata->kaddr1 = &res;
+                        cbdata->kaddr2 = NULL;
+                        cbdata->kaddr3 = NULL;
+                        pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);
+                        continue;
+                }
+
+                switch (res.a0) {
+                case INTEL_SIP_SMC_STATUS_OK:
+                        svc_thread_recv_status_ok(pdata, cbdata, res);
+                        break;
+                case INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY:
+                        switch (pdata->command) {
+                        case COMMAND_RECONFIG_DATA_SUBMIT:
+                                svc_thread_cmd_data_claim(ctrl,
+                                                          pdata, cbdata);
+                                break;
+                        case COMMAND_RECONFIG_STATUS:
+                                svc_thread_cmd_config_status(ctrl,
+                                                             pdata, cbdata);
+                                break;
+                        default:
+                                pr_warn("it shouldn't happen\n");
+                                break;
+                        }
+                        break;
+                case INTEL_SIP_SMC_FPGA_CONFIG_STATUS_REJECTED:
+                        pr_debug("%s: STATUS_REJECTED\n", __func__);
+                        break;
+                case INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR:
+                        pr_err("%s: STATUS_ERROR\n", __func__);
+                        cbdata->status = BIT(SVC_STATUS_RECONFIG_ERROR);
+                        cbdata->kaddr1 = NULL;
+                        cbdata->kaddr2 = NULL;
+                        cbdata->kaddr3 = NULL;
+                        pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);
+                        break;
+                default:
+                        pr_warn("it shouldn't happen\n");
+                        break;
+                }
+        };
+
+        kfree(cbdata);
+        kfree(pdata);
+
+        return 0;
+}
+
+/**
+ * svc_normal_to_secure_shm_thread() - the function to run in the kthread
+ * @data: data pointer for kthread function
+ *
+ * Service layer driver creates stratix10_svc_smc_hvc_shm kthread on CPU
+ * node 0, its function stratix10_svc_secure_shm_thread is used to query the
+ * physical address of memory block reserved by secure monitor software at
+ * secure world.
+ *
+ * svc_normal_to_secure_shm_thread() calls do_exit() directly since it is a
+ * standlone thread for which no one will call kthread_stop() or return when
+ * 'kthread_should_stop()' is true.
+ */
+static int svc_normal_to_secure_shm_thread(void *data)
+{
+        struct stratix10_svc_sh_memory
+                        *sh_mem = (struct stratix10_svc_sh_memory *)data;
+        struct arm_smccc_res res;
+
+        /* SMC or HVC call to get shared memory info from secure world */
+        sh_mem->invoke_fn(INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM,
+                          0, 0, 0, 0, 0, 0, 0, &res);
+        if (res.a0 == INTEL_SIP_SMC_STATUS_OK) {
+                sh_mem->addr = res.a1;
+                sh_mem->size = res.a2;
+        } else {
+                pr_err("%s: after SMC call -- res.a0=0x%016x",  __func__,
+                       (unsigned int)res.a0);
+                sh_mem->addr = 0;
+                sh_mem->size = 0;
+        }
+
+        complete(&sh_mem->sync_complete);
+        do_exit(0);
+}
+
+/**
+ * svc_get_sh_memory() - get memory block reserved by secure monitor SW
+ * @pdev: pointer to service layer device
+ * @sh_memory: pointer to service shared memory structure
+ *
+ * Return: zero for successfully getting the physical address of memory block
+ * reserved by secure monitor software, or negative value on error.
+ */
+static int svc_get_sh_memory(struct platform_device *pdev,
+                                    struct stratix10_svc_sh_memory *sh_memory)
+{
+        struct device *dev = &pdev->dev;
+        struct task_struct *sh_memory_task;
+        unsigned int cpu = 0;
+
+        init_completion(&sh_memory->sync_complete);
+
+        /* smc or hvc call happens on cpu 0 bound kthread */
+        sh_memory_task = kthread_create_on_node(svc_normal_to_secure_shm_thread,
+                                               (void *)sh_memory,
+                                                cpu_to_node(cpu),
+                                                "svc_smc_hvc_shm_thread");
+        if (IS_ERR(sh_memory_task)) {
+                dev_err(dev, "fail to create stratix10_svc_smc_shm_thread\n");
+                return -EINVAL;
+        }
+
+        wake_up_process(sh_memory_task);
+
+        if (!wait_for_completion_timeout(&sh_memory->sync_complete, 10 * HZ)) {
+                dev_err(dev,
+                        "timeout to get sh-memory paras from secure world\n");
+                return -ETIMEDOUT;
+        }
+
+        if (!sh_memory->addr || !sh_memory->size) {
+                dev_err(dev,
+                        "fails to get shared memory info from secure world\n");
+                return -ENOMEM;
+        }
+
+        dev_dbg(dev, "SM software provides paddr: 0x%016x, size: 0x%08x\n",
+                (unsigned int)sh_memory->addr,
+                (unsigned int)sh_memory->size);
+
+        return 0;
+}
+
+/**
+ * svc_create_memory_pool() - create a memory pool from reserved memory block
+ * @pdev: pointer to service layer device
+ * @sh_memory: pointer to service shared memory structure
+ *
+ * Return: pool allocated from reserved memory block or ERR_PTR() on error.
+ */
+static struct gen_pool *
+svc_create_memory_pool(struct platform_device *pdev,
+                       struct stratix10_svc_sh_memory *sh_memory)
+{
+        struct device *dev = &pdev->dev;
+        struct gen_pool *genpool;
+        unsigned long vaddr;
+        phys_addr_t paddr;
+        size_t size;
+        phys_addr_t begin;
+        phys_addr_t end;
+        void *va;
+        size_t page_mask = PAGE_SIZE - 1;
+        int min_alloc_order = 3;
+        int ret;
+
+        begin = roundup(sh_memory->addr, PAGE_SIZE);
+        end = rounddown(sh_memory->addr + sh_memory->size, PAGE_SIZE);
+        paddr = begin;
+        size = end - begin;
+        va = memremap(paddr, size, MEMREMAP_WC);
+        if (!va) {
+                dev_err(dev, "fail to remap shared memory\n");
+                return ERR_PTR(-EINVAL);
+        }
+        vaddr = (unsigned long)va;
+        dev_dbg(dev,
+                "reserved memory vaddr: %p, paddr: 0x%16x size: 0x%8x\n",
+                va, (unsigned int)paddr, (unsigned int)size);
+        if ((vaddr & page_mask) || (paddr & page_mask) ||
+            (size & page_mask)) {
+                dev_err(dev, "page is not aligned\n");
+                return ERR_PTR(-EINVAL);
+        }
+        genpool = gen_pool_create(min_alloc_order, -1);
+        if (!genpool) {
+                dev_err(dev, "fail to create genpool\n");
+                return ERR_PTR(-ENOMEM);
+        }
+        gen_pool_set_algo(genpool, gen_pool_best_fit, NULL);
+        ret = gen_pool_add_virt(genpool, vaddr, paddr, size, -1);
+        if (ret) {
+                dev_err(dev, "fail to add memory chunk to the pool\n");
+                gen_pool_destroy(genpool);
+                return ERR_PTR(ret);
+        }
+
+        return genpool;
+}
+
+/**
+ * svc_smccc_smc() - secure monitor call between normal and secure world
+ * @a0: argument passed in registers 0
+ * @a1: argument passed in registers 1
+ * @a2: argument passed in registers 2
+ * @a3: argument passed in registers 3
+ * @a4: argument passed in registers 4
+ * @a5: argument passed in registers 5
+ * @a6: argument passed in registers 6
+ * @a7: argument passed in registers 7
+ * @res: result values from register 0 to 3
+ */
+static void svc_smccc_smc(unsigned long a0, unsigned long a1,
+                          unsigned long a2, unsigned long a3,
+                          unsigned long a4, unsigned long a5,
+                          unsigned long a6, unsigned long a7,
+                          struct arm_smccc_res *res)
+{
+        arm_smccc_smc(a0, a1, a2, a3, a4, a5, a6, a7, res);
+}
+
+/**
+ * svc_smccc_hvc() - hypervisor call between normal and secure world
+ * @a0: argument passed in registers 0
+ * @a1: argument passed in registers 1
+ * @a2: argument passed in registers 2
+ * @a3: argument passed in registers 3
+ * @a4: argument passed in registers 4
+ * @a5: argument passed in registers 5
+ * @a6: argument passed in registers 6
+ * @a7: argument passed in registers 7
+ * @res: result values from register 0 to 3
+ */
+static void svc_smccc_hvc(unsigned long a0, unsigned long a1,
+                          unsigned long a2, unsigned long a3,
+                          unsigned long a4, unsigned long a5,
+                          unsigned long a6, unsigned long a7,
+                          struct arm_smccc_res *res)
+{
+        arm_smccc_hvc(a0, a1, a2, a3, a4, a5, a6, a7, res);
+}
+
+/**
+ * get_invoke_func() - invoke SMC or HVC call
+ * @dev: pointer to device
+ *
+ * Return: function pointer to svc_smccc_smc or svc_smccc_hvc.
+ */
+static svc_invoke_fn *get_invoke_func(struct device *dev)
+{
+        const char *method;
+
+        if (of_property_read_string(dev->of_node, "method", &method)) {
+                dev_warn(dev, "missing \"method\" property\n");
+                return ERR_PTR(-ENXIO);
+        }
+
+        if (!strcmp(method, "smc"))
+                return svc_smccc_smc;
+        if (!strcmp(method, "hvc"))
+                return svc_smccc_hvc;
+
+        dev_warn(dev, "invalid \"method\" property: %s\n", method);
+
+        return ERR_PTR(-EINVAL);
+}
+
+/**
+ * stratix10_svc_request_channel_byname() - request a service channel
+ * @client: pointer to service client
+ * @name: service client name
+ *
+ * This function is used by service client to request a service channel.
+ *
+ * Return: a pointer to channel assigned to the client on success,
+ * or ERR_PTR() on error.
+ */
+struct stratix10_svc_chan *stratix10_svc_request_channel_byname(
+        struct stratix10_svc_client *client, const char *name)
+{
+        struct device *dev = client->dev;
+        struct stratix10_svc_controller *controller;
+        struct stratix10_svc_chan *chan = NULL;
+        unsigned long flag;
+        int i;
+
+        /* if probe was called after client's, or error on probe */
+        if (list_empty(&svc_ctrl))
+                return ERR_PTR(-EPROBE_DEFER);
+
+        controller = list_first_entry(&svc_ctrl,
+                                      struct stratix10_svc_controller, node);
+        for (i = 0; i < SVC_NUM_CHANNEL; i++) {
+                if (!strcmp(controller->chans[i].name, name)) {
+                        chan = &controller->chans[i];
+                        break;
+                }
+        }
+
+        /* if there was no channel match */
+        if (i == SVC_NUM_CHANNEL) {
+                dev_err(dev, "%s: channel not allocated\n", __func__);
+                return ERR_PTR(-EINVAL);
+        }
+
+        if (chan->scl || !try_module_get(controller->dev->driver->owner)) {
+                dev_dbg(dev, "%s: svc not free\n", __func__);
+                return ERR_PTR(-EBUSY);
+        }
+
+        spin_lock_irqsave(&chan->lock, flag);
+        chan->scl = client;
+        chan->ctrl->num_active_client++;
+        spin_unlock_irqrestore(&chan->lock, flag);
+
+        return chan;
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_request_channel_byname);
+
+/**
+ * stratix10_svc_free_channel() - free service channel
+ * @chan: service channel to be freed
+ *
+ * This function is used by service client to free a service channel.
+ */
+void stratix10_svc_free_channel(struct stratix10_svc_chan *chan)
+{
+        unsigned long flag;
+
+        spin_lock_irqsave(&chan->lock, flag);
+        chan->scl = NULL;
+        chan->ctrl->num_active_client--;
+        module_put(chan->ctrl->dev->driver->owner);
+        spin_unlock_irqrestore(&chan->lock, flag);
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_free_channel);
+
+/**
+ * stratix10_svc_send() - send a message data to the remote
+ * @chan: service channel assigned to the client
+ * @msg: message data to be sent, in the format of
+ * "struct stratix10_svc_client_msg"
+ *
+ * This function is used by service client to add a message to the service
+ * layer driver's queue for being sent to the secure world.
+ *
+ * Return: 0 for success, -ENOMEM or -ENOBUFS on error.
+ */
+int stratix10_svc_send(struct stratix10_svc_chan *chan, void *msg)
+{
+        struct stratix10_svc_client_msg
+                *p_msg = (struct stratix10_svc_client_msg *)msg;
+        struct stratix10_svc_data_mem *p_mem;
+        struct stratix10_svc_data *p_data;
+        int ret = 0;
+        unsigned int cpu = 0;
+
+        p_data = kzalloc(sizeof(*p_data), GFP_KERNEL);
+        if (!p_data)
+                return -ENOMEM;
+
+        /* first client will create kernel thread */
+        if (!chan->ctrl->task) {
+                chan->ctrl->task =
+                        kthread_create_on_node(svc_normal_to_secure_thread,
+                                              (void *)chan->ctrl,
+                                              cpu_to_node(cpu),
+                                              "svc_smc_hvc_thread");
+                        if (IS_ERR(chan->ctrl->task)) {
+                                dev_err(chan->ctrl->dev,
+                                        "fails to create svc_smc_hvc_thread\n");
+                                kfree(p_data);
+                                return -EINVAL;
+                        }
+                kthread_bind(chan->ctrl->task, cpu);
+                wake_up_process(chan->ctrl->task);
+        }
+
+        pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,
+                 p_msg->payload, p_msg->command,
+                 (unsigned int)p_msg->payload_length);
+
+        if (list_empty(&svc_data_mem)) {
+                if (p_msg->command == COMMAND_RECONFIG) {
+                        struct stratix10_svc_command_config_type *ct =
+                                (struct stratix10_svc_command_config_type *)
+                                p_msg->payload;
+                        p_data->flag = ct->flags;
+                }
+        } else {
+                list_for_each_entry(p_mem, &svc_data_mem, node)
+                        if (p_mem->vaddr == p_msg->payload) {
+                                p_data->paddr = p_mem->paddr;
+                                break;
+                        }
+        }
+
+        p_data->command = p_msg->command;
+        p_data->arg[0] = p_msg->arg[0];
+        p_data->arg[1] = p_msg->arg[1];
+        p_data->arg[2] = p_msg->arg[2];
+        p_data->size = p_msg->payload_length;
+        p_data->chan = chan;
+        pr_debug("%s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n", __func__,
+               (unsigned int)p_data->paddr, p_data->command,
+               (unsigned int)p_data->size);
+        ret = kfifo_in_spinlocked(&chan->ctrl->svc_fifo, p_data,
+                                  sizeof(*p_data),
+                                  &chan->ctrl->svc_fifo_lock);
+
+        kfree(p_data);
+
+        if (!ret)
+                return -ENOBUFS;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_send);
+
+/**
+ * stratix10_svc_done() - complete service request transactions
+ * @chan: service channel assigned to the client
+ *
+ * This function should be called when client has finished its request
+ * or there is an error in the request process. It allows the service layer
+ * to stop the running thread to have maximize savings in kernel resources.
+ */
+void stratix10_svc_done(struct stratix10_svc_chan *chan)
+{
+        /* stop thread when thread is running AND only one active client */
+        if (chan->ctrl->task && chan->ctrl->num_active_client <= 1) {
+                pr_debug("svc_smc_hvc_shm_thread is stopped\n");
+                kthread_stop(chan->ctrl->task);
+                chan->ctrl->task = NULL;
+        }
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_done);
+
+/**
+ * stratix10_svc_allocate_memory() - allocate memory
+ * @chan: service channel assigned to the client
+ * @size: memory size requested by a specific service client
+ *
+ * Service layer allocates the requested number of bytes buffer from the
+ * memory pool, service client uses this function to get allocated buffers.
+ *
+ * Return: address of allocated memory on success, or ERR_PTR() on error.
+ */
+void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
+                                    size_t size)
+{
+        struct stratix10_svc_data_mem *pmem;
+        unsigned long va;
+        phys_addr_t pa;
+        struct gen_pool *genpool = chan->ctrl->genpool;
+        size_t s = roundup(size, 1 << genpool->min_alloc_order);
+
+        pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+        if (!pmem)
+                return ERR_PTR(-ENOMEM);
+
+        va = gen_pool_alloc(genpool, s);
+        if (!va)
+                return ERR_PTR(-ENOMEM);
+
+        memset((void *)va, 0, s);
+        pa = gen_pool_virt_to_phys(genpool, va);
+
+        pmem->vaddr = (void *)va;
+        pmem->paddr = pa;
+        pmem->size = s;
+        list_add_tail(&pmem->node, &svc_data_mem);
+        pr_debug("%s: va=%p, pa=0x%016x\n", __func__,
+                 pmem->vaddr, (unsigned int)pmem->paddr);
+
+        return (void *)va;
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
+
+/**
+ * stratix10_svc_free_memory() - free allocated memory
+ * @chan: service channel assigned to the client
+ * @kaddr: memory to be freed
+ *
+ * This function is used by service client to free allocated buffers.
+ */
+void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
+{
+        struct stratix10_svc_data_mem *pmem;
+        size_t size = 0;
+
+        list_for_each_entry(pmem, &svc_data_mem, node)
+                if (pmem->vaddr == kaddr) {
+                        size = pmem->size;
+                        break;
+                }
+
+        gen_pool_free(chan->ctrl->genpool, (unsigned long)kaddr, size);
+        pmem->vaddr = NULL;
+        list_del(&pmem->node);
+}
+EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
+
+static const struct of_device_id stratix10_svc_drv_match[] = {
+        {.compatible = "intel,stratix10-svc"},
+        {},
+};
+
+static int stratix10_svc_drv_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct stratix10_svc_controller *controller;
+        struct stratix10_svc_chan *chans;
+        struct gen_pool *genpool;
+        struct stratix10_svc_sh_memory *sh_memory;
+        svc_invoke_fn *invoke_fn;
+        size_t fifo_size;
+        int ret;
+
+        /* get SMC or HVC function */
+        invoke_fn = get_invoke_func(dev);
+        if (IS_ERR(invoke_fn))
+                return -EINVAL;
+
+        sh_memory = devm_kzalloc(dev, sizeof(*sh_memory), GFP_KERNEL);
+        if (!sh_memory)
+                return -ENOMEM;
+
+        sh_memory->invoke_fn = invoke_fn;
+        ret = svc_get_sh_memory(pdev, sh_memory);
+        if (ret)
+                return ret;
+
+        genpool = svc_create_memory_pool(pdev, sh_memory);
+        if (!genpool)
+                return -ENOMEM;
+
+        /* allocate service controller and supporting channel */
+        controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
+        if (!controller)
+                return -ENOMEM;
+
+        chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL,
+                                   sizeof(*chans), GFP_KERNEL | __GFP_ZERO);
+        if (!chans)
+                return -ENOMEM;
+
+        controller->dev = dev;
+        controller->num_chans = SVC_NUM_CHANNEL;
+        controller->num_active_client = 0;
+        controller->chans = chans;
+        controller->genpool = genpool;
+        controller->task = NULL;
+        controller->invoke_fn = invoke_fn;
+        init_completion(&controller->complete_status);
+
+        fifo_size = sizeof(struct stratix10_svc_data) * SVC_NUM_DATA_IN_FIFO;
+        ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL);
+        if (ret) {
+                dev_err(dev, "fails to allocate FIFO\n");
+                return ret;
+        }
+        spin_lock_init(&controller->svc_fifo_lock);
+
+        chans[0].scl = NULL;
+        chans[0].ctrl = controller;
+        chans[0].name = SVC_CLIENT_FPGA;
+        spin_lock_init(&chans[0].lock);
+
+        chans[1].scl = NULL;
+        chans[1].ctrl = controller;
+        chans[1].name = SVC_CLIENT_RSU;
+        spin_lock_init(&chans[1].lock);
+
+        list_add_tail(&controller->node, &svc_ctrl);
+        platform_set_drvdata(pdev, controller);
+
+        pr_info("Intel Service Layer Driver Initialized\n");
+
+        return ret;
+}
+
+static int stratix10_svc_drv_remove(struct platform_device *pdev)
+{
+        struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
+
+        kfifo_free(&ctrl->svc_fifo);
+        if (ctrl->task) {
+                kthread_stop(ctrl->task);
+                ctrl->task = NULL;
+        }
+        if (ctrl->genpool)
+                gen_pool_destroy(ctrl->genpool);
+        list_del(&ctrl->node);
+
+        return 0;
+}
+
+static struct platform_driver stratix10_svc_driver = {
+        .probe = stratix10_svc_drv_probe,
+        .remove = stratix10_svc_drv_remove,
+        .driver = {
+                .name = "stratix10-svc",
+                .of_match_table = stratix10_svc_drv_match,
+        },
+};
+
+static int __init stratix10_svc_init(void)
+{
+        struct device_node *fw_np;
+        struct device_node *np;
+        int ret;
+
+        fw_np = of_find_node_by_name(NULL, "firmware");
+        if (!fw_np)
+                return -ENODEV;
+
+        np = of_find_matching_node(fw_np, stratix10_svc_drv_match);
+        if (!np)
+                return -ENODEV;
+
+        of_node_put(np);
+        ret = of_platform_populate(fw_np, stratix10_svc_drv_match, NULL, NULL);
+        if (ret)
+                return ret;
+
+        return platform_driver_register(&stratix10_svc_driver);
+}
+
+static void __exit stratix10_svc_exit(void)
+{
+        return platform_driver_unregister(&stratix10_svc_driver);
+}
+
+subsys_initcall(stratix10_svc_init);
+module_exit(stratix10_svc_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Intel Stratix10 Service Layer Driver");
+MODULE_AUTHOR("Richard Gong <richard.gong@intel.com>");
+MODULE_ALIAS("platform:stratix10-svc");
diff --git a/drivers/fpga/Kconfig b/drivers/fpga/Kconfig
index 1ebcef4bab5b..0bb7b5cd6cdc 100644
--- a/drivers/fpga/Kconfig
+++ b/drivers/fpga/Kconfig
@@ -56,6 +56,12 @@ config FPGA_MGR_ZYNQ_FPGA
         help
           FPGA manager driver support for Xilinx Zynq FPGAs.
 
+config FPGA_MGR_STRATIX10_SOC
+        tristate "Intel Stratix10 SoC FPGA Manager"
+        depends on (ARCH_STRATIX10 && INTEL_STRATIX10_SERVICE)
+        help
+          FPGA manager driver support for the Intel Stratix10 SoC.
+
 config FPGA_MGR_XILINX_SPI
         tristate "Xilinx Configuration over Slave Serial (SPI)"
         depends on SPI
diff --git a/drivers/fpga/Makefile b/drivers/fpga/Makefile
index 7a2d73ba7122..c0dd4c82fbdb 100644
--- a/drivers/fpga/Makefile
+++ b/drivers/fpga/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_FPGA_MGR_ICE40_SPI)	+= ice40-spi.o
 obj-$(CONFIG_FPGA_MGR_MACHXO2_SPI)      += machxo2-spi.o
 obj-$(CONFIG_FPGA_MGR_SOCFPGA)          += socfpga.o
 obj-$(CONFIG_FPGA_MGR_SOCFPGA_A10)      += socfpga-a10.o
+obj-$(CONFIG_FPGA_MGR_STRATIX10_SOC)    += stratix10-soc.o
 obj-$(CONFIG_FPGA_MGR_TS73XX)           += ts73xx-fpga.o
 obj-$(CONFIG_FPGA_MGR_XILINX_SPI)       += xilinx-spi.o
 obj-$(CONFIG_FPGA_MGR_ZYNQ_FPGA)        += zynq-fpga.o
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 610a1558e0ed..35c3aa5792e2 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -403,6 +403,7 @@ static int altera_cvp_probe(struct pci_dev *pdev,
         struct altera_cvp_conf *conf;
         struct fpga_manager *mgr;
         u16 cmd, val;
+        u32 regval;
         int ret;
 
         /*
@@ -416,6 +417,14 @@ static int altera_cvp_probe(struct pci_dev *pdev,
                 return -ENODEV;
         }
 
+        pci_read_config_dword(pdev, VSE_CVP_STATUS, &regval);
+        if (!(regval & VSE_CVP_STATUS_CVP_EN)) {
+                dev_err(&pdev->dev,
+                        "CVP is disabled for this device: CVP_STATUS Reg 0x%x\n",
+                        regval);
+                return -ENODEV;
+        }
+
         conf = devm_kzalloc(&pdev->dev, sizeof(*conf), GFP_KERNEL);
         if (!conf)
                 return -ENOMEM;
@@ -466,18 +475,11 @@ static int altera_cvp_probe(struct pci_dev *pdev,
         if (ret)
                 goto err_unmap;
 
-        ret = driver_create_file(&altera_cvp_driver.driver,
-                                 &driver_attr_chkcfg);
-        if (ret) {
-                dev_err(&pdev->dev, "Can't create sysfs chkcfg file\n");
-                fpga_mgr_unregister(mgr);
-                goto err_unmap;
-        }
-
         return 0;
 
 err_unmap:
-        pci_iounmap(pdev, conf->map);
+        if (conf->map)
+                pci_iounmap(pdev, conf->map);
         pci_release_region(pdev, CVP_BAR);
 err_disable:
         cmd &= ~PCI_COMMAND_MEMORY;
@@ -491,16 +493,39 @@ static void altera_cvp_remove(struct pci_dev *pdev)
         struct altera_cvp_conf *conf = mgr->priv;
         u16 cmd;
 
-        driver_remove_file(&altera_cvp_driver.driver, &driver_attr_chkcfg);
         fpga_mgr_unregister(mgr);
-        pci_iounmap(pdev, conf->map);
+        if (conf->map)
+                pci_iounmap(pdev, conf->map);
         pci_release_region(pdev, CVP_BAR);
         pci_read_config_word(pdev, PCI_COMMAND, &cmd);
         cmd &= ~PCI_COMMAND_MEMORY;
         pci_write_config_word(pdev, PCI_COMMAND, cmd);
 }
 
-module_pci_driver(altera_cvp_driver);
+static int __init altera_cvp_init(void)
+{
+        int ret;
+
+        ret = pci_register_driver(&altera_cvp_driver);
+        if (ret)
+                return ret;
+
+        ret = driver_create_file(&altera_cvp_driver.driver,
+                                 &driver_attr_chkcfg);
+        if (ret)
+                pr_warn("Can't create sysfs chkcfg file\n");
+
+        return 0;
+}
+
+static void __exit altera_cvp_exit(void)
+{
+        driver_remove_file(&altera_cvp_driver.driver, &driver_attr_chkcfg);
+        pci_unregister_driver(&altera_cvp_driver);
+}
+
+module_init(altera_cvp_init);
+module_exit(altera_cvp_exit);
 
 MODULE_LICENSE("GPL v2");
 MODULE_AUTHOR("Anatolij Gustschin <agust@denx.de>");
diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
index 33aafda50af5..8c18beec6b57 100644
--- a/drivers/fpga/altera-ps-spi.c
+++ b/drivers/fpga/altera-ps-spi.c
@@ -75,6 +75,12 @@ static struct altera_ps_data a10_data = {
         .t_st2ck_us = 10, /* min(t_ST2CK) */
 };
 
+/* Array index is enum altera_ps_devtype */
+static const struct altera_ps_data *altera_ps_data_map[] = {
+        &c5_data,
+        &a10_data,
+};
+
 static const struct of_device_id of_ef_match[] = {
         { .compatible = "altr,fpga-passive-serial", .data = &c5_data },
         { .compatible = "altr,fpga-arria10-passive-serial", .data = &a10_data },
@@ -234,6 +240,22 @@ static const struct fpga_manager_ops altera_ps_ops = {
         .write_complete = altera_ps_write_complete,
 };
 
+static const struct altera_ps_data *id_to_data(const struct spi_device_id *id)
+{
+        kernel_ulong_t devtype = id->driver_data;
+        const struct altera_ps_data *data;
+
+        /* someone added a altera_ps_devtype without adding to the map array */
+        if (devtype >= ARRAY_SIZE(altera_ps_data_map))
+                return NULL;
+
+        data = altera_ps_data_map[devtype];
+        if (!data || data->devtype != devtype)
+                return NULL;
+
+        return data;
+}
+
 static int altera_ps_probe(struct spi_device *spi)
 {
         struct altera_ps_conf *conf;
@@ -244,11 +266,17 @@ static int altera_ps_probe(struct spi_device *spi)
         if (!conf)
                 return -ENOMEM;
 
-        of_id = of_match_device(of_ef_match, &spi->dev);
-        if (!of_id)
-                return -ENODEV;
+        if (spi->dev.of_node) {
+                of_id = of_match_device(of_ef_match, &spi->dev);
+                if (!of_id)
+                        return -ENODEV;
+                conf->data = of_id->data;
+        } else {
+                conf->data = id_to_data(spi_get_device_id(spi));
+                if (!conf->data)
+                        return -ENODEV;
+        }
 
-        conf->data = of_id->data;
         conf->spi = spi;
         conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_LOW);
         if (IS_ERR(conf->config)) {
@@ -294,7 +322,9 @@ static int altera_ps_remove(struct spi_device *spi)
 }
 
 static const struct spi_device_id altera_ps_spi_ids[] = {
-        {"cyclone-ps-spi", 0},
+        { "cyclone-ps-spi", CYCLONE5 },
+        { "fpga-passive-serial", CYCLONE5 },
+        { "fpga-arria10-passive-serial", ARRIA10 },
         {}
 };
 MODULE_DEVICE_TABLE(spi, altera_ps_spi_ids);
diff --git a/drivers/fpga/dfl-fme-pr.c b/drivers/fpga/dfl-fme-pr.c
index 0b840531ef33..fe5a5578fbf7 100644
--- a/drivers/fpga/dfl-fme-pr.c
+++ b/drivers/fpga/dfl-fme-pr.c
@@ -444,10 +444,8 @@ static void pr_mgmt_uinit(struct platform_device *pdev,
                           struct dfl_feature *feature)
 {
         struct dfl_feature_platform_data *pdata = dev_get_platdata(&pdev->dev);
-        struct dfl_fme *priv;
 
         mutex_lock(&pdata->lock);
-        priv = dfl_fpga_pdata_get_private(pdata);
 
         dfl_fme_destroy_regions(pdata);
         dfl_fme_destroy_bridges(pdata);
diff --git a/drivers/fpga/dfl-fme-region.c b/drivers/fpga/dfl-fme-region.c
index ec134ec93f08..1eeb42af1012 100644
--- a/drivers/fpga/dfl-fme-region.c
+++ b/drivers/fpga/dfl-fme-region.c
@@ -64,7 +64,7 @@ eprobe_mgr_put:
 
 static int fme_region_remove(struct platform_device *pdev)
 {
-        struct fpga_region *region = dev_get_drvdata(&pdev->dev);
+        struct fpga_region *region = platform_get_drvdata(pdev);
         struct fpga_manager *mgr = region->mgr;
 
         fpga_region_unregister(region);
diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
index 122286fd255a..75f64abf9c81 100644
--- a/drivers/fpga/of-fpga-region.c
+++ b/drivers/fpga/of-fpga-region.c
@@ -421,7 +421,7 @@ static int of_fpga_region_probe(struct platform_device *pdev)
                 goto eprobe_mgr_put;
 
         of_platform_populate(np, fpga_region_of_match, NULL, &region->dev);
-        dev_set_drvdata(dev, region);
+        platform_set_drvdata(pdev, region);
 
         dev_info(dev, "FPGA Region probed\n");
 
diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
new file mode 100644
index 000000000000..a1a09e04fab8
--- /dev/null
+++ b/drivers/fpga/stratix10-soc.c
@@ -0,0 +1,535 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * FPGA Manager Driver for Intel Stratix10 SoC
+ *
+ *  Copyright (C) 2018 Intel Corporation
+ */
+#include <linux/completion.h>
+#include <linux/fpga/fpga-mgr.h>
+#include <linux/firmware/intel/stratix10-svc-client.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+
+/*
+ * FPGA programming requires a higher level of privilege (EL3), per the SoC
+ * design.
+ */
+#define NUM_SVC_BUFS    4
+#define SVC_BUF_SIZE    SZ_512K
+
+/* Indicates buffer is in use if set */
+#define SVC_BUF_LOCK    0
+
+#define S10_BUFFER_TIMEOUT (msecs_to_jiffies(SVC_RECONFIG_BUFFER_TIMEOUT_MS))
+#define S10_RECONFIG_TIMEOUT (msecs_to_jiffies(SVC_RECONFIG_REQUEST_TIMEOUT_MS))
+
+/*
+ * struct s10_svc_buf
+ * buf:  virtual address of buf provided by service layer
+ * lock: locked if buffer is in use
+ */
+struct s10_svc_buf {
+        char *buf;
+        unsigned long lock;
+};
+
+struct s10_priv {
+        struct stratix10_svc_chan *chan;
+        struct stratix10_svc_client client;
+        struct completion status_return_completion;
+        struct s10_svc_buf svc_bufs[NUM_SVC_BUFS];
+        unsigned long status;
+};
+
+static int s10_svc_send_msg(struct s10_priv *priv,
+                            enum stratix10_svc_command_code command,
+                            void *payload, u32 payload_length)
+{
+        struct stratix10_svc_chan *chan = priv->chan;
+        struct device *dev = priv->client.dev;
+        struct stratix10_svc_client_msg msg;
+        int ret;
+
+        dev_dbg(dev, "%s cmd=%d payload=%p length=%d\n",
+                __func__, command, payload, payload_length);
+
+        msg.command = command;
+        msg.payload = payload;
+        msg.payload_length = payload_length;
+
+        ret = stratix10_svc_send(chan, &msg);
+        dev_dbg(dev, "stratix10_svc_send returned status %d\n", ret);
+
+        return ret;
+}
+
+/*
+ * Free buffers allocated from the service layer's pool that are not in use.
+ * Return true when all buffers are freed.
+ */
+static bool s10_free_buffers(struct fpga_manager *mgr)
+{
+        struct s10_priv *priv = mgr->priv;
+        uint num_free = 0;
+        uint i;
+
+        for (i = 0; i < NUM_SVC_BUFS; i++) {
+                if (!priv->svc_bufs[i].buf) {
+                        num_free++;
+                        continue;
+                }
+
+                if (!test_and_set_bit_lock(SVC_BUF_LOCK,
+                                           &priv->svc_bufs[i].lock)) {
+                        stratix10_svc_free_memory(priv->chan,
+                                                  priv->svc_bufs[i].buf);
+                        priv->svc_bufs[i].buf = NULL;
+                        num_free++;
+                }
+        }
+
+        return num_free == NUM_SVC_BUFS;
+}
+
+/*
+ * Returns count of how many buffers are not in use.
+ */
+static uint s10_free_buffer_count(struct fpga_manager *mgr)
+{
+        struct s10_priv *priv = mgr->priv;
+        uint num_free = 0;
+        uint i;
+
+        for (i = 0; i < NUM_SVC_BUFS; i++)
+                if (!priv->svc_bufs[i].buf)
+                        num_free++;
+
+        return num_free;
+}
+
+/*
+ * s10_unlock_bufs
+ * Given the returned buffer address, match that address to our buffer struct
+ * and unlock that buffer.  This marks it as available to be refilled and sent
+ * (or freed).
+ * priv: private data
+ * kaddr: kernel address of buffer that was returned from service layer
+ */
+static void s10_unlock_bufs(struct s10_priv *priv, void *kaddr)
+{
+        uint i;
+
+        if (!kaddr)
+                return;
+
+        for (i = 0; i < NUM_SVC_BUFS; i++)
+                if (priv->svc_bufs[i].buf == kaddr) {
+                        clear_bit_unlock(SVC_BUF_LOCK,
+                                         &priv->svc_bufs[i].lock);
+                        return;
+                }
+
+        WARN(1, "Unknown buffer returned from service layer %p\n", kaddr);
+}
+
+/*
+ * s10_receive_callback - callback for service layer to use to provide client
+ * (this driver) messages received through the mailbox.
+ * client: service layer client struct
+ * data: message from service layer
+ */
+static void s10_receive_callback(struct stratix10_svc_client *client,
+                                 struct stratix10_svc_cb_data *data)
+{
+        struct s10_priv *priv = client->priv;
+        u32 status;
+        int i;
+
+        WARN_ONCE(!data, "%s: stratix10_svc_rc_data = NULL", __func__);
+
+        status = data->status;
+
+        /*
+         * Here we set status bits as we receive them.  Elsewhere, we always use
+         * test_and_clear_bit() to check status in priv->status
+         */
+        for (i = 0; i <= SVC_STATUS_RECONFIG_ERROR; i++)
+                if (status & (1 << i))
+                        set_bit(i, &priv->status);
+
+        if (status & BIT(SVC_STATUS_RECONFIG_BUFFER_DONE)) {
+                s10_unlock_bufs(priv, data->kaddr1);
+                s10_unlock_bufs(priv, data->kaddr2);
+                s10_unlock_bufs(priv, data->kaddr3);
+        }
+
+        complete(&priv->status_return_completion);
+}
+
+/*
+ * s10_ops_write_init - prepare for FPGA reconfiguration by requesting
+ * partial reconfig and allocating buffers from the service layer.
+ */
+static int s10_ops_write_init(struct fpga_manager *mgr,
+                              struct fpga_image_info *info,
+                              const char *buf, size_t count)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        struct stratix10_svc_command_config_type ctype;
+        char *kbuf;
+        uint i;
+        int ret;
+
+        ctype.flags = 0;
+        if (info->flags & FPGA_MGR_PARTIAL_RECONFIG) {
+                dev_dbg(dev, "Requesting partial reconfiguration.\n");
+                ctype.flags |= BIT(COMMAND_RECONFIG_FLAG_PARTIAL);
+        } else {
+                dev_dbg(dev, "Requesting full reconfiguration.\n");
+        }
+
+        reinit_completion(&priv->status_return_completion);
+        ret = s10_svc_send_msg(priv, COMMAND_RECONFIG,
+                               &ctype, sizeof(ctype));
+        if (ret < 0)
+                goto init_done;
+
+        ret = wait_for_completion_interruptible_timeout(
+                &priv->status_return_completion, S10_RECONFIG_TIMEOUT);
+        if (!ret) {
+                dev_err(dev, "timeout waiting for RECONFIG_REQUEST\n");
+                ret = -ETIMEDOUT;
+                goto init_done;
+        }
+        if (ret < 0) {
+                dev_err(dev, "error (%d) waiting for RECONFIG_REQUEST\n", ret);
+                goto init_done;
+        }
+
+        ret = 0;
+        if (!test_and_clear_bit(SVC_STATUS_RECONFIG_REQUEST_OK,
+                                &priv->status)) {
+                ret = -ETIMEDOUT;
+                goto init_done;
+        }
+
+        /* Allocate buffers from the service layer's pool. */
+        for (i = 0; i < NUM_SVC_BUFS; i++) {
+                kbuf = stratix10_svc_allocate_memory(priv->chan, SVC_BUF_SIZE);
+                if (!kbuf) {
+                        s10_free_buffers(mgr);
+                        ret = -ENOMEM;
+                        goto init_done;
+                }
+
+                priv->svc_bufs[i].buf = kbuf;
+                priv->svc_bufs[i].lock = 0;
+        }
+
+init_done:
+        stratix10_svc_done(priv->chan);
+        return ret;
+}
+
+/*
+ * s10_send_buf - send a buffer to the service layer queue
+ * mgr: fpga manager struct
+ * buf: fpga image buffer
+ * count: size of buf in bytes
+ * Returns # of bytes transferred or -ENOBUFS if the all the buffers are in use
+ * or if the service queue is full. Never returns 0.
+ */
+static int s10_send_buf(struct fpga_manager *mgr, const char *buf, size_t count)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        void *svc_buf;
+        size_t xfer_sz;
+        int ret;
+        uint i;
+
+        /* get/lock a buffer that that's not being used */
+        for (i = 0; i < NUM_SVC_BUFS; i++)
+                if (!test_and_set_bit_lock(SVC_BUF_LOCK,
+                                           &priv->svc_bufs[i].lock))
+                        break;
+
+        if (i == NUM_SVC_BUFS)
+                return -ENOBUFS;
+
+        xfer_sz = count < SVC_BUF_SIZE ? count : SVC_BUF_SIZE;
+
+        svc_buf = priv->svc_bufs[i].buf;
+        memcpy(svc_buf, buf, xfer_sz);
+        ret = s10_svc_send_msg(priv, COMMAND_RECONFIG_DATA_SUBMIT,
+                               svc_buf, xfer_sz);
+        if (ret < 0) {
+                dev_err(dev,
+                        "Error while sending data to service layer (%d)", ret);
+                clear_bit_unlock(SVC_BUF_LOCK, &priv->svc_bufs[i].lock);
+                return ret;
+        }
+
+        return xfer_sz;
+}
+
+/*
+ * Send a FPGA image to privileged layers to write to the FPGA.  When done
+ * sending, free all service layer buffers we allocated in write_init.
+ */
+static int s10_ops_write(struct fpga_manager *mgr, const char *buf,
+                         size_t count)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        long wait_status;
+        int sent = 0;
+        int ret = 0;
+
+        /*
+         * Loop waiting for buffers to be returned.  When a buffer is returned,
+         * reuse it to send more data or free if if all data has been sent.
+         */
+        while (count > 0 || s10_free_buffer_count(mgr) != NUM_SVC_BUFS) {
+                reinit_completion(&priv->status_return_completion);
+
+                if (count > 0) {
+                        sent = s10_send_buf(mgr, buf, count);
+                        if (sent < 0)
+                                continue;
+
+                        count -= sent;
+                        buf += sent;
+                } else {
+                        if (s10_free_buffers(mgr))
+                                return 0;
+
+                        ret = s10_svc_send_msg(
+                                priv, COMMAND_RECONFIG_DATA_CLAIM,
+                                NULL, 0);
+                        if (ret < 0)
+                                break;
+                }
+
+                /*
+                 * If callback hasn't already happened, wait for buffers to be
+                 * returned from service layer
+                 */
+                wait_status = 1; /* not timed out */
+                if (!priv->status)
+                        wait_status = wait_for_completion_interruptible_timeout(
+                                &priv->status_return_completion,
+                                S10_BUFFER_TIMEOUT);
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_BUFFER_DONE,
+                                       &priv->status) ||
+                    test_and_clear_bit(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED,
+                                       &priv->status)) {
+                        ret = 0;
+                        continue;
+                }
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_ERROR,
+                                       &priv->status)) {
+                        dev_err(dev, "ERROR - giving up - SVC_STATUS_RECONFIG_ERROR\n");
+                        ret = -EFAULT;
+                        break;
+                }
+
+                if (!wait_status) {
+                        dev_err(dev, "timeout waiting for svc layer buffers\n");
+                        ret = -ETIMEDOUT;
+                        break;
+                }
+                if (wait_status < 0) {
+                        ret = wait_status;
+                        dev_err(dev,
+                                "error (%d) waiting for svc layer buffers\n",
+                                ret);
+                        break;
+                }
+        }
+
+        if (!s10_free_buffers(mgr))
+                dev_err(dev, "%s not all buffers were freed\n", __func__);
+
+        return ret;
+}
+
+static int s10_ops_write_complete(struct fpga_manager *mgr,
+                                  struct fpga_image_info *info)
+{
+        struct s10_priv *priv = mgr->priv;
+        struct device *dev = priv->client.dev;
+        unsigned long timeout;
+        int ret;
+
+        timeout = usecs_to_jiffies(info->config_complete_timeout_us);
+
+        do {
+                reinit_completion(&priv->status_return_completion);
+
+                ret = s10_svc_send_msg(priv, COMMAND_RECONFIG_STATUS, NULL, 0);
+                if (ret < 0)
+                        break;
+
+                ret = wait_for_completion_interruptible_timeout(
+                        &priv->status_return_completion, timeout);
+                if (!ret) {
+                        dev_err(dev,
+                                "timeout waiting for RECONFIG_COMPLETED\n");
+                        ret = -ETIMEDOUT;
+                        break;
+                }
+                if (ret < 0) {
+                        dev_err(dev,
+                                "error (%d) waiting for RECONFIG_COMPLETED\n",
+                                ret);
+                        break;
+                }
+                /* Not error or timeout, so ret is # of jiffies until timeout */
+                timeout = ret;
+                ret = 0;
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_COMPLETED,
+                                       &priv->status))
+                        break;
+
+                if (test_and_clear_bit(SVC_STATUS_RECONFIG_ERROR,
+                                       &priv->status)) {
+                        dev_err(dev, "ERROR - giving up - SVC_STATUS_RECONFIG_ERROR\n");
+                        ret = -EFAULT;
+                        break;
+                }
+        } while (1);
+
+        stratix10_svc_done(priv->chan);
+
+        return ret;
+}
+
+static enum fpga_mgr_states s10_ops_state(struct fpga_manager *mgr)
+{
+        return FPGA_MGR_STATE_UNKNOWN;
+}
+
+static const struct fpga_manager_ops s10_ops = {
+        .state = s10_ops_state,
+        .write_init = s10_ops_write_init,
+        .write = s10_ops_write,
+        .write_complete = s10_ops_write_complete,
+};
+
+static int s10_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct s10_priv *priv;
+        struct fpga_manager *mgr;
+        int ret;
+
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        priv->client.dev = dev;
+        priv->client.receive_cb = s10_receive_callback;
+        priv->client.priv = priv;
+
+        priv->chan = stratix10_svc_request_channel_byname(&priv->client,
+                                                          SVC_CLIENT_FPGA);
+        if (IS_ERR(priv->chan)) {
+                dev_err(dev, "couldn't get service channel (%s)\n",
+                        SVC_CLIENT_FPGA);
+                return PTR_ERR(priv->chan);
+        }
+
+        init_completion(&priv->status_return_completion);
+
+        mgr = fpga_mgr_create(dev, "Stratix10 SOC FPGA Manager",
+                              &s10_ops, priv);
+        if (!mgr) {
+                dev_err(dev, "unable to create FPGA manager\n");
+                ret = -ENOMEM;
+                goto probe_err;
+        }
+
+        ret = fpga_mgr_register(mgr);
+        if (ret) {
+                dev_err(dev, "unable to register FPGA manager\n");
+                fpga_mgr_free(mgr);
+                goto probe_err;
+        }
+
+        platform_set_drvdata(pdev, mgr);
+        return ret;
+
+probe_err:
+        stratix10_svc_free_channel(priv->chan);
+        return ret;
+}
+
+static int s10_remove(struct platform_device *pdev)
+{
+        struct fpga_manager *mgr = platform_get_drvdata(pdev);
+        struct s10_priv *priv = mgr->priv;
+
+        fpga_mgr_unregister(mgr);
+        stratix10_svc_free_channel(priv->chan);
+
+        return 0;
+}
+
+static const struct of_device_id s10_of_match[] = {
+        { .compatible = "intel,stratix10-soc-fpga-mgr", },
+        {},
+};
+
+MODULE_DEVICE_TABLE(of, s10_of_match);
+
+static struct platform_driver s10_driver = {
+        .probe = s10_probe,
+        .remove = s10_remove,
+        .driver = {
+                .name   = "Stratix10 SoC FPGA manager",
+                .of_match_table = of_match_ptr(s10_of_match),
+        },
+};
+
+static int __init s10_init(void)
+{
+        struct device_node *fw_np;
+        struct device_node *np;
+        int ret;
+
+        fw_np = of_find_node_by_name(NULL, "svc");
+        if (!fw_np)
+                return -ENODEV;
+
+        np = of_find_matching_node(fw_np, s10_of_match);
+        if (!np) {
+                of_node_put(fw_np);
+                return -ENODEV;
+        }
+
+        of_node_put(np);
+        ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
+        of_node_put(fw_np);
+        if (ret)
+                return ret;
+
+        return platform_driver_register(&s10_driver);
+}
+
+static void __exit s10_exit(void)
+{
+        return platform_driver_unregister(&s10_driver);
+}
+
+module_init(s10_init);
+module_exit(s10_exit);
+
+MODULE_AUTHOR("Alan Tull <atull@kernel.org>");
+MODULE_DESCRIPTION("Intel Stratix 10 SOC FPGA Manager");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/fpga/zynq-fpga.c b/drivers/fpga/zynq-fpga.c
index bb82efeebb9d..57b0e6775958 100644
--- a/drivers/fpga/zynq-fpga.c
+++ b/drivers/fpga/zynq-fpga.c
@@ -501,6 +501,10 @@ static int zynq_fpga_ops_write_complete(struct fpga_manager *mgr,
         if (err)
                 return err;
 
+        /* Release 'PR' control back to the ICAP */
+        zynq_fpga_write(priv, CTRL_OFFSET,
+                zynq_fpga_read(priv, CTRL_OFFSET) & ~CTRL_PCAP_PR_MASK);
+
         err = zynq_fpga_poll_timeout(priv, INT_STS_OFFSET, intr_status,
                                      intr_status & IXR_PCFG_DONE_MASK,
                                      INIT_POLL_DELAY,
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index fe00b12e4417..ce0ba2062723 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -711,7 +711,6 @@ int vmbus_disconnect_ring(struct vmbus_channel *channel)
         /* Snapshot the list of subchannels */
         spin_lock_irqsave(&channel->lock, flags);
         list_splice_init(&channel->sc_list, &list);
-        channel->num_sc = 0;
         spin_unlock_irqrestore(&channel->lock, flags);
 
         list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index edd34c167a9b..d01689079e9b 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -405,7 +405,6 @@ void hv_process_channel_removal(struct vmbus_channel *channel)
                 primary_channel = channel->primary_channel;
                 spin_lock_irqsave(&primary_channel->lock, flags);
                 list_del(&channel->sc_list);
-                primary_channel->num_sc--;
                 spin_unlock_irqrestore(&primary_channel->lock, flags);
         }
 
@@ -1302,49 +1301,6 @@ cleanup:
         return ret;
 }
 
-/*
- * Retrieve the (sub) channel on which to send an outgoing request.
- * When a primary channel has multiple sub-channels, we try to
- * distribute the load equally amongst all available channels.
- */
-struct vmbus_channel *vmbus_get_outgoing_channel(struct vmbus_channel *primary)
-{
-        struct list_head *cur, *tmp;
-        int cur_cpu;
-        struct vmbus_channel *cur_channel;
-        struct vmbus_channel *outgoing_channel = primary;
-        int next_channel;
-        int i = 1;
-
-        if (list_empty(&primary->sc_list))
-                return outgoing_channel;
-
-        next_channel = primary->next_oc++;
-
-        if (next_channel > (primary->num_sc)) {
-                primary->next_oc = 0;
-                return outgoing_channel;
-        }
-
-        cur_cpu = hv_cpu_number_to_vp_number(smp_processor_id());
-        list_for_each_safe(cur, tmp, &primary->sc_list) {
-                cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
-                if (cur_channel->state != CHANNEL_OPENED_STATE)
-                        continue;
-
-                if (cur_channel->target_vp == cur_cpu)
-                        return cur_channel;
-
-                if (i == next_channel)
-                        return cur_channel;
-
-                i++;
-        }
-
-        return outgoing_channel;
-}
-EXPORT_SYMBOL_GPL(vmbus_get_outgoing_channel);
-
 static void invoke_sc_cb(struct vmbus_channel *primary_channel)
 {
         struct list_head *cur, *tmp;
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 11273cd384d6..632d25674e7f 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -33,9 +33,7 @@
 #include "hyperv_vmbus.h"
 
 /* The one and only */
-struct hv_context hv_context = {
-        .synic_initialized      = false,
-};
+struct hv_context hv_context;
 
 /*
  * If false, we're using the old mechanism for stimer0 interrupts
@@ -326,8 +324,6 @@ int hv_synic_init(unsigned int cpu)
 
         hv_set_synic_state(sctrl.as_uint64);
 
-        hv_context.synic_initialized = true;
-
         /*
          * Register the per-cpu clockevent source.
          */
@@ -373,7 +369,8 @@ int hv_synic_cleanup(unsigned int cpu)
         bool channel_found = false;
         unsigned long flags;
 
-        if (!hv_context.synic_initialized)
+        hv_get_synic_state(sctrl.as_uint64);
+        if (sctrl.enable != 1)
                 return -EFAULT;
 
         /*
@@ -435,7 +432,6 @@ int hv_synic_cleanup(unsigned int cpu)
         hv_set_siefp(siefp.as_uint64);
 
         /* Disable the global synic bit */
-        hv_get_synic_state(sctrl.as_uint64);
         sctrl.enable = 0;
         hv_set_synic_state(sctrl.as_uint64);
 
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index d6106e1a0d4a..5054d1105236 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -437,7 +437,7 @@ kvp_send_key(struct work_struct *dummy)
                         val32 = in_msg->body.kvp_set.data.value_u32;
                         message->body.kvp_set.data.value_size =
                                 sprintf(message->body.kvp_set.data.value,
-                                        "%d", val32) + 1;
+                                        "%u", val32) + 1;
                         break;
 
                 case REG_U64:
diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
index 423205077bf6..f10eeb120c8b 100644
--- a/drivers/hv/hv_util.c
+++ b/drivers/hv/hv_util.c
@@ -483,7 +483,7 @@ MODULE_DEVICE_TABLE(vmbus, id_table);
 
 /* The one and only one */
 static  struct hv_driver util_drv = {
-        .name = "hv_util",
+        .name = "hv_utils",
         .id_table = id_table,
         .probe =  util_probe,
         .remove =  util_remove,
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index ea201034b248..a1f6ce6e5974 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -162,8 +162,6 @@ struct hv_context {
 
         void *tsc_page;
 
-        bool synic_initialized;
-
         struct hv_per_cpu_context __percpu *cpu_context;
 
         /*
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index 824be0c5f592..105782ea64c7 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -136,6 +136,11 @@ static void __etb_enable_hw(struct etb_drvdata *drvdata)
 
 static int etb_enable_hw(struct etb_drvdata *drvdata)
 {
+        int rc = coresight_claim_device(drvdata->base);
+
+        if (rc)
+                return rc;
+
         __etb_enable_hw(drvdata);
         return 0;
 }
@@ -223,7 +228,7 @@ static int etb_enable(struct coresight_device *csdev, u32 mode, void *data)
         return 0;
 }
 
-static void etb_disable_hw(struct etb_drvdata *drvdata)
+static void __etb_disable_hw(struct etb_drvdata *drvdata)
 {
         u32 ffcr;
 
@@ -313,6 +318,13 @@ static void etb_dump_hw(struct etb_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
+static void etb_disable_hw(struct etb_drvdata *drvdata)
+{
+        __etb_disable_hw(drvdata);
+        etb_dump_hw(drvdata);
+        coresight_disclaim_device(drvdata->base);
+}
+
 static void etb_disable(struct coresight_device *csdev)
 {
         struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
@@ -323,7 +335,6 @@ static void etb_disable(struct coresight_device *csdev)
         /* Disable the ETB only if it needs to */
         if (drvdata->mode != CS_MODE_DISABLED) {
                 etb_disable_hw(drvdata);
-                etb_dump_hw(drvdata);
                 drvdata->mode = CS_MODE_DISABLED;
         }
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
@@ -402,7 +413,7 @@ static unsigned long etb_update_buffer(struct coresight_device *csdev,
 
         capacity = drvdata->buffer_depth * ETB_FRAME_SIZE_WORDS;
 
-        etb_disable_hw(drvdata);
+        __etb_disable_hw(drvdata);
         CS_UNLOCK(drvdata->base);
 
         /* unit is in words, not bytes */
@@ -510,7 +521,7 @@ static unsigned long etb_update_buffer(struct coresight_device *csdev,
                 handle->head = (cur * PAGE_SIZE) + offset;
                 to_read = buf->nr_pages << PAGE_SHIFT;
         }
-        etb_enable_hw(drvdata);
+        __etb_enable_hw(drvdata);
         CS_LOCK(drvdata->base);
 
         return to_read;
@@ -534,9 +545,9 @@ static void etb_dump(struct etb_drvdata *drvdata)
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
         if (drvdata->mode == CS_MODE_SYSFS) {
-                etb_disable_hw(drvdata);
+                __etb_disable_hw(drvdata);
                 etb_dump_hw(drvdata);
-                etb_enable_hw(drvdata);
+                __etb_enable_hw(drvdata);
         }
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
diff --git a/drivers/hwtracing/coresight/coresight-etm3x.c b/drivers/hwtracing/coresight/coresight-etm3x.c
index fd5c4cca7db5..9a63e87ea5f3 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x.c
@@ -363,15 +363,16 @@ static int etm_enable_hw(struct etm_drvdata *drvdata)
 
         CS_UNLOCK(drvdata->base);
 
+        rc = coresight_claim_device_unlocked(drvdata->base);
+        if (rc)
+                goto done;
+
         /* Turn engine on */
         etm_clr_pwrdwn(drvdata);
         /* Apply power to trace registers */
         etm_set_pwrup(drvdata);
         /* Make sure all registers are accessible */
         etm_os_unlock(drvdata);
-        rc = coresight_claim_device_unlocked(drvdata->base);
-        if (rc)
-                goto done;
 
         etm_set_prog(drvdata);
 
@@ -422,8 +423,6 @@ static int etm_enable_hw(struct etm_drvdata *drvdata)
         etm_clr_prog(drvdata);
 
 done:
-        if (rc)
-                etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
 
         dev_dbg(drvdata->dev, "cpu: %d enable smp call done: %d\n",
@@ -577,9 +576,9 @@ static void etm_disable_hw(void *info)
         for (i = 0; i < drvdata->nr_cntr; i++)
                 config->cntr_val[i] = etm_readl(drvdata, ETMCNTVRn(i));
 
+        etm_set_pwrdwn(drvdata);
         coresight_disclaim_device_unlocked(drvdata->base);
 
-        etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
 
         dev_dbg(drvdata->dev, "cpu: %d disable smp call done\n", drvdata->cpu);
@@ -602,6 +601,7 @@ static void etm_disable_perf(struct coresight_device *csdev)
          * power down the tracer.
          */
         etm_set_pwrdwn(drvdata);
+        coresight_disclaim_device_unlocked(drvdata->base);
 
         CS_LOCK(drvdata->base);
 }
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index 35d6f9709274..ef339ff22090 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -856,7 +856,7 @@ static int stm_probe(struct amba_device *adev, const struct amba_id *id)
 
         if (stm_register_device(dev, &drvdata->stm, THIS_MODULE)) {
                 dev_info(dev,
-                         "stm_register_device failed, probing deffered\n");
+                         "stm_register_device failed, probing deferred\n");
                 return -EPROBE_DEFER;
         }
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
index 53fc83b72a49..a5f053f2db2c 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -86,8 +86,8 @@ static void __tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
 
 static void tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
 {
-        coresight_disclaim_device(drvdata);
         __tmc_etb_disable_hw(drvdata);
+        coresight_disclaim_device(drvdata->base);
 }
 
 static void __tmc_etf_enable_hw(struct tmc_drvdata *drvdata)
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index d293e55553bd..ba7aaf421f36 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -1423,7 +1423,8 @@ nr_pages_store(struct device *dev, struct device_attribute *attr,
                 if (!end)
                         break;
 
-                len -= end - p;
+                /* consume the number and the following comma, hence +1 */
+                len -= end - p + 1;
                 p = end + 1;
         } while (len);
 
diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index 0910ec807187..4b9e44b227d8 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -440,10 +440,8 @@ stp_policy_make(struct config_group *group, const char *name)
 
         stm->policy = kzalloc(sizeof(*stm->policy), GFP_KERNEL);
         if (!stm->policy) {
-                mutex_unlock(&stm->policy_mutex);
-                stm_put_protocol(pdrv);
-                stm_put_device(stm);
-                return ERR_PTR(-ENOMEM);
+                ret = ERR_PTR(-ENOMEM);
+                goto unlock_policy;
         }
 
         config_group_init_type_name(&stm->policy->group, name,
@@ -458,7 +456,11 @@ unlock_policy:
         mutex_unlock(&stm->policy_mutex);
 
         if (IS_ERR(ret)) {
-                stm_put_protocol(stm->pdrv);
+                /*
+                 * pdrv and stm->pdrv at this point can be quite different,
+                 * and only one of them needs to be 'put'
+                 */
+                stm_put_protocol(pdrv);
                 stm_put_device(stm);
         }
 
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index d9c748b6f9e4..1edf2a251336 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -2042,3 +2042,28 @@ int dmar_device_remove(acpi_handle handle)
 {
         return dmar_device_hotplug(handle, false);
 }
+
+/*
+ * dmar_platform_optin - Is %DMA_CTRL_PLATFORM_OPT_IN_FLAG set in DMAR table
+ *
+ * Returns true if the platform has %DMA_CTRL_PLATFORM_OPT_IN_FLAG set in
+ * the ACPI DMAR table. This means that the platform boot firmware has made
+ * sure no device can issue DMA outside of RMRR regions.
+ */
+bool dmar_platform_optin(void)
+{
+        struct acpi_table_dmar *dmar;
+        acpi_status status;
+        bool ret;
+
+        status = acpi_get_table(ACPI_SIG_DMAR, 0,
+                                (struct acpi_table_header **)&dmar);
+        if (ACPI_FAILURE(status))
+                return false;
+
+        ret = !!(dmar->flags & DMAR_PLATFORM_OPT_IN);
+        acpi_put_table((struct acpi_table_header *)dmar);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(dmar_platform_optin);
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 0ad67d65bbce..63b6ce78492a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -184,6 +184,7 @@ static int rwbf_quirk;
  */
 static int force_on = 0;
 int intel_iommu_tboot_noforce;
+static int no_platform_optin;
 
 #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
 
@@ -503,6 +504,7 @@ static int __init intel_iommu_setup(char *str)
                         pr_info("IOMMU enabled\n");
                 } else if (!strncmp(str, "off", 3)) {
                         dmar_disabled = 1;
+                        no_platform_optin = 1;
                         pr_info("IOMMU disabled\n");
                 } else if (!strncmp(str, "igfx_off", 8)) {
                         dmar_map_gfx = 0;
@@ -1471,7 +1473,8 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info)
         if (info->pri_supported && !pci_reset_pri(pdev) && !pci_enable_pri(pdev, 32))
                 info->pri_enabled = 1;
 #endif
-        if (info->ats_supported && !pci_enable_ats(pdev, VTD_PAGE_SHIFT)) {
+        if (!pdev->untrusted && info->ats_supported &&
+            !pci_enable_ats(pdev, VTD_PAGE_SHIFT)) {
                 info->ats_enabled = 1;
                 domain_update_iotlb(info->domain);
                 info->ats_qdep = pci_ats_queue_depth(pdev);
@@ -2895,6 +2898,13 @@ static int iommu_should_identity_map(struct device *dev, int startup)
                 if (device_is_rmrr_locked(dev))
                         return 0;
 
+                /*
+                 * Prevent any device marked as untrusted from getting
+                 * placed into the statically identity mapping domain.
+                 */
+                if (pdev->untrusted)
+                        return 0;
+
                 if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
                         return 1;
 
@@ -4722,14 +4732,54 @@ const struct attribute_group *intel_iommu_groups[] = {
         NULL,
 };
 
+static int __init platform_optin_force_iommu(void)
+{
+        struct pci_dev *pdev = NULL;
+        bool has_untrusted_dev = false;
+
+        if (!dmar_platform_optin() || no_platform_optin)
+                return 0;
+
+        for_each_pci_dev(pdev) {
+                if (pdev->untrusted) {
+                        has_untrusted_dev = true;
+                        break;
+                }
+        }
+
+        if (!has_untrusted_dev)
+                return 0;
+
+        if (no_iommu || dmar_disabled)
+                pr_info("Intel-IOMMU force enabled due to platform opt in\n");
+
+        /*
+         * If Intel-IOMMU is disabled by default, we will apply identity
+         * map for all devices except those marked as being untrusted.
+         */
+        if (dmar_disabled)
+                iommu_identity_mapping |= IDENTMAP_ALL;
+
+        dmar_disabled = 0;
+#if defined(CONFIG_X86) && defined(CONFIG_SWIOTLB)
+        swiotlb = 0;
+#endif
+        no_iommu = 0;
+
+        return 1;
+}
+
 int __init intel_iommu_init(void)
 {
         int ret = -ENODEV;
         struct dmar_drhd_unit *drhd;
         struct intel_iommu *iommu;
 
-        /* VT-d is required for a TXT/tboot launch, so enforce that */
-        force_on = tboot_force_iommu();
+        /*
+         * Intel IOMMU is required for a TXT/tboot launch or platform
+         * opt in, so enforce that.
+         */
+        force_on = tboot_force_iommu() || platform_optin_force_iommu();
 
         if (iommu_init_mempool()) {
                 if (force_on)
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3726eacdf65d..f417b06e11c5 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -513,6 +513,14 @@ config MISC_RTSX
         tristate
         default MISC_RTSX_PCI || MISC_RTSX_USB
 
+config PVPANIC
+        tristate "pvpanic device support"
+        depends on HAS_IOMEM && (ACPI || OF)
+        help
+          This driver provides support for the pvpanic device.  pvpanic is
+          a paravirtualized device provided by QEMU; it lets a virtual machine
+          (guest) communicate panic events to the host.
+
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index fe3134cf3008..e39ccbbc1b3a 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -57,4 +57,5 @@ obj-$(CONFIG_ASPEED_LPC_CTRL)	+= aspeed-lpc-ctrl.o
 obj-$(CONFIG_ASPEED_LPC_SNOOP)  += aspeed-lpc-snoop.o
 obj-$(CONFIG_PCI_ENDPOINT_TEST) += pci_endpoint_test.o
 obj-$(CONFIG_OCXL)              += ocxl/
-obj-y           += cardreader/
+obj-y                           += cardreader/
+obj-$(CONFIG_PVPANIC)           += pvpanic.o
diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
index ef83a9078646..d2ed3b9728b7 100644
--- a/drivers/misc/altera-stapl/altera.c
+++ b/drivers/misc/altera-stapl/altera.c
@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size,
                         key_ptr = &p[note_strings +
                                         get_unaligned_be32(
                                         &p[note_table + (8 * i)])];
-                        if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) &&
-                                                (key != NULL)) {
+                        if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
                                 status = 0;
 
                                 value_ptr = &p[note_strings +
diff --git a/drivers/misc/genwqe/card_debugfs.c b/drivers/misc/genwqe/card_debugfs.c
index c6b82f09b3ba..7c713e01d198 100644
--- a/drivers/misc/genwqe/card_debugfs.c
+++ b/drivers/misc/genwqe/card_debugfs.c
@@ -33,19 +33,6 @@
 #include "card_base.h"
 #include "card_ddcb.h"
 
-#define GENWQE_DEBUGFS_RO(_name, _showfn)                               \
-        static int genwqe_debugfs_##_name##_open(struct inode *inode,   \
-                                                 struct file *file)     \
-        {                                                               \
-                return single_open(file, _showfn, inode->i_private);    \
-        }                                                               \
-        static const struct file_operations genwqe_##_name##_fops = {   \
-                .open = genwqe_debugfs_##_name##_open,                  \
-                .read = seq_read,                                       \
-                .llseek = seq_lseek,                                    \
-                .release = single_release,                              \
-        }
-
 static void dbg_uidn_show(struct seq_file *s, struct genwqe_reg *regs,
                           int entries)
 {
@@ -87,26 +74,26 @@ static int curr_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
         return 0;
 }
 
-static int genwqe_curr_dbg_uid0_show(struct seq_file *s, void *unused)
+static int curr_dbg_uid0_show(struct seq_file *s, void *unused)
 {
         return curr_dbg_uidn_show(s, unused, 0);
 }
 
-GENWQE_DEBUGFS_RO(curr_dbg_uid0, genwqe_curr_dbg_uid0_show);
+DEFINE_SHOW_ATTRIBUTE(curr_dbg_uid0);
 
-static int genwqe_curr_dbg_uid1_show(struct seq_file *s, void *unused)
+static int curr_dbg_uid1_show(struct seq_file *s, void *unused)
 {
         return curr_dbg_uidn_show(s, unused, 1);
 }
 
-GENWQE_DEBUGFS_RO(curr_dbg_uid1, genwqe_curr_dbg_uid1_show);
+DEFINE_SHOW_ATTRIBUTE(curr_dbg_uid1);
 
-static int genwqe_curr_dbg_uid2_show(struct seq_file *s, void *unused)
+static int curr_dbg_uid2_show(struct seq_file *s, void *unused)
 {
         return curr_dbg_uidn_show(s, unused, 2);
 }
 
-GENWQE_DEBUGFS_RO(curr_dbg_uid2, genwqe_curr_dbg_uid2_show);
+DEFINE_SHOW_ATTRIBUTE(curr_dbg_uid2);
 
 static int prev_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
 {
@@ -116,28 +103,28 @@ static int prev_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
         return 0;
 }
 
-static int genwqe_prev_dbg_uid0_show(struct seq_file *s, void *unused)
+static int prev_dbg_uid0_show(struct seq_file *s, void *unused)
 {
         return prev_dbg_uidn_show(s, unused, 0);
 }
 
-GENWQE_DEBUGFS_RO(prev_dbg_uid0, genwqe_prev_dbg_uid0_show);
+DEFINE_SHOW_ATTRIBUTE(prev_dbg_uid0);
 
-static int genwqe_prev_dbg_uid1_show(struct seq_file *s, void *unused)
+static int prev_dbg_uid1_show(struct seq_file *s, void *unused)
 {
         return prev_dbg_uidn_show(s, unused, 1);
 }
 
-GENWQE_DEBUGFS_RO(prev_dbg_uid1, genwqe_prev_dbg_uid1_show);
+DEFINE_SHOW_ATTRIBUTE(prev_dbg_uid1);
 
-static int genwqe_prev_dbg_uid2_show(struct seq_file *s, void *unused)
+static int prev_dbg_uid2_show(struct seq_file *s, void *unused)
 {
         return prev_dbg_uidn_show(s, unused, 2);
 }
 
-GENWQE_DEBUGFS_RO(prev_dbg_uid2, genwqe_prev_dbg_uid2_show);
+DEFINE_SHOW_ATTRIBUTE(prev_dbg_uid2);
 
-static int genwqe_curr_regs_show(struct seq_file *s, void *unused)
+static int curr_regs_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int i;
@@ -164,9 +151,9 @@ static int genwqe_curr_regs_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(curr_regs, genwqe_curr_regs_show);
+DEFINE_SHOW_ATTRIBUTE(curr_regs);
 
-static int genwqe_prev_regs_show(struct seq_file *s, void *unused)
+static int prev_regs_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int i;
@@ -188,9 +175,9 @@ static int genwqe_prev_regs_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(prev_regs, genwqe_prev_regs_show);
+DEFINE_SHOW_ATTRIBUTE(prev_regs);
 
-static int genwqe_jtimer_show(struct seq_file *s, void *unused)
+static int jtimer_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int vf_num;
@@ -209,9 +196,9 @@ static int genwqe_jtimer_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(jtimer, genwqe_jtimer_show);
+DEFINE_SHOW_ATTRIBUTE(jtimer);
 
-static int genwqe_queue_working_time_show(struct seq_file *s, void *unused)
+static int queue_working_time_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int vf_num;
@@ -227,9 +214,9 @@ static int genwqe_queue_working_time_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(queue_working_time, genwqe_queue_working_time_show);
+DEFINE_SHOW_ATTRIBUTE(queue_working_time);
 
-static int genwqe_ddcb_info_show(struct seq_file *s, void *unused)
+static int ddcb_info_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         unsigned int i;
@@ -300,9 +287,9 @@ static int genwqe_ddcb_info_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(ddcb_info, genwqe_ddcb_info_show);
+DEFINE_SHOW_ATTRIBUTE(ddcb_info);
 
-static int genwqe_info_show(struct seq_file *s, void *unused)
+static int info_show(struct seq_file *s, void *unused)
 {
         struct genwqe_dev *cd = s->private;
         u64 app_id, slu_id, bitstream = -1;
@@ -335,7 +322,7 @@ static int genwqe_info_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-GENWQE_DEBUGFS_RO(info, genwqe_info_show);
+DEFINE_SHOW_ATTRIBUTE(info);
 
 int genwqe_init_debugfs(struct genwqe_dev *cd)
 {
@@ -356,14 +343,14 @@ int genwqe_init_debugfs(struct genwqe_dev *cd)
 
         /* non privileged interfaces are done here */
         file = debugfs_create_file("ddcb_info", S_IRUGO, root, cd,
-                                   &genwqe_ddcb_info_fops);
+                                   &ddcb_info_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("info", S_IRUGO, root, cd,
-                                   &genwqe_info_fops);
+                                   &info_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
@@ -396,56 +383,56 @@ int genwqe_init_debugfs(struct genwqe_dev *cd)
         }
 
         file = debugfs_create_file("curr_regs", S_IRUGO, root, cd,
-                                   &genwqe_curr_regs_fops);
+                                   &curr_regs_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("curr_dbg_uid0", S_IRUGO, root, cd,
-                                   &genwqe_curr_dbg_uid0_fops);
+                                   &curr_dbg_uid0_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("curr_dbg_uid1", S_IRUGO, root, cd,
-                                   &genwqe_curr_dbg_uid1_fops);
+                                   &curr_dbg_uid1_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("curr_dbg_uid2", S_IRUGO, root, cd,
-                                   &genwqe_curr_dbg_uid2_fops);
+                                   &curr_dbg_uid2_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_regs", S_IRUGO, root, cd,
-                                   &genwqe_prev_regs_fops);
+                                   &prev_regs_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_dbg_uid0", S_IRUGO, root, cd,
-                                   &genwqe_prev_dbg_uid0_fops);
+                                   &prev_dbg_uid0_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_dbg_uid1", S_IRUGO, root, cd,
-                                   &genwqe_prev_dbg_uid1_fops);
+                                   &prev_dbg_uid1_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("prev_dbg_uid2", S_IRUGO, root, cd,
-                                   &genwqe_prev_dbg_uid2_fops);
+                                   &prev_dbg_uid2_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
@@ -463,14 +450,14 @@ int genwqe_init_debugfs(struct genwqe_dev *cd)
         }
 
         file = debugfs_create_file("jobtimer", S_IRUGO, root, cd,
-                                   &genwqe_jtimer_fops);
+                                   &jtimer_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
         }
 
         file = debugfs_create_file("queue_working_time", S_IRUGO, root, cd,
-                                   &genwqe_queue_working_time_fops);
+                                   &queue_working_time_fops);
         if (!file) {
                 ret = -ENOMEM;
                 goto err1;
diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
index 3fcb9a2fe1c9..efe2fb72d54b 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -215,7 +215,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u32 init)
 void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
                                dma_addr_t *dma_handle)
 {
-        if (get_order(size) > MAX_ORDER)
+        if (get_order(size) >= MAX_ORDER)
                 return NULL;
 
         return dma_zalloc_coherent(&cd->pci_dev->dev, size, dma_handle,
diff --git a/drivers/misc/mei/Makefile b/drivers/misc/mei/Makefile
index cd6825afa8e1..d9215fc4e499 100644
--- a/drivers/misc/mei/Makefile
+++ b/drivers/misc/mei/Makefile
@@ -9,6 +9,7 @@ mei-objs += hbm.o
 mei-objs += interrupt.o
 mei-objs += client.o
 mei-objs += main.o
+mei-objs += dma-ring.o
 mei-objs += bus.o
 mei-objs += bus-fixup.o
 mei-$(CONFIG_DEBUG_FS) += debugfs.o
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index ebdcf0b450e2..1fc8ea0f519b 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -318,23 +318,6 @@ void mei_me_cl_rm_all(struct mei_device *dev)
 }
 
 /**
- * mei_cl_cmp_id - tells if the clients are the same
- *
- * @cl1: host client 1
- * @cl2: host client 2
- *
- * Return: true  - if the clients has same host and me ids
- *         false - otherwise
- */
-static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
-                                const struct mei_cl *cl2)
-{
-        return cl1 && cl2 &&
-                (cl1->host_client_id == cl2->host_client_id) &&
-                (mei_cl_me_id(cl1) == mei_cl_me_id(cl2));
-}
-
-/**
  * mei_io_cb_free - free mei_cb_private related memory
  *
  * @cb: mei callback struct
@@ -418,7 +401,7 @@ static void mei_io_list_flush_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (mei_cl_cmp_id(cl, cb->cl))
+                if (cl == cb->cl)
                         list_del_init(&cb->list);
         }
 }
@@ -435,7 +418,7 @@ static void mei_io_tx_list_free_cl(struct list_head *head,
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, head, list) {
-                if (mei_cl_cmp_id(cl, cb->cl))
+                if (cl == cb->cl)
                         mei_tx_cb_dequeue(cb);
         }
 }
@@ -478,7 +461,7 @@ struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
         if (length == 0)
                 return cb;
 
-        cb->buf.data = kmalloc(length, GFP_KERNEL);
+        cb->buf.data = kmalloc(roundup(length, MEI_SLOT_SIZE), GFP_KERNEL);
         if (!cb->buf.data) {
                 mei_io_cb_free(cb);
                 return NULL;
@@ -1374,7 +1357,9 @@ int mei_cl_notify_request(struct mei_cl *cl,
 
         mutex_unlock(&dev->device_lock);
         wait_event_timeout(cl->wait,
-                           cl->notify_en == request || !mei_cl_is_connected(cl),
+                           cl->notify_en == request ||
+                           cl->status ||
+                           !mei_cl_is_connected(cl),
                            mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT));
         mutex_lock(&dev->device_lock);
 
@@ -1573,10 +1558,13 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         struct mei_msg_hdr mei_hdr;
         size_t hdr_len = sizeof(mei_hdr);
         size_t len;
-        size_t hbuf_len;
+        size_t hbuf_len, dr_len;
         int hbuf_slots;
+        u32 dr_slots;
+        u32 dma_len;
         int rets;
         bool first_chunk;
+        const void *data;
 
         if (WARN_ON(!cl || !cl->dev))
                 return -ENODEV;
@@ -1597,6 +1585,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         }
 
         len = buf->size - cb->buf_idx;
+        data = buf->data + cb->buf_idx;
         hbuf_slots = mei_hbuf_empty_slots(dev);
         if (hbuf_slots < 0) {
                 rets = -EOVERFLOW;
@@ -1604,6 +1593,8 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         }
 
         hbuf_len = mei_slots2data(hbuf_slots);
+        dr_slots = mei_dma_ring_empty_slots(dev);
+        dr_len = mei_slots2data(dr_slots);
 
         mei_msg_hdr_init(&mei_hdr, cb);
 
@@ -1614,23 +1605,33 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         if (len + hdr_len <= hbuf_len) {
                 mei_hdr.length = len;
                 mei_hdr.msg_complete = 1;
+        } else if (dr_slots && hbuf_len >= hdr_len + sizeof(dma_len)) {
+                mei_hdr.dma_ring = 1;
+                if (len > dr_len)
+                        len = dr_len;
+                else
+                        mei_hdr.msg_complete = 1;
+
+                mei_hdr.length = sizeof(dma_len);
+                dma_len = len;
+                data = &dma_len;
         } else if ((u32)hbuf_slots == mei_hbuf_depth(dev)) {
-                mei_hdr.length = hbuf_len - hdr_len;
+                len = hbuf_len - hdr_len;
+                mei_hdr.length = len;
         } else {
                 return 0;
         }
 
-        cl_dbg(dev, cl, "buf: size = %zu idx = %zu\n",
-                        cb->buf.size, cb->buf_idx);
+        if (mei_hdr.dma_ring)
+                mei_dma_ring_write(dev, buf->data + cb->buf_idx, len);
 
-        rets = mei_write_message(dev, &mei_hdr, hdr_len,
-                                 buf->data + cb->buf_idx, mei_hdr.length);
+        rets = mei_write_message(dev, &mei_hdr, hdr_len, data, mei_hdr.length);
         if (rets)
                 goto err;
 
         cl->status = 0;
         cl->writing_state = MEI_WRITING;
-        cb->buf_idx += mei_hdr.length;
+        cb->buf_idx += len;
 
         if (first_chunk) {
                 if (mei_cl_tx_flow_ctrl_creds_reduce(cl)) {
@@ -1665,11 +1666,13 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
         struct mei_msg_data *buf;
         struct mei_msg_hdr mei_hdr;
         size_t hdr_len = sizeof(mei_hdr);
-        size_t len;
-        size_t hbuf_len;
+        size_t len, hbuf_len, dr_len;
         int hbuf_slots;
+        u32 dr_slots;
+        u32 dma_len;
         ssize_t rets;
         bool blocking;
+        const void *data;
 
         if (WARN_ON(!cl || !cl->dev))
                 return -ENODEV;
@@ -1681,10 +1684,12 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
 
         buf = &cb->buf;
         len = buf->size;
-        blocking = cb->blocking;
 
         cl_dbg(dev, cl, "len=%zd\n", len);
 
+        blocking = cb->blocking;
+        data = buf->data;
+
         rets = pm_runtime_get(dev->dev);
         if (rets < 0 && rets != -EINPROGRESS) {
                 pm_runtime_put_noidle(dev->dev);
@@ -1721,16 +1726,32 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
         }
 
         hbuf_len = mei_slots2data(hbuf_slots);
+        dr_slots = mei_dma_ring_empty_slots(dev);
+        dr_len =  mei_slots2data(dr_slots);
 
         if (len + hdr_len <= hbuf_len) {
                 mei_hdr.length = len;
                 mei_hdr.msg_complete = 1;
+        } else if (dr_slots && hbuf_len >= hdr_len + sizeof(dma_len)) {
+                mei_hdr.dma_ring = 1;
+                if (len > dr_len)
+                        len = dr_len;
+                else
+                        mei_hdr.msg_complete = 1;
+
+                mei_hdr.length = sizeof(dma_len);
+                dma_len = len;
+                data = &dma_len;
         } else {
-                mei_hdr.length = hbuf_len - hdr_len;
+                len = hbuf_len - hdr_len;
+                mei_hdr.length = len;
         }
 
+        if (mei_hdr.dma_ring)
+                mei_dma_ring_write(dev, buf->data, len);
+
         rets = mei_write_message(dev, &mei_hdr, hdr_len,
-                                 buf->data, mei_hdr.length);
+                                 data, mei_hdr.length);
         if (rets)
                 goto err;
 
@@ -1739,7 +1760,9 @@ ssize_t mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb)
                 goto err;
 
         cl->writing_state = MEI_WRITING;
-        cb->buf_idx = mei_hdr.length;
+        cb->buf_idx = len;
+        /* restore return value */
+        len = buf->size;
 
 out:
         if (mei_hdr.msg_complete)
diff --git a/drivers/misc/mei/dma-ring.c b/drivers/misc/mei/dma-ring.c
new file mode 100644
index 000000000000..795641b82181
--- /dev/null
+++ b/drivers/misc/mei/dma-ring.c
@@ -0,0 +1,269 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright(c) 2016 - 2018 Intel Corporation. All rights reserved.
+ */
+#include <linux/dma-mapping.h>
+#include <linux/mei.h>
+
+#include "mei_dev.h"
+
+/**
+ * mei_dmam_dscr_alloc() - allocate a managed coherent buffer
+ *     for the dma descriptor
+ * @dev: mei_device
+ * @dscr: dma descriptor
+ *
+ * Return:
+ * * 0       - on success or zero allocation request
+ * * -EINVAL - if size is not power of 2
+ * * -ENOMEM - of allocation has failed
+ */
+static int mei_dmam_dscr_alloc(struct mei_device *dev,
+                               struct mei_dma_dscr *dscr)
+{
+        if (!dscr->size)
+                return 0;
+
+        if (WARN_ON(!is_power_of_2(dscr->size)))
+                return -EINVAL;
+
+        if (dscr->vaddr)
+                return 0;
+
+        dscr->vaddr = dmam_alloc_coherent(dev->dev, dscr->size, &dscr->daddr,
+                                          GFP_KERNEL);
+        if (!dscr->vaddr)
+                return -ENOMEM;
+
+        return 0;
+}
+
+/**
+ * mei_dmam_dscr_free() - free a managed coherent buffer
+ *     from the dma descriptor
+ * @dev: mei_device
+ * @dscr: dma descriptor
+ */
+static void mei_dmam_dscr_free(struct mei_device *dev,
+                               struct mei_dma_dscr *dscr)
+{
+        if (!dscr->vaddr)
+                return;
+
+        dmam_free_coherent(dev->dev, dscr->size, dscr->vaddr, dscr->daddr);
+        dscr->vaddr = NULL;
+}
+
+/**
+ * mei_dmam_ring_free() - free dma ring buffers
+ * @dev: mei device
+ */
+void mei_dmam_ring_free(struct mei_device *dev)
+{
+        int i;
+
+        for (i = 0; i < DMA_DSCR_NUM; i++)
+                mei_dmam_dscr_free(dev, &dev->dr_dscr[i]);
+}
+
+/**
+ * mei_dmam_ring_alloc() - allocate dma ring buffers
+ * @dev: mei device
+ *
+ * Return: -ENOMEM on allocation failure 0 otherwise
+ */
+int mei_dmam_ring_alloc(struct mei_device *dev)
+{
+        int i;
+
+        for (i = 0; i < DMA_DSCR_NUM; i++)
+                if (mei_dmam_dscr_alloc(dev, &dev->dr_dscr[i]))
+                        goto err;
+
+        return 0;
+
+err:
+        mei_dmam_ring_free(dev);
+        return -ENOMEM;
+}
+
+/**
+ * mei_dma_ring_is_allocated() - check if dma ring is allocated
+ * @dev: mei device
+ *
+ * Return: true if dma ring is allocated
+ */
+bool mei_dma_ring_is_allocated(struct mei_device *dev)
+{
+        return !!dev->dr_dscr[DMA_DSCR_HOST].vaddr;
+}
+
+static inline
+struct hbm_dma_ring_ctrl *mei_dma_ring_ctrl(struct mei_device *dev)
+{
+        return (struct hbm_dma_ring_ctrl *)dev->dr_dscr[DMA_DSCR_CTRL].vaddr;
+}
+
+/**
+ * mei_dma_ring_reset() - reset the dma control block
+ * @dev: mei device
+ */
+void mei_dma_ring_reset(struct mei_device *dev)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+
+        if (!ctrl)
+                return;
+
+        memset(ctrl, 0, sizeof(*ctrl));
+}
+
+/**
+ * mei_dma_copy_from() - copy from dma ring into buffer
+ * @dev: mei device
+ * @buf: data buffer
+ * @offset: offset in slots.
+ * @n: number of slots to copy.
+ */
+static size_t mei_dma_copy_from(struct mei_device *dev, unsigned char *buf,
+                                u32 offset, u32 n)
+{
+        unsigned char *dbuf = dev->dr_dscr[DMA_DSCR_DEVICE].vaddr;
+
+        size_t b_offset = offset << 2;
+        size_t b_n = n << 2;
+
+        memcpy(buf, dbuf + b_offset, b_n);
+
+        return b_n;
+}
+
+/**
+ * mei_dma_copy_to() - copy to a buffer to the dma ring
+ * @dev: mei device
+ * @buf: data buffer
+ * @offset: offset in slots.
+ * @n: number of slots to copy.
+ */
+static size_t mei_dma_copy_to(struct mei_device *dev, unsigned char *buf,
+                              u32 offset, u32 n)
+{
+        unsigned char *hbuf = dev->dr_dscr[DMA_DSCR_HOST].vaddr;
+
+        size_t b_offset = offset << 2;
+        size_t b_n = n << 2;
+
+        memcpy(hbuf + b_offset, buf, b_n);
+
+        return b_n;
+}
+
+/**
+ * mei_dma_ring_read() - read data from the ring
+ * @dev: mei device
+ * @buf: buffer to read into: may be NULL in case of droping the data.
+ * @len: length to read.
+ */
+void mei_dma_ring_read(struct mei_device *dev, unsigned char *buf, u32 len)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+        u32 dbuf_depth;
+        u32 rd_idx, rem, slots;
+
+        if (WARN_ON(!ctrl))
+                return;
+
+        dev_dbg(dev->dev, "reading from dma %u bytes\n", len);
+
+        if (!len)
+                return;
+
+        dbuf_depth = dev->dr_dscr[DMA_DSCR_DEVICE].size >> 2;
+        rd_idx = READ_ONCE(ctrl->dbuf_rd_idx) & (dbuf_depth - 1);
+        slots = mei_data2slots(len);
+
+        /* if buf is NULL we drop the packet by advancing the pointer.*/
+        if (!buf)
+                goto out;
+
+        if (rd_idx + slots > dbuf_depth) {
+                buf += mei_dma_copy_from(dev, buf, rd_idx, dbuf_depth - rd_idx);
+                rem = slots - (dbuf_depth - rd_idx);
+                rd_idx = 0;
+        } else {
+                rem = slots;
+        }
+
+        mei_dma_copy_from(dev, buf, rd_idx, rem);
+out:
+        WRITE_ONCE(ctrl->dbuf_rd_idx, ctrl->dbuf_rd_idx + slots);
+}
+
+static inline u32 mei_dma_ring_hbuf_depth(struct mei_device *dev)
+{
+        return dev->dr_dscr[DMA_DSCR_HOST].size >> 2;
+}
+
+/**
+ * mei_dma_ring_empty_slots() - calaculate number of empty slots in dma ring
+ * @dev: mei_device
+ *
+ * Return: number of empty slots
+ */
+u32 mei_dma_ring_empty_slots(struct mei_device *dev)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+        u32 wr_idx, rd_idx, hbuf_depth, empty;
+
+        if (!mei_dma_ring_is_allocated(dev))
+                return 0;
+
+        if (WARN_ON(!ctrl))
+                return 0;
+
+        /* easier to work in slots */
+        hbuf_depth = mei_dma_ring_hbuf_depth(dev);
+        rd_idx = READ_ONCE(ctrl->hbuf_rd_idx);
+        wr_idx = READ_ONCE(ctrl->hbuf_wr_idx);
+
+        if (rd_idx > wr_idx)
+                empty = rd_idx - wr_idx;
+        else
+                empty = hbuf_depth - (wr_idx - rd_idx);
+
+        return empty;
+}
+
+/**
+ * mei_dma_ring_write - write data to dma ring host buffer
+ *
+ * @dev: mei_device
+ * @buf: data will be written
+ * @len: data length
+ */
+void mei_dma_ring_write(struct mei_device *dev, unsigned char *buf, u32 len)
+{
+        struct hbm_dma_ring_ctrl *ctrl = mei_dma_ring_ctrl(dev);
+        u32 hbuf_depth;
+        u32 wr_idx, rem, slots;
+
+        if (WARN_ON(!ctrl))
+                return;
+
+        dev_dbg(dev->dev, "writing to dma %u bytes\n", len);
+        hbuf_depth = mei_dma_ring_hbuf_depth(dev);
+        wr_idx = READ_ONCE(ctrl->hbuf_wr_idx) & (hbuf_depth - 1);
+        slots = mei_data2slots(len);
+
+        if (wr_idx + slots > hbuf_depth) {
+                buf += mei_dma_copy_to(dev, buf, wr_idx, hbuf_depth - wr_idx);
+                rem = slots - (hbuf_depth - wr_idx);
+                wr_idx = 0;
+        } else {
+                rem = slots;
+        }
+
+        mei_dma_copy_to(dev, buf, wr_idx, rem);
+
+        WRITE_ONCE(ctrl->hbuf_wr_idx, ctrl->hbuf_wr_idx + slots);
+}
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index e56f3e72d57a..78c26cebf5d4 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -65,6 +65,7 @@ const char *mei_hbm_state_str(enum mei_hbm_state state)
         MEI_HBM_STATE(IDLE);
         MEI_HBM_STATE(STARTING);
         MEI_HBM_STATE(STARTED);
+        MEI_HBM_STATE(DR_SETUP);
         MEI_HBM_STATE(ENUM_CLIENTS);
         MEI_HBM_STATE(CLIENT_PROPERTIES);
         MEI_HBM_STATE(STOPPED);
@@ -296,6 +297,48 @@ int mei_hbm_start_req(struct mei_device *dev)
 }
 
 /**
+ * mei_hbm_dma_setup_req() - setup DMA request
+ * @dev: the device structure
+ *
+ * Return: 0 on success and < 0 on failure
+ */
+static int mei_hbm_dma_setup_req(struct mei_device *dev)
+{
+        struct mei_msg_hdr mei_hdr;
+        struct hbm_dma_setup_request req;
+        const size_t len = sizeof(struct hbm_dma_setup_request);
+        unsigned int i;
+        int ret;
+
+        mei_hbm_hdr(&mei_hdr, len);
+
+        memset(&req, 0, len);
+        req.hbm_cmd = MEI_HBM_DMA_SETUP_REQ_CMD;
+        for (i = 0; i < DMA_DSCR_NUM; i++) {
+                phys_addr_t paddr;
+
+                paddr = dev->dr_dscr[i].daddr;
+                req.dma_dscr[i].addr_hi = upper_32_bits(paddr);
+                req.dma_dscr[i].addr_lo = lower_32_bits(paddr);
+                req.dma_dscr[i].size = dev->dr_dscr[i].size;
+        }
+
+        mei_dma_ring_reset(dev);
+
+        ret = mei_hbm_write_message(dev, &mei_hdr, &req);
+        if (ret) {
+                dev_err(dev->dev, "dma setup request write failed: ret = %d.\n",
+                        ret);
+                return ret;
+        }
+
+        dev->hbm_state = MEI_HBM_DR_SETUP;
+        dev->init_clients_timer = MEI_CLIENTS_INIT_TIMEOUT;
+        mei_schedule_stall_timer(dev);
+        return 0;
+}
+
+/**
  * mei_hbm_enum_clients_req - sends enumeration client request message.
  *
  * @dev: the device structure
@@ -1044,6 +1087,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
         struct hbm_host_version_response *version_res;
         struct hbm_props_response *props_res;
         struct hbm_host_enum_response *enum_res;
+        struct hbm_dma_setup_response *dma_setup_res;
         struct hbm_add_client_request *add_cl_req;
         int ret;
 
@@ -1108,14 +1152,52 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                         return -EPROTO;
                 }
 
-                if (mei_hbm_enum_clients_req(dev)) {
-                        dev_err(dev->dev, "hbm: start: failed to send enumeration request\n");
-                        return -EIO;
+                if (dev->hbm_f_dr_supported) {
+                        if (mei_dmam_ring_alloc(dev))
+                                dev_info(dev->dev, "running w/o dma ring\n");
+                        if (mei_dma_ring_is_allocated(dev)) {
+                                if (mei_hbm_dma_setup_req(dev))
+                                        return -EIO;
+
+                                wake_up(&dev->wait_hbm_start);
+                                break;
+                        }
                 }
 
+                dev->hbm_f_dr_supported = 0;
+                mei_dmam_ring_free(dev);
+
+                if (mei_hbm_enum_clients_req(dev))
+                        return -EIO;
+
                 wake_up(&dev->wait_hbm_start);
                 break;
 
+        case MEI_HBM_DMA_SETUP_RES_CMD:
+                dev_dbg(dev->dev, "hbm: dma setup response: message received.\n");
+
+                dev->init_clients_timer = 0;
+
+                if (dev->hbm_state != MEI_HBM_DR_SETUP) {
+                        dev_err(dev->dev, "hbm: dma setup response: state mismatch, [%d, %d]\n",
+                                dev->dev_state, dev->hbm_state);
+                        return -EPROTO;
+                }
+
+                dma_setup_res = (struct hbm_dma_setup_response *)mei_msg;
+
+                if (dma_setup_res->status) {
+                        dev_info(dev->dev, "hbm: dma setup response: failure = %d %s\n",
+                                 dma_setup_res->status,
+                                 mei_hbm_status_str(dma_setup_res->status));
+                        dev->hbm_f_dr_supported = 0;
+                        mei_dmam_ring_free(dev);
+                }
+
+                if (mei_hbm_enum_clients_req(dev))
+                        return -EIO;
+                break;
+
         case CLIENT_CONNECT_RES_CMD:
                 dev_dbg(dev->dev, "hbm: client connect response: message received.\n");
                 mei_hbm_cl_res(dev, cl_cmd, MEI_FOP_CONNECT);
@@ -1271,8 +1353,8 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                 break;
 
         default:
-                BUG();
-                break;
+                WARN(1, "hbm: wrong command %d\n", mei_msg->hbm_cmd);
+                return -EPROTO;
 
         }
         return 0;
diff --git a/drivers/misc/mei/hbm.h b/drivers/misc/mei/hbm.h
index a2025a5083a3..0171a7e79bab 100644
--- a/drivers/misc/mei/hbm.h
+++ b/drivers/misc/mei/hbm.h
@@ -26,6 +26,7 @@ struct mei_cl;
  *
  * @MEI_HBM_IDLE : protocol not started
  * @MEI_HBM_STARTING : start request message was sent
+ * @MEI_HBM_DR_SETUP : dma ring setup request message was sent
  * @MEI_HBM_ENUM_CLIENTS : enumeration request was sent
  * @MEI_HBM_CLIENT_PROPERTIES : acquiring clients properties
  * @MEI_HBM_STARTED : enumeration was completed
@@ -34,6 +35,7 @@ struct mei_cl;
 enum mei_hbm_state {
         MEI_HBM_IDLE = 0,
         MEI_HBM_STARTING,
+        MEI_HBM_DR_SETUP,
         MEI_HBM_ENUM_CLIENTS,
         MEI_HBM_CLIENT_PROPERTIES,
         MEI_HBM_STARTED,
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 0759c3a668de..3fbbadfa2ae1 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -1471,15 +1471,21 @@ struct mei_device *mei_me_dev_init(struct pci_dev *pdev,
 {
         struct mei_device *dev;
         struct mei_me_hw *hw;
+        int i;
 
         dev = devm_kzalloc(&pdev->dev, sizeof(struct mei_device) +
                            sizeof(struct mei_me_hw), GFP_KERNEL);
         if (!dev)
                 return NULL;
+
         hw = to_me_hw(dev);
 
+        for (i = 0; i < DMA_DSCR_NUM; i++)
+                dev->dr_dscr[i].size = cfg->dma_size[i];
+
         mei_device_init(dev, &pdev->dev, &mei_me_hw_ops);
         hw->cfg = cfg;
+
         return dev;
 }
 
diff --git a/drivers/misc/mei/hw.h b/drivers/misc/mei/hw.h
index 65655925791a..2b7f7677f8cc 100644
--- a/drivers/misc/mei/hw.h
+++ b/drivers/misc/mei/hw.h
@@ -35,7 +35,7 @@
 /*
  * MEI Version
  */
-#define HBM_MINOR_VERSION                   0
+#define HBM_MINOR_VERSION                   1
 #define HBM_MAJOR_VERSION                   2
 
 /*
@@ -206,6 +206,7 @@ enum  mei_cl_disconnect_status {
  * @dma_ring: message is on dma ring
  * @internal: message is internal
  * @msg_complete: last packet of the message
+ * @extension: extension of the header
  */
 struct mei_msg_hdr {
         u32 me_addr:8;
@@ -215,8 +216,11 @@ struct mei_msg_hdr {
         u32 dma_ring:1;
         u32 internal:1;
         u32 msg_complete:1;
+        u32 extension[0];
 } __packed;
 
+#define MEI_MSG_HDR_MAX 2
+
 struct mei_bus_message {
         u8 hbm_cmd;
         u8 data[0];
@@ -512,4 +516,27 @@ struct hbm_dma_setup_response {
         u8 reserved[2];
 } __packed;
 
+/**
+ * struct mei_dma_ring_ctrl - dma ring control block
+ *
+ * @hbuf_wr_idx: host circular buffer write index in slots
+ * @reserved1: reserved for alignment
+ * @hbuf_rd_idx: host circular buffer read index in slots
+ * @reserved2: reserved for alignment
+ * @dbuf_wr_idx: device circular buffer write index in slots
+ * @reserved3: reserved for alignment
+ * @dbuf_rd_idx: device circular buffer read index in slots
+ * @reserved4: reserved for alignment
+ */
+struct hbm_dma_ring_ctrl {
+        u32 hbuf_wr_idx;
+        u32 reserved1;
+        u32 hbuf_rd_idx;
+        u32 reserved2;
+        u32 dbuf_wr_idx;
+        u32 reserved3;
+        u32 dbuf_rd_idx;
+        u32 reserved4;
+} __packed;
+
 #endif
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 4888ebc076b7..eb026e2a0537 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -151,7 +151,7 @@ int mei_reset(struct mei_device *dev)
 
         mei_hbm_reset(dev);
 
-        dev->rd_msg_hdr = 0;
+        memset(dev->rd_msg_hdr, 0, sizeof(dev->rd_msg_hdr));
 
         if (ret) {
                 dev_err(dev->dev, "hw_reset failed ret = %d\n", ret);
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 5a661cbdf2ae..055c2d89b310 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -75,6 +75,8 @@ static inline int mei_cl_hbm_equal(struct mei_cl *cl,
  */
 static void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr)
 {
+        if (hdr->dma_ring)
+                mei_dma_ring_read(dev, NULL, hdr->extension[0]);
         /*
          * no need to check for size as it is guarantied
          * that length fits into rd_msg_buf
@@ -100,6 +102,7 @@ static int mei_cl_irq_read_msg(struct mei_cl *cl,
         struct mei_device *dev = cl->dev;
         struct mei_cl_cb *cb;
         size_t buf_sz;
+        u32 length;
 
         cb = list_first_entry_or_null(&cl->rd_pending, struct mei_cl_cb, list);
         if (!cb) {
@@ -119,25 +122,31 @@ static int mei_cl_irq_read_msg(struct mei_cl *cl,
                 goto discard;
         }
 
-        buf_sz = mei_hdr->length + cb->buf_idx;
+        length = mei_hdr->dma_ring ? mei_hdr->extension[0] : mei_hdr->length;
+
+        buf_sz = length + cb->buf_idx;
         /* catch for integer overflow */
         if (buf_sz < cb->buf_idx) {
                 cl_err(dev, cl, "message is too big len %d idx %zu\n",
-                       mei_hdr->length, cb->buf_idx);
+                       length, cb->buf_idx);
                 cb->status = -EMSGSIZE;
                 goto discard;
         }
 
         if (cb->buf.size < buf_sz) {
                 cl_dbg(dev, cl, "message overflow. size %zu len %d idx %zu\n",
-                        cb->buf.size, mei_hdr->length, cb->buf_idx);
+                        cb->buf.size, length, cb->buf_idx);
                 cb->status = -EMSGSIZE;
                 goto discard;
         }
 
+        if (mei_hdr->dma_ring)
+                mei_dma_ring_read(dev, cb->buf.data + cb->buf_idx, length);
+
+        /*  for DMA read 0 length to generate an interrupt to the device */
         mei_read_slots(dev, cb->buf.data + cb->buf_idx, mei_hdr->length);
 
-        cb->buf_idx += mei_hdr->length;
+        cb->buf_idx += length;
 
         if (mei_hdr->msg_complete) {
                 cl_dbg(dev, cl, "completed read length = %zu\n", cb->buf_idx);
@@ -247,6 +256,9 @@ static inline int hdr_is_valid(u32 msg_hdr)
         if (!msg_hdr || mei_hdr->reserved)
                 return -EBADMSG;
 
+        if (mei_hdr->dma_ring && mei_hdr->length != MEI_SLOT_SIZE)
+                return -EBADMSG;
+
         return 0;
 }
 
@@ -267,20 +279,20 @@ int mei_irq_read_handler(struct mei_device *dev,
         struct mei_cl *cl;
         int ret;
 
-        if (!dev->rd_msg_hdr) {
-                dev->rd_msg_hdr = mei_read_hdr(dev);
+        if (!dev->rd_msg_hdr[0]) {
+                dev->rd_msg_hdr[0] = mei_read_hdr(dev);
                 (*slots)--;
                 dev_dbg(dev->dev, "slots =%08x.\n", *slots);
 
-                ret = hdr_is_valid(dev->rd_msg_hdr);
+                ret = hdr_is_valid(dev->rd_msg_hdr[0]);
                 if (ret) {
                         dev_err(dev->dev, "corrupted message header 0x%08X\n",
-                                dev->rd_msg_hdr);
+                                dev->rd_msg_hdr[0]);
                         goto end;
                 }
         }
 
-        mei_hdr = (struct mei_msg_hdr *)&dev->rd_msg_hdr;
+        mei_hdr = (struct mei_msg_hdr *)dev->rd_msg_hdr;
         dev_dbg(dev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
 
         if (mei_slots2data(*slots) < mei_hdr->length) {
@@ -291,6 +303,12 @@ int mei_irq_read_handler(struct mei_device *dev,
                 goto end;
         }
 
+        if (mei_hdr->dma_ring) {
+                dev->rd_msg_hdr[1] = mei_read_hdr(dev);
+                (*slots)--;
+                mei_hdr->length = 0;
+        }
+
         /*  HBM message */
         if (hdr_is_hbm(mei_hdr)) {
                 ret = mei_hbm_dispatch(dev, mei_hdr);
@@ -324,7 +342,7 @@ int mei_irq_read_handler(struct mei_device *dev,
                         goto reset_slots;
                 }
                 dev_err(dev->dev, "no destination client found 0x%08X\n",
-                                dev->rd_msg_hdr);
+                                dev->rd_msg_hdr[0]);
                 ret = -EBADMSG;
                 goto end;
         }
@@ -334,9 +352,8 @@ int mei_irq_read_handler(struct mei_device *dev,
 
 reset_slots:
         /* reset the number of slots and header */
+        memset(dev->rd_msg_hdr, 0, sizeof(dev->rd_msg_hdr));
         *slots = mei_count_full_read_slots(dev);
-        dev->rd_msg_hdr = 0;
-
         if (*slots == -EOVERFLOW) {
                 /* overflow - reset */
                 dev_err(dev->dev, "resetting due to slots overflow.\n");
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 377397e1b5a5..685b78ce30a5 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -122,6 +122,19 @@ struct mei_msg_data {
         unsigned char *data;
 };
 
+/**
+ * struct mei_dma_dscr - dma address descriptor
+ *
+ * @vaddr: dma buffer virtual address
+ * @daddr: dma buffer physical address
+ * @size : dma buffer size
+ */
+struct mei_dma_dscr {
+        void *vaddr;
+        dma_addr_t daddr;
+        size_t size;
+};
+
 /* Maximum number of processed FW status registers */
 #define MEI_FW_STATUS_MAX 6
 /* Minimal  buffer for FW status string (8 bytes in dw + space or '\0') */
@@ -409,6 +422,7 @@ struct mei_fw_version {
  * @rd_msg_hdr  : read message header storage
  *
  * @hbuf_is_ready : query if the host host/write buffer is ready
+ * @dr_dscr: DMA ring descriptors: TX, RX, and CTRL
  *
  * @version     : HBM protocol version in use
  * @hbm_f_pg_supported  : hbm feature pgi protocol
@@ -483,11 +497,13 @@ struct mei_device {
 #endif /* CONFIG_PM */
 
         unsigned char rd_msg_buf[MEI_RD_MSG_BUF_SIZE];
-        u32 rd_msg_hdr;
+        u32 rd_msg_hdr[MEI_MSG_HDR_MAX];
 
         /* write buffer */
         bool hbuf_is_ready;
 
+        struct mei_dma_dscr dr_dscr[DMA_DSCR_NUM];
+
         struct hbm_version version;
         unsigned int hbm_f_pg_supported:1;
         unsigned int hbm_f_dc_supported:1;
@@ -578,6 +594,14 @@ int mei_restart(struct mei_device *dev);
 void mei_stop(struct mei_device *dev);
 void mei_cancel_work(struct mei_device *dev);
 
+int mei_dmam_ring_alloc(struct mei_device *dev);
+void mei_dmam_ring_free(struct mei_device *dev);
+bool mei_dma_ring_is_allocated(struct mei_device *dev);
+void mei_dma_ring_reset(struct mei_device *dev);
+void mei_dma_ring_read(struct mei_device *dev, unsigned char *buf, u32 len);
+void mei_dma_ring_write(struct mei_device *dev, unsigned char *buf, u32 len);
+u32 mei_dma_ring_empty_slots(struct mei_device *dev);
+
 /*
  *  MEI interrupt functions prototype
  */
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index ea4e152270a3..73ace2d59dea 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -98,9 +98,9 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
 
-        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH12_CFG)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
 
         /* required last entry */
diff --git a/drivers/misc/mic/card/mic_debugfs.c b/drivers/misc/mic/card/mic_debugfs.c
index 421b3d7911df..7a4140874888 100644
--- a/drivers/misc/mic/card/mic_debugfs.c
+++ b/drivers/misc/mic/card/mic_debugfs.c
@@ -37,9 +37,9 @@
 static struct dentry *mic_dbg;
 
 /**
- * mic_intr_test - Send interrupts to host.
+ * mic_intr_show - Send interrupts to host.
  */
-static int mic_intr_test(struct seq_file *s, void *unused)
+static int mic_intr_show(struct seq_file *s, void *unused)
 {
         struct mic_driver *mdrv = s->private;
         struct mic_device *mdev = &mdrv->mdev;
@@ -56,23 +56,7 @@ static int mic_intr_test(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int mic_intr_test_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_intr_test, inode->i_private);
-}
-
-static int mic_intr_test_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations intr_test_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_intr_test_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_intr_test_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_intr);
 
 /**
  * mic_create_card_debug_dir - Initialize MIC debugfs entries.
@@ -91,7 +75,7 @@ void __init mic_create_card_debug_dir(struct mic_driver *mdrv)
         }
 
         d = debugfs_create_file("intr_test", 0444, mdrv->dbg_dir,
-                mdrv, &intr_test_ops);
+                mdrv, &mic_intr_fops);
 
         if (!d) {
                 dev_err(mdrv->dev,
diff --git a/drivers/misc/mic/cosm/cosm_debugfs.c b/drivers/misc/mic/cosm/cosm_debugfs.c
index 216cb3cd2fe3..71c216d0504d 100644
--- a/drivers/misc/mic/cosm/cosm_debugfs.c
+++ b/drivers/misc/mic/cosm/cosm_debugfs.c
@@ -28,12 +28,12 @@
 static struct dentry *cosm_dbg;
 
 /**
- * cosm_log_buf_show - Display MIC kernel log buffer
+ * log_buf_show - Display MIC kernel log buffer
  *
  * log_buf addr/len is read from System.map by user space
  * and populated in sysfs entries.
  */
-static int cosm_log_buf_show(struct seq_file *s, void *unused)
+static int log_buf_show(struct seq_file *s, void *unused)
 {
         void __iomem *log_buf_va;
         int __iomem *log_buf_len_va;
@@ -78,26 +78,15 @@ done:
         return 0;
 }
 
-static int cosm_log_buf_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cosm_log_buf_show, inode->i_private);
-}
-
-static const struct file_operations log_buf_ops = {
-        .owner   = THIS_MODULE,
-        .open    = cosm_log_buf_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = single_release
-};
+DEFINE_SHOW_ATTRIBUTE(log_buf);
 
 /**
- * cosm_force_reset_show - Force MIC reset
+ * force_reset_show - Force MIC reset
  *
  * Invokes the force_reset COSM bus op instead of the standard reset
  * op in case a force reset of the MIC device is required
  */
-static int cosm_force_reset_show(struct seq_file *s, void *pos)
+static int force_reset_show(struct seq_file *s, void *pos)
 {
         struct cosm_device *cdev = s->private;
 
@@ -105,18 +94,7 @@ static int cosm_force_reset_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int cosm_force_reset_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, cosm_force_reset_show, inode->i_private);
-}
-
-static const struct file_operations force_reset_ops = {
-        .owner   = THIS_MODULE,
-        .open    = cosm_force_reset_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = single_release
-};
+DEFINE_SHOW_ATTRIBUTE(force_reset);
 
 void cosm_create_debug_dir(struct cosm_device *cdev)
 {
@@ -130,9 +108,10 @@ void cosm_create_debug_dir(struct cosm_device *cdev)
         if (!cdev->dbg_dir)
                 return;
 
-        debugfs_create_file("log_buf", 0444, cdev->dbg_dir, cdev, &log_buf_ops);
+        debugfs_create_file("log_buf", 0444, cdev->dbg_dir, cdev,
+                            &log_buf_fops);
         debugfs_create_file("force_reset", 0444, cdev->dbg_dir, cdev,
-                            &force_reset_ops);
+                            &force_reset_fops);
 }
 
 void cosm_delete_debug_dir(struct cosm_device *cdev)
diff --git a/drivers/misc/mic/host/mic_debugfs.c b/drivers/misc/mic/host/mic_debugfs.c
index 0a9daba8bb5d..c6e3c764699f 100644
--- a/drivers/misc/mic/host/mic_debugfs.c
+++ b/drivers/misc/mic/host/mic_debugfs.c
@@ -54,23 +54,7 @@ static int mic_smpt_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int mic_smpt_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_smpt_show, inode->i_private);
-}
-
-static int mic_smpt_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations smpt_file_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_smpt_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_smpt_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_smpt);
 
 static int mic_post_code_show(struct seq_file *s, void *pos)
 {
@@ -81,23 +65,7 @@ static int mic_post_code_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int mic_post_code_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_post_code_show, inode->i_private);
-}
-
-static int mic_post_code_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations post_code_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_post_code_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_post_code_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_post_code);
 
 static int mic_msi_irq_info_show(struct seq_file *s, void *pos)
 {
@@ -143,24 +111,7 @@ static int mic_msi_irq_info_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int mic_msi_irq_info_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_msi_irq_info_show, inode->i_private);
-}
-
-static int
-mic_msi_irq_info_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations msi_irq_info_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_msi_irq_info_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_msi_irq_info_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(mic_msi_irq_info);
 
 /**
  * mic_create_debug_dir - Initialize MIC debugfs entries.
@@ -177,13 +128,14 @@ void mic_create_debug_dir(struct mic_device *mdev)
         if (!mdev->dbg_dir)
                 return;
 
-        debugfs_create_file("smpt", 0444, mdev->dbg_dir, mdev, &smpt_file_ops);
+        debugfs_create_file("smpt", 0444, mdev->dbg_dir, mdev,
+                            &mic_smpt_fops);
 
         debugfs_create_file("post_code", 0444, mdev->dbg_dir, mdev,
-                            &post_code_ops);
+                            &mic_post_code_fops);
 
         debugfs_create_file("msi_irq_info", 0444, mdev->dbg_dir, mdev,
-                            &msi_irq_info_ops);
+                            &mic_msi_irq_info_fops);
 }
 
 /**
diff --git a/drivers/misc/mic/scif/scif_debugfs.c b/drivers/misc/mic/scif/scif_debugfs.c
index 6884dad97e17..cca5e980c710 100644
--- a/drivers/misc/mic/scif/scif_debugfs.c
+++ b/drivers/misc/mic/scif/scif_debugfs.c
@@ -24,7 +24,7 @@
 /* Debugfs parent dir */
 static struct dentry *scif_dbg;
 
-static int scif_dev_test(struct seq_file *s, void *unused)
+static int scif_dev_show(struct seq_file *s, void *unused)
 {
         int node;
 
@@ -44,23 +44,7 @@ static int scif_dev_test(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int scif_dev_test_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, scif_dev_test, inode->i_private);
-}
-
-static int scif_dev_test_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations scif_dev_ops = {
-        .owner   = THIS_MODULE,
-        .open    = scif_dev_test_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = scif_dev_test_release
-};
+DEFINE_SHOW_ATTRIBUTE(scif_dev);
 
 static void scif_display_window(struct scif_window *window, struct seq_file *s)
 {
@@ -104,7 +88,7 @@ static void scif_display_all_windows(struct list_head *head, struct seq_file *s)
         }
 }
 
-static int scif_rma_test(struct seq_file *s, void *unused)
+static int scif_rma_show(struct seq_file *s, void *unused)
 {
         struct scif_endpt *ep;
         struct list_head *pos;
@@ -123,23 +107,7 @@ static int scif_rma_test(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int scif_rma_test_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, scif_rma_test, inode->i_private);
-}
-
-static int scif_rma_test_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations scif_rma_ops = {
-        .owner   = THIS_MODULE,
-        .open    = scif_rma_test_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = scif_rma_test_release
-};
+DEFINE_SHOW_ATTRIBUTE(scif_rma);
 
 void __init scif_init_debugfs(void)
 {
@@ -150,8 +118,8 @@ void __init scif_init_debugfs(void)
                 return;
         }
 
-        debugfs_create_file("scif_dev", 0444, scif_dbg, NULL, &scif_dev_ops);
-        debugfs_create_file("scif_rma", 0444, scif_dbg, NULL, &scif_rma_ops);
+        debugfs_create_file("scif_dev", 0444, scif_dbg, NULL, &scif_dev_fops);
+        debugfs_create_file("scif_rma", 0444, scif_dbg, NULL, &scif_rma_fops);
         debugfs_create_u8("en_msg_log", 0666, scif_dbg, &scif_info.en_msg_log);
         debugfs_create_u8("p2p_enable", 0666, scif_dbg, &scif_info.p2p_enable);
 }
diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c
index 7bb929f05d85..2e7ce6ae9dd2 100644
--- a/drivers/misc/mic/scif/scif_fence.c
+++ b/drivers/misc/mic/scif/scif_fence.c
@@ -195,10 +195,11 @@ static inline void *scif_get_local_va(off_t off, struct scif_window *window)
 
 static void scif_prog_signal_cb(void *arg)
 {
-        struct scif_status *status = arg;
+        struct scif_cb_arg *cb_arg = arg;
 
-        dma_pool_free(status->ep->remote_dev->signal_pool, status,
-                      status->src_dma_addr);
+        dma_pool_free(cb_arg->ep->remote_dev->signal_pool, cb_arg->status,
+                      cb_arg->src_dma_addr);
+        kfree(cb_arg);
 }
 
 static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
@@ -209,6 +210,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
         bool x100 = !is_dma_copy_aligned(chan->device, 1, 1, 1);
         struct dma_async_tx_descriptor *tx;
         struct scif_status *status = NULL;
+        struct scif_cb_arg *cb_arg = NULL;
         dma_addr_t src;
         dma_cookie_t cookie;
         int err;
@@ -257,8 +259,16 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
                 goto dma_fail;
         }
         if (!x100) {
+                cb_arg = kmalloc(sizeof(*cb_arg), GFP_KERNEL);
+                if (!cb_arg) {
+                        err = -ENOMEM;
+                        goto dma_fail;
+                }
+                cb_arg->src_dma_addr = src;
+                cb_arg->status = status;
+                cb_arg->ep = ep;
                 tx->callback = scif_prog_signal_cb;
-                tx->callback_param = status;
+                tx->callback_param = cb_arg;
         }
         cookie = tx->tx_submit(tx);
         if (dma_submit_error(cookie)) {
@@ -270,9 +280,11 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
         dma_async_issue_pending(chan);
         return 0;
 dma_fail:
-        if (!x100)
+        if (!x100) {
                 dma_pool_free(ep->remote_dev->signal_pool, status,
                               src - offsetof(struct scif_status, val));
+                kfree(cb_arg);
+        }
 alloc_fail:
         return err;
 }
diff --git a/drivers/misc/mic/scif/scif_rma.h b/drivers/misc/mic/scif/scif_rma.h
index fa6722279196..84af3033a473 100644
--- a/drivers/misc/mic/scif/scif_rma.h
+++ b/drivers/misc/mic/scif/scif_rma.h
@@ -206,6 +206,19 @@ struct scif_status {
 };
 
 /*
+ * struct scif_cb_arg - Stores the argument of the callback func
+ *
+ * @src_dma_addr: Source buffer DMA address
+ * @status: DMA status
+ * @ep: SCIF endpoint
+ */
+struct scif_cb_arg {
+        dma_addr_t src_dma_addr;
+        struct scif_status *status;
+        struct scif_endpt *ep;
+};
+
+/*
  * struct scif_window - Registration Window for Self and Remote
  *
  * @nr_pages: Number of pages which is defined as a s64 instead of an int
diff --git a/drivers/misc/mic/vop/vop_debugfs.c b/drivers/misc/mic/vop/vop_debugfs.c
index ab43884e5cd7..2ccef52aca23 100644
--- a/drivers/misc/mic/vop/vop_debugfs.c
+++ b/drivers/misc/mic/vop/vop_debugfs.c
@@ -101,23 +101,7 @@ static int vop_dp_show(struct seq_file *s, void *pos)
         return 0;
 }
 
-static int vop_dp_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, vop_dp_show, inode->i_private);
-}
-
-static int vop_dp_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations dp_ops = {
-        .owner   = THIS_MODULE,
-        .open    = vop_dp_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = vop_dp_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(vop_dp);
 
 static int vop_vdev_info_show(struct seq_file *s, void *unused)
 {
@@ -194,23 +178,7 @@ static int vop_vdev_info_show(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int vop_vdev_info_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, vop_vdev_info_show, inode->i_private);
-}
-
-static int vop_vdev_info_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations vdev_info_ops = {
-        .owner   = THIS_MODULE,
-        .open    = vop_vdev_info_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = vop_vdev_info_debug_release
-};
+DEFINE_SHOW_ATTRIBUTE(vop_vdev_info);
 
 void vop_init_debugfs(struct vop_info *vi)
 {
@@ -222,8 +190,8 @@ void vop_init_debugfs(struct vop_info *vi)
                 pr_err("can't create debugfs dir vop\n");
                 return;
         }
-        debugfs_create_file("dp", 0444, vi->dbg, vi, &dp_ops);
-        debugfs_create_file("vdev_info", 0444, vi->dbg, vi, &vdev_info_ops);
+        debugfs_create_file("dp", 0444, vi->dbg, vi, &vop_dp_fops);
+        debugfs_create_file("vdev_info", 0444, vi->dbg, vi, &vop_vdev_info_fops);
 }
 
 void vop_exit_debugfs(struct vop_info *vi)
diff --git a/drivers/misc/pvpanic.c b/drivers/misc/pvpanic.c
new file mode 100644
index 000000000000..595ac065b401
--- /dev/null
+++ b/drivers/misc/pvpanic.c
@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ *  Pvpanic Device Support
+ *
+ *  Copyright (C) 2013 Fujitsu.
+ *  Copyright (C) 2018 ZTE.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/acpi.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/platform_device.h>
+#include <linux/types.h>
+
+static void __iomem *base;
+
+#define PVPANIC_PANICKED        (1 << 0)
+
+MODULE_AUTHOR("Hu Tao <hutao@cn.fujitsu.com>");
+MODULE_DESCRIPTION("pvpanic device driver");
+MODULE_LICENSE("GPL");
+
+static void
+pvpanic_send_event(unsigned int event)
+{
+        iowrite8(event, base);
+}
+
+static int
+pvpanic_panic_notify(struct notifier_block *nb, unsigned long code,
+                     void *unused)
+{
+        pvpanic_send_event(PVPANIC_PANICKED);
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block pvpanic_panic_nb = {
+        .notifier_call = pvpanic_panic_notify,
+        .priority = 1, /* let this called before broken drm_fb_helper */
+};
+
+#ifdef CONFIG_ACPI
+static int pvpanic_add(struct acpi_device *device);
+static int pvpanic_remove(struct acpi_device *device);
+
+static const struct acpi_device_id pvpanic_device_ids[] = {
+        { "QEMU0001", 0 },
+        { "", 0 }
+};
+MODULE_DEVICE_TABLE(acpi, pvpanic_device_ids);
+
+static struct acpi_driver pvpanic_driver = {
+        .name =         "pvpanic",
+        .class =        "QEMU",
+        .ids =          pvpanic_device_ids,
+        .ops =          {
+                                .add =          pvpanic_add,
+                                .remove =       pvpanic_remove,
+                        },
+        .owner =        THIS_MODULE,
+};
+
+static acpi_status
+pvpanic_walk_resources(struct acpi_resource *res, void *context)
+{
+        struct resource r;
+
+        if (acpi_dev_resource_io(res, &r)) {
+                base = ioport_map(r.start, resource_size(&r));
+                return AE_OK;
+        } else if (acpi_dev_resource_memory(res, &r)) {
+                base = ioremap(r.start, resource_size(&r));
+                return AE_OK;
+        }
+
+        return AE_ERROR;
+}
+
+static int pvpanic_add(struct acpi_device *device)
+{
+        int ret;
+
+        ret = acpi_bus_get_status(device);
+        if (ret < 0)
+                return ret;
+
+        if (!device->status.enabled || !device->status.functional)
+                return -ENODEV;
+
+        acpi_walk_resources(device->handle, METHOD_NAME__CRS,
+                            pvpanic_walk_resources, NULL);
+
+        if (!base)
+                return -ENODEV;
+
+        atomic_notifier_chain_register(&panic_notifier_list,
+                                       &pvpanic_panic_nb);
+
+        return 0;
+}
+
+static int pvpanic_remove(struct acpi_device *device)
+{
+
+        atomic_notifier_chain_unregister(&panic_notifier_list,
+                                         &pvpanic_panic_nb);
+        iounmap(base);
+
+        return 0;
+}
+
+static int pvpanic_register_acpi_driver(void)
+{
+        return acpi_bus_register_driver(&pvpanic_driver);
+}
+
+static void pvpanic_unregister_acpi_driver(void)
+{
+        acpi_bus_unregister_driver(&pvpanic_driver);
+}
+#else
+static int pvpanic_register_acpi_driver(void)
+{
+        return -ENODEV;
+}
+
+static void pvpanic_unregister_acpi_driver(void) {}
+#endif
+
+static int pvpanic_mmio_probe(struct platform_device *pdev)
+{
+        struct resource *mem;
+
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!mem)
+                return -EINVAL;
+
+        base = devm_ioremap_resource(&pdev->dev, mem);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        atomic_notifier_chain_register(&panic_notifier_list,
+                                       &pvpanic_panic_nb);
+
+        return 0;
+}
+
+static int pvpanic_mmio_remove(struct platform_device *pdev)
+{
+
+        atomic_notifier_chain_unregister(&panic_notifier_list,
+                                         &pvpanic_panic_nb);
+
+        return 0;
+}
+
+static const struct of_device_id pvpanic_mmio_match[] = {
+        { .compatible = "qemu,pvpanic-mmio", },
+        {}
+};
+
+static struct platform_driver pvpanic_mmio_driver = {
+        .driver = {
+                .name = "pvpanic-mmio",
+                .of_match_table = pvpanic_mmio_match,
+        },
+        .probe = pvpanic_mmio_probe,
+        .remove = pvpanic_mmio_remove,
+};
+
+static int __init pvpanic_mmio_init(void)
+{
+        if (acpi_disabled)
+                return platform_driver_register(&pvpanic_mmio_driver);
+        else
+                return pvpanic_register_acpi_driver();
+}
+
+static void __exit pvpanic_mmio_exit(void)
+{
+        if (acpi_disabled)
+                platform_driver_unregister(&pvpanic_mmio_driver);
+        else
+                pvpanic_unregister_acpi_driver();
+}
+
+module_init(pvpanic_mmio_init);
+module_exit(pvpanic_mmio_exit);
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 1874ac922166..e7cfdbd1f66d 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -211,7 +211,7 @@ static void kim_int_recv(struct kim_data_s *kim_gdata,
 static long read_local_version(struct kim_data_s *kim_gdata, char *bts_scr_name)
 {
         unsigned short version = 0, chip = 0, min_ver = 0, maj_ver = 0;
-        const char read_ver_cmd[] = { 0x01, 0x01, 0x10, 0x00 };
+        static const char read_ver_cmd[] = { 0x01, 0x01, 0x10, 0x00 };
         long timeout;
 
         pr_debug("%s", __func__);
@@ -564,7 +564,7 @@ long st_kim_stop(void *kim_data)
 /* functions called from subsystems */
 /* called when debugfs entry is read from */
 
-static int show_version(struct seq_file *s, void *unused)
+static int version_show(struct seq_file *s, void *unused)
 {
         struct kim_data_s *kim_gdata = (struct kim_data_s *)s->private;
         seq_printf(s, "%04X %d.%d.%d\n", kim_gdata->version.full,
@@ -573,7 +573,7 @@ static int show_version(struct seq_file *s, void *unused)
         return 0;
 }
 
-static int show_list(struct seq_file *s, void *unused)
+static int list_show(struct seq_file *s, void *unused)
 {
         struct kim_data_s *kim_gdata = (struct kim_data_s *)s->private;
         kim_st_list_protocols(kim_gdata->core_data, s);
@@ -688,30 +688,8 @@ err:
         *core_data = NULL;
 }
 
-static int kim_version_open(struct inode *i, struct file *f)
-{
-        return single_open(f, show_version, i->i_private);
-}
-
-static int kim_list_open(struct inode *i, struct file *f)
-{
-        return single_open(f, show_list, i->i_private);
-}
-
-static const struct file_operations version_debugfs_fops = {
-        /* version info */
-        .open = kim_version_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-static const struct file_operations list_debugfs_fops = {
-        /* protocols info */
-        .open = kim_list_open,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(version);
+DEFINE_SHOW_ATTRIBUTE(list);
 
 /**********************************************************************/
 /* functions called from platform device driver subsystem
@@ -789,9 +767,9 @@ static int kim_probe(struct platform_device *pdev)
         }
 
         debugfs_create_file("version", S_IRUGO, kim_debugfs_dir,
-                                kim_gdata, &version_debugfs_fops);
+                                kim_gdata, &version_fops);
         debugfs_create_file("protocols", S_IRUGO, kim_debugfs_dir,
-                                kim_gdata, &list_debugfs_fops);
+                                kim_gdata, &list_fops);
         return 0;
 
 err_sysfs_group:
diff --git a/drivers/misc/vexpress-syscfg.c b/drivers/misc/vexpress-syscfg.c
index 6c3591cdf855..a3c6c773d9dc 100644
--- a/drivers/misc/vexpress-syscfg.c
+++ b/drivers/misc/vexpress-syscfg.c
@@ -61,7 +61,7 @@ static int vexpress_syscfg_exec(struct vexpress_syscfg_func *func,
         int tries;
         long timeout;
 
-        if (WARN_ON(index > func->num_templates))
+        if (WARN_ON(index >= func->num_templates))
                 return -EINVAL;
 
         command = readl(syscfg->base + SYS_CFGCTRL);
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
index e6126a4b95d3..f8240b87df22 100644
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -1470,18 +1470,7 @@ static int vmballoon_debug_show(struct seq_file *f, void *offset)
         return 0;
 }
 
-static int vmballoon_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, vmballoon_debug_show, inode->i_private);
-}
-
-static const struct file_operations vmballoon_debug_fops = {
-        .owner          = THIS_MODULE,
-        .open           = vmballoon_debug_open,
-        .read           = seq_read,
-        .llseek         = seq_lseek,
-        .release        = single_release,
-};
+DEFINE_SHOW_ATTRIBUTE(vmballoon_debug);
 
 static int __init vmballoon_debugfs_init(struct vmballoon *b)
 {
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index edfffc9699ba..5da1f3e3f997 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -750,19 +750,10 @@ static int vmci_host_do_ctx_set_cpt_state(struct vmci_host_dev *vmci_host_dev,
         if (copy_from_user(&set_info, uptr, sizeof(set_info)))
                 return -EFAULT;
 
-        cpt_buf = kmalloc(set_info.buf_size, GFP_KERNEL);
-        if (!cpt_buf) {
-                vmci_ioctl_err(
-                        "cannot allocate memory to set cpt state (type=%d)\n",
-                        set_info.cpt_type);
-                return -ENOMEM;
-        }
-
-        if (copy_from_user(cpt_buf, (void __user *)(uintptr_t)set_info.cpt_buf,
-                           set_info.buf_size)) {
-                retval = -EFAULT;
-                goto out;
-        }
+        cpt_buf = memdup_user((void __user *)(uintptr_t)set_info.cpt_buf,
+                                set_info.buf_size);
+        if (IS_ERR(cpt_buf))
+                return PTR_ERR(cpt_buf);
 
         cid = vmci_ctx_get_id(vmci_host_dev->context);
         set_info.result = vmci_ctx_set_chkpt_state(cid, set_info.cpt_type,
@@ -770,7 +761,6 @@ static int vmci_host_do_ctx_set_cpt_state(struct vmci_host_dev *vmci_host_dev,
 
         retval = copy_to_user(uptr, &set_info, sizeof(set_info)) ? -EFAULT : 0;
 
-out:
         kfree(cpt_buf);
         return retval;
 }
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index 1e18c9639c3e..79a8ff542883 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -1,5 +1,6 @@
 menuconfig MTD
         tristate "Memory Technology Device (MTD) support"
+        imply NVMEM
         help
           Memory Technology Devices are flash, RAM and similar chips, often
           used for solid state file systems on embedded devices. This option
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index b6b93291aba9..21e3cdc04036 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -41,6 +41,7 @@
 #include <linux/reboot.h>
 #include <linux/leds.h>
 #include <linux/debugfs.h>
+#include <linux/nvmem-provider.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
@@ -488,6 +489,50 @@ int mtd_pairing_groups(struct mtd_info *mtd)
 }
 EXPORT_SYMBOL_GPL(mtd_pairing_groups);
 
+static int mtd_nvmem_reg_read(void *priv, unsigned int offset,
+                              void *val, size_t bytes)
+{
+        struct mtd_info *mtd = priv;
+        size_t retlen;
+        int err;
+
+        err = mtd_read(mtd, offset, bytes, &retlen, val);
+        if (err && err != -EUCLEAN)
+                return err;
+
+        return retlen == bytes ? 0 : -EIO;
+}
+
+static int mtd_nvmem_add(struct mtd_info *mtd)
+{
+        struct nvmem_config config = {};
+
+        config.dev = &mtd->dev;
+        config.name = mtd->name;
+        config.owner = THIS_MODULE;
+        config.reg_read = mtd_nvmem_reg_read;
+        config.size = mtd->size;
+        config.word_size = 1;
+        config.stride = 1;
+        config.read_only = true;
+        config.root_only = true;
+        config.no_of_node = true;
+        config.priv = mtd;
+
+        mtd->nvmem = nvmem_register(&config);
+        if (IS_ERR(mtd->nvmem)) {
+                /* Just ignore if there is no NVMEM support in the kernel */
+                if (PTR_ERR(mtd->nvmem) == -ENOSYS) {
+                        mtd->nvmem = NULL;
+                } else {
+                        dev_err(&mtd->dev, "Failed to register NVMEM device\n");
+                        return PTR_ERR(mtd->nvmem);
+                }
+        }
+
+        return 0;
+}
+
 static struct dentry *dfs_dir_mtd;
 
 /**
@@ -570,6 +615,11 @@ int add_mtd_device(struct mtd_info *mtd)
         if (error)
                 goto fail_added;
 
+        /* Add the nvmem provider */
+        error = mtd_nvmem_add(mtd);
+        if (error)
+                goto fail_nvmem_add;
+
         if (!IS_ERR_OR_NULL(dfs_dir_mtd)) {
                 mtd->dbg.dfs_dir = debugfs_create_dir(dev_name(&mtd->dev), dfs_dir_mtd);
                 if (IS_ERR_OR_NULL(mtd->dbg.dfs_dir)) {
@@ -595,6 +645,8 @@ int add_mtd_device(struct mtd_info *mtd)
         __module_get(THIS_MODULE);
         return 0;
 
+fail_nvmem_add:
+        device_unregister(&mtd->dev);
 fail_added:
         of_node_put(mtd_get_of_node(mtd));
         idr_remove(&mtd_idr, i);
@@ -637,6 +689,10 @@ int del_mtd_device(struct mtd_info *mtd)
                        mtd->index, mtd->name, mtd->usecount);
                 ret = -EBUSY;
         } else {
+                /* Try to remove the NVMEM provider */
+                if (mtd->nvmem)
+                        nvmem_unregister(mtd->nvmem);
+
                 device_unregister(&mtd->dev);
 
                 idr_remove(&mtd_idr, mtd->index);
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 27f67dfa649d..f7301bb4ef3b 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -28,6 +28,7 @@ struct nvmem_device {
         size_t                  size;
         bool                    read_only;
         int                     flags;
+        enum nvmem_type         type;
         struct bin_attribute    eeprom;
         struct device           *base_dev;
         struct list_head        cells;
@@ -60,6 +61,13 @@ static LIST_HEAD(nvmem_lookup_list);
 
 static BLOCKING_NOTIFIER_HEAD(nvmem_notifier);
 
+static const char * const nvmem_type_str[] = {
+        [NVMEM_TYPE_UNKNOWN] = "Unknown",
+        [NVMEM_TYPE_EEPROM] = "EEPROM",
+        [NVMEM_TYPE_OTP] = "OTP",
+        [NVMEM_TYPE_BATTERY_BACKED] = "Battery backed",
+};
+
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key eeprom_lock_key;
 #endif
@@ -83,6 +91,21 @@ static int nvmem_reg_write(struct nvmem_device *nvmem, unsigned int offset,
         return -EINVAL;
 }
 
+static ssize_t type_show(struct device *dev,
+                         struct device_attribute *attr, char *buf)
+{
+        struct nvmem_device *nvmem = to_nvmem_device(dev);
+
+        return sprintf(buf, "%s\n", nvmem_type_str[nvmem->type]);
+}
+
+static DEVICE_ATTR_RO(type);
+
+static struct attribute *nvmem_attrs[] = {
+        &dev_attr_type.attr,
+        NULL,
+};
+
 static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
                                     struct bin_attribute *attr,
                                     char *buf, loff_t pos, size_t count)
@@ -168,6 +191,7 @@ static struct bin_attribute *nvmem_bin_rw_attributes[] = {
 
 static const struct attribute_group nvmem_bin_rw_group = {
         .bin_attrs      = nvmem_bin_rw_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_rw_dev_groups[] = {
@@ -191,6 +215,7 @@ static struct bin_attribute *nvmem_bin_ro_attributes[] = {
 
 static const struct attribute_group nvmem_bin_ro_group = {
         .bin_attrs      = nvmem_bin_ro_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_ro_dev_groups[] = {
@@ -215,6 +240,7 @@ static struct bin_attribute *nvmem_bin_rw_root_attributes[] = {
 
 static const struct attribute_group nvmem_bin_rw_root_group = {
         .bin_attrs      = nvmem_bin_rw_root_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_rw_root_dev_groups[] = {
@@ -238,6 +264,7 @@ static struct bin_attribute *nvmem_bin_ro_root_attributes[] = {
 
 static const struct attribute_group nvmem_bin_ro_root_group = {
         .bin_attrs      = nvmem_bin_ro_root_attributes,
+        .attrs          = nvmem_attrs,
 };
 
 static const struct attribute_group *nvmem_ro_root_dev_groups[] = {
@@ -605,9 +632,11 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
         nvmem->dev.bus = &nvmem_bus_type;
         nvmem->dev.parent = config->dev;
         nvmem->priv = config->priv;
+        nvmem->type = config->type;
         nvmem->reg_read = config->reg_read;
         nvmem->reg_write = config->reg_write;
-        nvmem->dev.of_node = config->dev->of_node;
+        if (!config->no_of_node)
+                nvmem->dev.of_node = config->dev->of_node;
 
         if (config->id == -1 && config->name) {
                 dev_set_name(&nvmem->dev, "%s", config->name);
diff --git a/drivers/nvmem/meson-efuse.c b/drivers/nvmem/meson-efuse.c
index d769840d1e18..99372768446b 100644
--- a/drivers/nvmem/meson-efuse.c
+++ b/drivers/nvmem/meson-efuse.c
@@ -14,6 +14,7 @@
  * more details.
  */
 
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/nvmem-provider.h>
 #include <linux/of.h>
@@ -46,10 +47,36 @@ static int meson_efuse_probe(struct platform_device *pdev)
         struct device *dev = &pdev->dev;
         struct nvmem_device *nvmem;
         struct nvmem_config *econfig;
+        struct clk *clk;
         unsigned int size;
+        int ret;
 
-        if (meson_sm_call(SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0)
+        clk = devm_clk_get(dev, NULL);
+        if (IS_ERR(clk)) {
+                ret = PTR_ERR(clk);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "failed to get efuse gate");
+                return ret;
+        }
+
+        ret = clk_prepare_enable(clk);
+        if (ret) {
+                dev_err(dev, "failed to enable gate");
+                return ret;
+        }
+
+        ret = devm_add_action_or_reset(dev,
+                                       (void(*)(void *))clk_disable_unprepare,
+                                       clk);
+        if (ret) {
+                dev_err(dev, "failed to add disable callback");
+                return ret;
+        }
+
+        if (meson_sm_call(SM_EFUSE_USER_MAX, &size, 0, 0, 0, 0, 0) < 0) {
+                dev_err(dev, "failed to get max user");
                 return -EINVAL;
+        }
 
         econfig = devm_kzalloc(dev, sizeof(*econfig), GFP_KERNEL);
         if (!econfig)
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index 380916bff9e0..9c8249f74479 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -1667,7 +1667,7 @@ static int parport_ECP_supported(struct parport *pb)
         default:
                 printk(KERN_WARNING "0x%lx: Unknown implementation ID\n",
                         pb->base);
-                /* Assume 1 */
+                /* Fall through - Assume 1 */
         case 1:
                 pword = 1;
         }
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 921db6f80340..e1949f7efd9c 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -789,6 +789,24 @@ static void pci_acpi_optimize_delay(struct pci_dev *pdev,
         ACPI_FREE(obj);
 }
 
+static void pci_acpi_set_untrusted(struct pci_dev *dev)
+{
+        u8 val;
+
+        if (pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT)
+                return;
+        if (device_property_read_u8(&dev->dev, "ExternalFacingPort", &val))
+                return;
+
+        /*
+         * These root ports expose PCIe (including DMA) outside of the
+         * system so make sure we treat them and everything behind as
+         * untrusted.
+         */
+        if (val)
+                dev->untrusted = 1;
+}
+
 static void pci_acpi_setup(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
@@ -798,6 +816,7 @@ static void pci_acpi_setup(struct device *dev)
                 return;
 
         pci_acpi_optimize_delay(pci_dev, adev->handle);
+        pci_acpi_set_untrusted(pci_dev);
 
         pci_acpi_add_pm_notifier(adev, pci_dev);
         if (!adev->wakeup.flags.valid)
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index b1c05b5054a0..257b9f6f2ebb 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1378,6 +1378,19 @@ static void set_pcie_thunderbolt(struct pci_dev *dev)
         }
 }
 
+static void set_pcie_untrusted(struct pci_dev *dev)
+{
+        struct pci_dev *parent;
+
+        /*
+         * If the upstream bridge is untrusted we treat this device
+         * untrusted as well.
+         */
+        parent = pci_upstream_bridge(dev);
+        if (parent && parent->untrusted)
+                dev->untrusted = true;
+}
+
 /**
  * pci_ext_cfg_is_aliased - Is ext config space just an alias of std config?
  * @dev: PCI device
@@ -1638,6 +1651,8 @@ int pci_setup_device(struct pci_dev *dev)
         /* Need to have dev->cfg_size ready */
         set_pcie_thunderbolt(dev);
 
+        set_pcie_untrusted(dev);
+
         /* "Unknown power state" */
         dev->current_state = PCI_UNKNOWN;
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 45ef4d22f14c..e3b62c2ee8d1 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -1172,14 +1172,6 @@ config INTEL_SMARTCONNECT
           This driver checks to determine whether the device has Intel Smart
           Connect enabled, and if so disables it.
 
-config PVPANIC
-        tristate "pvpanic device support"
-        depends on ACPI
-        ---help---
-          This driver provides support for the pvpanic device.  pvpanic is
-          a paravirtualized device provided by QEMU; it lets a virtual machine
-          (guest) communicate panic events to the host.
-
 config INTEL_PMC_IPC
         tristate "Intel PMC IPC Driver"
         depends on ACPI
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index d841c550e3cc..ce8da260c223 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -79,7 +79,6 @@ obj-$(CONFIG_APPLE_GMUX)	+= apple-gmux.o
 obj-$(CONFIG_INTEL_RST)         += intel-rst.o
 obj-$(CONFIG_INTEL_SMARTCONNECT)        += intel-smartconnect.o
 
-obj-$(CONFIG_PVPANIC)           += pvpanic.o
 obj-$(CONFIG_ALIENWARE_WMI)     += alienware-wmi.o
 obj-$(CONFIG_INTEL_PMC_IPC)     += intel_pmc_ipc.o
 obj-$(CONFIG_TOUCHSCREEN_DMI)   += touchscreen_dmi.o
diff --git a/drivers/platform/x86/pvpanic.c b/drivers/platform/x86/pvpanic.c
deleted file mode 100644
index fd86daba7ffd..000000000000
--- a/drivers/platform/x86/pvpanic.c
+++ /dev/null
@@ -1,124 +0,0 @@
-/*
- *  pvpanic.c - pvpanic Device Support
- *
- *  Copyright (C) 2013 Fujitsu.
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
- *  (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/types.h>
-#include <linux/acpi.h>
-
-MODULE_AUTHOR("Hu Tao <hutao@cn.fujitsu.com>");
-MODULE_DESCRIPTION("pvpanic device driver");
-MODULE_LICENSE("GPL");
-
-static int pvpanic_add(struct acpi_device *device);
-static int pvpanic_remove(struct acpi_device *device);
-
-static const struct acpi_device_id pvpanic_device_ids[] = {
-        { "QEMU0001", 0 },
-        { "", 0 },
-};
-MODULE_DEVICE_TABLE(acpi, pvpanic_device_ids);
-
-#define PVPANIC_PANICKED        (1 << 0)
-
-static u16 port;
-
-static struct acpi_driver pvpanic_driver = {
-        .name =         "pvpanic",
-        .class =        "QEMU",
-        .ids =          pvpanic_device_ids,
-        .ops =          {
-                                .add =          pvpanic_add,
-                                .remove =       pvpanic_remove,
-                        },
-        .owner =        THIS_MODULE,
-};
-
-static void
-pvpanic_send_event(unsigned int event)
-{
-        outb(event, port);
-}
-
-static int
-pvpanic_panic_notify(struct notifier_block *nb, unsigned long code,
-                     void *unused)
-{
-        pvpanic_send_event(PVPANIC_PANICKED);
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block pvpanic_panic_nb = {
-        .notifier_call = pvpanic_panic_notify,
-        .priority = 1, /* let this called before broken drm_fb_helper */
-};
-
-
-static acpi_status
-pvpanic_walk_resources(struct acpi_resource *res, void *context)
-{
-        switch (res->type) {
-        case ACPI_RESOURCE_TYPE_END_TAG:
-                return AE_OK;
-
-        case ACPI_RESOURCE_TYPE_IO:
-                port = res->data.io.minimum;
-                return AE_OK;
-
-        default:
-                return AE_ERROR;
-        }
-}
-
-static int pvpanic_add(struct acpi_device *device)
-{
-        int ret;
-
-        ret = acpi_bus_get_status(device);
-        if (ret < 0)
-                return ret;
-
-        if (!device->status.enabled || !device->status.functional)
-                return -ENODEV;
-
-        acpi_walk_resources(device->handle, METHOD_NAME__CRS,
-                            pvpanic_walk_resources, NULL);
-
-        if (!port)
-                return -ENODEV;
-
-        atomic_notifier_chain_register(&panic_notifier_list,
-                                       &pvpanic_panic_nb);
-
-        return 0;
-}
-
-static int pvpanic_remove(struct acpi_device *device)
-{
-
-        atomic_notifier_chain_unregister(&panic_notifier_list,
-                                         &pvpanic_panic_nb);
-        return 0;
-}
-
-module_acpi_driver(pvpanic_driver);
diff --git a/drivers/pps/clients/pps-gpio.c b/drivers/pps/clients/pps-gpio.c
index 333ad7d5b45b..dd5d1103e02b 100644
--- a/drivers/pps/clients/pps-gpio.c
+++ b/drivers/pps/clients/pps-gpio.c
@@ -158,10 +158,10 @@ static int pps_gpio_probe(struct platform_device *pdev)
         if (data->capture_clear)
                 pps_default_params |= PPS_CAPTURECLEAR | PPS_OFFSETCLEAR;
         data->pps = pps_register_source(&data->info, pps_default_params);
-        if (data->pps == NULL) {
+        if (IS_ERR(data->pps)) {
                 dev_err(&pdev->dev, "failed to register IRQ %d as PPS source\n",
                         data->irq);
-                return -EINVAL;
+                return PTR_ERR(data->pps);
         }
 
         /* register IRQ interrupt handler */
diff --git a/drivers/pps/clients/pps-ktimer.c b/drivers/pps/clients/pps-ktimer.c
index 04735649052a..728818b87af3 100644
--- a/drivers/pps/clients/pps-ktimer.c
+++ b/drivers/pps/clients/pps-ktimer.c
@@ -80,9 +80,9 @@ static int __init pps_ktimer_init(void)
 {
         pps = pps_register_source(&pps_ktimer_info,
                                 PPS_CAPTUREASSERT | PPS_OFFSETASSERT);
-        if (pps == NULL) {
+        if (IS_ERR(pps)) {
                 pr_err("cannot register PPS source\n");
-                return -ENOMEM;
+                return PTR_ERR(pps);
         }
 
         timer_setup(&ktimer, pps_ktimer_event, 0);
diff --git a/drivers/pps/clients/pps-ldisc.c b/drivers/pps/clients/pps-ldisc.c
index 73bd3bb4d93b..00f6c460e493 100644
--- a/drivers/pps/clients/pps-ldisc.c
+++ b/drivers/pps/clients/pps-ldisc.c
@@ -72,9 +72,9 @@ static int pps_tty_open(struct tty_struct *tty)
 
         pps = pps_register_source(&info, PPS_CAPTUREBOTH | \
                                 PPS_OFFSETASSERT | PPS_OFFSETCLEAR);
-        if (pps == NULL) {
+        if (IS_ERR(pps)) {
                 pr_err("cannot register PPS source \"%s\"\n", info.path);
-                return -ENOMEM;
+                return PTR_ERR(pps);
         }
         pps->lookup_cookie = tty;
 
diff --git a/drivers/pps/clients/pps_parport.c b/drivers/pps/clients/pps_parport.c
index 4db824f88d00..7226e39aae83 100644
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -179,7 +179,7 @@ static void parport_attach(struct parport *port)
 
         device->pps = pps_register_source(&info,
                         PPS_CAPTUREBOTH | PPS_OFFSETASSERT | PPS_OFFSETCLEAR);
-        if (device->pps == NULL) {
+        if (IS_ERR(device->pps)) {
                 pr_err("couldn't register PPS source\n");
                 goto err_release_dev;
         }
diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index 805c749ac1ad..a1c3cd38754f 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -72,7 +72,8 @@ static void pps_echo_client_default(struct pps_device *pps, int event,
  * source is described by info's fields and it will have, as default PPS
  * parameters, the ones specified into default_params.
  *
- * The function returns, in case of success, the PPS device. Otherwise NULL.
+ * The function returns, in case of success, the PPS device. Otherwise
+ * ERR_PTR(errno).
  */
 
 struct pps_device *pps_register_source(struct pps_source_info *info,
@@ -135,7 +136,7 @@ kfree_pps:
 pps_register_source_exit:
         pr_err("%s: unable to register source\n", info->name);
 
-        return NULL;
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(pps_register_source);
 
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index 8a81eecc0ecd..48f3594a7458 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -265,8 +265,8 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
                 pps.mode = PTP_PPS_MODE;
                 pps.owner = info->owner;
                 ptp->pps_source = pps_register_source(&pps, PTP_PPS_DEFAULTS);
-                if (!ptp->pps_source) {
-                        err = -EINVAL;
+                if (IS_ERR(ptp->pps_source)) {
+                        err = PTR_ERR(ptp->pps_source);
                         pr_err("failed to register pps source\n");
                         goto no_pps;
                 }
diff --git a/drivers/slimbus/Kconfig b/drivers/slimbus/Kconfig
index 9d73ad806698..8cd595148d17 100644
--- a/drivers/slimbus/Kconfig
+++ b/drivers/slimbus/Kconfig
@@ -22,8 +22,9 @@ config SLIM_QCOM_CTRL
 
 config SLIM_QCOM_NGD_CTRL
         tristate "Qualcomm SLIMbus Satellite Non-Generic Device Component"
-        depends on QCOM_QMI_HELPERS
-        depends on HAS_IOMEM && DMA_ENGINE
+        depends on HAS_IOMEM && DMA_ENGINE && NET
+        depends on ARCH_QCOM || COMPILE_TEST
+        select QCOM_QMI_HELPERS
         help
           Select driver if Qualcomm's SLIMbus Satellite Non-Generic Device
           Component is programmed using Linux kernel.
diff --git a/drivers/slimbus/qcom-ctrl.c b/drivers/slimbus/qcom-ctrl.c
index db1f5135846a..ad3e2e23f56e 100644
--- a/drivers/slimbus/qcom-ctrl.c
+++ b/drivers/slimbus/qcom-ctrl.c
@@ -654,8 +654,7 @@ static int qcom_slim_remove(struct platform_device *pdev)
 #ifdef CONFIG_PM
 static int qcom_slim_runtime_suspend(struct device *device)
 {
-        struct platform_device *pdev = to_platform_device(device);
-        struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+        struct qcom_slim_ctrl *ctrl = dev_get_drvdata(device);
         int ret;
 
         dev_dbg(device, "pm_runtime: suspending...\n");
@@ -672,8 +671,7 @@ static int qcom_slim_runtime_suspend(struct device *device)
 
 static int qcom_slim_runtime_resume(struct device *device)
 {
-        struct platform_device *pdev = to_platform_device(device);
-        struct qcom_slim_ctrl *ctrl = platform_get_drvdata(pdev);
+        struct qcom_slim_ctrl *ctrl = dev_get_drvdata(device);
         int ret = 0;
 
         dev_dbg(device, "pm_runtime: resuming...\n");
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 1382a8df6c75..71f094c9ec68 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -787,7 +787,7 @@ static int qcom_slim_ngd_xfer_msg(struct slim_controller *sctrl,
 
         if (txn->msg->num_bytes > SLIM_MSGQ_BUF_LEN ||
                         txn->rl > SLIM_MSGQ_BUF_LEN) {
-                dev_err(ctrl->dev, "msg exeeds HW limit\n");
+                dev_err(ctrl->dev, "msg exceeds HW limit\n");
                 return -EINVAL;
         }
 
@@ -1327,11 +1327,12 @@ static int of_qcom_slim_ngd_register(struct device *parent,
 {
         const struct ngd_reg_offset_data *data;
         struct qcom_slim_ngd *ngd;
+        const struct of_device_id *match;
         struct device_node *node;
         u32 id;
 
-        data = of_match_node(qcom_slim_ngd_dt_match, parent->of_node)->data;
-
+        match = of_match_node(qcom_slim_ngd_dt_match, parent->of_node);
+        data = match->data;
         for_each_available_child_of_node(parent->of_node, node) {
                 if (of_property_read_u32(node, "reg", &id))
                         continue;
diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index c5ee97ee7886..fd8d034cfec1 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -654,14 +654,14 @@ static int intel_pdm_set_sdw_stream(struct snd_soc_dai *dai,
         return cdns_set_sdw_stream(dai, stream, false, direction);
 }
 
-static struct snd_soc_dai_ops intel_pcm_dai_ops = {
+static const struct snd_soc_dai_ops intel_pcm_dai_ops = {
         .hw_params = intel_hw_params,
         .hw_free = intel_hw_free,
         .shutdown = sdw_cdns_shutdown,
         .set_sdw_stream = intel_pcm_set_sdw_stream,
 };
 
-static struct snd_soc_dai_ops intel_pdm_dai_ops = {
+static const struct snd_soc_dai_ops intel_pdm_dai_ops = {
         .hw_params = intel_hw_params,
         .hw_free = intel_hw_free,
         .shutdown = sdw_cdns_shutdown,
diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c
index 93e562f18d40..7416bdbd8576 100644
--- a/drivers/thunderbolt/domain.c
+++ b/drivers/thunderbolt/domain.c
@@ -7,7 +7,9 @@
  */
 
 #include <linux/device.h>
+#include <linux/dmar.h>
 #include <linux/idr.h>
+#include <linux/iommu.h>
 #include <linux/module.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
@@ -236,6 +238,20 @@ err_free_str:
 }
 static DEVICE_ATTR_RW(boot_acl);
 
+static ssize_t iommu_dma_protection_show(struct device *dev,
+                                         struct device_attribute *attr,
+                                         char *buf)
+{
+        /*
+         * Kernel DMA protection is a feature where Thunderbolt security is
+         * handled natively using IOMMU. It is enabled when IOMMU is
+         * enabled and ACPI DMAR table has DMAR_PLATFORM_OPT_IN set.
+         */
+        return sprintf(buf, "%d\n",
+                       iommu_present(&pci_bus_type) && dmar_platform_optin());
+}
+static DEVICE_ATTR_RO(iommu_dma_protection);
+
 static ssize_t security_show(struct device *dev, struct device_attribute *attr,
                              char *buf)
 {
@@ -251,6 +267,7 @@ static DEVICE_ATTR_RO(security);
 
 static struct attribute *domain_attrs[] = {
         &dev_attr_boot_acl.attr,
+        &dev_attr_iommu_dma_protection.attr,
         &dev_attr_security.attr,
         NULL,
 };
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 0a357db4b31b..131342280b46 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -569,20 +569,20 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
         ssize_t retval = 0;
         s32 event_count;
 
-        mutex_lock(&idev->info_lock);
-        if (!idev->info || !idev->info->irq)
-                retval = -EIO;
-        mutex_unlock(&idev->info_lock);
-
-        if (retval)
-                return retval;
-
         if (count != sizeof(s32))
                 return -EINVAL;
 
         add_wait_queue(&idev->wait, &wait);
 
         do {
+                mutex_lock(&idev->info_lock);
+                if (!idev->info || !idev->info->irq) {
+                        retval = -EIO;
+                        mutex_unlock(&idev->info_lock);
+                        break;
+                }
+                mutex_unlock(&idev->info_lock);
+
                 set_current_state(TASK_INTERRUPTIBLE);
 
                 event_count = atomic_read(&idev->event);
@@ -1017,6 +1017,9 @@ void uio_unregister_device(struct uio_info *info)
         idev->info = NULL;
         mutex_unlock(&idev->info_lock);
 
+        wake_up_interruptible(&idev->wait);
+        kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);
+
         device_unregister(&idev->dev);
 
         return;
diff --git a/drivers/uio/uio_fsl_elbc_gpcm.c b/drivers/uio/uio_fsl_elbc_gpcm.c
index 9cc37fe07d35..0ee3cd3c25ee 100644
--- a/drivers/uio/uio_fsl_elbc_gpcm.c
+++ b/drivers/uio/uio_fsl_elbc_gpcm.c
@@ -74,8 +74,7 @@ DEVICE_ATTR(reg_or, S_IRUGO|S_IWUSR|S_IWGRP, reg_show, reg_store);
 static ssize_t reg_show(struct device *dev, struct device_attribute *attr,
                         char *buf)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct uio_info *info = platform_get_drvdata(pdev);
+        struct uio_info *info = dev_get_drvdata(dev);
         struct fsl_elbc_gpcm *priv = info->priv;
         struct fsl_lbc_bank *bank = &priv->lbc->bank[priv->bank];
 
@@ -94,8 +93,7 @@ static ssize_t reg_show(struct device *dev, struct device_attribute *attr,
 static ssize_t reg_store(struct device *dev, struct device_attribute *attr,
                          const char *buf, size_t count)
 {
-        struct platform_device *pdev = to_platform_device(dev);
-        struct uio_info *info = platform_get_drvdata(pdev);
+        struct uio_info *info = dev_get_drvdata(dev);
         struct fsl_elbc_gpcm *priv = info->priv;
         struct fsl_lbc_bank *bank = &priv->lbc->bank[priv->bank];
         unsigned long val;
diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c
index 3093655c7b92..1475ed5ffcde 100644
--- a/drivers/virt/vboxguest/vboxguest_core.c
+++ b/drivers/virt/vboxguest/vboxguest_core.c
@@ -1312,7 +1312,7 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
                 return -EINVAL;
         }
 
-        if (f32bit)
+        if (IS_ENABLED(CONFIG_COMPAT) && f32bit)
                 ret = vbg_hgcm_call32(gdev, client_id,
                                       call->function, call->timeout_ms,
                                       VBG_IOCTL_HGCM_CALL_PARMS32(call),
diff --git a/fs/file.c b/fs/file.c
index 50304c7525ea..3209ee271c41 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -640,6 +640,35 @@ out_unlock:
 }
 EXPORT_SYMBOL(__close_fd); /* for ksys_close() */
 
+/*
+ * variant of __close_fd that gets a ref on the file for later fput
+ */
+int __close_fd_get_file(unsigned int fd, struct file **res)
+{
+        struct files_struct *files = current->files;
+        struct file *file;
+        struct fdtable *fdt;
+
+        spin_lock(&files->file_lock);
+        fdt = files_fdtable(files);
+        if (fd >= fdt->max_fds)
+                goto out_unlock;
+        file = fdt->fd[fd];
+        if (!file)
+                goto out_unlock;
+        rcu_assign_pointer(fdt->fd[fd], NULL);
+        __put_unused_fd(files, fd);
+        spin_unlock(&files->file_lock);
+        get_file(file);
+        *res = file;
+        return filp_close(file, files);
+
+out_unlock:
+        spin_unlock(&files->file_lock);
+        *res = NULL;
+        return -ENOENT;
+}
+
 void do_close_on_exec(struct files_struct *files)
 {
         unsigned i;
diff --git a/include/linux/dmar.h b/include/linux/dmar.h
index 843a41ba7e28..f8af1d770520 100644
--- a/include/linux/dmar.h
+++ b/include/linux/dmar.h
@@ -39,6 +39,7 @@ struct acpi_dmar_header;
 /* DMAR Flags */
 #define DMAR_INTR_REMAP         0x1
 #define DMAR_X2APIC_OPT_OUT     0x2
+#define DMAR_PLATFORM_OPT_IN    0x4
 
 struct intel_iommu;
 
@@ -170,6 +171,8 @@ static inline int dmar_ir_hotplug(struct dmar_drhd_unit *dmaru, bool insert)
 { return 0; }
 #endif /* CONFIG_IRQ_REMAP */
 
+extern bool dmar_platform_optin(void);
+
 #else /* CONFIG_DMAR_TABLE */
 
 static inline int dmar_device_add(void *handle)
@@ -182,6 +185,11 @@ static inline int dmar_device_remove(void *handle)
         return 0;
 }
 
+static inline bool dmar_platform_optin(void)
+{
+        return false;
+}
+
 #endif /* CONFIG_DMAR_TABLE */
 
 struct irte {
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index 41615f38bcff..f07c55ea0c22 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -121,6 +121,7 @@ extern void __fd_install(struct files_struct *files,
                       unsigned int fd, struct file *file);
 extern int __close_fd(struct files_struct *files,
                       unsigned int fd);
+extern int __close_fd_get_file(unsigned int fd, struct file **res);
 
 extern struct kmem_cache *files_cachep;
 
diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h
new file mode 100644
index 000000000000..5be5dab50b13
--- /dev/null
+++ b/include/linux/firmware/intel/stratix10-smc.h
@@ -0,0 +1,312 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2017-2018, Intel Corporation
+ */
+
+#ifndef __STRATIX10_SMC_H
+#define __STRATIX10_SMC_H
+
+#include <linux/arm-smccc.h>
+#include <linux/bitops.h>
+
+/**
+ * This file defines the Secure Monitor Call (SMC) message protocol used for
+ * service layer driver in normal world (EL1) to communicate with secure
+ * monitor software in Secure Monitor Exception Level 3 (EL3).
+ *
+ * This file is shared with secure firmware (FW) which is out of kernel tree.
+ *
+ * An ARM SMC instruction takes a function identifier and up to 6 64-bit
+ * register values as arguments, and can return up to 4 64-bit register
+ * value. The operation of the secure monitor is determined by the parameter
+ * values passed in through registers.
+ *
+ * EL1 and EL3 communicates pointer as physical address rather than the
+ * virtual address.
+ *
+ * Functions specified by ARM SMC Calling convention:
+ *
+ * FAST call executes atomic operations, returns when the requested operation
+ * has completed.
+ * STD call starts a operation which can be preempted by a non-secure
+ * interrupt. The call can return before the requested operation has
+ * completed.
+ *
+ * a0..a7 is used as register names in the descriptions below, on arm32
+ * that translates to r0..r7 and on arm64 to w0..w7.
+ */
+
+/**
+ * @func_num: function ID
+ */
+#define INTEL_SIP_SMC_STD_CALL_VAL(func_num) \
+        ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL, ARM_SMCCC_SMC_64, \
+        ARM_SMCCC_OWNER_SIP, (func_num))
+
+#define INTEL_SIP_SMC_FAST_CALL_VAL(func_num) \
+        ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_64, \
+        ARM_SMCCC_OWNER_SIP, (func_num))
+
+/**
+ * Return values in INTEL_SIP_SMC_* call
+ *
+ * INTEL_SIP_SMC_RETURN_UNKNOWN_FUNCTION:
+ * Secure monitor software doesn't recognize the request.
+ *
+ * INTEL_SIP_SMC_STATUS_OK:
+ * FPGA configuration completed successfully,
+ * In case of FPGA configuration write operation, it means secure monitor
+ * software can accept the next chunk of FPGA configuration data.
+ *
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY:
+ * In case of FPGA configuration write operation, it means secure monitor
+ * software is still processing previous data & can't accept the next chunk
+ * of data. Service driver needs to issue
+ * INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE call to query the
+ * completed block(s).
+ *
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR:
+ * There is error during the FPGA configuration process.
+ *
+ * INTEL_SIP_SMC_REG_ERROR:
+ * There is error during a read or write operation of the protected registers.
+ *
+ * INTEL_SIP_SMC_RSU_ERROR:
+ * There is error during a remote status update.
+ */
+#define INTEL_SIP_SMC_RETURN_UNKNOWN_FUNCTION           0xFFFFFFFF
+#define INTEL_SIP_SMC_STATUS_OK                         0x0
+#define INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY           0x1
+#define INTEL_SIP_SMC_FPGA_CONFIG_STATUS_REJECTED       0x2
+#define INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR          0x4
+#define INTEL_SIP_SMC_REG_ERROR                         0x5
+#define INTEL_SIP_SMC_RSU_ERROR                         0x7
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_START
+ *
+ * Sync call used by service driver at EL1 to request the FPGA in EL3 to
+ * be prepare to receive a new configuration.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_START.
+ * a1: flag for full or partial configuration. 0 for full and 1 for partial
+ * configuration.
+ * a2-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, or INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_START 1
+#define INTEL_SIP_SMC_FPGA_CONFIG_START \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_START)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_WRITE
+ *
+ * Async call used by service driver at EL1 to provide FPGA configuration data
+ * to secure world.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_WRITE.
+ * a1: 64bit physical address of the configuration data memory block
+ * a2: Size of configuration data block.
+ * a3-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY or
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1: 64bit physical address of 1st completed memory block if any completed
+ * block, otherwise zero value.
+ * a2: 64bit physical address of 2nd completed memory block if any completed
+ * block, otherwise zero value.
+ * a3: 64bit physical address of 3rd completed memory block if any completed
+ * block, otherwise zero value.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_WRITE 2
+#define INTEL_SIP_SMC_FPGA_CONFIG_WRITE \
+        INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_WRITE)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE
+ *
+ * Sync call used by service driver at EL1 to track the completed write
+ * transactions. This request is called after INTEL_SIP_SMC_FPGA_CONFIG_WRITE
+ * call returns INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY or
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1: 64bit physical address of 1st completed memory block.
+ * a2: 64bit physical address of 2nd completed memory block if
+ * any completed block, otherwise zero value.
+ * a3: 64bit physical address of 3rd completed memory block if
+ * any completed block, otherwise zero value.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE 3
+#define INTEL_SIP_SMC_FPGA_CONFIG_COMPLETED_WRITE \
+INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_ISDONE
+ *
+ * Sync call used by service driver at EL1 to inform secure world that all
+ * data are sent, to check whether or not the secure world had completed
+ * the FPGA configuration process.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_ISDONE.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FPGA_CONFIG_STATUS_BUSY or
+ * INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_ISDONE 4
+#define INTEL_SIP_SMC_FPGA_CONFIG_ISDONE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_ISDONE)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM
+ *
+ * Sync call used by service driver at EL1 to query the physical address of
+ * memory block reserved by secure monitor software.
+ *
+ * Call register usage:
+ * a0:INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1: start of physical address of reserved memory block.
+ * a2: size of reserved memory block.
+ * a3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_GET_MEM 5
+#define INTEL_SIP_SMC_FPGA_CONFIG_GET_MEM \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_GET_MEM)
+
+/**
+ * Request INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK
+ *
+ * For SMC loop-back mode only, used for internal integration, debugging
+ * or troubleshooting.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK.
+ * a1-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_FPGA_CONFIG_STATUS_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_LOOPBACK 6
+#define INTEL_SIP_SMC_FPGA_CONFIG_LOOPBACK \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_LOOPBACK)
+
+/*
+ * Request INTEL_SIP_SMC_REG_READ
+ *
+ * Read a protected register at EL3
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_REG_READ.
+ * a1: register address.
+ * a2-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_REG_ERROR.
+ * a1: value in the register
+ * a2-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_REG_READ 7
+#define INTEL_SIP_SMC_REG_READ \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_REG_READ)
+
+/*
+ * Request INTEL_SIP_SMC_REG_WRITE
+ *
+ * Write a protected register at EL3
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_REG_WRITE.
+ * a1: register address
+ * a2: value to program into register.
+ * a3-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_REG_ERROR.
+ * a1-3: not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_REG_WRITE 8
+#define INTEL_SIP_SMC_REG_WRITE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_REG_WRITE)
+
+/*
+ * Request INTEL_SIP_SMC_FUNCID_REG_UPDATE
+ *
+ * Update one or more bits in a protected register at EL3 using a
+ * read-modify-write operation.
+ *
+ * Call register usage:
+ * a0: INTEL_SIP_SMC_REG_UPDATE.
+ * a1: register address
+ * a2: write Mask.
+ * a3: value to write.
+ * a4-7: not used.
+ *
+ * Return status:
+ * a0: INTEL_SIP_SMC_STATUS_OK or INTEL_SIP_SMC_REG_ERROR.
+ * a1-3: Not used.
+ */
+#define INTEL_SIP_SMC_FUNCID_REG_UPDATE 9
+#define INTEL_SIP_SMC_REG_UPDATE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_REG_UPDATE)
+
+/*
+ * Request INTEL_SIP_SMC_RSU_STATUS
+ *
+ * Request remote status update boot log, call is synchronous.
+ *
+ * Call register usage:
+ * a0 INTEL_SIP_SMC_RSU_STATUS
+ * a1-7 not used
+ *
+ * Return status
+ * a0: Current Image
+ * a1: Last Failing Image
+ * a2: Version | State
+ * a3: Error details | Error location
+ *
+ * Or
+ *
+ * a0: INTEL_SIP_SMC_RSU_ERROR
+ */
+#define INTEL_SIP_SMC_FUNCID_RSU_STATUS 11
+#define INTEL_SIP_SMC_RSU_STATUS \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_RSU_STATUS)
+
+/*
+ * Request INTEL_SIP_SMC_RSU_UPDATE
+ *
+ * Request to set the offset of the bitstream to boot after reboot, call
+ * is synchronous.
+ *
+ * Call register usage:
+ * a0 INTEL_SIP_SMC_RSU_UPDATE
+ * a1 64bit physical address of the configuration data memory in flash
+ * a2-7 not used
+ *
+ * Return status
+ * a0 INTEL_SIP_SMC_STATUS_OK
+ */
+#define INTEL_SIP_SMC_FUNCID_RSU_UPDATE 12
+#define INTEL_SIP_SMC_RSU_UPDATE \
+        INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_RSU_UPDATE)
+#endif
diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h
new file mode 100644
index 000000000000..e521f172a47a
--- /dev/null
+++ b/include/linux/firmware/intel/stratix10-svc-client.h
@@ -0,0 +1,217 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (C) 2017-2018, Intel Corporation
+ */
+
+#ifndef __STRATIX10_SVC_CLIENT_H
+#define __STRATIX10_SVC_CLIENT_H
+
+/**
+ * Service layer driver supports client names
+ *
+ * fpga: for FPGA configuration
+ * rsu: for remote status update
+ */
+#define SVC_CLIENT_FPGA                 "fpga"
+#define SVC_CLIENT_RSU                  "rsu"
+
+/**
+ * Status of the sent command, in bit number
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_REQUEST_OK:
+ * Secure firmware accepts the request of FPGA reconfiguration.
+ *
+ * SVC_STATUS_RECONFIG_BUFFER_SUBMITTED:
+ * Service client successfully submits FPGA configuration
+ * data buffer to secure firmware.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_BUFFER_DONE:
+ * Secure firmware completes data process, ready to accept the
+ * next WRITE transaction.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_COMPLETED:
+ * Secure firmware completes FPGA configuration successfully, FPGA should
+ * be in user mode.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_BUSY:
+ * FPGA configuration is still in process.
+ *
+ * SVC_COMMAND_STATUS_RECONFIG_ERROR:
+ * Error encountered during FPGA configuration.
+ *
+ * SVC_STATUS_RSU_OK:
+ * Secure firmware accepts the request of remote status update (RSU).
+ */
+#define SVC_STATUS_RECONFIG_REQUEST_OK          0
+#define SVC_STATUS_RECONFIG_BUFFER_SUBMITTED    1
+#define SVC_STATUS_RECONFIG_BUFFER_DONE         2
+#define SVC_STATUS_RECONFIG_COMPLETED           3
+#define SVC_STATUS_RECONFIG_BUSY                4
+#define SVC_STATUS_RECONFIG_ERROR               5
+#define SVC_STATUS_RSU_OK                       6
+#define SVC_STATUS_RSU_ERROR                    7
+/**
+ * Flag bit for COMMAND_RECONFIG
+ *
+ * COMMAND_RECONFIG_FLAG_PARTIAL:
+ * Set to FPGA configuration type (full or partial), the default
+ * is full reconfig.
+ */
+#define COMMAND_RECONFIG_FLAG_PARTIAL   0
+
+/**
+ * Timeout settings for service clients:
+ * timeout value used in Stratix10 FPGA manager driver.
+ * timeout value used in RSU driver
+ */
+#define SVC_RECONFIG_REQUEST_TIMEOUT_MS         100
+#define SVC_RECONFIG_BUFFER_TIMEOUT_MS          240
+#define SVC_RSU_REQUEST_TIMEOUT_MS              300
+
+struct stratix10_svc_chan;
+
+/**
+ * enum stratix10_svc_command_code - supported service commands
+ *
+ * @COMMAND_NOOP: do 'dummy' request for integration/debug/trouble-shooting
+ *
+ * @COMMAND_RECONFIG: ask for FPGA configuration preparation, return status
+ * is SVC_STATUS_RECONFIG_REQUEST_OK
+ *
+ * @COMMAND_RECONFIG_DATA_SUBMIT: submit buffer(s) of bit-stream data for the
+ * FPGA configuration, return status is SVC_STATUS_RECONFIG_BUFFER_SUBMITTED,
+ * or SVC_STATUS_RECONFIG_ERROR
+ *
+ * @COMMAND_RECONFIG_DATA_CLAIM: check the status of the configuration, return
+ * status is SVC_STATUS_RECONFIG_COMPLETED, or SVC_STATUS_RECONFIG_BUSY, or
+ * SVC_STATUS_RECONFIG_ERROR
+ *
+ * @COMMAND_RECONFIG_STATUS: check the status of the configuration, return
+ * status is SVC_STATUS_RECONFIG_COMPLETED, or  SVC_STATUS_RECONFIG_BUSY, or
+ * SVC_STATUS_RECONFIG_ERROR
+ *
+ * @COMMAND_RSU_STATUS: request remote system update boot log, return status
+ * is log data or SVC_STATUS_RSU_ERROR
+ *
+ * @COMMAND_RSU_UPDATE: set the offset of the bitstream to boot after reboot,
+ * return status is SVC_STATUS_RSU_OK or SVC_STATUS_RSU_ERROR
+ */
+enum stratix10_svc_command_code {
+        COMMAND_NOOP = 0,
+        COMMAND_RECONFIG,
+        COMMAND_RECONFIG_DATA_SUBMIT,
+        COMMAND_RECONFIG_DATA_CLAIM,
+        COMMAND_RECONFIG_STATUS,
+        COMMAND_RSU_STATUS,
+        COMMAND_RSU_UPDATE
+};
+
+/**
+ * struct stratix10_svc_client_msg - message sent by client to service
+ * @payload: starting address of data need be processed
+ * @payload_length: data size in bytes
+ * @command: service command
+ * @arg: args to be passed via registers and not physically mapped buffers
+ */
+struct stratix10_svc_client_msg {
+        void *payload;
+        size_t payload_length;
+        enum stratix10_svc_command_code command;
+        u64 arg[3];
+};
+
+/**
+ * struct stratix10_svc_command_config_type - config type
+ * @flags: flag bit for the type of FPGA configuration
+ */
+struct stratix10_svc_command_config_type {
+        u32 flags;
+};
+
+/**
+ * struct stratix10_svc_cb_data - callback data structure from service layer
+ * @status: the status of sent command
+ * @kaddr1: address of 1st completed data block
+ * @kaddr2: address of 2nd completed data block
+ * @kaddr3: address of 3rd completed data block
+ */
+struct stratix10_svc_cb_data {
+        u32 status;
+        void *kaddr1;
+        void *kaddr2;
+        void *kaddr3;
+};
+
+/**
+ * struct stratix10_svc_client - service client structure
+ * @dev: the client device
+ * @receive_cb: callback to provide service client the received data
+ * @priv: client private data
+ */
+struct stratix10_svc_client {
+        struct device *dev;
+        void (*receive_cb)(struct stratix10_svc_client *client,
+                           struct stratix10_svc_cb_data *cb_data);
+        void *priv;
+};
+
+/**
+ * stratix10_svc_request_channel_byname() - request service channel
+ * @client: identity of the client requesting the channel
+ * @name: supporting client name defined above
+ *
+ * Return: a pointer to channel assigned to the client on success,
+ * or ERR_PTR() on error.
+ */
+struct stratix10_svc_chan
+*stratix10_svc_request_channel_byname(struct stratix10_svc_client *client,
+        const char *name);
+
+/**
+ * stratix10_svc_free_channel() - free service channel.
+ * @chan: service channel to be freed
+ */
+void stratix10_svc_free_channel(struct stratix10_svc_chan *chan);
+
+/**
+ * stratix10_svc_allocate_memory() - allocate the momory
+ * @chan: service channel assigned to the client
+ * @size: number of bytes client requests
+ *
+ * Service layer allocates the requested number of bytes from the memory
+ * pool for the client.
+ *
+ * Return: the starting address of allocated memory on success, or
+ * ERR_PTR() on error.
+ */
+void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
+                                    size_t size);
+
+/**
+ * stratix10_svc_free_memory() - free allocated memory
+ * @chan: service channel assigned to the client
+ * @kaddr: starting address of memory to be free back to pool
+ */
+void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr);
+
+/**
+ * stratix10_svc_send() - send a message to the remote
+ * @chan: service channel assigned to the client
+ * @msg: message data to be sent, in the format of
+ * struct stratix10_svc_client_msg
+ *
+ * Return: 0 for success, -ENOMEM or -ENOBUFS on error.
+ */
+int stratix10_svc_send(struct stratix10_svc_chan *chan, void *msg);
+
+/**
+ * intel_svc_done() - complete service request
+ * @chan: service channel assigned to the client
+ *
+ * This function is used by service client to inform service layer that
+ * client's service requests are completed, or there is an error in the
+ * request process.
+ */
+void stratix10_svc_done(struct stratix10_svc_chan *chan);
+#endif
+
diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h
index 9d3f668df7df..741f567253ef 100644
--- a/include/linux/fsl/mc.h
+++ b/include/linux/fsl/mc.h
@@ -210,8 +210,8 @@ struct mc_cmd_header {
 };
 
 struct fsl_mc_command {
-        u64 header;
-        u64 params[MC_CMD_NUM_OF_PARAMS];
+        __le64 header;
+        __le64 params[MC_CMD_NUM_OF_PARAMS];
 };
 
 enum mc_cmd_status {
@@ -238,11 +238,11 @@ enum mc_cmd_status {
 /* Command completion flag */
 #define MC_CMD_FLAG_INTR_DIS    0x01
 
-static inline u64 mc_encode_cmd_header(u16 cmd_id,
-                                       u32 cmd_flags,
-                                       u16 token)
+static inline __le64 mc_encode_cmd_header(u16 cmd_id,
+                                          u32 cmd_flags,
+                                          u16 token)
 {
-        u64 header = 0;
+        __le64 header = 0;
         struct mc_cmd_header *hdr = (struct mc_cmd_header *)&header;
 
         hdr->cmd_id = cpu_to_le16(cmd_id);
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 14131b6fae68..f0885cc01db6 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -831,15 +831,6 @@ struct vmbus_channel {
          */
         struct list_head sc_list;
         /*
-         * Current number of sub-channels.
-         */
-        int num_sc;
-        /*
-         * Number of a sub-channel (position within sc_list) which is supposed
-         * to be used as the next outgoing channel.
-         */
-        int next_oc;
-        /*
          * The primary channel this sub-channel belongs to.
          * This will be NULL for the primary channel.
          */
@@ -973,14 +964,6 @@ void vmbus_set_chn_rescind_callback(struct vmbus_channel *channel,
                 void (*chn_rescind_cb)(struct vmbus_channel *));
 
 /*
- * Retrieve the (sub) channel on which to send an outgoing request.
- * When a primary channel has multiple sub-channels, we choose a
- * channel whose VCPU binding is closest to the VCPU on which
- * this call is being made.
- */
-struct vmbus_channel *vmbus_get_outgoing_channel(struct vmbus_channel *primary);
-
-/*
  * Check if sub-channels have already been offerred. This API will be useful
  * when the driver is unloaded after establishing sub-channels. In this case,
  * when the driver is re-loaded, the driver would have to check if the
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index ba8fa9072aca..677768b21a1d 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -25,6 +25,7 @@
 #include <linux/notifier.h>
 #include <linux/device.h>
 #include <linux/of.h>
+#include <linux/nvmem-provider.h>
 
 #include <mtd/mtd-abi.h>
 
@@ -342,6 +343,7 @@ struct mtd_info {
         struct device dev;
         int usecount;
         struct mtd_debug_info dbg;
+        struct nvmem_device *nvmem;
 };
 
 int mtd_ooblayout_ecc(struct mtd_info *mtd, int section,
diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h
index 1e3283c2af77..fe051323be0a 100644
--- a/include/linux/nvmem-provider.h
+++ b/include/linux/nvmem-provider.h
@@ -19,6 +19,13 @@ typedef int (*nvmem_reg_read_t)(void *priv, unsigned int offset,
 typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
                                  void *val, size_t bytes);
 
+enum nvmem_type {
+        NVMEM_TYPE_UNKNOWN = 0,
+        NVMEM_TYPE_EEPROM,
+        NVMEM_TYPE_OTP,
+        NVMEM_TYPE_BATTERY_BACKED,
+};
+
 /**
  * struct nvmem_config - NVMEM device configuration
  *
@@ -28,8 +35,10 @@ typedef int (*nvmem_reg_write_t)(void *priv, unsigned int offset,
  * @owner:      Pointer to exporter module. Used for refcounting.
  * @cells:      Optional array of pre-defined NVMEM cells.
  * @ncells:     Number of elements in cells.
+ * @type:       Type of the nvmem storage
  * @read_only:  Device is read-only.
  * @root_only:  Device is accessibly to root only.
+ * @no_of_node: Device should not use the parent's of_node even if it's !NULL.
  * @reg_read:   Callback to read data.
  * @reg_write:  Callback to write data.
  * @size:       Device size.
@@ -51,8 +60,10 @@ struct nvmem_config {
         struct module           *owner;
         const struct nvmem_cell_info    *cells;
         int                     ncells;
+        enum nvmem_type         type;
         bool                    read_only;
         bool                    root_only;
+        bool                    no_of_node;
         nvmem_reg_read_t        reg_read;
         nvmem_reg_write_t       reg_write;
         int     size;
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 51a5a5217667..1ab78a23ae08 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -396,6 +396,14 @@ struct pci_dev {
         unsigned int    is_hotplug_bridge:1;
         unsigned int    shpc_managed:1;         /* SHPC owned by shpchp */
         unsigned int    is_thunderbolt:1;       /* Thunderbolt controller */
+        /*
+         * Devices marked being untrusted are the ones that can potentially
+         * execute DMA attacks and similar. They are typically connected
+         * through external ports such as Thunderbolt but not limited to
+         * that. When an IOMMU is enabled they should be getting full
+         * mappings to make sure they cannot access arbitrary memory.
+         */
+        unsigned int    untrusted:1;
         unsigned int    __aer_firmware_first_valid:1;
         unsigned int    __aer_firmware_first:1;
         unsigned int    broken_intx_masking:1;  /* INTx masking can't be used */
diff --git a/include/uapi/linux/android/binder_ctl.h b/include/uapi/linux/android/binder_ctl.h
new file mode 100644
index 000000000000..65b2efd1a0a5
--- /dev/null
+++ b/include/uapi/linux/android/binder_ctl.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 2018 Canonical Ltd.
+ *
+ */
+
+#ifndef _UAPI_LINUX_BINDER_CTL_H
+#define _UAPI_LINUX_BINDER_CTL_H
+
+#include <linux/android/binder.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define BINDERFS_MAX_NAME 255
+
+/**
+ * struct binderfs_device - retrieve information about a new binder device
+ * @name:   the name to use for the new binderfs binder device
+ * @major:  major number allocated for binderfs binder devices
+ * @minor:  minor number allocated for the new binderfs binder device
+ *
+ */
+struct binderfs_device {
+        char name[BINDERFS_MAX_NAME + 1];
+        __u8 major;
+        __u8 minor;
+};
+
+/**
+ * Allocate a new binder device.
+ */
+#define BINDER_CTL_ADD _IOWR('b', 1, struct binderfs_device)
+
+#endif /* _UAPI_LINUX_BINDER_CTL_H */
+
diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h
index 96c24478d8ce..f8c00045d537 100644
--- a/include/uapi/linux/magic.h
+++ b/include/uapi/linux/magic.h
@@ -73,6 +73,7 @@
 #define DAXFS_MAGIC             0x64646178
 #define BINFMTFS_MAGIC          0x42494e4d
 #define DEVPTS_SUPER_MAGIC      0x1cd1
+#define BINDERFS_SUPER_MAGIC    0x6c6f6f70
 #define FUTEXFS_SUPER_MAGIC     0xBAD1DEA
 #define PIPEFS_MAGIC            0x50495045
 #define PROC_SUPER_MAGIC        0x9fa0
diff --git a/tools/Makefile b/tools/Makefile
index abb358a70ad0..77f1aee8ea01 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -13,6 +13,7 @@ help:
         @echo '  cgroup                 - cgroup tools'
         @echo '  cpupower               - a tool for all things x86 CPU power'
         @echo '  firewire               - the userspace part of nosy, an IEEE-1394 traffic sniffer'
+        @echo '  firmware               - Firmware tools'
         @echo '  freefall               - laptop accelerometer program for disk protection'
         @echo '  gpio                   - GPIO tools'
         @echo '  hv                     - tools used when in Hyper-V clients'
@@ -60,7 +61,7 @@ acpi: FORCE
 cpupower: FORCE
         $(call descend,power/$@)
 
-cgroup firewire hv guest spi usb virtio vm bpf iio gpio objtool leds wmi pci: FORCE
+cgroup firewire hv guest spi usb virtio vm bpf iio gpio objtool leds wmi pci firmware: FORCE
         $(call descend,$@)
 
 liblockdep: FORCE
@@ -137,7 +138,7 @@ acpi_clean:
 cpupower_clean:
         $(call descend,power/cpupower,clean)
 
-cgroup_clean hv_clean firewire_clean spi_clean usb_clean virtio_clean vm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean pci_clean:
+cgroup_clean hv_clean firewire_clean spi_clean usb_clean virtio_clean vm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean pci_clean firmware_clean:
         $(call descend,$(@:_clean=),clean)
 
 liblockdep_clean:
@@ -175,6 +176,6 @@ clean: acpi_clean cgroup_clean cpupower_clean hv_clean firewire_clean \
                 perf_clean selftests_clean turbostat_clean spi_clean usb_clean virtio_clean \
                 vm_clean bpf_clean iio_clean x86_energy_perf_policy_clean tmon_clean \
                 freefall_clean build_clean libbpf_clean libsubcmd_clean liblockdep_clean \
-                gpio_clean objtool_clean leds_clean wmi_clean pci_clean
+                gpio_clean objtool_clean leds_clean wmi_clean pci_clean firmware_clean
 
 .PHONY: FORCE
diff --git a/tools/firmware/Makefile b/tools/firmware/Makefile
new file mode 100644
index 000000000000..d329825aa31b
--- /dev/null
+++ b/tools/firmware/Makefile
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0
+# Makefile for firmware tools
+
+CFLAGS = -Wall -Wextra -g
+
+all: ihex2fw
+%: %.c
+        $(CC) $(CFLAGS) -o $@ $^
+
+clean:
+        $(RM) ihex2fw
+
+.PHONY: all clean
\ No newline at end of file
diff --git a/tools/firmware/ihex2fw.c b/tools/firmware/ihex2fw.c
new file mode 100644
index 000000000000..b58dd061e978
--- /dev/null
+++ b/tools/firmware/ihex2fw.c
@@ -0,0 +1,281 @@
+/*
+ * Parser/loader for IHEX formatted data.
+ *
+ * Copyright © 2008 David Woodhouse <dwmw2@infradead.org>
+ * Copyright © 2005 Jan Harkes <jaharkes@cs.cmu.edu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#define _GNU_SOURCE
+#include <getopt.h>
+
+
+struct ihex_binrec {
+        struct ihex_binrec *next; /* not part of the real data structure */
+        uint32_t addr;
+        uint16_t len;
+        uint8_t data[];
+};
+
+/**
+ * nybble/hex are little helpers to parse hexadecimal numbers to a byte value
+ **/
+static uint8_t nybble(const uint8_t n)
+{
+        if      (n >= '0' && n <= '9') return n - '0';
+        else if (n >= 'A' && n <= 'F') return n - ('A' - 10);
+        else if (n >= 'a' && n <= 'f') return n - ('a' - 10);
+        return 0;
+}
+
+static uint8_t hex(const uint8_t *data, uint8_t *crc)
+{
+        uint8_t val = (nybble(data[0]) << 4) | nybble(data[1]);
+        *crc += val;
+        return val;
+}
+
+static int process_ihex(uint8_t *data, ssize_t size);
+static void file_record(struct ihex_binrec *record);
+static int output_records(int outfd);
+
+static int sort_records = 0;
+static int wide_records = 0;
+static int include_jump = 0;
+
+static int usage(void)
+{
+        fprintf(stderr, "ihex2fw: Convert ihex files into binary "
+                "representation for use by Linux kernel\n");
+        fprintf(stderr, "usage: ihex2fw [<options>] <src.HEX> <dst.fw>\n");
+        fprintf(stderr, "       -w: wide records (16-bit length)\n");
+        fprintf(stderr, "       -s: sort records by address\n");
+        fprintf(stderr, "       -j: include records for CS:IP/EIP address\n");
+        return 1;
+}
+
+int main(int argc, char **argv)
+{
+        int infd, outfd;
+        struct stat st;
+        uint8_t *data;
+        int opt;
+
+        while ((opt = getopt(argc, argv, "wsj")) != -1) {
+                switch (opt) {
+                case 'w':
+                        wide_records = 1;
+                        break;
+                case 's':
+                        sort_records = 1;
+                        break;
+                case 'j':
+                        include_jump = 1;
+                        break;
+                default:
+                        return usage();
+                }
+        }
+
+        if (optind + 2 != argc)
+                return usage();
+
+        if (!strcmp(argv[optind], "-"))
+                infd = 0;
+        else
+                infd = open(argv[optind], O_RDONLY);
+        if (infd == -1) {
+                fprintf(stderr, "Failed to open source file: %s",
+                        strerror(errno));
+                return usage();
+        }
+        if (fstat(infd, &st)) {
+                perror("stat");
+                return 1;
+        }
+        data = mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, infd, 0);
+        if (data == MAP_FAILED) {
+                perror("mmap");
+                return 1;
+        }
+
+        if (!strcmp(argv[optind+1], "-"))
+                outfd = 1;
+        else
+                outfd = open(argv[optind+1], O_TRUNC|O_CREAT|O_WRONLY, 0644);
+        if (outfd == -1) {
+                fprintf(stderr, "Failed to open destination file: %s",
+                        strerror(errno));
+                return usage();
+        }
+        if (process_ihex(data, st.st_size))
+                return 1;
+
+        return output_records(outfd);
+}
+
+static int process_ihex(uint8_t *data, ssize_t size)
+{
+        struct ihex_binrec *record;
+        uint32_t offset = 0;
+        uint32_t data32;
+        uint8_t type, crc = 0, crcbyte = 0;
+        int i, j;
+        int line = 1;
+        int len;
+
+        i = 0;
+next_record:
+        /* search for the start of record character */
+        while (i < size) {
+                if (data[i] == '\n') line++;
+                if (data[i++] == ':') break;
+        }
+
+        /* Minimum record length would be about 10 characters */
+        if (i + 10 > size) {
+                fprintf(stderr, "Can't find valid record at line %d\n", line);
+                return -EINVAL;
+        }
+
+        len = hex(data + i, &crc); i += 2;
+        if (wide_records) {
+                len <<= 8;
+                len += hex(data + i, &crc); i += 2;
+        }
+        record = malloc((sizeof (*record) + len + 3) & ~3);
+        if (!record) {
+                fprintf(stderr, "out of memory for records\n");
+                return -ENOMEM;
+        }
+        memset(record, 0, (sizeof(*record) + len + 3) & ~3);
+        record->len = len;
+
+        /* now check if we have enough data to read everything */
+        if (i + 8 + (record->len * 2) > size) {
+                fprintf(stderr, "Not enough data to read complete record at line %d\n",
+                        line);
+                return -EINVAL;
+        }
+
+        record->addr  = hex(data + i, &crc) << 8; i += 2;
+        record->addr |= hex(data + i, &crc); i += 2;
+        type = hex(data + i, &crc); i += 2;
+
+        for (j = 0; j < record->len; j++, i += 2)
+                record->data[j] = hex(data + i, &crc);
+
+        /* check CRC */
+        crcbyte = hex(data + i, &crc); i += 2;
+        if (crc != 0) {
+                fprintf(stderr, "CRC failure at line %d: got 0x%X, expected 0x%X\n",
+                        line, crcbyte, (unsigned char)(crcbyte-crc));
+                return -EINVAL;
+        }
+
+        /* Done reading the record */
+        switch (type) {
+        case 0:
+                /* old style EOF record? */
+                if (!record->len)
+                        break;
+
+                record->addr += offset;
+                file_record(record);
+                goto next_record;
+
+        case 1: /* End-Of-File Record */
+                if (record->addr || record->len) {
+                        fprintf(stderr, "Bad EOF record (type 01) format at line %d",
+                                line);
+                        return -EINVAL;
+                }
+                break;
+
+        case 2: /* Extended Segment Address Record (HEX86) */
+        case 4: /* Extended Linear Address Record (HEX386) */
+                if (record->addr || record->len != 2) {
+                        fprintf(stderr, "Bad HEX86/HEX386 record (type %02X) at line %d\n",
+                                type, line);
+                        return -EINVAL;
+                }
+
+                /* We shouldn't really be using the offset for HEX86 because
+                 * the wraparound case is specified quite differently. */
+                offset = record->data[0] << 8 | record->data[1];
+                offset <<= (type == 2 ? 4 : 16);
+                goto next_record;
+
+        case 3: /* Start Segment Address Record */
+        case 5: /* Start Linear Address Record */
+                if (record->addr || record->len != 4) {
+                        fprintf(stderr, "Bad Start Address record (type %02X) at line %d\n",
+                                type, line);
+                        return -EINVAL;
+                }
+
+                memcpy(&data32, &record->data[0], sizeof(data32));
+                data32 = htonl(data32);
+                memcpy(&record->data[0], &data32, sizeof(data32));
+
+                /* These records contain the CS/IP or EIP where execution
+                 * starts. If requested output this as a record. */
+                if (include_jump)
+                        file_record(record);
+                goto next_record;
+
+        default:
+                fprintf(stderr, "Unknown record (type %02X)\n", type);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct ihex_binrec *records;
+
+static void file_record(struct ihex_binrec *record)
+{
+        struct ihex_binrec **p = &records;
+
+        while ((*p) && (!sort_records || (*p)->addr < record->addr))
+                p = &((*p)->next);
+
+        record->next = *p;
+        *p = record;
+}
+
+static int output_records(int outfd)
+{
+        unsigned char zeroes[6] = {0, 0, 0, 0, 0, 0};
+        struct ihex_binrec *p = records;
+
+        while (p) {
+                uint16_t writelen = (p->len + 9) & ~3;
+
+                p->addr = htonl(p->addr);
+                p->len = htons(p->len);
+                if (write(outfd, &p->addr, writelen) != writelen)
+                        return 1;
+                p = p->next;
+        }
+        /* EOF record is zero length, since we don't bother to represent
+           the type field in the binary version */
+        if (write(outfd, zeroes, 6) != 6)
+                return 1;
+        return 0;
+}
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index bbb2a8ef367c..d7e06fe0270e 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
         FILE *file;
         char cmd[PATH_MAX];
         char *mac_addr;
+        int str_len;
 
         /*
          * Set the configuration for the specified interface with
@@ -1301,8 +1302,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
          * invoke the external script to do its magic.
          */
 
-        snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
-                 "hv_set_ifconfig", if_file);
+        str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
+                           "hv_set_ifconfig", if_file);
+        /*
+         * This is a little overcautious, but it's necessary to suppress some
+         * false warnings from gcc 8.0.1.
+         */
+        if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) {
+                syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long",
+                       cmd, str_len);
+                return HV_E_FAIL;
+        }
+
         if (system(cmd)) {
                 syslog(LOG_ERR, "Failed to execute cmd '%s'; error: %d %s",
                                 cmd, errno, strerror(errno));